Slashdot Mirror
Worms Going Further, Faster
Major Byte writes "Rob Kolstad's MOTD (pdf) column in Usenix login; passes along a few distilled factiods from a CAIDA analysis of the 'Sappire/Slammer' Worm. When it was at full blast it was scanning over 3 billion systems per hour--a speed that 'a "better" vulnerability would have enabled infection of the entire internet in 15 minutes, a "flash worm" or a "Warhol Worm."' I think 'better' to mean 'able to infect across a lot of platforms.'"
A good set of vulnerabilities across multiple hardware configurations and OSes is a great start. An interesting idea would be to sync the worms up based upon a reading from a certain timezone on time.gov. Make them start scanning all IPs for vulnerable, uninfected machines at the same time. So not only do you get the chance to infect, but you DDoS. Fun stuff. Also, you could make it infect unprotected routers and give the virus 'priority' in transmissions, etc, etc.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
I'm still waiting for a Cisco IOS bug to be discovered that is present in all 12.x series code. I can't wait to see the worm for that one :D
Actually 'the Sapphire Worm' was just 376 bytes long. Not much extra code in that assembly program to track an author by.
What kind of a statistic is that? How can it fully complete a 3 billion system per hour cycle if there are not 3 billion systems to infect (I'm guessing that there aren't). So it's true rate is how ever many systems it actually did infect, which is likely a lot less than 3 billion. You can't just calculate the speed over 2 minutes and multiply it by 30. That'd be like a starship that was able to travel at 15 billion light years per hour. Really? Where would it go?
Maybe the "delinquents" are actually pretty damn smart. Smart enough to not get caught because they take proper security precautions. Like others have said this worm was a pretty smooth little hack. All over UDP and in a single packet. Anyway at least when a worm like this comes along people start paying attention to actually fixing the problem. If no one exploited the vulnerability then folks like MS might never get around to fixing it. When something like this is front-page news and on CNN normal folks sit up and take notice. Maybe enough notice to try and make their systems more secure, or perhaps switch to a more secure preogram/OS. Not that I like viruses and worms, quite the opposite is true. I remember when my ISP got a worm, (Code Red I think), and infected me. The incident certainly made me more security conscious, and I now have a new ISP that I hope has more of a clue than my old one.
Anti-social? My code is just platform-specific.
Slammer and Code Red were blockable by patches released long before the outbreak happened.
Or we can just ignore that and blame Microsoft. Yeah, that's the ticket.
Not to nitpick, but the SQL Slammer worm appeared to be written in assembly. It is quite interesting to read through the source. [alt] [alt]
While the PRNG isn't of the highest quality, its brevity is what allowed it to spread so quickly. An infected system was sending out packets as fast as the outbound pipe could handle it. A smaller virus, even by a few bytes, would mean that much faster of an infection rate.
By and large, you're right about VBScript making for simple virii, but this isn't the one to use as an example.
nature has evolved to fight biological infection by various means: genetic diversity, adaptive defensives. we could take a lesson from this.
-- There is no patch for human carelessness.
The user isn't always to blame. What about the software developers who don't take even minimal efforts to protect their scripting systems?
Yes, there will always be someone who will open attachments no matter how often you tell them not to.
But perhaps the root issue isn't the fellow who can't stop clicking on Fireworks.exe files but the OS and application developers who enable and then don't patch systems that allow those users to be so easily exploited.
I was just listening to a radio show. The host had an email from "an insider" we'll say, who related that just lately (ongoing) there is supposedly some big "attack" going on that is targeting some government database,allegedly the largest in the world, but no name-redacted of course- and also banks of all things. I emailed him with the latest bug bear exploit details, because it sounded like it. He mentioned my email after a station break, and was adamant that his source was saying it was NOT the latest bugbear variant, but something much larger and they think it's a state sponsored cyber warfare attack.
Anyone hear of anything like this going on? I checked the usual security sites, I see nothing mentioned.
My apologies for the sidetracking, just the timing and this thread gave me an opportunity to ask here.
There's a lot to be said for having diversity in a population to prevent a 100% infection rate.
Why doesn't someone just make a worm that goes around and downloads Windows and SQL server updates to patch against all these worms? I realize Microsoft doesn't have the best track record even with their updates, but it would still probably solve some problems. And yes, I realize there's something wrong with forcing people to install updates, but consider the alternative of reading these articles every week here.
