Case Study - How a partnership caught The LoveBug

The infamous LoveBug virus that infected computers in Asia, Europe, and the Americas in early May once again reminded IT managers at corporations around the world that vigilance in the face of email-spreading/replicating viruses is critical to protecting the productivity and bottom line of their businesses. Indeed, by midday of the virus' initial release, analysts estimated that it had already cost hundreds of millions of dollars in damage to computer software, with an equally dismal resultant loss of commerce. By the time the virus was eradicated, billions of dollars had been lost worldwide.

However, in the face of all the chaos and damage, a few companies were prepared. Among these were ISPs utilizing the leading edge Internet virus screening solution offered by European application solutions provider (ASP) MessageLabs. Called Virus Control Centre (VCC) this service, based on an I-Bus high availability platform, provides a centralized screening system in which all subscriber emails and attachments are scanned for viruses without impacting transfer performance.

The most sophisticated system of its type in the world, the Virus Control Centre (VCC) utilises a two-step queuing process to receive, scan, and deliver emails. The first queue accepts incoming email. At this point, email delivery is halted for scanning by four virus checking software packages, McAfee, F-Secure, V-Find and MessageLabs' own proprietary scanning software Skeptic. After the system has screened the messages, clean emails are funneled into the second queue, which forwards them for delivery. This whole process takes on average only 1.33 seconds for a 1Mb e-mail.

The MessageLabs Virus Control Centre
The MessageLabs Virus Control Centre intercepted the first copy of the LoveBug virus at 00.43am BST on 4th May 2000. The virus was intercepted by Skeptic™ a rules-based and heuristic anti-virus program, which blocks emails based on probability levels set against core characteristics of a virus. Standard Anti-Virus programs initially did not have a signature available for LoveBug. The MessageLabs system was able to identify the virus because it contained characteristics of a mass-mailing worm. Skeptic™ is one of the many ways that Message Labs pro-actively seek out and stop new and emerging viruses.

The LoveBug virus was extremely damaging; it overloaded email systems around the world and destroyed files. Following the release of the virus, several copycat variants emerged. Most of these were created by minor edits to the worm's code. The most common variant we have seen is LoveBug.C, which pretended to be a joke, rather than a love letter.

Skeptic™ was able to pick up all variants, and not one copy of LoveBug got through to a MessageLabs customer. In order to operate the Virus Control Centre (VCC) with the high performance levels necessary to avoid system downtime, Message Labs initially turned to I-Bus to design its hardware platform. The system required an innovative solution to meet MessageLabs requirements, as for all ASP's, operating space is one of the largest sources of overhead once initial investments in equipment and software systems are made. In order for the virus scanning solution to be cost-effective, it could not be built on a conventional high-availability PC platform, as these platforms generally take up significant amounts of space and thereby result in large investments in hardware-housing real estate.

Traditional solutions have been based around a standard 6U 19-inch rack mounted system, however, in conjunction with I-Bus's UK operation the new TR4C cassette server was designed. The TR4C is a high performance, high availability rack mounted PC-based hardware platform that retains all the benefits of conventional fault tolerant systems, but is packaged in a 4U enclosure that is a mere 112 mm wide. This innovative format allows four individual servers to be installed side-by-side in a standard 19-inch rack, offering significant ongoing cost benefits.

All I-Bus TR4Cs have a 130 watt power supply and the front panels have customer-defined floppy drives, as well as power and disk drive LEDs. Each TR4C also has an ISA/PCI passive backplane with five full-length slots. Consequently, once a single board computer has been added there is still plenty of room for expansion and I/O boards.

The I-Bus TR4C Server
In the MessageLabs configuration there are twelve individual TR4Cs installed with the Virus Scan anti-virus software. Known as "Inoculation Pillars," these platforms have an inherent ability to double their capacity to 24 systems when traffic volume builds to increased levels. In addition, the TR4C servers offer warm-swap capabilities to ensure that faults can be detected and corrected without suspending virus-scanning operations.

The I-Bus platforms also offer built-in system monitoring which provides MessageLabs service technicians with immediate notification, via automatic pager and email communications, of failures in system cooling fans and power supplies. Individual systems can also be controlled by remote monitoring through any worldwide web browser with full on-screen status displays.

The ability to fulfill all of these requirements - from the size issues to the necessary remote access capabilities - were critical to MessageLabs' choice of I-Bus as the hardware supplier for Virus Control Centres. "By gaining a sound understanding of our business needs, I-Bus was able to supply a powerful, fault tolerant system that guaranteed our specified performance levels," said Jos White, MessageLabs' Marketing Director. "At the same time, their flexible design has offered ongoing cost benefits in terms of its space-saving and upgrade capabilities."

MessageLabs statistics show that the number of Love Bug viruses caught on the first day of infection totalled 12,843. LoveBug was just one virus that reached the news when in-fact statistics show that more than 200 new viruses are maliciously released each month and that 1 in every 1,500 e-mails carries a virus of some kind. This chilling statistic makes the MessageLabs and
I-Bus partnership the ideal solution.