sign in sign up
<<
Home , Computer worm, Morris worm, Mydoom, Nimda, Sobig, SQL Slammer

Computer Worms: Past, Present, and Future Craig Fosnock CISSP, MCSE, CNE East Carolina University

Abstract:

Internet computer worms have gone Computer Program: from a hypothetical theorem to very real and Is an example of computer software that very dangerous threat to computer networks. prescribes the actions ("computations") that They are even capable of affecting the are to be carried out by a computer. Most biggest network of our time, the . programs consist of a loadable set of Starting from humble and beneficial instructions which determines how the beginnings computer worms are now the computer will react to user input when that plague of the Internet and can cause billions program is running, i.e., when the of dollars worth of damages in just a few instructions are 'loaded'. The term program hours, if not minutes. In this paper I will or computer program is used discuss the history of computer worms, their interchangeably with software and software past, present, and their possible future, but application. ("Computer Program," 2005) before we start this discussion about computer worms lets first define some : computer terminology. It is important that Is a self-replicating program that spreads by we have these definitions up front not only inserting copies of itself into other because we will need them to help explain executable code or documents. A computer the rest of this paper, it is also important to virus behaves in a way similar to a discuss this now because the term computer biological virus, which spreads by inserting virus is often used interchangeably to refer itself into living cells. Extending the to computer worms. This may cause analogy, the insertion of the virus into a confusion with some readers as this paper is program is termed infection, and the focusing on computer worms, not computer infected file (or executable code that is not viruses. I have chosen not to address viruses part of a file) is called a host. ("Computer because, although viruses take advantage of Virus," 2005) network services such as the Internet to spread, viruses are currently somewhat less : common than worms, and viruses do not Is a self-replicating computer program, seem to have emulated the scale of similar to a computer virus but unlike a disruptive behavior, and monetary damage virus which attaches itself to, and becomes that current computer worms are capable of part of, another executable program, a worm inflecting on today’s computer networks. is self-contained and does not need to be part of another program to propagate itself. In other words a typical computer virus is similar to a parasite and it requires a host. In this case the host is another executable program. A worm does not need a host, it can spread on its own. ("Computer Worm," 2005) I. The Past and played on the Internet or on your local computer. The "organisms" now called A. Background “warriors”that are used in the Core Wars is considered the forebear of the modern The roots of the modern computer computer virus including computer worms. virus go back to John Von Neumann. Von Neumann’s name because of his publication B. The First worms of the concept, was given to the von Neumann architecture. This architecture is The first computer worm was used in most non-parallel-processing created at the legendary Xerox PARC ( Palo computers. Almost every commercially Alto Research Center). For those of you available home computer, microcomputer who do not know this research center not and supercomputer is a von Neumann only created the first computer worm it gave machine. In 1949 von Neumann created the us the first personal computer, the first field of cellular automata only using pencil graphical user interface and the first laser and graph paper, when he presented a paper printer. The worm was created by John on the "Theory and Organization of Shoch. Shoch was a PARC engineer Complicated Automata." In this paper he working on his Stanford doctorate when he postulated that a computer program could created the worm. The program took its reproduce. The paper included a model of name from the "tapeworm," a program that what is now known as a computer virus. appeared in a popular science-fiction novel of the time by John Brunner called "The In the 1950s Bell Labs employees Shockwave Rider." This science-fiction gave life to von Neumann's theory in a game novel ironically helped to promote the they called "Core Wars." This game was concept of a replicating program more than created by H. Douglas McIlroy, Victor other more