Date: Wed, 10 Sep 2003 16:39:54 +0100 (BST)
From: Tony Finch <dot@xxxxxxxx>
Subject: Sobig Stats
Sender: Tony Finch <fanf2@xxxxxxxxxxxxxxxx>
X-X-Sender: fanf2@xxxxxxxxxxxxxxxxxxxx
To: dave@xxxxxxxxxx
[For IP, if you wish]
We've now reached the day when Sobig disables itself and stops sending out
vast amounts of email. I help to run the University of Cambridge's central
email systems, with special responsibility for filtering email, so I have
been tracking it fairly closely. Over the last three weeks our systems
have deleted over 3.5 million copies of the virus, which is over 1/3
terabyte of junk email, or 2 Mbit/s of bandwidth on average. 56% of
messages over the period were infected, and it peaked at 90% of our total
email volume. It has been 1000 times more active than other email worms.
Things are getting back to normal now, as you can see from this graph
http://www.cus.cam.ac.uk/~fanf2/hermes/doc/talks/2003-09-techlinks/sobig-end.ps
The green line is the number of Sobig messages per hour, and it tails off
steadily from 20:00 yesterday to 08:00 today. The cyan line is all junk
email (spam and viruses), the magenta line is email from outside the
University, and the blue line is all email, all in messages per hour.
Back to only half of all email being junk, instead of two thirds -- at
least until the next outbreak...
--
Tony Finch
<dot@xxxxxxxx> http://dotat.at/
<fanf2@xxxxxxxxx> http://www.cus.cam.ac.uk/~fanf2/