SlideShare a Scribd company logo
Spreading Viruses
Introduction
Computer virus have become today’s headline
news
With the increasing use of the Internet, it has
become easier for virus to spread
Virus show us loopholes in software
Most virus are targeted at the MS Windows OS
Definition
Virus : A true virus is capable of self replication
on a machine. It may spread between files or
disks, but the defining character is that it can
recreate itself on it’s own with out traveling to a
new host
Overview
Background
Symptoms
Classifying Viruses
Examples
Protection/Prevention
Conclusion
Background
There are estimated 30,000 computer
viruses in existence
Over 300 new ones are created each
month
First virus was created to show loopholes
in software
Virus Languages
ANSI COBOL
C/C++
Pascal
VBA
Unix Shell Scripts
JavaScript
Basically any language that works on the system
that is the target
Symptoms of Virus Attack
Computer runs slower then usual
Computer no longer boots up
Screen sometimes flicker
PC speaker beeps periodically
System crashes for no reason
Files/directories sometimes disappear
Denial of Service (DoS)
Virus through the Internet
Today almost 87% of all viruses are spread
through the internet (source: ZDNet)
Transmission time to a new host is relatively
low, on the order of hours to days
“Latent virus”
Classifying Virus - General
Virus Information
Discovery Date:
Origin:
Length:
Type:
SubType:
Risk Assessment:
Category:
Classifying Virus - Categories
Stealth
Polymorphic
Companion
Armored
Classifying Virus - Types
Trojan Horse
Worm
Macro
Trojan Horse
Covert
Leaks information
Usually does not reproduce
Trojan Horse
Back Orifice
Discovery Date: 10/15/1998
Origin: Pro-hacker Website
Length: 124,928
Type: Trojan
SubType: Remote Access
Risk Assessment: Low
Category: Stealth
Trojan Horse
About Back Orifice
requires Windows to work
distributed by “Cult of the Dead Cow”
similar to PC Anywhere, Carbon Copy software
allows remote access and control of other computers
install a reference in the registry
once infected, runs in the background
by default uses UDP port 54320
TCP port 54321
In Australia 72% of 92 ISP surveyed were infected with
Back Orifice
Trojan Horse
Features of Back Orifice
pings and query servers
reboot or lock up the system
list cached and screen saver password
display system information
logs keystrokes
edit registry
server control
receive and send files
display a message box
Worms
Spread over network connection
Worms replicate
First worm released on the Internet was called
Morris worm, it was released on Nov 2, 1988.
Worms
Bubbleboy
Discovery Date: 11/8/1999
Origin: Argentina (?)
Length: 4992
Type: Worm/Macro
SubType: VbScript
Risk Assessment: Low
Category: Stealth/Companion
Worms
Bubbleboy
requires WSL (windows scripting language), Outlook
or Outlook Express, and IE5
Does not work in Windows NT
Effects Spanish and English version of Windows
2 variants have been identified
Is a “latent virus” on a Unix or Linux system
May cause DoS
Worms
How Bubbleboy works
Bubbleboy is embedded within an email message of
HTML format.
a VbScript while the user views a HTML page
a file named “Update.hta” is placed in the start up
directory
upon reboot Bubbleboy executes
Worms
How Bubbleboy works
changes the registered owner/organization
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurren
tVersionRegisteredOwner = “Bubble Boy”
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurren
tVersionRegisteredOrganization = “Vandalay Industry”
using the Outlook MAPI address book it sends itself to
each entry
marks itself in the registry
HKEY_LOCAL_MACHINESoftwareOutlook.bubbleboy =
“OUTLOOK.Bubbleboy1.0 by Zulu”
Macro
Specific to certain applications
Comprise a high percentage of the viruses
Usually made in WordBasic and Visual
Basic for Applications (VBA)
Microsoft shipped “Concept”, the first
macro virus, on a CD ROM called
"Windows 95 Software Compatibility Test"
in 1995
Macro
Melissa
Discovery Date: 3/26/1999
Origin: Newsgroup Posting
Length: varies depending on variant
Type: Macro/Worm
Subtype: Macro
Risk Assessment: High
Category: Companion
Macro
Melissa
requires WSL, Outlook or Outlook Express Word
97 SR1 or Office 2000
105 lines of code (original variant)
received either as an infected template or email
attachment
lowers computer defenses to future macro virus
attacks
may cause DoS
infects template files with it’s own macro code
80% of of the 150 Fortune 1000 companies
were affected
Macro
How Melissa works
the virus is activated through a MS word document
document displays reference to pornographic
websites while macro runs
1st lowers the macro protection security setting for
future attacks
checks to see is it has run in current session before
HKEY_LOCAL_MACHINESoftwareMicrosoftOfficeMelissa
= “by Kwyjibo”
propagates itself using the Outlook MAPI address
book (emails sent to the first 50 addresses)
Macro
How Melissa works
infects the Normal.dot template file with it’s own code
Lastly if the minutes of the hour match up to the date
the macro inserts a quote by Bart Simpson into the
current document
“Twenty two points, plus triple word score, plus fifty points
for using all my letters. Game’s over. I’m outta here.”
Protection/Prevention
Knowledge
Proper configurations
Run only necessary programs
Anti-virus software
Case study
Conclusion
More about virus and how:
viruses work through your system
to make a better virus
Have seen how viruses show us a loophole in
popular software
Most viruses show that they can cause great
damage due to loopholes in programming

