The Most Popular Viruses Of All Times Learn All About The Most Popular Viruses of All Time The Coding Eagle The Most Popular Viruses Of All Times Learn All About The Most Popular Viruses of All Time The Coding Eagle This book is for sale at http://leanpub.com/mostpopularviruses This version was published on 2015-03-21 This is a Leanpub book. Leanpub empowers authors and publishers with the Lean Publishing process. Lean Publishing is the act of publishing an in-progress ebook using lightweight tools and many iterations to get reader feedback, pivot until you have the right book and build traction once you do. ©2015 The Coding Eagle Tweet This Book! Please help The Coding Eagle by spreading the word about this book on Twitter! The suggested hashtag for this book is #Viruses. Find out what other people are saying about the book by clicking on this link to search for this hashtag on Twitter: https://twitter.com/search?q=#Viruses Contents Chapter One ............................................ 1 Introduction ........................................... 1 Viruses Covered in This Book ................................. 1 Chapter 2: Terms .......................................... 2 Worms .............................................. 2 Trojans .............................................. 2 Denial of Service Attack (DDoS) ................................ 2 Botnets .............................................. 2 Popular Windows Security Holes ................................ 3 Chapter 3: MyDoom ........................................ 4 Introduction ........................................... 4 How it Worked ......................................... 4 Once infected… ......................................... 5 Damages ............................................. 5 The End ............................................. 6 Chapter 4: Sobig.F ......................................... 7 Introduction ........................................... 7 How it Worked ......................................... 7 Once Infected.. ......................................... 8 Damages ............................................. 9 The End ............................................. 9 Chapter 5: ILOVEYOU ...................................... 10 Introduction ........................................... 10 How it Worked ......................................... 10 Once Infected… ......................................... 11 Damages ............................................. 11 The End ............................................. 12 Chapter One Introduction This is my first book at Leanpub, and I wanted to make it free so that I can see how many people would download it. Please also tell me how much you would have paid for this book (though you don’t have to!) Email any questions or comments to me at [email protected]¹. Anyway, this book will be about computer viruses, because I just love it when one completely destroys my computer :-). Computer viruses may seem boring and useless, but it’s not. It’s actually really interesting, and I wanted to show you what they are and how they work in the most efficient manner possible. Viruses Covered in This Book Currently, the viruses covered in this book are: • MyDoom This list is not complete. I will be adding more and more viruses to this book as I find them. To fully understand this book, it’s best if you first get familiar with virus concepts. If you already know about worms, trojans, and how viruses work, you can skip ahead and start reading. ¹mailto:[email protected] Chapter 2: Terms Worms Worms are earthly creatures that crawl under the ground and are not dangerous… yeah yeah. When you’re talking about viruses, worms are actually quite dangerous. Worms are viruses that replicate itself many times to spread to other computers. While worms itself doesn’t do any damage, it can carry malicious code that does. Worms typically spread via email attachments, so step one to not getting infected is don’t open up email attachments. Trojans History lesson! OK. Take it back. I hate history lessons. Basically, as in every war, one side tries to kill another. However, one of the sides is extremely smart. It fakes a surrender, and sends a giant wooden horse, called a trojan, into the enemy territory as a gift. As you know, there are warriors hidden inside the horse and they come out and conquer the enemy. Hooray! Wait. What does this have to do with viruses? Well, a Trojan is simply a fancy name for a program that pretends to be something else. Let’s say I created a virus. I want to hide it. So I name it windowsantivirus.exe. The user sees this, but thinks, Yay! Windows gave me a free antivirus! And the user doesn’t delete it. Well, that’s a trojan. Denial of Service Attack (DDoS) This is quick: A denial of service means an attack that is meant to stop a service, like a email client or server. If I had five thousand computers located around the globe, what if I suddenly all directed them to Google? OK, bad example. Say