Computer Worms: Past, Present, and Future

Craig Fosnock
CISSP, MCSE, CNE
East Carolina University

Abstract:

Internet computer worms have gone Computer Program:

from a hypothetical theorem to very real and Is an example of computer software that
very dangerous threat to computer networks. prescribes the actions ("computations") that
They are even capable of affecting the are to be carried out by a computer. Most
biggest network of our time, the Internet. programs consist of a loadable set of
Starting from humble and beneficial instructions which determines how the
beginnings computer worms are now the computer will react to user input when that
plague of the Internet and can cause billions program is running, i.e., when the
of dollars worth of damages in just a few instructions are 'loaded'. The term program
hours, if not minutes. In this paper I will or computer program is used
discuss the history of computer worms, their interchangeably with software and software
past, present, and their possible future, but application. ("Computer Program," 2005)
before we start this discussion about
computer worms lets first define some Computer Virus:
computer terminology. It is important that Is a self-replicating program that spreads by
we have these definitions up front not only inserting copies of itself into other
because we will need them to help explain executable code or documents. A computer
the rest of this paper, it is also important to virus behaves in a way similar to a
discuss this now because the term computer biological virus, which spreads by inserting
virus is often used interchangeably to refer itself into living cells. Extending the
to computer worms. This may cause analogy, the insertion of the virus into a
confusion with some readers as this paper is program is termed infection, and the
focusing on computer worms, not computer infected file (or executable code that is not
viruses. I have chosen not to address viruses part of a file) is called a host. ("Computer
because, although viruses take advantage of Virus," 2005)
network services such as the Internet to
spread, viruses are currently somewhat less Computer Worm:
common than worms, and viruses do not Is a self-replicating computer program,
seem to have emulated the scale of similar to a computer virus but unlike a
disruptive behavior, and monetary damage virus which attaches itself to, and becomes
that current computer worms are capable of part of, another executable program, a worm
inflecting on today’s computer networks. is self-contained and does not need to be
part of another program to propagate itself.
In other words a typical computer virus is
similar to a parasite and it requires a host. In
this case the host is another executable
program. A worm does not need a host, it
can spread on its own. ("Computer Worm,"
2005)
I. The Past and played on the Internet or on your local
computer. The "organisms" now called
A. Background “warriors”that are used in the Core Wars is
considered the forebear of the modern
The roots of the modern computer computer virus including computer worms.
virus go back to John Von Neumann. Von
Neumann’s name because of his publication B. The First worms
of the concept, was given to the von
Neumann architecture. This architecture is The first computer worm was
used in most non-parallel-processing created at the legendary Xerox PARC ( Palo
computers. Almost every commercially Alto Research Center). For those of you
available home computer, microcomputer who do not know this research center not
and supercomputer is a von Neumann only created the first computer worm it gave
machine. In 1949 von Neumann created the us the first personal computer, the first
field of cellular automata only using pencil graphical user interface and the first laser
and graph paper, when he presented a paper printer. The worm was created by John
on the "Theory and Organization of Shoch. Shoch was a PARC engineer
Complicated Automata." In this paper he working on his Stanford doctorate when he
postulated that a computer program could created the worm. The program took its
reproduce. The paper included a model of name from the "tapeworm," a program that
what is now known as a computer virus. appeared in a popular science-fiction novel
of the time by John Brunner called "The
In the 1950s Bell Labs employees Shockwave Rider." This science-fiction
gave life to von Neumann's theory in a game novel ironically helped to promote the
they called "Core Wars." This game was concept of a replicating program more than
created by H. Douglas McIlroy, Victor other more serious writings on the subject.
Vysottsky, and Robert Morris, Sr. The
object of the game was to unleash software Unlike the worm in the book
"organisms" they called "self-altering Shockwave Rider which was used to destroy