More Related Content

What's hot

1311782 634629102605888750
1311782 6346291026058887501311782 634629102605888750
1311782 634629102605888750
bhagatsigh
 
Virus and worms analysis
Virus and worms analysisVirus and worms analysis
Virus and worms analysis
roniee1234567890
 
Network virus detection & prevention
Network virus detection & preventionNetwork virus detection & prevention
Network virus detection & prevention
Khaleel Assadi
 
Viruses, Worms And Trojan Horses
Viruses, Worms And Trojan HorsesViruses, Worms And Trojan Horses
Viruses, Worms And Trojan Horses
Mario Reascos
 
Virus and worms
Virus and wormsVirus and worms
Virus and worms
Vikas Sharma
 
Virus slides
Virus slidesVirus slides
Virus slides
rahul kundu
 
As computer virus
As computer virusAs computer virus
As computer virus
achal bisht
 
Network virus detection & prevention
Network virus detection & preventionNetwork virus detection & prevention
Network virus detection & prevention
Khaleel Assadi
 
Virus
Virus  Virus
Virus
safi Ullah
 
Computer viruses
Computer virusesComputer viruses
Computer viruses
Dark Side
 
Virus soran university
Virus  soran universityVirus  soran university
Virus soran university
Rebaz Hamad
 
Computer virus 1
Computer virus 1Computer virus 1
Computer virus 1
wargames12
 
Virus-Awareness
Virus-AwarenessVirus-Awareness
Virus-Awareness
Utkarsh Srivastava
 
Malware by Ms. Allwood
Malware by Ms. AllwoodMalware by Ms. Allwood
Malware by Ms. Allwood
Stavia
 
Ids 007 trojan horse
Ids 007 trojan horseIds 007 trojan horse
Ids 007 trojan horse
jyoti_lakhani
 
Computer virus
Computer virusComputer virus
Computer virus
Priti Singh
 
Viruses And Hacking
Viruses And HackingViruses And Hacking
Viruses And Hacking
Muhammad Fahd Un-Nabi Khan
 
Computer viruses
Computer virusesComputer viruses
Computer viruses
Abdul Wadood Khan
 
Sanmi's first pp
Sanmi's first ppSanmi's first pp
Sanmi's first pp
sanmitha rao
 
Computer virus
Computer virusComputer virus
Computer virus
kiran_a_c
 

What's hot (20)

1311782 634629102605888750
1311782 6346291026058887501311782 634629102605888750
1311782 634629102605888750
 
Virus and worms analysis
Virus and worms analysisVirus and worms analysis
Virus and worms analysis
 
Network virus detection & prevention
Network virus detection & preventionNetwork virus detection & prevention
Network virus detection & prevention
 
Viruses, Worms And Trojan Horses
Viruses, Worms And Trojan HorsesViruses, Worms And Trojan Horses
Viruses, Worms And Trojan Horses
 
Virus and worms
Virus and wormsVirus and worms
Virus and worms
 
Virus slides
Virus slidesVirus slides
Virus slides
 
As computer virus
As computer virusAs computer virus
As computer virus
 
Network virus detection & prevention
Network virus detection & preventionNetwork virus detection & prevention
Network virus detection & prevention
 
Virus
Virus  Virus
Virus
 
Computer viruses
Computer virusesComputer viruses
Computer viruses
 
Virus soran university
Virus  soran universityVirus  soran university
Virus soran university
 
