The Worm

1
The Worm

• Zaw Aung
• 14/07/2005

2
What is it?
A virus by contrast cant spread/infect on its
own.

• A worm is self-contained and does not need to be
  part of another program to propagate itself
• The Worm programs were an experiment in the
  development of distributed computation
• Programs that span machine boundaries
• Replicate themselves in idle machines
• A Worm is composed of multiple segments, each
  running on a different machine

3
What can it do?

• Infect and take over large number of hosts
• These hosts can then be used to
• launch a massive Distributed Denial of Service
  (DDOS) attack.
• access sensitive information on the hosts.
• inject false or malicious information into
  networks.

4
History

• The name 'worm' was taken from The Shockwave
  Rider, a 1970s science fiction novel by John
  Brunner.
• John Shoch and Jon Hupp,
• Xerox Palo Alto Research Center

5
Building a Worm
Schematic of Several Multi-segment Worm Programs
6
Building a Worm

• General issues in constructing
• Starting a Worm
• Some code starts from a machine
• Initialize when it starts on any subsequent
  machine
• Program start methods
• Loading via OS or booting from network server
• Locating other idle machines
• Booting an idle machines
• Intra-Worm Communication - The Need for Multi
  destination Addressing
• Pseudo-multicast
• Brute force multicast
• Releasing a Machine

7
A key Problem

• worm management was a key problem to ensure that
  worm growth could be reliably contained
• Challenging area
• The development of distributed worm control
  algorithms with
• Low delay
• Stable behavior

8
Applications Using the Worms

• In 1982 at Xerox s Palo Alto Research Center,
  John Shoch and Jon Hupp wrote five worm programs
  that performed such benign tasks as posting
  announcements
• The Existential Worm
• The Billboard Worm
• The Alarm Clock Worm
• Multi-machine Animation Worm
• Diagnostic Worm for the Ethernet

9
Worm Defenses

• Preventing
• Run only essential services
• Patch all systems regularly
• Firewall
• Detecting
• Distributed Intrusion Detection Systems
• Countermeasures
• Start patching
• Content filtering
• Quarantine IP address blocking

10
Name
Morris
Mellisa
Loveletter
Code Red
Blaster
Sasser
1999
2000
2004
1998
2001
2003
Time
11
Future of Worm

• Emergence of multiple spread paths
• Peer-to-Peer (P2P)
• Instant Messaging
• Mobile Device
• Technical advancement of attacking methods
• Vulnerability attacks and blended attacks
• Intelligent technique to avoid detection
• Faster worm writing by automated tools