Scourge · January 26 2004

The Scourge of MyDoom

Chronicle

On 26 January 2004 MyDoom was identified, a mass-mailing worm disguised as a failed-delivery notice. It became the fastest-spreading email worm on record: at its peak, according to MessageLabs, about one in twelve messages was a copy of it. It opened a backdoor on infected machines and was programmed to launch a DDoS against the SCO Group's website. Its author has never been identified.

Lesson learned

It showed that mass worms were no longer pranks but tools working for someone, with backdoors ready to turn PCs into spam machines.

Prayer of reparation

O MyDoom, who dressed up as a bounce message, let our filters recognise attachments disguised as notifications. Amen.

How it is remembered

Remembered by filtering executable attachments at the mail gateway and never opening the .zip from an unknown "Mail Delivery System".