Computer virus 1
Computer virus 1Computer virus 1
Computer virus 1
 
Virus-Awareness
Virus-AwarenessVirus-Awareness
Virus-Awareness
 
Malware by Ms. Allwood
Malware by Ms. AllwoodMalware by Ms. Allwood
Malware by Ms. Allwood
 
Ids 007 trojan horse
Ids 007 trojan horseIds 007 trojan horse
Ids 007 trojan horse
 
Computer virus
Computer virusComputer virus
Computer virus
 
Viruses And Hacking
Viruses And HackingViruses And Hacking
Viruses And Hacking
 
Computer viruses
Computer virusesComputer viruses
Computer viruses
 
Sanmi's first pp
Sanmi's first ppSanmi's first pp
Sanmi's first pp
 
Computer virus
Computer virusComputer virus
Computer virus
 

Viewers also liked

Digital Distractions
Digital DistractionsDigital Distractions
Digital Distractions
ericb453
 
Board structure and firm performance of hotel and travel sector companies in ...
Board structure and firm performance of hotel and travel sector companies in ...Board structure and firm performance of hotel and travel sector companies in ...
Board structure and firm performance of hotel and travel sector companies in ...
Sajith Jayawardhana
 
Bluejacking
BluejackingBluejacking
Bluejacking
dixitas
 
This is How Memories Are Made
This is How Memories Are MadeThis is How Memories Are Made
This is How Memories Are Made
Claire Sprawson
 
Board structure and firm performance
Board structure and firm performanceBoard structure and firm performance
Board structure and firm performance
Sajith Jayawardhana
 
Spartacus workouts
Spartacus workoutsSpartacus workouts
Spartacus workouts
Mark McClintock
 
Cyber crime
Cyber crimeCyber crime
Cyber crime
dixitas
 
Image web crawler
Image web crawlerImage web crawler
Image web crawler
dixitas
 
Oracle ORA Errors
Oracle ORA ErrorsOracle ORA Errors
Oracle ORA Errors
Manish Mudhliyar
 

Viewers also liked (9)

Digital Distractions
Digital DistractionsDigital Distractions
Digital Distractions
 
Board structure and firm performance of hotel and travel sector companies in ...
Board structure and firm performance of hotel and travel sector companies in ...Board structure and firm performance of hotel and travel sector companies in ...
Board structure and firm performance of hotel and travel sector companies in ...
 
Bluejacking
BluejackingBluejacking
Bluejacking
 
This is How Memories Are Made
This is How Memories Are MadeThis is How Memories Are Made
This is How Memories Are Made
 
Board structure and firm performance
Board structure and firm performanceBoard structure and firm performance
Board structure and firm performance
 
Spartacus workouts
Spartacus workoutsSpartacus workouts
Spartacus workouts
 
Cyber crime
Cyber crimeCyber crime
Cyber crime
 
Image web crawler
Image web crawlerImage web crawler
Image web crawler
 
Oracle ORA Errors
Oracle ORA ErrorsOracle ORA Errors
Oracle ORA Errors
 

Similar to Spreading virus

Computer virus
Computer virusComputer virus
Computer virus
Walden University
 
Malware
MalwareMalware
Malware
Tuhin_Das
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
VijayPatidar71
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
NORTHCUSTOMS
 
Viruses (2).ppt
Viruses (2).pptViruses (2).ppt
Viruses (2).ppt
PrinceYdvz
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
Priyanka Aggarwal
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
AsimRaza464161
 
Viruses
VirusesViruses
Viruses
AlyssaFerrer7
 
Viruses (1).ppt
Viruses (1).pptViruses (1).ppt
Viruses (1).ppt
LadyChristianneCalic
 
W 12 computer viruses
W 12 computer virusesW 12 computer viruses
Computer virus
Computer virusComputer virus
Computer virus
Shailendra Gohil
 
VIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSESVIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSES
HARSORA_SEJAL
 
Data loss causes and its threats
Data loss causes and its threatsData loss causes and its threats
Data loss causes and its threats
Remo Software
 
Computer virus
Computer virusComputer virus
Computer virus
Mark Anthony Maranga
 
Digital Immunity -The Myths and Reality
Digital Immunity -The Myths and RealityDigital Immunity -The Myths and Reality
Digital Immunity -The Myths and Reality
amiable_indian
 
