Computer Worms


Published on

Computer Worms

Published in: Education, Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Computer Worms

  1. 1. COMPUTER WORMS Pondicherry University By: SADIQUE NAYEEM
  2. 2. Worms  Worms: A worm is a program that uses computer networks and security holes to replicate itself.  Scans the network for another machine that has a specific security hole and copies itself  Use up computer processing time and network bandwidth during replication.  Carry payloads that do considerable damage.
  3. 3. Virus v/s Worm Virus • Attaches itself to OS or the programs • Need user action to abet their propagation. • Damages caused is mostly local to the machine • Spread quite slowly Worm • Do not Attaches itself to OS • Self propagates across a network exploiting security in widely used services. • It harms the network and consumes n/w bandwidth. • Spread much more rapidly Ex. SQL Slammer worm 75,000 victims within ten minutes.
  4. 4. Mechanism of Operation
  5. 5. CLASSIFICATION Target discovery Carrier Activation Payloads
  6. 6. I. Target Discovery  Scanning:  Scanning entails probing a set of addresses to identify vulnerable hosts. (Sequential form or Random form)  Pre- Generated Target Lists  Externally Generated Target Lists  An target list maintained on a server (Metaserver)  Internal Target Lists  Network-based applications always contain information about other hosts  Passive  Not positively search for victim hosts, it waiting for potential victims contact and produces no abnormal traffic  More stealthy
  7. 7. II. Propagation Carriers  Two basic types  Positively spread itself machine by machine(Self- Carried)  Be carried along with normal communication.  Second Channel  Need second communication channel  Embedded  Either appending to or replacing normal messages and very difficult to detect
  8. 8. III. Activation  Human Activation(slowest worm activation method)  Try to convince people by using social engineering techniques  Indicating urgency, “Attached is an important message for you”  Using people’s vanity, “Open this message to see who loves you”  Human Activity-Based Activation  Resetting the machine  Logging in  Opening a remotely infected file  Scheduled Process Activation  Auto-updater programs  Self Activation(fastest worm activation)  Attach themselves to running services
  9. 9. IV. Payloads  A "payload" is code in the worm designed to do more than spread the worm.  None/nonfunctional (Morris worms)  Internet Remote Control (Code Red II)  Spam-Relays (Sobig.f)  Internet DOS (Code Red, Yaha)  Data Collection(target on sensitive data and identity theft)  Data Damage(erase data)  Physical-world Damage  Reflashing the BIOSs  Destroying the motherboards
  10. 10. Work of Payloads  Delete files  Encrypt files  Send documents via e-mail  Install a “backdoor” in the infected computer to allow the creation of a “zombie” computer under control of the worm author. Networks of such machines are often referred to as botnets.
  11. 11. Prevalence Table – November 2011 Malware Type % Autorun Worm 8.08% Heuristic/generic Worm 5.13% Conficker/Downadup Worm 2.85% VB Worm 2.12% Dorkbot Worm 1.46% According to VIRUS BULLETIN ( 2012
  12. 12. Motivation  experimental curiosity(Morris worms)  pride  extortion and criminal gain  random protest  political protest  terrorism  Cyber warfare
  13. 13. Morris worms  Launched on November 2, 1988 from MIT, by Robert Morris.  Designed to spread on UNIX System.  6000 computers out of 60000 computers at that time (i.e 10%).  The U.S. GAO(Government Accountability Office) put the cost of the damage at $10M–100M.  He was convicted in the US under the 1986 Computer Fraud and Abuse Act.
  14. 14. Code Red  Made huge headlines in 2001.  It slowed down Internet traffic when it began to replicate itself.  Worm scanned the Internet for unpatched Windows NT or Windows 2000 servers.  The Code Red worm had instructions to do three things:  Replicate itself for the first 20 days of each month  Replace Web pages featuring the message "Hacked by Chinese"  Launch a concerted attack on the White House Web site. ----The U.S. government changed the IP address of (
  15. 15. Nimda  The worm was released on September 18, 2001  the Internet’s most widespread virus/worm within 22 minutes.  Nimda affected both user workstations (clients) running Windows 95, 98, Me, NT, 2000 or XP and servers running Windows NT and 2000.  Nimda spread by five different infection vectors:  via email  via open network shares  via browsing of compromised web sites  via back doors left behind by the "Code Red II" and "sadmind/IIS" worms.
  16. 16. SQL Slammer worm  Starting on January 25, 2003. It spread rapidly, infecting most of its 75,000 victims within ten minutes.  Although titled "SQL slammer worm", the program did not use the SQL language  It exploited a buffer overflow bug in Microsoft's SQL Server  Slammer's tiny (376 byte) program.
  17. 17. Sobig.f Worm  In late 2003, the Sobig.f worm exploited open proxy servers to turn infected machines into a spam engine.  The Sobig worm appears as an electronic mail with one of the following subjects: Re: Approved, Re: Details, Re: My details, Re: Thank you!, Re: That movie etc.  It will contain the text: "See the attached file for details” and have attachments such as application.pif, details.pif, movie0045.pif etc.  At its peak Sobig.f reportedly accounted for 1 in every 17 messages.  It produced more than one million copies of itself with in the first 24 hours.  It was written using the Microsoft Visual C++ compiler.
  18. 18. Prevention  How can I prevent virus’, trojans, worms and malware fromgetting onto my system?  Careful web browsing  E-mail safety  Keep protection tools up to date  Review software being installed  and monitor your child’s computer usage
  19. 19. Current research Focus  Modelling: To model Worm propagation  Scanning Techniques  Sequential Scanning  Hit List Based Scanning  Permutation Scanning  Preferential Subnet Scanning  Propagation Mechanisms  Prevention Techniques
  20. 20. Refrences 1. VIRUS BULLETIN ( 2012 2. A Taxonomy of ComputerWorms WO RM’0 3, O cto be r 27 , 20 0 3, Washing to n, DC, USA. 3. 4. www. wikipe dia. co m 5. www. ho wstuffwo rks. co m 6. NetworkSecurity Essentials -William Stallings