automata" that attacked, erased, and tried to a sinister computer network, the PARC
propagate in a computer generated world. worm's intended purpose was save Shoch
Each organism was a small program hours of tedious work. Shoch's doctoral
consisting of well-defined instructions with research was an analysis of the traffic
each of the instructions occupying a single patterns of PARC's Ethernet (another PARC
cell in a memory array. In modern times this first) that linked 200 of its "Altos," personal
computer-generated world is actually a computers. His idea was to arrange for
linear looping array of memory cells called about 100 of the machines to spew bits into
the "Core,” but in the 50's the word core the Ethernet simultaneously, then measure
referred to magnetic core memory. The the ensuing electronic gridlock. ("Benefits,"
game was started when two programs were n.d) Rather than loading the same program
loaded into random positions in the core. individually into every machine, he devised
After a certain number of cycles, if neither the worm to do the loading automatically by
program has quit executing, a tie was seeking out idle Altos computers and
declared. If one program terminated, the transmitting the test program by wire to
other was declared the winner. The primary those that signaled they were available. The
objective behind the game was to write an test proved successful and soon he turned
organism that could terminate all the his thoughts from communicating directly
opponent processes. Re-energized and with each machine to instructing them to
popularized by A.K. Dewdney through his talk among themselves. Shoch eventually
series of articles in Scientific American, was able to invest his worm with the ability
Core Wars and its variants can still be found to seek out idle Altos, boot up a host
machine through the network and replicate as we should all know by now that this ruse
by sending copies of itself from machine to is still an effective means of computer worm
machine, remaining in communication with distribution. When the user executing the
its dispersed offspring. script it would cause a Christmas tree to
appear on the terminal and then it mailed
One night, however, something itself to everyone on the user's NAMES file
unexpectedly went wrong. Shoch and two including any distribution lists. When it
colleagues had set a small worm loose in the finished sending itself to all addressees, it
PARC Ethernet to test a control function, erased itself from the original victim's
and went home. At some point the program computer. When new recipients received
became corrupted so badly it crashed its and activated their copies of Christma Exec,
host computer. Sensing it had lost a the scenario would repeat, flooding the
segment, the control worm sent out a tendril network with Christma Exec messages. The
to another idle Alto. That host crashed, and flood of traffic created left parts of the IBM
the next, and the next. For hours, the worm network unusable on December 10 and 11
spread through the building until scores of until it was finally brought under control.
machines were disabled. The next day the (Henry, 2003)
down machines did not cause any alarm as
Altos frequently crashed for no reason. Even with the introduction of two
Soon, however, it became obvious that this fully functional worms, most people still
was no random occurrence. Summoned to treated computer worms as an obscure
the lab Shoch and his colleagues could not theoretical problem. That perception of
stop the worm and eventually they had no worms took a dramatic turn in late-1988,
choice but to eradicate the worm with a when a college student, and son of the
failsafe software mechanism that Shoch had above mentioned and co-creator of the
pre loaded as insurance against some “Core Wars” Robert Morris, Sr. unleashed
unpredictable disaster. ("Benefits," n.d) the infamous "Internet Worm," otherwise
known as the Morris worm or the “Great
The next worm started out as a joke worm,” on the new and unsuspecting
or innocent prank, but is among the first and Internet.
most notable worms to qualify as a network
exploit. The worm was launched from The Morris worm was a “Multi
Germany on December 9, 1987. This date is Mode” worm that attacked DEC VAX
well before the Internet was officially born. servers running Sun and BSD operating
The worm originated on the German EARN systems. It exploited weak passwords along
network, propagated through connected with known vulnerabilities in the send mail
Bitnet sites and eventually worked its way application and Unix utilities fingerd and
through Bitnet connections to wreak havoc rsh/rexec. Although not, written to cause
on the IBM Internal File Transfer Network damage a bug in Robert’s software allowed
(otherwise known as VNET) in the United the worm to reinfect individual servers