COMPUTER VIRUSES AND WORMS.pdf
COMPUTER VIRUSES AND WORMS.pdfCOMPUTER VIRUSES AND WORMS.pdf
COMPUTER VIRUSES AND WORMS.pdf
Mahmud Hasan Tanvir
 
Computer Virus
Computer VirusComputer Virus
Introduction to Computer Virus
Introduction to Computer VirusIntroduction to Computer Virus
Introduction to Computer Virus
Imtiaz Ahmed
 
computer virus Report
computer virus Reportcomputer virus Report
computer virus Report
rawaabdullah
 
New Wordpad Document
New Wordpad DocumentNew Wordpad Document
New Wordpad Document
shoib_245
 

Similar to Spreading virus (20)

Computer virus
Computer virusComputer virus
Computer virus
 
Malware
MalwareMalware
Malware
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
 
Viruses (2).ppt
Viruses (2).pptViruses (2).ppt
Viruses (2).ppt
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
 
Viruses.ppt
Viruses.pptViruses.ppt
Viruses.ppt
 
Viruses
VirusesViruses
Viruses
 
Viruses (1).ppt
Viruses (1).pptViruses (1).ppt
Viruses (1).ppt
 
W 12 computer viruses
W 12 computer virusesW 12 computer viruses
W 12 computer viruses
 
Computer virus
Computer virusComputer virus
Computer virus
 
VIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSESVIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSES
 
Data loss causes and its threats
Data loss causes and its threatsData loss causes and its threats
Data loss causes and its threats
 
Computer virus
Computer virusComputer virus
Computer virus
 
Digital Immunity -The Myths and Reality
Digital Immunity -The Myths and RealityDigital Immunity -The Myths and Reality
Digital Immunity -The Myths and Reality
 
COMPUTER VIRUSES AND WORMS.pdf
COMPUTER VIRUSES AND WORMS.pdfCOMPUTER VIRUSES AND WORMS.pdf
COMPUTER VIRUSES AND WORMS.pdf
 
Computer Virus
Computer VirusComputer Virus
Computer Virus
 
Introduction to Computer Virus
Introduction to Computer VirusIntroduction to Computer Virus
Introduction to Computer Virus
 
computer virus Report
computer virus Reportcomputer virus Report
computer virus Report
 
New Wordpad Document
New Wordpad DocumentNew Wordpad Document
New Wordpad Document
 

Recently uploaded

Question paper of renewable energy sources
Question paper of renewable energy sourcesQuestion paper of renewable energy sources
Question paper of renewable energy sources
mahammadsalmanmech
 
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
insn4465
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
171ticu
 
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
IJECEIAES
 
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdfIron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
RadiNasr
 
Recycled Concrete Aggregate in Construction Part II
Recycled Concrete Aggregate in Construction Part IIRecycled Concrete Aggregate in Construction Part II
Recycled Concrete Aggregate in Construction Part II
Aditya Rajan Patra
 
Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...
IJECEIAES
 
The Python for beginners. This is an advance computer language.
The Python for beginners. This is an advance computer language.The Python for beginners. This is an advance computer language.
The Python for beginners. This is an advance computer language.
sachin chaurasia
 
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Sinan KOZAK
 
Textile Chemical Processing and Dyeing.pdf
Textile Chemical Processing and Dyeing.pdfTextile Chemical Processing and Dyeing.pdf
Textile Chemical Processing and Dyeing.pdf
NazakatAliKhoso2
 
Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...
bijceesjournal
 
basic-wireline-operations-course-mahmoud-f-radwan.pdf
basic-wireline-operations-course-mahmoud-f-radwan.pdfbasic-wireline-operations-course-mahmoud-f-radwan.pdf
basic-wireline-operations-course-mahmoud-f-radwan.pdf
NidhalKahouli2
 
CSM Cloud Service Management Presentarion
CSM Cloud Service Management PresentarionCSM Cloud Service Management Presentarion
CSM Cloud Service Management Presentarion
rpskprasana
 
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEMTIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
HODECEDSIET
 
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdfBPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
MIGUELANGEL966976
 
spirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptxspirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptx
Madan Karki
 
Literature Review Basics and Understanding Reference Management.pptx
Literature Review Basics and Understanding Reference Management.pptxLiterature Review Basics and Understanding Reference Management.pptx
Literature Review Basics and Understanding Reference Management.pptx
Dr Ramhari Poudyal
 