serious writings on the subject. Vysottsky, and Robert Morris, Sr. The object of the game was to unleash software Unlike the worm in the book "organisms" they called "self-altering Shockwave Rider which was used to destroy automata" that attacked, erased, and tried to a sinister , the PARC propagate in a computer generated world. worm's intended purpose was save Shoch Each organism was a small program hours of tedious work. Shoch's doctoral consisting of well-defined instructions with research was an analysis of the traffic each of the instructions occupying a single patterns of PARC's (another PARC cell in a memory array. In modern times this first) that linked 200 of its "Altos," personal computer-generated world is actually a computers. His idea was to arrange for linear looping array of memory cells called about 100 of the machines to spew bits into the "Core,” but in the 50's the word core the Ethernet simultaneously, then measure referred to magnetic core memory. The the ensuing electronic gridlock. ("Benefits," game was started when two programs were n.d) Rather than loading the same program loaded into random positions in the core. individually into every machine, he devised After a certain number of cycles, if neither the worm to do the loading automatically by program has quit executing, a tie was seeking out idle Altos computers and declared. If one program terminated, the transmitting the test program by wire to other was declared the winner. The primary those that signaled they were available. The objective behind the game was to write an test proved successful and soon he turned organism that could terminate all the his thoughts from communicating directly opponent processes. Re-energized and with each machine to instructing them to popularized by A.K. Dewdney through his talk among themselves. Shoch eventually series of articles in Scientific American, was able to invest his worm with the ability Core Wars and its variants can still be found to seek out idle Altos, boot up a host machine through the network and replicate as we should all know by now that this ruse by sending copies of itself from machine to is still an effective means of computer worm machine, remaining in communication with distribution. When the user executing the its dispersed offspring. script it would cause a Christmas tree to appear on the terminal and then it mailed One night, however, something itself to everyone on the user's NAMES file unexpectedly went wrong. Shoch and two including any distribution lists. When it colleagues had set a small worm loose in the finished sending itself to all addressees, it PARC Ethernet to test a control function, erased itself from the original victim's and went home. At some point the program computer. When new recipients received became corrupted so badly it crashed its and activated their copies of Christma Exec, host computer. Sensing it had lost a the scenario would repeat, flooding the segment, the control worm sent out a tendril network with Christma Exec messages. The to another idle Alto. That host crashed, and flood of traffic created left parts of the IBM the next, and the next. For hours, the worm network unusable on December 10 and 11 spread through the building until of until it was finally brought under control. machines were disabled. The next day the (Henry, 2003) down machines did not cause any alarm as Altos frequently crashed for no reason. Even with the introduction of two Soon, however, it became obvious that this fully functional worms, most people still was no random occurrence. Summoned to treated computer worms as an obscure the lab Shoch and his colleagues could not theoretical problem. That perception of stop the worm and eventually they had no worms took a dramatic turn in late-1988, choice but to eradicate the worm with a when a college student, and son of the failsafe software mechanism that Shoch had above mentioned and co-creator of the pre loaded as insurance against some “Core Wars” Robert Morris, Sr. unleashed unpredictable disaster. ("Benefits," n.d) the infamous "Internet Worm," otherwise known as the or the “Great The next worm started out as a joke worm,” on the new and unsuspecting or innocent prank, but is among the first and Internet. most notable worms to qualify as a network exploit. The worm was launched from The Morris worm was a “Multi Germany on December 9, 1987. This date is Mode” worm that attacked DEC VAX well before the Internet was officially born. servers running Sun and BSD operating The worm originated on the German EARN systems. It exploited weak along network, propagated through connected