MyDoom 2004: The Email Worm That Declared War on SCO

On 26 January 2004, inboxes around the world began receiving messages that looked like routine failures: a mail delivery error, a bounce, a test message. The attachment was the worm that became known as MyDoom. Within a day, it had become one of the most widespread email worms ever seen, and it had a target in mind: the website of a software company in Utah.

A message that looked like a system error

MyDoom used a clever social trick. Instead of promising a prize or a love letter, it posed as a technical problem. Subject lines included phrases like "Error", "Mail Delivery System" and "Test", with text that suggested a message could not be delivered and that the original was attached. Many recipients, especially in busy offices, opened the file to see what had failed.

The attachment carried an executable file, often disguised with a document icon or compressed inside a zip archive. Opening it installed the worm, which then harvested email addresses from files on the computer and sent itself to them, using forged sender addresses. Because the forged sender was usually a random name taken from the victim's own files, the apparent source of an infected message was frequently someone who had not sent anything.

Speed and scale

The worm spread with extraordinary speed. At its peak, one email security company reported that around one in twelve of the messages passing through its systems carried the worm. Mail servers struggled under the volume. MyDoom was widely described as the fastest-spreading email worm to that date, a record that held for some time. As with other incidents, estimates of total damage vary greatly and should be treated with caution.

The backdoor

MyDoom did more than send mail. It installed a backdoor on infected computers, opening a network port, TCP port 3127 in the first version, that allowed an attacker to send commands or upload programs. This meant that the worm turned each infected machine into a potential member of a botnet, a group of computers under outside control. Later malware, including a worm called Doomjuice, deliberately scanned for machines already infected with MyDoom and used the backdoor to enter.

Botnets built from infected home computers were increasingly used to send spam, and the use of such machines for email relay and attack traffic became a major problem in the following years.

The attack on SCO

The worm contained a timer. From 1 February 2004, infected machines were programmed to send repeated requests to the website of the SCO Group, a company that was then involved in a controversial lawsuit claiming that Linux contained its intellectual property. SCO was unpopular in parts of the open source community, and some commentators speculated that the worm's author was acting out of hostility to the company.

The attack worked. SCO's website became unreachable, and the company took it offline and redirected visitors to a different address. SCO announced a reward of 250,000 dollars for information leading to the author. Microsoft offered a similar reward. A second version of the worm, which appeared soon afterwards, targeted Microsoft's website, but Microsoft was better able to withstand the traffic.

Strings inside the code included a short message: "andy; I'm just doing my job, nothing personal, sorry". It suggested that the author might have been paid, though this has never been shown.

Despite the rewards and the attention of investigators and security firms, nobody has been publicly identified and prosecuted as the author of MyDoom. Some analysts suggested the backdoor and the spreading looked designed to build a network of mail-relaying machines, which would point to spam operations. That is an inference, and the question remains officially unsolved.

The way MyDoom handled the forged senders had an irritating side effect for ordinary people. Because the worm picked sender names from files on the infected machine, innocent people received angry replies and bounce messages for mail they had never sent. Their only link to the worm was that their address appeared in someone's contacts. This kind of collateral damage, called backscatter, is a good reason why mail systems today are careful about what they accept and then bounce.

What it signalled

MyDoom is often seen as the point at which mass-mailing worms stopped being mostly about vandalism and notoriety and began to look like a commercial enterprise. The infected machines were an asset that could be used for spam, attacks or fraud. In the years that followed, the motivation for malware shifted strongly toward money, and the era of the lone teenager seeking fame gave way to organised groups.

The lesson for site owners today

Email remains the main route for malware and phishing, and small organisations are targeted as often as large ones. An attacker needs only one person to open one attachment. Two practical lessons follow from MyDoom.

• Do not trust the sender field. Forged senders are easy. Authenticate your own domain with SPF, DKIM and DMARC, so that receiving servers can reject fakes that claim to be from you.
• Filter before delivery. Block executable attachments and scan archives at the mail server.
• Watch for compromise. If your machines start sending large amounts of mail you did not write, treat it as an infection.

Also be careful with what a hacked website or mailbox is used for. A compromised contact form or mail account can be used to send exactly this sort of mail from your domain, hurting your reputation.

Practical how-to guides are collected in the knowledgebase.

Protecting your domain

Zebra Hosting offers business email hosting for your own domain, and our knowledgebase explains how to set up SPF, DKIM and DMARC. You can start with the knowledgebase or the security page.