11.1 - Internet Worms Flashcards
An infection of an existing program that results in the modification of original programs behavior. Typically require user action to spread (pen attachment on email, or runninng an exe that a friend gave on a USB key) - user intervention
Viruses
Code that propagates and replicates itself across the network. Usually spread by exploiting flaws in existing programs or open services. Propagate automatically - scanning to spread automatically
Worm
Infects an existing executable file
parasitic virus
infects running programs
memory-resident virus
spreads when system is booted
Boot-sector
encrypt part of virus program using randomly generated key
Polymorphic
First internet worm
Morris worm, 1988
Had no malicious payload but exhausted resources
effected 10% of all internet hosts
standard buffer overflow exploit
Quiz:
Main difference between a worm and a virus?
Worms can spread automatically
Both worms and viruses can have destructive payloads
worm life-cycle
1) Discover/”scan” for vulnerable hosts
2) Infect vulnerable machines via remote exploit
Worms exploit through multiple vectors in order to spread faster
Vectors
1) remote shell execution/weak passwords
2) buffer overflow /remote exploit
3) debug in sendmail (smtp)
General approach of a worm
1) Scan to find a vulnerable host
2) Spread to other vulnerable hosts
3) Remain undetected - undiscoverable to continue to spread
Quiz:
What are the three steps in a worm’s “life cycle”?
1) Scans for vulnerable hosts
2) Infects them
3) remains undetected
3 major worm outbreaks in 2001
1) Code red I v2
2) Code red II
3) Nimda
Zero Day attacks
An exploit directed at a zero-day is called a zero-day exploit, or zero-day attack. In the jargon of computer security, “Day Zero” is the day on which the interested party (presumably the vendor of the targeted system) learns of the vulnerability.
A zero-day vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability. Until the vulnerability is mitigated, hackers can exploit it to adversely affect computer programs, data, additional computers or a network.
Random constant spread
K: initial compromise rate
N: # of vulnerable hosts
a: Fraction of hosts already compromised
Nda = (Na)*K(1-a) dt
a = e^K(t-T)/1+e^K(t-T)
If you want to design a fast spreading worm you need a high compromise rate (K)