with known vulnerabilities in the send mail Bitnet sites and eventually worked its way application and utilities fingerd and through Bitnet connections to wreak havoc rsh/rexec. Although not, written to cause on the IBM Internal File Transfer Network damage a bug in Robert’s software allowed (otherwise known as VNET) in the United the worm to reinfect individual servers States. (Henry, 2003) The name given to multiple times. Hence, each additional this worm was the Christma Exec, which instance of the worm on the server caused happened to be the name of the script the additional CPU resources to be consumed, user needed to execute to launch the worm. slowing the server and effectively causing the world’s first Internet denial of service As mentioned above Christma Exec (DoS) attack. (Henry, 2003) At the time of required the user to execute an innocent the attack it was estimated that the Morris looking script that was attached to an E-mail worm infected approximately 6,000 servers message, which appeared to come from an or 10% of the servers on the Internet, and E-mail address that the recipient knew and caused between $10 million and $100 trusted. This ruse sounds really familiar, and million in damages. II. The Present it virtually impossible to recover original files. It also marked all mp3 files as hidden, The development of computer and downloaded a that would worms seemed to die down until the steal user names and passwords and them to development of the worm eleven the virus’s author. (11) years later. Here is a time line and brief Estimated damage: $8.75 billion. synopsis of modern computer worms. You will notice that the time between virus Year 2001 outbreaks, and the estimated amount of Virus name”: Anna Kournikova Virus" damages will be increasing. You will also worm notice no entries for the year 2002. This is Description: First appearing in February because which dominated that year 2001 it was produced by a “scrip kiddie,” was released in 2001, and none of the and is well known only for its social worms created that year although engineering attachment that appeared to be a destructive like the BugBear worm, did not graphic image of Russian tennis star Anna provided any new computer worm Kournikova. However, when the file was developments. opened, a clandestine code extension enabled the worm to copy itself to the Year 1999 Windows directory and then send the file as an attachment to all addresses listed in your Virus name: Melissa Outlook e-mail address book. Description: First found in March 26, 1999, The "Anna Kournikova Virus" worm using holes in Microsoft Outlook, Melissa although famous was just a nuisance as it shut down Internet mail systems that got did little to no damage clogged with infected e-mails propagating Estimated damage: $166,827 from the worm. Once executed the original version of Melissa used a to Virus name: spread to the first 50 addresses in the user’s Description: First found on July 13, 2001 Outlook address book. However, if Internet this worm exploited a vulnerability in access or Outlook were not available, it Microsoft's Internet Information Server (IIS) would copy itself to other word documents web servers to deface the host’s website, and attempt to E-mail those documents, and copy the command.com file and rename revealing potentially confidential it root.exe in the ’s publically information. Further, it would modify accessible scripts directory. This would existing documents by inserting quotes from provide complete command line control to the Simpson’s television show. (Henry, anyone who knew the Web server had been 2003) compromised. It also waited 20-27 days Estimated damage: $1.1 billion. after it was installed to launch denial of service attacks against the White House’s IP Year 2000 address. Code Red spread at a speed that overwhelmed network administrators as Virus name: I LOVE YOU more than 359,000 servers became Description: First found on May, 3, 2000 in compromised in just over 14 hours. At its Asia it spread quickly across the globe. peak, more than 2,000 servers were being Instead of sending a copy of the worm to the compromised every single minute. first 50 or 100 addresses in the host’s Estimates are that Code Red compromised Outlook address book like Melissa, I Love more than 750,000 servers. (Henry, 2003) You used every single address in the host’s Estimated damage: $2.6 billion address book. This worm also had a malicious side to it, as the worm overwrote important files with a copy of itself, making Virus name: Sircam Description: First found on July 19, 2001 Year 2003. this mass mailing E-mail worm not only exploited Microsoft’s Outlook program it Virus name: SQL Slammer had the ability of spreading through Description: Appearing January 25, 2003, Windows Network shares. The worm had and taking advantage of two two deadly payloads, but due to a program bugs in Microsoft's SQL Server database error they did not work. product, it spread rapidly, with a doubling Estimated damage: $1.03 billion time of 8.5 seconds in the early phases of the attack allowing it to infecting most of Virus name: its victims within 10 minutes. SQL Slammer Description: First appearing in September was the first example of a "." 