Net Search takes a beating due to worm

Daniel Sorid

SAN FRANCISCO: A fast-spreading computer worm disrupted the world's most popular online search sites, scanning the vast databases of Google Inc. and other search engines to find the e-mail addresses of new victims.

The worm's assault came on the same day that Google disclosed it was seeking as much as $3.3 billion in its highly anticipated initial public offering, although there was no indication that the two events were related.

In a filing with stock regulators, Google made the prescient acknowledgment that "outages and delays" from viruses and worms could harm its business.

The online attack marked an evolution of a worm called MyDoom that infected hundreds of thousands of computers earlier this year. In the current variant, MyDoom not only scans the hard drives of victims for e-mail addresses, but also turns to online search sites to find additional leads.

The worm then sends a copy of itself as an e-mail attachment to those addresses. Users who open those attachments, and who are not protected by security software, infect their own computers.

"Those search requests have been overloading the search engines," said Lloyd Taylor, vice president of technology for Keynote Systems Inc., which measures Web site performance.

A Yahoo spokesman said the effect of the slowdown was limited solely to its search engine and said that by Monday afternoon that impact had been mitigated.

Google, in a statement, said that some of its users had experienced a slowdown but added that it expected full service would be "restored shortly" as of Monday afternoon.

Symantec Corp., a maker of security software, said it received 250 reports about the new worm in two hours, on pace with the original MyDoom attack in January.

"This is certainly equivalent to what we saw back then," said Oliver Friedrichs, a senior manager with Symantec's security response group.

INITIAL SIGNS OF TROUBLE

Initial signs of problems popped up on Monday morning, with reports from around the world that users were having problems searching on Google.com.

Keynote said the attack appeared to have started around 6:30 a.m. PDT (9:30 a.m. EDT), when East Coast office workers arrive and check their e-mail.

As of 2:30 p.m. PDT, the spread of the infection had not yet waned, though Web search sites had apparently found a way to block the automated search requests, Keynote's Taylor said. Anti-virus vendors also had updates ready to protect against the latest strain of MyDoom, he said.

Monday's outbreak underscored the more widespread threat of Internet viruses, analysts said.

McAfee Inc. said it expected 2004 to be a record year in terms of the total number of "successful" viruses and worms, due to smarter malicious code writers and the still-common practice of computer users opening virus-laden messages.

Brian Mann, a virus outbreak manager at McAfee, said that at current rates up to 100 successful viruses and worms could run across the Internet by the end of this year compared with a total of 20 for all of 2003.

"We're already in record territory now" in terms of the number of successful viruses, which are assessed by McAfee as a "medium-risk" to "high-risk" threat, Mann said.

Several thousand computer security threats appear every year but most never cause widespread disruption due to protections, such as firewalls, that prevent malicious code from entering computer systems.

(Additional reporting by Spencer Swartz, Ben Berkowitz)