Slashdot Mirror
What Does a Spreading Worm Look Like?
quibbs0 writes "When a new worm spreads around the world, people want to know if they are protected. How fast is it? How does it spread? A new simulation program developed by Symantec Research Labs not only has the answers, it also provides pictures."
You can run virii with Wine ;)
"A truly wise man realizes he knows nothing."
Ok, it's not that useful this time, but I'm doing this to learn :)
r .msi.torrent
http://dload.digitalriviera.com/SRL_Worm_Simulato
On similar theme, current issue of IEEE Spectrum has article on How to Hook Worms
... and in a WWW based format, as opposed to the executable from an AV company. I think it was two of their researchers -- Colleen Shannon and David Moore. The animation for Code Red is here .
One of the reasons that worms spread exclusively on Windows is because you need end to end linkage. A simplified model is if I wanted to send a message to Kevin Bacon, I'd talk to friend A who knows an actor, who talks to Friend B, then friend C, who then talks to Kevin. If I tell someone who doesn't speak the language, the linkage is broken and my original message can no longer propogate.
In other words, a computer can only infect other computers through being infected itself (unless if the system is just serving files). Worms can't move through unsupported systems. Once it hits OS X or Linux system, it can't move anywhere. Windows is the only OS with critical mass high enough to achieve this. Symbian for mobile devices. This is why you won't see any Windows CE worms unless if it gains in terms of marketshare.
Sure: http://www.jeanhaines.com/tmp/wormSim.html
/.'ed!*
*watches website get
Haydn.
Time is an illusion. Lunchtime doubly so. - Douglas Adams
Someone above requested a screenshot, I've replied above but for those that missed the reply and can't run .msi files, here's a screenie:
.msi files!
http://www.jeanhaines.com/tmp/wormSim.html
Haydn.
p.s: thank god I'm at work so I can open
Time is an illusion. Lunchtime doubly so. - Douglas Adams
The funny thing so far i've seen concerning worm and viruses is the Windows media center. I was looking at a new flat TV screen in an electronic shop. They were promoting the Microsoft media center. The funny thing was a little popup window at the right of the taskbar. "Windows did not find any anti-virus software on this computer." or something like. Lol...Thanks but I prefer my good old Television. Olivier
As it happens, a friend of mine, (former boss) happens to be doing something very much along these lines.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
If people are interested in another take on worm propagation monitoring and containment, have a look at http://www.intrinsicsecurity.com/.
Disclaimer: I did some work with the folks there in past, and they are pretty sharp.
First Netsky DOES NOT effect Mac OS. It can be received via email like numerous other PC viruses, but doesn't execute or cause any damage on a Mac OS X machine.
Second, Opener/Renepo IS NOT a virus or a worm. It doesn't spread and can not self-replicate. Opener/Renepo can cause damage to a Mac OS X system, but only if the user running it has permission to run it, and grants the app permission to run and perform the damage. It can't traverse the network, spread to others machines, or run without explicit permission of the user. In that sense it's pretty much the equivalent of a user deleting their own files or running a trojan application locally.
Obviously, if your going to write this, you could have at least spent 5 minutes getting information from any reputable anti-virus site. Symantec, Sophos, and a host of other sites, will give you the details of what OSs the virus run on,threat level, etc.