2001, NIMDA, which is admin spelled A Warhol worm was first hypothesized in backwards was not as malicious in nature as 2002 in a paper by Nicholas Weaver, and it previous worms, but its advanced features is an extremely rapidly propagating and its different means of propagation computer worm that spreads as fast as which included from client to client via physically possible, infecting all vulnerable , from client to client via open network machines on the entire Internet in 15 shares, from web server to client via minutes or less. The term is based on Andy browsing of compromised web sites, from Warhol's remark that "In the future, client to web server via active scanning for everybody will have 15 minutes of fame.” and exploitation of various Microsoft IIS (Computer Worm, 2005) vulnerabilities, and from client to web Estimated damage: $1.2 billion. server via scanning for the back doors left behind by the "Code Red II" and Virus name: "sadmind/IIS" worms, allowed it to spread Description: Originally put together in faster than any preceding worm. NIMDA January 2003 to spread a proxy server also the first worm that contained its own E- trojan, its variant Sobig.F set a record in mail program so it did not depend on the sheer volume of e-mails. Sobig like Nimda host’s E-mail program to propagate. used a built-in SMTP engine so it did not Estimated damage:$645 million depend on the host’s E-mail program to propagate. Then emulating Klez, it selected Virus name: Klez one E-mail address from the host’s address Description: First appearing in October 26, book to use as the “from” address, then 2001 Klez, and it variants were still sending the worm to all the other addresses. considered a problem late in 2003, making It also attempted to create a copy of itself on Klez one of the most persistent viruses ever. network shares, but failed due to bugs in the Klez was a hybrid worm that took advantage code. of a flaw in Outlook that allowed it to be Estimated damage: $36.1 billion installed simply by viewing the E-mail in the preview panel. As a hybrid threat it Virus name: could behave like a virus, a worm and at Description: Appearing August 11, 2003 other times even like a Trojan horse. Klez Blaster exploited a Microsoft DCOM RPC also incorporated a technique we saw in the vulnerability to infect systems running Christma Exec worm as it selected one E- and Windows XP, and cause mail address from the host’s address book to instability on systems running Windows use as the “from” address, then sending the NT, and Windows Server 2003. Filtering of worm to all the other addresses. In this virus activity by Internet service providers manner, the E-mail often appeared to have (ISPs) worldwide greatly reduced the spread been sent from someone the addressee of Blaster. actually knew. Estimated damage: $1.3 billion Estimated damage: $18.9 billion Year 2004 code created in Pakistan which infected boot sectors of disks so that their contents Virus name: could not be accessed. was the first Description: Appearing January 26, 2004 PC virus created and it infected MS-DOS. and primarily transmitted via E-mail to Another more resent example of this appear as a transmission error, Mydoom’s behavior is found in the Nachi family of rapid spread becomes the fastest spreading worms, which terminated and deleted the email worm ever. It slowed overall Internet Blaster worm, then tried to download and performance by about 10%, and average install patches to fix the Microsoft DCOM web page load times by about 50%. RPC vulnerability in the host system. Estimated damage: $38.5 billion Although considered “beneficial” in nature both of these worms cause problems. In the Virus name: Witty case of Nachi it generated more network Description: Appearing March 19, 2004, traffic than the Blaster worm it was the Witty worm was the fastest developed protecting against. In the case of Den_Zuko worm to date as there was only 36 hours boot virus37 it could not infect 1.2M or 3.5" between the release of the advisory to the diskettes correctly, and because of this it release of the virus. Witty infected the entire destroyed data on them. Most importantly exposed population of twelve thousand both worms worked without the explicit machines in 45 minutes, and it was the first consent of the computer's owner or user. widespread worm that destroyed the it Because of these problems no true infected (by randomly erasing a section of “beneficial” worm has been created, the hard drive) without significantly slowing whatever their . the worm's expansion. Estimated damage: $11 million II. The Future