I had one million computers. Suddenly, I command all of them to open up a web browser, and open one tab every second that points to a small website, like leanpub². Because leanpub cannot filter out every single computer as a spamming computer, its server crashes. Now nobody can access it. Botnets In DDoS, I mentioned that I was able to command one million computers around the globe that weren’t mine. This is called a botnet. A botnet consists of many computers that the hacker has access to, called bots. ²http://leanpub.com Chapter 2: Terms 3 Popular Windows Security Holes Although this isn’t a term, I just wanted to mention it because it’s so hilarious. • Outlook’s contact book is frequently used to spread email viruses. • Every time Windows boots up, it executes every single file in a specific folder, and in administrator level, which basically lets the virus do whatever it wants to your computer. And you know what? It’s super easy to put your own malicious file inside the folder. • Windows hides file extensions, letting the virus hide its .exe or .pif or whatever, basically concealing its virus properties. • Windows registry is basically a jackpot of commands that Windows will run. You can specify to run this command whenever the user does this, like run destroy_this_computer.exe whenever the user presses space. And Windows even gave an easy way to do this. In fact, this was supposed to be a feature that Windows applications could use, meaning that viruses could use this feature to destroy the computer. These terms are not complete, so don’t think you are a virus expert yet. However, it’s a start. Chapter 3: MyDoom Introduction Finally! We get to start talking about viruses! Anyway, here are some stats, just to let you know: • Infected Computers: 2 Million • Damages: Over $38 Billion • Type: Worm + DDoS • How it Spread: Email • Date: January 26, 2004 • Creator: In Hiding • Origin: Russia • Language: C++ • Platform(s): MS Windows • File Type(s): cmd, exe, pif, scr, zip • End Date: Feb 12, 2004 (MyDoom.A) and March 1, 2004 (MyDoom.B) Yeah. Pretty bad. But not that bad, considering we’re talking about computer viruses. How it Worked This virus would go to the victim’s inbox as a email, with these subject lines: • test • hi • hello • Mail Delivery System • Mail Transaction Failed • Server Report • Status • Error And just like any other virus, it’s stupid. Anybody would be smart enough to know not to open a email titled “hi.” And they would definitely not open up the attachment. Well, they did, anyway. Some of the message bodies included: Chapter 3: MyDoom 5 • Mail transaction failed. Partial message is available. • The message contains Unicode characters and has been sent as a binary attachment. • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment. Again, this virus can be easily avoided if people would use their common sense. But they didn’t. And that wasn’t their fault; This virus only targeted Windows, and everybody knows why: Windows is just too insecure. It hid the file extension. If I create a file named homework.txt, it would show up on my computer as homework. So, what if I created a file called virus.txt.exe? It would appear as a harmless virus.txt file. This is how viruses work. Unknowing victims only see the harmless txt file extension, and they open the file. Once opened, Windows actually executes the file, and boom! Your computer is infected. Once infected… Once your computer is infected, the virus did a number of things, but first it sent itself to everybody on your contact book. It would quickly scan through all your contacts, and send a replica of itself to one of your contacts. It is capable of sending 100 emails in 30 seconds. It’s very smart; it is designed so that it doesn’t send itself to Google or any other system that can detect it as a virus. It also fakes the sender so that it seems that somebody else is sending the virus. Some people also claim that it drops an infected file onto your computer to steal all your passwords. Finally, as if it hadn’t done enough harm, it opened up all the ports on your computer, or allowed the hacker full control over your computer. Damages MyDoom used its large botnet to attack SCO and Microsoft. Both SCO and Microsoft both promised to give large sums of money to anybody who revealed the creator of the virus. MyDoom was also held responsible for one out of every 41 emails sent. At one point, it was responsible one in every twelve emails, breaking Sobig’s record of one in every 21. More on Sobig later. This caused giant internet traffic jams, and whole websites were forced to move in order to not be attacked. Email servers were also down for quite some time. Not just that, but once a variant of MyDoom actually dared to attack Google, AltaVista and Lycos, and you know what? It succeeded! Google was brought down for the majority of the day, and AltaVista and Lycos were noticeably slower than usual. Chapter 3: MyDoom 6 The End Well, all this fun had to end someday.