States. (Henry, 2003) The name given to multiple times. Hence, each additional
this worm was the Christma Exec, which instance of the worm on the server caused
happened to be the name of the script the additional CPU resources to be consumed,
user needed to execute to launch the worm. slowing the server and effectively causing
the world’s first Internet denial of service
As mentioned above Christma Exec (DoS) attack. (Henry, 2003) At the time of
required the user to execute an innocent the attack it was estimated that the Morris
looking script that was attached to an E-mail worm infected approximately 6,000 servers
message, which appeared to come from an or 10% of the servers on the Internet, and
E-mail address that the recipient knew and caused between $10 million and $100
trusted. This ruse sounds really familiar, and million in damages.
II. The Present it virtually impossible to recover original
files. It also marked all mp3 files as hidden,
The development of computer and downloaded a Trojan horse that would
worms seemed to die down until the steal user names and passwords and them to
development of the Melissa worm eleven the virus’s author.
(11) years later. Here is a time line and brief Estimated damage: $8.75 billion.
synopsis of modern computer worms. You
will notice that the time between virus Year 2001
outbreaks, and the estimated amount of Virus name”: Anna Kournikova Virus"
damages will be increasing. You will also worm
notice no entries for the year 2002. This is Description: First appearing in February
because Klez which dominated that year 2001 it was produced by a “scrip kiddie,”
was released in 2001, and none of the and is well known only for its social
worms created that year although engineering attachment that appeared to be a
destructive like the BugBear worm, did not graphic image of Russian tennis star Anna
provided any new computer worm Kournikova. However, when the file was
developments. opened, a clandestine code extension
enabled the worm to copy itself to the
Year 1999 Windows directory and then send the file as
an attachment to all addresses listed in your
Virus name: Melissa Microsoft Outlook e-mail address book.
Description: First found in March 26, 1999, The "Anna Kournikova Virus" worm
using holes in Microsoft Outlook, Melissa although famous was just a nuisance as it
shut down Internet mail systems that got did little to no damage
clogged with infected e-mails propagating Estimated damage: $166,827
from the worm. Once executed the original
version of Melissa used a macro virus to Virus name: Code Red
spread to the first 50 addresses in the user’s Description: First found on July 13, 2001
Outlook address book. However, if Internet this worm exploited a vulnerability in
access or Outlook were not available, it Microsoft's Internet Information Server (IIS)
would copy itself to other word documents web servers to deface the host’s website,
and attempt to E-mail those documents, and copy the command.com file and rename
revealing potentially confidential it root.exe in the Web server’s publically
information. Further, it would modify accessible scripts directory. This would
existing documents by inserting quotes from provide complete command line control to
the Simpson’s television show. (Henry, anyone who knew the Web server had been
2003) compromised. It also waited 20-27 days
Estimated damage: $1.1 billion. after it was installed to launch denial of
service attacks against the White House’s IP
Year 2000 address. Code Red spread at a speed that
overwhelmed network administrators as
Virus name: I LOVE YOU more than 359,000 servers became
Description: First found on May, 3, 2000 in compromised in just over 14 hours. At its
Asia it spread quickly across the globe. peak, more than 2,000 servers were being
Instead of sending a copy of the worm to the compromised every single minute.
first 50 or 100 addresses in the host’s Estimates are that Code Red compromised
Outlook address book like Melissa, I Love more than 750,000 servers. (Henry, 2003)
You used every single address in the host’s Estimated damage: $2.6 billion
address book. This worm also had a
malicious side to it, as the worm overwrote
important files with a copy of itself, making Virus name: Sircam
Description: First found on July 19, 2001 Year 2003.
this mass mailing E-mail worm not only
exploited Microsoft’s Outlook program it Virus name: SQL Slammer
had the ability of spreading through Description: Appearing January 25, 2003,
Windows Network shares. The worm had and taking advantage of two buffer overflow
two deadly payloads, but due to a program bugs in Microsoft's SQL Server database
error they did not work. product, it spread rapidly, with a doubling
Estimated damage: $1.03 billion time of 8.5 seconds in the early phases of
the attack allowing it to infecting most of