Virus name: It is expected that in the future that Description: Appearing on April 30, 2004 we will see ever more complex worms and spreading by exploiting a buffer labeled “Super Worms.” These worms will overflow in the component known as incorporating complex polymorphic, and LSASS, (Local Security Authority metamorphic behavior routines that will Subsystem Service) it hit the Internet a little make use of entry-point obscuration. The more than two weeks after Microsoft current trends in traditional areas of worm warned users of this flaw. Although it development do not seem to be leading us caused infected Windows XP and Windows immediately in the direction of the “Super 2000 computers to repeatedly reboot, Sasser Worm,” but they are getting their slowly. did little damage, as was merely designed to SpyBot.KEG is an example the new batch spread and carried no payload. of worms attempting to use these behavior Estimated damage: $14.8 billion methods. It is considered a sophisticated vulnerability assessment worm, and it set Although all the computer viruses new standards for all computer worms. discussed above in the time line are SpyBot.KEG has managed to remain below malicious in nature, not all computer worms most people’s radar as it causes no damage, are meant to be bad. These viruses are often and only reports discovered vulnerabilities called "beneficial viruses" or "antivirus" back to the author via IRC channels. viruses because they attack other viruses Security experts have also seen the release and disinfect them from the systems that of multiple variants per a single day of they have compromised. An early example another sophisticated worm called Mytob. of this is the Den_Zuko boot virus37, which This worm has recently included a was actually a worm that disinfected the trick in the form of a fake URL pointing to a Brain virus. The Brain virus was a malicious Web site that hosts the worm’s code. Another possible future threat that could propagation speed for worms is limited only develop into the next “Super Worm” by their ability to find new hosts. In the case outbreak is called YellowFever. of Code Red took about 14 hours to ping YellowFever is an advanced i-worm with every IP address in the world looking for some really interesting features, which vulnerable systems, and in Slammer’s case shows that conceptual complexity of current it took only 20 minutes. A similar threat i-worms in the wild is well far from what targeting IM, according to a Symantec can be done. A Short virus description: the simulation could lead to half a million worm installs itself as a system service. On systems being infected in only 30 seconds. startup, it enumerates all running This is because the worm would already applications looking for its target (Outlook). have a list of vulnerable machines located The infection procedure is very interesting: on users’ “ buddy” lists. This any new worm the virus has a small built-in debugger that using IM would not have to use time- uses to attach to the host. Next, it consuming methods to locate vulnerable impersonates the host and, using its own systems. Once inside a vulnerable company, "SMTP" engine, E-mails itself. an IM worm would cause a lot of damage as "YellowFever" is not polymorphic but it it would bypass all existing security would be possible to add a poly-engine to it. defenses. The virus can bypass many of the user level firewalls, but it has not been coded for Could the next major worm spreading. (Labir, 2005) Although complex outbreak not even involve computers? Will these worms have failed to be modified to the outbreak be a new development in the point where they can cause any major traditional propagation methods or will it damage, but that could change at anytime. come from new areas such as IM? Regardless history has shown us that no Other new worm developments matter what method it will use to propagate, include the Cabir worm. The Cabir worm is it is only a matter of time before we see the the first worm that can infect mobile next