IBM Security Solutions May 2011 IBM X-Force Threat Insight Quarterly 2 X-Force Threat Insight Quarterly IBM Security Solutions Contents About the report 2 About the Report The IBM X-Force® Threat Insight Quarterly is designed to highlight some of the most significant threats and challenges 3 Evolution: From Nuisance to Weapon facing security professionals today. This report is a product of IBM Managed Security Services and the IBM X-Force 8 Prolific and Impacting Issues of Q1 2011 research and development team. Each issue focuses on specific challenges and provides a recap of the most significant recent 16 References online threats. IBM Managed Security Services are designed to help an organization improve its information security, by outsourcing security operations or supplementing your existing security teams. The IBM protection on-demand platform helps deliver Managed Security Services and the expertise, knowledge and infrastructure an organization needs to secure its information assets from Internet attacks. The X-Force team provides the foundation for a preemptive approach to Internet security. The X-Force team is one of the best-known commercial security research groups in the world. This group of security experts researches and evaluates vulnerabilities and security issues, develops assessment and countermeasure technology for IBM security products, and educates the public about emerging Internet threats. We welcome your feedback. Questions or comments regarding the content of this report should be addressed to [email protected]. 3 X-Force Threat Insight Quarterly IBM Security Solutions Evolution: From Nuisance to Weapon One of the more notable examples here is Brain3, a boot sector infector which originated in Pakistan and released in 1986, was Creeper, Wabbit, Animal, Elk Cloner, Brain, Vienna, Lehigh, one of the first examples of malware that infected PC’s running Stoned, Jerusalem. These are the names of early examples of MS-DOS. It infected the boot sector of FAT formatted what today we generally simply refer to as malware which removable media (read Floppies) and was actually written as a appeared between 1971 and 1987. means to control software piracy. It was not as such malicious however that did not stop it from infecting victims other than This was the beginning. These examples infected various the intended targets. The authors had even placed their platforms and delivered various payloads, some just a simple contact information in the code which resulted in them having message echoed to a screen. While Sci-Fi writers such as John to get their telephone line disconnected due to the number of Brunner in “Shockwave Rider” wrote conceptually about calls they received from irate victims of Brain. viruses and worms, it was not until 1984 that Fred Cohen1 gave 4 such programs a true mathematical definition. The age of the In December 1987 Christmas Tree Exec appeared on IBM “Computer Virus” was upon us. mainframes causing significant disruption on EARN, BITNET with IBM’s VNET. A user would receive an email which Creeper2 is arguably the first virus, or more accurately, worm, invited them to execute “CHRISTMAS”, which would draw a and infected only DEC PDP-10 computers. While it was Christmas tree on their terminal. It did indeed do this, and also written as a demonstration, it spread through ARPANET in sent itself to other users located through the NAMES and 1971 with a simple payload, a text message which read, “I’m NETLOG files. While this technique for replication might the creeper, catch me if you can!”. The characteristics of self seem very familiar now, it wasn’t then. The author of the replication and spreading via a network are important concepts malware stated the intention of the code was simply to send a in malware which remain with us today. In response to greeting to a few friends but it resulted in his being barred Creeper, came the Reaper, a virus in itself which spread across from access to their system. the same network however it’s goal, was to delete instances of Creeper. It can be argued that Reaper was the first example of Moving forward to 1988, we come to one of the most famous anti-virus software. Its task was to detect and remove malware. items of malware in history and we begin to see the signs of 5 However code that executes on a system or spreads across a sophistication creeping in. The Robert Morris Worm was network without permission is not welcome at all. More unique at the time because it exploited vulnerabilities in recently, the same technique has been used by modern malware sendmail, finger and weak passwords. It also was able to infect used to create botnets attempting to remove instances of other multiple architectures. Its transport was the fledgling Internet. botnet malware so as to take control on the affected system. When it was released into the wild, it began clogging systems and soon resulted in a denial of service condition which directly or indirectly affected most systems attached to the Internet. 