The worm I am afraid of is one that learns (or at least adapts) using some sort of evolution-based algorthm. Several million computers is a sufficient "population" for the worms to gain a lot of knowledge about what works and what doesn't.
Grok!
I still remember stunning some of my cow orkers by saying from two cubicles away, "Dude, run a virus scanner. There's no reason your floppy drive should be doing that many seeks across the entire width of the disk. Something's writing to the FAT or boot sector every time you access any files. Probably a virus. Kill it before it kills you."
To this day, they still no idea how I knew about that without even looking at the screen or touching the box, but from where I sat it was just obvious (when I first heard that pattern of seeks and asked if the guy was copying 100 small files to the floppy, and he said "no") that something on that box was fucked up. (And fucked up in a way that MS-DOS, all by itself, wasn't :)
Funny note - the virus in question was indeed a boot sector virus, and was pretty much harmless on Win3.1 boxen. Not so on an NT box. If only I'd come to work one day before. Yuk.
It is similar, but not quite the same (ender's worm). The worm would be based on a neural network capable of storing various infection and spreading techniques. Coupled with the neural network would be the âoestandardâ worm tools for infection and stealth. The core receives additional training information from other infected computers. The first time a worm is activated, it creates copies of itself on the host in various places using various techniques. Many of these may be discovered. Their loss is more valuable to the species. After a predefined time, the âoeprimary wormâ contacts all other worms on the system. The ones that survived are considered evidence that the particular method works on a particular system configuration. Next, it begins scanning the internet for other worms. When it finds one, it transmits a string containing two parts. One part describes various aspects of the system (operating system, versions of patches, versions of programs, versions of antivirus definitions, etc), the other describes the methods that successfully infected the computer. This information would be most certainly less than one packet. When a worm receives one of these packets, it first verifies it, and then adds it to its neural network. It then queries its neural network using its system configuration string and reinstalls itself onto the system based on those parameters. Then it waits a shorter time (maybe 15 minutes) before resuming port scanning (to make sure the updates don't reveal itself before it begins contributing to the "gene pool" again) This process allows the worm to evolve on its own and discover new ways to infect (assuming some sort of random mutation system).
Um... what if the worm writer used a new vulnerability that he discovered himself? There would be no patches.
I suppose the drive to release the worm while there is still a sizable pool of vulnerable hosts is one justification for the distinct lack of QA by worm developers.
Specifically, I would have done more testing on the PRNG (run in a sandbox, check IP target coverage), added code to selectively target "nearby" hosts (bypass randomization of the first, second and sometimes third byte), and perhaps looked into spoofing the source port (lots of badly written firewalls allow inbound packets that show a source port of 53, etc).
And to get really nasty, every few packets, set the fourth and sometimes third octet of the IP to .255/.127/.63, to get that whole smurf effect going in your favor.
Nonesuch@Chicago
The scary thing about UDP "flash worms":
My prediction: by the end of this year we will see a cross-platform (Linux/X86 and Solaris/Sparc?) "flash worm" targeting BIND...
Nonesuch@Chicago
The problem with Ender's worm is that by design it is self-defeating. The idea of a "worm farm" of different units targetting different systems is effective, but with a common communications protocol, it negates the worms' ability to evolve and thwart detection. The writer of the paper talks about the worms' needs to change signatures to avoid AV detection, yet communicate with other units by a common question-and-response session, which would make it incredibly easy for any infected unit on the network to be easily identified.
To date, what gives away worm activity is the incessant talking they perpetrate, which is necessary to their propagation. So the key to any "super worm" isn't necessarily the speed at which it can infect nodes, but how quietly this can be done. I would argue that a slow, methodical infection, at a pace which makes the activity unsuspicious, has the potential to be much more dangerous.
Maybe this would be the ultimate worm.. two modes.. the first one slowly propagates and avoids detection, then a second phase which triggers a more aggressive frontal assault.
Hey, when is someone going to be nice enough to the world to make a purty li'l worm that actually shuts off all the security features that are exploited in Outlook...
I am sure there are plenty of reasons not to do this, but if you asked the person politely like.
"Hello, this is your friendly internet virus fighter coming to say hello and give you a hand! Would you like to turn off the features now that allowed me to hack into your computer?
| Yes | No |"
*click*
"Thank you and have a nice day! If I come back again that means a new hole/exploit was found in Outlook and I can give you another helping hand!"