major worm outbreak. phones. Cabir appears to be a so-called "proof of concept" worm and requires social References engineering to reach its goal but once a Benefits of the Computer Virus. (Unknown) phone is infected, it will activate each time Owl Editing the phone is started, scan to nearby Retrieved July 15, 2005, from Bluetooth enabled phones, and transmit a http://www.owled.com/essays/virus.html copy of itself to the any vulnerable phone it Blaster Worm. (2005). reaches. Wikipedia, the free encyclopedia. Retrieved July 15, 2005, from http://en.wikipedia.org/wiki/Blaster_worm The most prevalent and immediately dangerous worms that seem to be Cabir. (2005). Wikipedia, the free encyclopedia. developing are those designed to propagate Retrieved July 15, 2005, from via (IM). Although older http://en.wikipedia.org/wiki/Cabir but less well known worms like the Hello Cathleen Moore (2005) worm used Microsoft's MAN Messenger to Worms wiggle into IM. Computer spread, the current batch of worms using IM WorldRetrieved July 15, 2005, from seems to hold the most promise of being the http://www.computerworld.com /securitytopics/ security/virus/story/0,10801,101201,00. next major outbreak. When we take a closer ?source=x10 look at this theat we can see that there are Computer Worm. (2005). about 60 published IM vulnerabilities, and Wikipedia, the free encyclopedia. the types of IM threats are expanding to Retrieved July 15, 2005, from include SPIM (spam over IM) and phishing http://en.wikipedia.org/wiki/Computer_worm attacks. As we have already seen, Computer program. (2005). Wikipedia, the free encyclopedia. Melissa worm (2005). Retrieved July 15, 2005, from Wikipedia, the free encyclopedia. http://en.wikipedia.org/wiki/Computer_program Retrieved July 15, 2005, from http://en.wikipedia.org/wiki/Melissa_worm

Computer virus . (2005). Morris worm (2005). Wikipedia, the free encyclopedia. Wikipedia, the free encyclopedia. Retrieved July 15, 2005, from Retrieved July 15, 2005, from http://en.wikipedia.org/wiki/Computer_virus http://en.wikipedia.org/wiki/Morris_worm Opic (2004) Introductory Primer To Chen, T.M.. (2003). Trends in viruses and worms. Polymorphism. The CodeBreakers-Journal, Vol. 1, No. 2 The Internet Protocol Journal, Vol. 6, No. 3. Paul Henry. (2003). Daniel Tynan (2003) A Brief Look at the Evolution of Killer Worms. Dawn of the Superworm. PC World. CyberGuard. Retrieved July 15, 2005, from Retrieved July 15, 2005, from http://www.pcworld.com/news/article / http://www.csoonline.com/whitepapers / 0,aid,110014,tfg,tfg,00.asp 050504_cyberguard /EvolutionoftheKillerWorms.pdf Edward Skoudis. (2002, July) - The Worm Turns. Magazine. Peter Szor. (2005) Strategies of Computer Worms. The Informit Network Eduardo Labir (2004) VX reversing II, Sasser B. Retrieved July 15, 2005, from The CodeBreakers-Journal, Vol. 1, No. 1 http://www.informit.com/articles/article.asp?p=36689 1&seqNum=8&rl=1 George V. Hulme (2005) First Worm For Mobile Phones Detected. Peter Westrin. (2001) Critical Information Infrastructure Information Week . Protection (CIIP). Information & Security: An Retrieved July 15, 2005, from International Journal. Volume 7, 67-79 http://www.informationweek.com/story/showArti cle.jhtml?articleID=21800340 Rinku Dewr (2003) Artificial Life: A Programmer's Perspective. Gregg Keizer (2005) Retrieved July 15, 2005, from IM Worms Could Spread In Seconds. Security http://ai-depot.com/ArtificialLife/ Pipeline Programmer-Perspective.html Retrieved July 15, 2005, from http://www.securitypipeline.com/news/22100839 Scarlet Pruitt (2005) Are Virus Writers Creating a Super Worm?. PC Ingrid Marson. (2005) World Mytob worm picks up phishing trick. News . Retrieved July 15, 2005, from Retrieved July 15, 2005, from http://news.com.com/Mytob+worm+picks+up+phishi Sasser worm.(2005). ng+trick/2100-7349_3- Wikipedia, the free encyclopedia. 5739271.html?part=rss&tag=5739271&subj=news Retrieved July 15, 2005, from http://en.wikipedia.org/wiki/Sasser worm ILOVEYOU. (2005). Wikipedia, the free encyclopedia. Symantec, Symantec and Information. Retrieved July 15, 2005, from 2005. http://en.wikipedia.org/wiki/VBS/Loveletter

Jack M. Germain (2004) Is the Superworm a Mere Myth?. Tech News World. Retrieved July 15, 2005, from http://www.technewsworld.com/story/32721.html

Julia Allen. (2002) System and Practices. Journal of Information Security, Vol1, No 2

Klez. (2005). Wikipedia, the free encyclopedia. Retrieved July 15, 2005, from http://en.wikipedia.org/wiki/Klez

Mary Landesman. (2005) Mytob prevention. About. Retrieved July 15, 2005, from http://antivirus.about.com/od/ virusdescriptions/a/mytob.htm