Information Security: Worms

   

Worms

A worm is a program that can replicate itself and send copies from computer to computer across network connections. Upon arrival, the worm may be activated to replicate and propagate again. In addition to propagation, the worm usually performs some unwanted function. A worm actively seeks out more machines to infect and each machine that is infected serves as an automated launching pad for attacks on other machines.

The concept of a computer worm was introduced in John Brunner’s 1975 SF novel The Shockwave Rider. The first known worm implementation was done in Xerox Palo Alto Labs in the early 1980s. It was nonmalicious, searching for idle systems to use to run a computationally intensive task.

Network worm programs use network connections to spread from system to system. Once active within a system, a network worm can behave as a computer virus or bacteria, or it could implant Trojan horse programs or perform any number of disruptive or destructive actions.

To replicate itself, a network worm uses some sort of network vehicle. Examples include the following:

·      Electronic mail facility: A worm mails a copy of itself to other systems, so that its code is run when the e-mail or an attachment is received or viewed. 


·      Remote execution capability: A worm executes a copy of itself on another system, either using an explicit remote execution facility or by exploiting a program flaw in a network service to subvert its operations. 


·      Remote login capability: A worm logs onto a remote system as a user and then uses commands to copy itself from one system to the other, where it then executes. 


The new copy of the worm program is then run on the remote system where, in addition to any functions that it performs at that system, it continues to spread in the same fashion. 
A network worm exhibits the same characteristics as a computer virus: a dormant phase, a propagation phase, a triggering phase, and an execution phase. The propagation phase generally performs the following functions:

1.     Search for other systems to infect by examining host tables or similar repositories of remote system addresses. 


2.     Establish a connection with a remote system. 


3.     Copy itself to the remote system and cause the copy to be run. 


Example: Internet Worm of 1988 targeted Berkeley, Sun UNIX systems entered the Internet; within hours, it had rendered several thousand computers unusable. It used virus-like attack to inject instructions into running program and run them. To recover from this the machines had to disconnect system from Internet and reboot. To prevent re-infection, several critical programs had to be patched, recompiled, and reinstalled. The only way to determine if the program had suffered other malicious side effects was to disassemble it. Fortunately, the only purpose of this virus turned out to be self-propagation.

Example: The Father Christmas worm was interesting because it was a form of macro worm. It was distributed in 1987 and was designed for IBM networks. It was an electronic letter instructing recipient to save it and run it as a program that drew Christmas tree, printed “Merry Christmas!” It also checked address book, list of previously received email and sent copies to each address. The worm quickly overwhelmed the IBM networks and forced the networks and systems to be shut down. This worm had the characteristics of a macro worm. It was written in a high-level job control language, which the IBM systems interpreted.

Worms with good intent

The Nachi family of worms, for example, tried to download and install patches from Microsoft's website to fix vulnerabilities in the host system — by exploiting those same vulnerabilities. In practice, although this may have made these systems more secure, it generated considerable network traffic, rebooted the machine in the course of patching it, and did its work without the consent of the computer's owner or user.

In 1982, at the Xerox Park research institute, a worm was created to find idle machines. It was used to distribute workloads and was not a malicious worm. So worms can be helpful.
 

CyberSecurity: Malware - Virus, Worms and Trojans

The two biggest threats to consumers online are malware and phishing.

Malware is the collective name for software that has been designed to disrupt or damage data, software or hardware. There are several types of malware, such as viruses, worms and Trojans.

However, as malware has evolved, from its beginnings as demonstrations of prowess by individual programmers to sophisticated technologies developed by organised crime, the boundaries between the different categories are beginning to blur. 

Viruses
The best-known type of malware is probably the virus, although many pieces of malware are called viruses they are nothing of the sort.

A virus is a piece of software that has been written to insert copies of itself into applications and data and onto crucial parts of a computer’s hard disk. Viruses are said to be self-replicating programs and date back as far as the early 1970s, but they only became well known with the advent of microcomputers and later, the internet.

Viruses attach themselves to specific applications on a computer and are activated when the program is first run. At that point, the virus may make a copy of itself on the hard disk and continue to run, or it may only run each time the application is used. Early viruses, relying on floppy disks for transmission, spread quickly as infected data disks were shared around an office, or pirated software was passed around a playground. Nowadays, viruses rely on devices such as flash memory cards or are transmitted through internet connections.

Although some viruses are not intended to cause harm, the majority of these programs are designed to harm users, by corrupting their data or attacking the operating system itself or providing an exploitable ‘backdoor’, giving attackers access to the computer. Even where no harm is intended, viruses consume memory, disk space and processing power.

Worms
Another type of self-replicating malware is the worm; like a virus it is designed to make copies of itself; but unlike a virus, a worm is a standalone application.

Worms spread through network connections, accessing uninfected machines and then hijacking their resources to transmit yet more copies across the network.

There are four stages in a worm attack:

The first stage is when the worm probes other machines looking for a vulnerability that can be exploited to copy itself to.
The next stage is to penetrate the vulnerable machine by performing the operations for exploiting the vulnerability. For example, the worm might detect an open network connection, through which it can get the remote machine to execute arbitrary instructions.
In the third stage, the worm will download itself to the remote machine, and store itself there. This is often called the ‘persist’ stage.
In the next stage, the worm will propagate itself by picking new machines to attempt to probe.
Worms were invented as a curiosity and have even been suggested as ways of testing networks or distributing software patches across a network; however their drawbacks far outweigh their benefits. Even the most ‘benign’ worm consumes resources and can affect the performance of a computer system.

Trojans
The final major type of malware is the Trojan (or Trojan horse); named after the wooden horse that supposedly smuggled Greek soldiers into the ancient city of Troy.
A Trojan disguises itself as an entirely legitimate program (such as a screensaver), but behind the scenes it is causing damage – perhaps allowing someone else to gain control of the computer, copying personal information, deleting information, monitoring keystrokes, or using email software to pass itself on to other computers. Unlike viruses and worms, Trojans are not self-replicating, they rely on their apparent usefulness to spread between computers.

Some Trojans work in isolation. Some, however, rely on networks, either to transmit stolen information – such as passwords, bank account details or credit card numbers – or to act as back doors to compromised computers. They allow attackers to bypass the operating system’s security features and gain access to data or even control the machine over a network.

For More:
https://www.futurelearn.com/courses/introduction-to-cyber-security/8/steps/83062