Computer viruses and worms are small pieces of software that replicate by inserting copies of themselves into other programs or files. Viruses piggyback on other programs to spread, while worms are self-contained and use networks and security vulnerabilities to replicate. Common types include executable viruses, boot sector viruses, and email viruses like Melissa. Prevention methods include software updates, antivirus programs, and more secure operating systems. The Morris worm of 1988 disrupted many computers and cost between $200-53,000 per system to remove, showing the damaging potential of worms.

1. Computer Viruses and Worms*Computer Viruses and Worms*
*Referred to slides by Dragan Lojpur, Zhu Fang at Florida State University

2. Definition of VirusDefinition of Virus
 A virus is a small piece of software thatA virus is a small piece of software that
piggybacks on real programs in order to getpiggybacks on real programs in order to get
executedexecuted
 Once itOnce it’’s running, it spreads by insertings running, it spreads by inserting
copies of itself into other executable code orcopies of itself into other executable code or
documentsdocuments

3. Typical things that some currentTypical things that some current
Personal Computer (PC) viruses doPersonal Computer (PC) viruses do
 Display a messageDisplay a message

4. Typical things that some currentTypical things that some current
Personal Computer (PC) viruses doPersonal Computer (PC) viruses do
 Erase filesErase files
 Scramble data on a hard diskScramble data on a hard disk
 Cause erratic screen behaviorCause erratic screen behavior
 Halt the PCHalt the PC
 Many viruses do nothing obvious at allMany viruses do nothing obvious at all
except spread!except spread!
 Display a messageDisplay a message

5. Executable VirusesExecutable Viruses
 Traditional VirusesTraditional Viruses
 pieces of code attached to a legitimatepieces of code attached to a legitimate
programprogram
 run when the legitimate program getsrun when the legitimate program gets
executedexecuted
 loads itself into memory and looks aroundloads itself into memory and looks around
to see if it can find any other programs onto see if it can find any other programs on
the diskthe disk

6. Boot Sector VirusesBoot Sector Viruses
 Traditional VirusTraditional Virus
 infect the boot sector on floppy disks andinfect the boot sector on floppy disks and
hard diskshard disks
 By putting its code in the boot sector, aBy putting its code in the boot sector, a
virus can guarantee it gets executedvirus can guarantee it gets executed
 load itself into memory immediately, and itload itself into memory immediately, and it
is able to run whenever the computer is onis able to run whenever the computer is on

7. E-mail VirusesE-mail Viruses
 Moves around in e-mail messagesMoves around in e-mail messages
 Replicates itself by automatically mailingReplicates itself by automatically mailing
itself to dozens of people in the victimitself to dozens of people in the victim’’s e-s e-
mail address bookmail address book
 Example:Example: Melissa virusMelissa virus,, ILOVEYOU virusILOVEYOU virus

8. Melissa virusMelissa virus
 March 1999March 1999
 the Melissa virus was the fastest-spreading virusthe Melissa virus was the fastest-spreading virus
ever seenever seen
 Someone created the virus as a Word documentSomeone created the virus as a Word document
uploaded to anuploaded to an Internet newsgroupInternet newsgroup
 People who downloaded the document and openedPeople who downloaded the document and opened
it would trigger the virusit would trigger the virus
 The virus would then send the document in an e-The virus would then send the document in an e-
mail message to the first 50 people in the person'smail message to the first 50 people in the person's
address bookaddress book

9. Melissa virusMelissa virus
 Took advantage of the programmingTook advantage of the programming
language built into Microsoft Word calledlanguage built into Microsoft Word called
VBA (Visual Basic for Applications)VBA (Visual Basic for Applications)

10. PreventionPrevention
 UpdatesUpdates
– Windows has a feature called Critical UpdatesWindows has a feature called Critical Updates
– An entire branch of Microsoft dedicated toAn entire branch of Microsoft dedicated to
staying one step ahead of the hackersstaying one step ahead of the hackers
– When a possible security loophole is fixed, youWhen a possible security loophole is fixed, you
need to download the patch right awayneed to download the patch right away
 Anti-VirusesAnti-Viruses
 More secure operating systemsMore secure operating systems
e.g. UNIXe.g. UNIX

11. WormsWorms
 WormWorm ­ is a ­ is a self­replicatingself­replicating program, program,
similar to a computer virus. A virus attaches similar to a computer virus. A virus attaches
itself to, and becomes part of, another itself to, and becomes part of, another
executable program; however, a worm is executable program; however, a worm is
self­contained self­contained and does not need to be part and does not need to be part
of another program to propagate itself. of another program to propagate itself.

12. Morris WormMorris Worm
 The first worm to attract wide attention, the Morris worm, The first worm to attract wide attention, the Morris worm,
was written by was written by Robert Tappan MorrisRobert Tappan Morris, who at the time was , who at the time was
a graduate student at Cornell University.a graduate student at Cornell University.
 It was released on November 2, 1988. The level of It was released on November 2, 1988. The level of
replication created system loads that not only brought it to replication created system loads that not only brought it to
the attention of system administrators, but also disrupted the attention of system administrators, but also disrupted
the target computers. It was guessed that the cost in the target computers. It was guessed that the cost in
"potential loss in productivity" caused by the worm and "potential loss in productivity" caused by the worm and
efforts to remove it ranged at each system from $200 to efforts to remove it ranged at each system from $200 to
more than $53,000 more than $53,000

13. Morris WormMorris Worm
 Morris himself was convicted under the US Computer Morris himself was convicted under the US Computer
Crime and Abuse Act and received three years probation, Crime and Abuse Act and received three years probation,
community service and a fine in excess of $10,000. community service and a fine in excess of $10,000.
 Robert Tappan Morris Robert Tappan Morris is now a professor at MITis now a professor at MIT

14. Worms…Worms…
 WormsWorms – is a small piece of software that uses – is a small piece of software that uses
computer networks and security holes to replicate computer networks and security holes to replicate
itself. A copy of the worm scans the network for itself. A copy of the worm scans the network for
another machine that has a specific security hole. another machine that has a specific security hole.
It copies itself to the new machine using the It copies itself to the new machine using the
security hole, and then starts replicating from security hole, and then starts replicating from
there, as well.there, as well.
 They are often designed to exploit the file They are often designed to exploit the file
transmission capabilities found on many transmission capabilities found on many
computers.computers.