Virus name: NIMDA its victims within 10 minutes. SQL Slammer
Description: First appearing in September was the first example of a "Warhol worm."
2001, NIMDA, which is admin spelled A Warhol worm was first hypothesized in
backwards was not as malicious in nature as 2002 in a paper by Nicholas Weaver, and it
previous worms, but its advanced features is an extremely rapidly propagating
and its different means of propagation computer worm that spreads as fast as
which included from client to client via physically possible, infecting all vulnerable
email, from client to client via open network machines on the entire Internet in 15
shares, from web server to client via minutes or less. The term is based on Andy
browsing of compromised web sites, from Warhol's remark that "In the future,
client to web server via active scanning for everybody will have 15 minutes of fame.”
and exploitation of various Microsoft IIS (Computer Worm, 2005)
vulnerabilities, and from client to web Estimated damage: $1.2 billion.
server via scanning for the back doors left
behind by the "Code Red II" and Virus name: Sobig
"sadmind/IIS" worms, allowed it to spread Description: Originally put together in
faster than any preceding worm. NIMDA January 2003 to spread a proxy server
also the first worm that contained its own E- trojan, its variant Sobig.F set a record in
mail program so it did not depend on the sheer volume of e-mails. Sobig like Nimda
host’s E-mail program to propagate. used a built-in SMTP engine so it did not
Estimated damage:$645 million depend on the host’s E-mail program to
propagate. Then emulating Klez, it selected
Virus name: Klez one E-mail address from the host’s address
Description: First appearing in October 26, book to use as the “from” address, then
2001 Klez, and it variants were still sending the worm to all the other addresses.
considered a problem late in 2003, making It also attempted to create a copy of itself on
Klez one of the most persistent viruses ever. network shares, but failed due to bugs in the
Klez was a hybrid worm that took advantage code.
of a flaw in Outlook that allowed it to be Estimated damage: $36.1 billion
installed simply by viewing the E-mail in
the preview panel. As a hybrid threat it Virus name: Blaster
could behave like a virus, a worm and at Description: Appearing August 11, 2003
other times even like a Trojan horse. Klez Blaster exploited a Microsoft DCOM RPC
also incorporated a technique we saw in the vulnerability to infect systems running
Christma Exec worm as it selected one E- Windows 2000 and Windows XP, and cause
mail address from the host’s address book to instability on systems running Windows
use as the “from” address, then sending the NT, and Windows Server 2003. Filtering of
worm to all the other addresses. In this virus activity by Internet service providers
manner, the E-mail often appeared to have (ISPs) worldwide greatly reduced the spread
been sent from someone the addressee of Blaster.
actually knew. Estimated damage: $1.3 billion
Estimated damage: $18.9 billion
 Year 2004 code created in Pakistan which infected
boot sectors of disks so that their contents
Virus name: Mydoom could not be accessed. Brain was the first
Description: Appearing January 26, 2004 PC virus created and it infected MS-DOS.
and primarily transmitted via E-mail to Another more resent example of this
appear as a transmission error, Mydoom’s behavior is found in the Nachi family of
rapid spread becomes the fastest spreading worms, which terminated and deleted the
email worm ever. It slowed overall Internet Blaster worm, then tried to download and
performance by about 10%, and average install patches to fix the Microsoft DCOM
web page load times by about 50%. RPC vulnerability in the host system.
Estimated damage: $38.5 billion Although considered “beneficial” in nature
both of these worms cause problems. In the
Virus name: Witty case of Nachi it generated more network
Description: Appearing March 19, 2004, traffic than the Blaster worm it was
the Witty worm was the fastest developed protecting against. In the case of Den_Zuko
worm to date as there was only 36 hours boot virus37 it could not infect 1.2M or 3.5"
between the release of the advisory to the diskettes correctly, and because of this it
release of the virus. Witty infected the entire destroyed data on them. Most importantly
exposed population of twelve thousand both worms worked without the explicit
machines in 45 minutes, and it was the first consent of the computer's owner or user.
widespread worm that destroyed the hosts it Because of these problems no true
infected (by randomly erasing a section of “beneficial” worm has been created,
the hard drive) without significantly slowing whatever their payload.
the worm's expansion.
Estimated damage: $11 million II. The Future

