This is the final week of Something Awesome, but I thought I’ll post the Bandit level update as my last blog. So this week, I have done a bit of research about computer worms and that is what this post is going to be about.
Computer worms are a type of malware that can replicate itself without attaching itself to a program (unlike viruses). It can enter the system through any of its existing vulnerabilities. Or by using some kind of social engineering to trick users into executing them like links sent through spam or instant messaging which when clicked can automatically download the worm and then infect the machine. The traditional worms were actually harmless, they could replicate quickly but that was it. They could not affect a system’s functionality. But in 2004, a new type of worm called Witty came into the scene which carried a payload, that is a piece of code which could do some real damage. So now, worms can execute a piece of destructive code and replicate themselves.
Earlier, worms could hide in the main text of emails. But now, it spreads through attachments (could be photos, could be a word doc) sent through the emails. It could replicate itself by replying to all the mails in your inbox or by emailing itself through all of its contacts.
A worm called Waledac spreads through email attachments. The email always contains an attachment called ecard.exe and comes with a subject line about a Christmas card from a friend. These are all examples of its subject lines :D
Merry Christmas To You! Merry Christmas To You!
Merry Christmas card for you! Merry Christmas card for you!
A Christmas card from a friend
Once installed, it will start searching for email addresses on your system and can forward password information to a remote server. Later they even started targeting people by sending out Valentine’s day e-cards. Looks like they don’t quite spare any kind of holiday.
Operating System Vulnerabilities
Computer worms can be designed to exploit the vulnerabilities of the OS. A worm called Confickr targeted the vulnerabilities that existed in various verision of Windows including Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 Beta and Windows 7 Beta! One of Window’s network services had a flaw that allowed for remote execution of arbitrary code and it spread through computers that lacked updates, computers with File Sharing enabled, computers with weak passwords and removable flash drives. In case the system had file sharing disabled and was fully updated, then it carried out a dictionary attack in order to bypass the computer’s password protection! Once installed, it could disable Windows’ auto updater, firewall and antivirus! It then proceeds to download arbitrary files from a pre-defined set of websites - basically filling your system with trash and rendering it useless. And the best part of it all was, if the users started to notice something suspicious and try going online to download an antivirus, they simply couldn’t. Because Confickr had the ability to block web searches related to the term antivirus! Quite impressive.
In the past it was Yahoo IM, MSN and so on. Now it is the Facebook messenger. Just as how worms can be sent through attachments in emails, they can be sent as links in messaging softwares and can eventually give backdoor access and control if downloaded. It can also delete or rewrite files, steal passwords and can block access to security sites.
Smartphones today support HTML5-based mobile apps. The key flaw of HTML5 is that malicious code can easily be inserted into it, meaning when a user launches an app they could also be executing a damaging program.