Press Release - For Immediate Release

Multi-Variant Virus Attack Attempts to Hijack Computers

IronPort Stops Over 96,000 Viral Messages - Saves $1.9M in One Week and Impedes Global Proliferation

SAN BRUNO, CA - September 26, 2006

NEWS FACTS

  • During the week of 9/11/06, IronPort Virus Outbreak Filters™ detected and stopped a series of viruses (launched hours apart from one another) in what appears to be a massive, staged attack intended to take over computers and use them for malicious purposes.
  • The worm, known as "Stration", was sent out as eight slightly different variants, beginning on September 9th and continuing through September 14th.
  • Indicative of a rising trend, the Stration virus contained malicious code that opened a "back door" into infected computers, enabling virus writers to take over infected PCs.
  • New sophisticated schemes to entice users to open viral emails are demonstrated in this most recent Stration outbreak. Sent emails claim to be from the recipient's IT department, telling them that a new virus outbreak has appeared and that they must download the attached file to protect their computer.
  • Many were fooled into opening the attachment and unprotected users were instantly infected.
  • IronPort stopped over 96,000 viral messages during the week-long outbreak, saving its customers an estimated $1.9M in clean-up costs. Estimates are based on a 10% sampling of all messages, calculating remediation costs of $200 per desktop.
  • IronPort Virus Outbreak Filters alerted to and curtailed attacks on average 4 hours and 16 minutes before the first anti-virus signature was available.

QUOTES

"Viruses these days don't just crash a computer," said Pat Peterson, IronPort's VP of Technology. "They literally take over a computer so that hackers can steal personal and confidential information from it, use it to send spam or viruses or even herd infected computers into 'bot networks' for resale on the black market."

"Virus writers will often release several, slightly different versions of a virus over a period of a few days," said Jan Mak, head of IronPort's Threat Operations Center - a team dedicated exclusively to preventive outbreak detection and protection 24 hours a day, 7 days a week. "These methods require traditional anti-virus companies to track down and write signatures for each separate variation - which takes much more time than writing a single signature. It is becoming tougher for AV companies to provide immediate and total protection for these types of distributed attacks."

MULTIMEDIA LINKS

To receive automated alerts of when IronPort Virus Outbreak Filters first detect outbreaks, please visit: http://www.ironport.com/outbreak_alerts/

To view the response times of the major anti-virus vendors please visit: http://www.ironport.com/toc/

About Virus Outbreak Filters

A proven preventive solution, IronPort Virus Outbreak Filters provide a critical first layer of defense against new outbreaks, hours before signatures used by traditional anti-virus solutions are in place. Real world results show an average lead time (over reactive anti-virus solutions) of over 13 hours - along with an extremely high catch rate and near-zero misclassifications. Integrated into the IronPort C-Series™ email security appliances, IronPort Virus Outbreak Filters perform a threat assessment of inbound and outbound messages, and then quarantine suspicious messages temporarily. Once signatures from traditional anti-virus vendors are deployed, messages are automatically released.

IronPort Virus Outbreak Filters:

  • Have demonstrated average lead times exceeding 13 hours prior to traditional AV solutions
  • Have saved IronPort customers an estimated $320M in cleanup costs
  • Have stopped over 175 outbreaks and approximately 16 million infected messages in the last twelve months alone.

About IronPort Systems

IronPort Systems is the leading email security provider for organizations ranging from small businesses to the Global 2000. The company has developed a family of email security appliances, the IronPort C-Series™, that offer breakthrough performance, unprecedented ease of use and reduced total cost of ownership. IronPort is driving new standards and providing innovative products for those faced with the monumental task of managing, protecting, and growing mission-critical email systems. For more information on IronPort products and services, visit: http://www.ironport.com/.

Press / Analysts

If you are a reporter or analyst and want more information on IronPort Systems please contact:
David Oro at (415) 885-9898 or dto@theorogroup.com
Suzanne Matik at (831) 479-1888 or smatick@ironport.com