Virus name: Sasser It is expected that in the future that

Description: Appearing on April 30, 2004 we will see ever more complex worms
and spreading by exploiting a buffer labeled “Super Worms.” These worms will
overflow in the component known as incorporating complex polymorphic, and
LSASS, (Local Security Authority metamorphic behavior routines that will
Subsystem Service) it hit the Internet a little make use of entry-point obscuration. The
more than two weeks after Microsoft current trends in traditional areas of worm
warned users of this flaw. Although it development do not seem to be leading us
caused infected Windows XP and Windows immediately in the direction of the “Super
2000 computers to repeatedly reboot, Sasser Worm,” but they are getting their slowly.
did little damage, as was merely designed to SpyBot.KEG is an example the new batch
spread and carried no payload. of worms attempting to use these behavior
Estimated damage: $14.8 billion methods. It is considered a sophisticated
vulnerability assessment worm, and it set
Although all the computer viruses new standards for all computer worms.
discussed above in the time line are SpyBot.KEG has managed to remain below
malicious in nature, not all computer worms most people’s radar as it causes no damage,
are meant to be bad. These viruses are often and only reports discovered vulnerabilities
called "beneficial viruses" or "antivirus" back to the author via IRC channels.
viruses because they attack other viruses Security experts have also seen the release
and disinfect them from the systems that of multiple variants per a single day of
they have compromised. An early example another sophisticated worm called Mytob.
of this is the Den_Zuko boot virus37, which This worm has recently included a phishing
was actually a worm that disinfected the trick in the form of a fake URL pointing to a
Brain virus. The Brain virus was a malicious Web site that hosts the worm’s code.
Another possible future threat that could propagation speed for worms is limited only
develop into the next “Super Worm” by their ability to find new hosts. In the case
outbreak is called YellowFever. of Code Red took about 14 hours to ping
YellowFever is an advanced i-worm with every IP address in the world looking for
some really interesting features, which vulnerable systems, and in Slammer’s case
shows that conceptual complexity of current it took only 20 minutes. A similar threat
i-worms in the wild is well far from what targeting IM, according to a Symantec
can be done. A Short virus description: the simulation could lead to half a million
worm installs itself as a system service. On systems being infected in only 30 seconds.
startup, it enumerates all running This is because the worm would already
applications looking for its target (Outlook). have a list of vulnerable machines located
The infection procedure is very interesting: on users’ “ buddy” lists. This any new worm
the virus has a small built-in debugger that using IM would not have to use time-
uses to attach to the host. Next, it consuming methods to locate vulnerable
impersonates the host and, using its own systems. Once inside a vulnerable company,
"SMTP" engine, E-mails itself. an IM worm would cause a lot of damage as
"YellowFever" is not polymorphic but it it would bypass all existing security
would be possible to add a poly-engine to it. defenses.
The virus can bypass many of the user level
firewalls, but it has not been coded for Could the next major worm
spreading. (Labir, 2005) Although complex outbreak not even involve computers? Will
these worms have failed to be modified to the outbreak be a new development in
the point where they can cause any major traditional propagation methods or will it
damage, but that could change at anytime. come from new areas such as IM?
Regardless history has shown us that no
Other new worm developments matter what method it will use to propagate,
include the Cabir worm. The Cabir worm is it is only a matter of time before we see the
the first worm that can infect mobile next major worm outbreak.
phones. Cabir appears to be a so-called
"proof of concept" worm and requires social References
engineering to reach its goal but once a
Benefits of the Computer Virus. (Unknown)
phone is infected, it will activate each time Owl Editing
the phone is started, scan to nearby Retrieved July 15, 2005, from
Bluetooth enabled phones, and transmit a http://www.owled.com/essays/virus.html
copy of itself to the any vulnerable phone it Blaster Worm. (2005).
reaches. Wikipedia, the free encyclopedia.
Retrieved July 15, 2005, from
http://en.wikipedia.org/wiki/Blaster_worm
The most prevalent and immediately
dangerous worms that seem to be Cabir. (2005).
Wikipedia, the free encyclopedia.
developing are those designed to propagate Retrieved July 15, 2005, from
via instant messaging (IM). Although older http://en.wikipedia.org/wiki/Cabir
but less well known worms like the Hello
Cathleen Moore (2005)
worm used Microsoft's MAN Messenger to Worms wiggle into IM. Computer
spread, the current batch of worms using IM WorldRetrieved July 15, 2005, from
seems to hold the most promise of being the http://www.computerworld.com /securitytopics/
security/virus/story/0,10801,101201,00.
next major outbreak. When we take a closer html?source=x10
look at this theat we can see that there are
Computer Worm. (2005).
about 60 published IM vulnerabilities, and Wikipedia, the free encyclopedia.
the types of IM threats are expanding to Retrieved July 15, 2005, from
include SPIM (spam over IM) and phishing http://en.wikipedia.org/wiki/Computer_worm
attacks. As we have already seen,
Computer program. (2005).
Wikipedia, the free encyclopedia. Melissa worm (2005).
Retrieved July 15, 2005, from Wikipedia, the free encyclopedia.
http://en.wikipedia.org/wiki/Computer_program Retrieved July 15, 2005, from
http://en.wikipedia.org/wiki/Melissa_worm

Computer virus . (2005). Morris worm (2005).