Modelagem de um CSTR com reação endotermica.pdf
Modelagem de um CSTR com reação endotermica.pdfModelagem de um CSTR com reação endotermica.pdf
Modelagem de um CSTR com reação endotermica.pdf
camseq
 
Engineering Drawings Lecture Detail Drawings 2014.pdf
Engineering Drawings Lecture Detail Drawings 2014.pdfEngineering Drawings Lecture Detail Drawings 2014.pdf
Engineering Drawings Lecture Detail Drawings 2014.pdf
abbyasa1014
 
Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
IJECEIAES
 

Recently uploaded (20)

Question paper of renewable energy sources
Question paper of renewable energy sourcesQuestion paper of renewable energy sources
Question paper of renewable energy sources
 
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
哪里办理(csu毕业证书)查尔斯特大学毕业证硕士学历原版一模一样
 
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样学校原版美国波士顿大学毕业证学历学位证书原版一模一样
学校原版美国波士顿大学毕业证学历学位证书原版一模一样
 
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...
 
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdfIron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
Iron and Steel Technology Roadmap - Towards more sustainable steelmaking.pdf
 
Recycled Concrete Aggregate in Construction Part II
Recycled Concrete Aggregate in Construction Part IIRecycled Concrete Aggregate in Construction Part II
Recycled Concrete Aggregate in Construction Part II
 
Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...Advanced control scheme of doubly fed induction generator for wind turbine us...
Advanced control scheme of doubly fed induction generator for wind turbine us...
 
The Python for beginners. This is an advance computer language.
The Python for beginners. This is an advance computer language.The Python for beginners. This is an advance computer language.
The Python for beginners. This is an advance computer language.
 
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
Optimizing Gradle Builds - Gradle DPE Tour Berlin 2024
 
Textile Chemical Processing and Dyeing.pdf
Textile Chemical Processing and Dyeing.pdfTextile Chemical Processing and Dyeing.pdf
Textile Chemical Processing and Dyeing.pdf
 
Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...Comparative analysis between traditional aquaponics and reconstructed aquapon...
Comparative analysis between traditional aquaponics and reconstructed aquapon...
 
basic-wireline-operations-course-mahmoud-f-radwan.pdf
basic-wireline-operations-course-mahmoud-f-radwan.pdfbasic-wireline-operations-course-mahmoud-f-radwan.pdf
basic-wireline-operations-course-mahmoud-f-radwan.pdf
 
CSM Cloud Service Management Presentarion
CSM Cloud Service Management PresentarionCSM Cloud Service Management Presentarion
CSM Cloud Service Management Presentarion
 
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEMTIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
TIME DIVISION MULTIPLEXING TECHNIQUE FOR COMMUNICATION SYSTEM
 
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdfBPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
BPV-GUI-01-Guide-for-ASME-Review-Teams-(General)-10-10-2023.pdf
 
spirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptxspirit beverages ppt without graphics.pptx
spirit beverages ppt without graphics.pptx
 
Literature Review Basics and Understanding Reference Management.pptx
Literature Review Basics and Understanding Reference Management.pptxLiterature Review Basics and Understanding Reference Management.pptx
Literature Review Basics and Understanding Reference Management.pptx
 
Modelagem de um CSTR com reação endotermica.pdf
Modelagem de um CSTR com reação endotermica.pdfModelagem de um CSTR com reação endotermica.pdf
Modelagem de um CSTR com reação endotermica.pdf
 
Engineering Drawings Lecture Detail Drawings 2014.pdf
Engineering Drawings Lecture Detail Drawings 2014.pdfEngineering Drawings Lecture Detail Drawings 2014.pdf
Engineering Drawings Lecture Detail Drawings 2014.pdf
 
Embedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoringEmbedded machine learning-based road conditions and driving behavior monitoring
Embedded machine learning-based road conditions and driving behavior monitoring
 

