11.1 Internet Worms

Question 1

Virus

Answer 1

“Infection” of an existing program that results in modification of behavior

Typically require user action to spread, for example, opening an attachment on an email or running a executable file that a friend gave you on a USB key

Require user activity

spreads manually

Question 2

Worm

Answer 2

Code that propagates/replicates across the network

Is spread by exploiting flaws in existing programs or open services

Propagate automatically

spreads automatically

Question 3

Parasitic (Type of Virus)

Answer 3

infects executable files

Question 4

Memory-resident (Type of Virus)

Answer 4

infect running programs

Question 5

Boot-sector (Type of Virus)

Answer 5

spreads when system is booted

Question 6

Polymorphic (Type of Virus)

Answer 6

encrypt part of virus program using a randomly generated key

Question 7

What is the main difference between a worm and a virus?

Answer 7

Worms can spread automatically

Question 8

Worm Lifecycle

Answer 8

1. Discover/ “scan” for vulnerable hosts

2. Infect vulnerable machines via remote exploit

Question 9

What are the 3 steps in a worm’s “life cycle”?

Answer 9

1. Scanning for vulnerable hosts
2. Infect vulnerable host
3. Remaining undetectable

Question 10

Increasing Initial Compromise Rate

Answer 10

1. Hit List: List of vulnerable hosts

2. Permutation scanning: shared permutation of IP address lists. Start from own IP + work down

Question 11

What allowed Slammer to spread quickly?

Answer 11

UDP/connectionless transport

Could fit in a single packet