1 Fred Cohen & Associates http://all.net/resume/bio.html 2 25th anniversary of the computer virus? Not so fast http://news.cnet.com/8301-13506_3-9745010-17.html 3 Searching for the first PC virus in Pakistan http://campaigns.f-secure.com/brain/index.html 4 Security Digest Archives http://securitydigest.org/rutgers/mirror/pyrite.rutgers.edu/christmas.exec 5 Morris Worm http://en.wikipedia.org/wiki/Morris_worm 4 X-Force Threat Insight Quarterly IBM Security Solutions The effect of Robert Morris’ worm was significant enough to Deserving of a mention from 1991 is the virus known as lead to the establishment of the CERT Coordination Center6 Michelangelo11. The mention however is not simply for the at Carnegie Mellon University. According to Robert Morris, virus, rather the hype that with it. There were wild and dire the creator of the worm, it was not written with malicious predictions that Michelangelo would wreck havoc. How widely intent rather it was written as a tool to gauge the size of the spread the virus was is not easy to determine. It seemed to Internet. The devastation it caused was an unintended spread globally, but the estimates of the number of computers consequence. Morris was however convicted of violating the that would be affected on March 6 1992, with some reports 1986 United States Computer Fraud and Abuse Act7 (amended quoting up to five million, turned out to be off target. Various since 1986) and was sentenced to three years probation, four experts and pundits made many claims12 regarding the number hundred hours of community work and a fine of $10,000. of infected computers, how the virus spread, and ways in which users could avoid damage by the virus when the trigger date In early 1989 we see Polymorphic encryption in the wild, a was reached. The virus itself was a DOS boot sector infector very notable stage of virus evolution. Predicted by Fred and remained dormant, until the trigger date. Cohen, brought into existence by Mark Washburn8 and the 1260 virus but, arguably most famously seen in the Mutation It is in 1999 that we really begin to see evolution in how we Engine written by the legendary Dark Avenger9. understand viruses today, with Happy9913 and Melissa14 as Polymorphism, simply put is the code’s ability to periodically poignant examples. Happy99 can be considered the first virus modify itself which is done to evade detection. The Dark to be propagated by email as we commonly know it today. Avenger has never been positively identified but a paper Melissa on the other hand was a worm delivered inside a Word written by Sara Gordon10 who interviewed the Dark Avenger document. Once active, one of the tasks of the worm was to (online) and published in 1993 provides a glimpse into the replicate by sending itself to the first fifty users in the victims mind of the author. The viruses created by the Dark Avenger address book. This not only spread the virus quickly, but email were very infectious and damaging. traffic generated started clogging email servers. At the time, Melissa may have been the fastest spreading virus in history. 6 Meet CERT http://www.cert.org/meet_cert/ 7 Unites States Code: TITLE 18, 1030. Fraud and related activity in connection with computers http://www.law.cornell.edu/uscode/18/1030.html 8 1260 (computer virus) http://en.wikipedia.org/wiki/1260_(computer_virus) 9 Dark Avenger http://en.wikipedia.org/wiki/Dark_Avenger 10 Inside the Mind of Dark Avenger http://www.research.ibm.com/antivirus/SciPapers/Gordon/Avenger.html 11 Michelangelo (computer virus) http://en.wikipedia.org/wiki/Michelangelo_%28virus%29 12 Michelangelo Fiasco: a Historical Timeline http://vmyths.com/column/1/1992/6/1/ 13 Email-Worm.Win32.Happy http://www.securelist.com/en/descriptions/old22314 14 Virus:W32/Melissa http://www.f-secure.com/v-descs/melissa.shtml 5 X-Force Threat Insight Quarterly IBM Security Solutions In 1988 when the Morris worm went wild, the Internet had IloveYou or the ten or so variants that had also surfaced within around 100,000 systems attached to it. By December 1998, the first 24 hours. It was also reported that18 this worm caused four months prior to Melissa, the Internet had some 148 the Pentagon, CIA, and the British Parliament to shut down million users. It is self evident that the impact of Melissa was their email systems. Estimates of the financial cost of the more widely felt than the impact of the Morris worm. The damage caused by IloveYou and variants range up to $5.5 author of Melissa was apprehended and sentenced15 to 20 billion.