Spreading virus

  • 2. Introduction Computer virus have become today’s headline news With the increasing use of the Internet, it has become easier for virus to spread Virus show us loopholes in software Most virus are targeted at the MS Windows OS
  • 3. Definition Virus : A true virus is capable of self replication on a machine. It may spread between files or disks, but the defining character is that it can recreate itself on it’s own with out traveling to a new host
  • 5. Background There are estimated 30,000 computer viruses in existence Over 300 new ones are created each month First virus was created to show loopholes in software
  • 6. Virus Languages ANSI COBOL C/C++ Pascal VBA Unix Shell Scripts JavaScript Basically any language that works on the system that is the target
  • 7. Symptoms of Virus Attack Computer runs slower then usual Computer no longer boots up Screen sometimes flicker PC speaker beeps periodically System crashes for no reason Files/directories sometimes disappear Denial of Service (DoS)
  • 8. Virus through the Internet Today almost 87% of all viruses are spread through the internet (source: ZDNet) Transmission time to a new host is relatively low, on the order of hours to days “Latent virus”
  • 9. Classifying Virus - General Virus Information Discovery Date: Origin: Length: Type: SubType: Risk Assessment: Category:
  • 10. Classifying Virus - Categories Stealth Polymorphic Companion Armored
  • 11. Classifying Virus - Types Trojan Horse Worm Macro
  • 13. Trojan Horse Back Orifice Discovery Date: 10/15/1998 Origin: Pro-hacker Website Length: 124,928 Type: Trojan SubType: Remote Access Risk Assessment: Low Category: Stealth
  • 14. Trojan Horse About Back Orifice requires Windows to work distributed by “Cult of the Dead Cow” similar to PC Anywhere, Carbon Copy software allows remote access and control of other computers install a reference in the registry once infected, runs in the background by default uses UDP port 54320 TCP port 54321 In Australia 72% of 92 ISP surveyed were infected with Back Orifice
  • 15. Trojan Horse Features of Back Orifice pings and query servers reboot or lock up the system list cached and screen saver password display system information logs keystrokes edit registry server control receive and send files display a message box
  • 16. Worms Spread over network connection Worms replicate First worm released on the Internet was called Morris worm, it was released on Nov 2, 1988.
  • 17. Worms Bubbleboy Discovery Date: 11/8/1999 Origin: Argentina (?) Length: 4992 Type: Worm/Macro SubType: VbScript Risk Assessment: Low Category: Stealth/Companion
  • 18. Worms Bubbleboy requires WSL (windows scripting language), Outlook or Outlook Express, and IE5 Does not work in Windows NT Effects Spanish and English version of Windows 2 variants have been identified Is a “latent virus” on a Unix or Linux system May cause DoS
  • 19. Worms How Bubbleboy works Bubbleboy is embedded within an email message of HTML format. a VbScript while the user views a HTML page a file named “Update.hta” is placed in the start up directory upon reboot Bubbleboy executes
  • 20. Worms How Bubbleboy works changes the registered owner/organization HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurren tVersionRegisteredOwner = “Bubble Boy” HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurren tVersionRegisteredOrganization = “Vandalay Industry” using the Outlook MAPI address book it sends itself to each entry marks itself in the registry HKEY_LOCAL_MACHINESoftwareOutlook.bubbleboy = “OUTLOOK.Bubbleboy1.0 by Zulu”
  • 21. Macro Specific to certain applications Comprise a high percentage of the viruses Usually made in WordBasic and Visual Basic for Applications (VBA) Microsoft shipped “Concept”, the first macro virus, on a CD ROM called "Windows 95 Software Compatibility Test" in 1995
  • 22. Macro Melissa Discovery Date: 3/26/1999 Origin: Newsgroup Posting Length: varies depending on variant Type: Macro/Worm Subtype: Macro Risk Assessment: High Category: Companion
  • 23. Macro Melissa requires WSL, Outlook or Outlook Express Word 97 SR1 or Office 2000 105 lines of code (original variant) received either as an infected template or email attachment lowers computer defenses to future macro virus attacks may cause DoS infects template files with it’s own macro code 80% of of the 150 Fortune 1000 companies were affected
  • 24. Macro How Melissa works the virus is activated through a MS word document document displays reference to pornographic websites while macro runs 1st lowers the macro protection security setting for future attacks checks to see is it has run in current session before HKEY_LOCAL_MACHINESoftwareMicrosoftOfficeMelissa = “by Kwyjibo” propagates itself using the Outlook MAPI address book (emails sent to the first 50 addresses)
  • 25. Macro How Melissa works infects the Normal.dot template file with it’s own code Lastly if the minutes of the hour match up to the date the macro inserts a quote by Bart Simpson into the current document “Twenty two points, plus triple word score, plus fifty points for using all my letters. Game’s over. I’m outta here.”
  • 26. Protection/Prevention Knowledge Proper configurations Run only necessary programs Anti-virus software
  • 28. Conclusion More about virus and how: viruses work through your system to make a better virus Have seen how viruses show us a loophole in popular software Most viruses show that they can cause great damage due to loopholes in programming