Wikipedia, the free encyclopedia. Wikipedia, the free encyclopedia.
Retrieved July 15, 2005, from Retrieved July 15, 2005, from
http://en.wikipedia.org/wiki/Computer_virus http://en.wikipedia.org/wiki/Morris_worm
Opic (2004) Introductory Primer To
Chen, T.M.. (2003). Trends in viruses and worms. Polymorphism. The CodeBreakers-Journal, Vol. 1, No. 2
The Internet Protocol Journal, Vol. 6, No. 3.
Paul Henry. (2003).
Daniel Tynan (2003) A Brief Look at the Evolution of Killer Worms.
Dawn of the Superworm. PC World. CyberGuard.
Retrieved July 15, 2005, from Retrieved July 15, 2005, from
http://www.pcworld.com/news/article / http://www.csoonline.com/whitepapers /
0,aid,110014,tfg,tfg,00.asp 050504_cyberguard
/EvolutionoftheKillerWorms.pdf
Edward Skoudis. (2002, July) Malware - The
Worm Turns. Information Security Magazine. Peter Szor. (2005)
Strategies of Computer Worms. The Informit Network
Eduardo Labir (2004) VX reversing II, Sasser B. Retrieved July 15, 2005, from
The CodeBreakers-Journal, Vol. 1, No. 1 http://www.informit.com/articles/article.asp?p=36689
1&seqNum=8&rl=1
George V. Hulme (2005)
First Worm For Mobile Phones Detected. Peter Westrin. (2001) Critical Information Infrastructure
Information Week . Protection (CIIP). Information & Security: An
Retrieved July 15, 2005, from International Journal. Volume 7, 67-79
http://www.informationweek.com/story/showArti
cle.jhtml?articleID=21800340 Rinku Dewr (2003)
Artificial Life: A Programmer's Perspective.
Gregg Keizer (2005) Retrieved July 15, 2005, from
IM Worms Could Spread In Seconds. Security http://ai-depot.com/ArtificialLife/
Pipeline Programmer-Perspective.html
Retrieved July 15, 2005, from
http://www.securitypipeline.com/news/22100839 Scarlet Pruitt (2005)
Are Virus Writers Creating a Super Worm?. PC
Ingrid Marson. (2005) World
Mytob worm picks up phishing trick. News . Retrieved July 15, 2005, from
Retrieved July 15, 2005, from
http://news.com.com/Mytob+worm+picks+up+phishi Sasser worm.(2005).
ng+trick/2100-7349_3- Wikipedia, the free encyclopedia.
5739271.html?part=rss&tag=5739271&subj=news Retrieved July 15, 2005, from
http://en.wikipedia.org/wiki/Sasser worm
ILOVEYOU. (2005).
Wikipedia, the free encyclopedia. Symantec, Symantec Antivirus Software and Information.
Retrieved July 15, 2005, from 2005.
http://en.wikipedia.org/wiki/VBS/Loveletter

Jack M. Germain (2004)

Is the Superworm a Mere Myth?.
Tech News World.
Retrieved July 15, 2005, from
http://www.technewsworld.com/story/32721.html

Julia Allen. (2002) System and Network Security

Practices. Journal of Information Security, Vol1, No 2

Klez. (2005).
Wikipedia, the free encyclopedia.
Retrieved July 15, 2005, from
http://en.wikipedia.org/wiki/Klez

Mary Landesman. (2005)

Mytob prevention. About.
Retrieved July 15, 2005, from
http://antivirus.about.com/od/
virusdescriptions/a/mytob.htm