TippingPoint's UnityOne Intrusion Prevention Systems Block Variant of `MyDoom' Virus.

Business Editors/High-Tech Writers

AUSTIN, Texas--(BUSINESS WIRE)--Jan. 30, 2004

TippingPoint Technologies Inc. (Nasdaq:TPTI), the leaders in high-speed intrusion prevention, today announced that the UnityOne Intrusion Prevention Systems provide network-level protection against a variant of the virus known as 'Novarg' or 'MyDoom.' The new variant, called 'Novarg.B' or 'MyDoom.B,' propagates via mass e-mail and also through a worm component that leverages the back doors installed by the virus' predecessor, MyDoom.A.

In its mass-mailing capacity, MyDoom.B arrives as an e-mail attachment, either as a Windows executable file with an .exe, .scr, .bat, .pif, or .cmd extension or as a zip file (.zip) containing the malicious executable. When the executable is launched, the virus harvests e-mail addresses from the victim's file system and sends a copy of itself to each address. MyDoom.B also contains an auto-propagating worm component that allows the virus to spread itself to systems that have already been infected with MyDoom.A. In this capacity, MyDoom.B scans random network blocks for systems listening on port 3127/tcp, and compromises new victims by exploiting the back door left by previous MyDoom.A infections.

All of the virus' propagation mechanisms will be disabled on March 1, 2004, but before that time MyDoom.B-infected hosts are programmed to launch denial of service attacks against www.sco.com and www.microsoft.com.

"The MyDoom virus is the fastest spreading virus we have seen to date," said CTO Marc Willebeek-LeMair. "We expect that the MyDoom.B variant will have the most devastating impact to networks already coping with large numbers of MyDoom.A infections. Our customers have been blocking the virus at the network level at average rates of between 150,000 to 300,000 infected e-mails per day."

Ronnie Wagers, security manager at the University of Dayton said, "With TippingPoint's UnityOne, our security logs showed us blocking over 50,000 MyDoom viruses per hour. The number of attacks blocked has grown as the week has progressed. We are extremely impressed with the product's protection."