Computer Worms: Traditional Malware

 

A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It will use this machine as a host scan and infect other computers.

 

  How do computer worms work?

Worms are major security threats to the internet. Worms refers to a kind of computer viruses which are actively and widely spread on the internet to infect the computers. Worms spread in a very short span of time and does not give time for any human countermeasures to happen.

After a computer worm loads and begins running on a newly infected system, it will typically follow its prime directive to remain active on an infected system for as long as possible and to spread to as many vulnerable systems as possible.  Once active on the newly infected computer, it initiates a network search for new potential victims. The woem then continues to propogare within a network through these clients. 

 

          How is a worm different from a virus?

The primary difference between a virus and a worm is that viruses must be triggered by the activation of their host; whereas worms are stand-alone malicious programs that can self-replicate and propagate independently as soon as they have breached the system. 

Real-time worm attacks:

In the year 2001, three major worm outbreaks occurred are Code Red I, Code Red II, Nimda. 

• Code Red 1 occurred on June 13th, 2001, and it was the first "modern" worm. It attacked Microsoft's IIS web server. It scanned random IP addresses and spread from 1st to 20th of each month which compromised over 99 vulnerable hosts. However, in version two of this worm bug of random scanning was fixed and it was able to infect over 350k hosts in a matter of 14 hours. The IP address of The White House was one of them. The worm spread was using vulnerability known as "buffer overflow" because of which one of the infected victims was able to discover how to block that worm. 
• Code Red 2 was released two weeks after Code Red on August 4th, 2001. Even after having the same behavior as the original, it was a new worm and not a variant of Code Red.  Unlike the first worm, this was designed to exploit a security hole in the indexing software including as part of Microsoft's IIS web server. While the original worm tried to affect the computers at random, Code Red II tries to affect machines on the same subnet as the infected machine. It only spread on Windows 2000 and crashed on Windows NT. The payload for this attack was the IIS backdoor. The worm was completely dead by Oct. 1st, 2001. 
• Nimda was released on Sept. 18th, 2001. It spread using multiple propagation vectors which were via E-mails, browsing compromised websites, exploitation of various IIS directories, and back doors left by Code Red II. It affected both windows 2000 and NT. It spread quickly due to the economic damage caused by previous outbreaks of Code Red.  The worm's name comes from the reverse spelling of the word "admin". F-Secure found text in Nimda code suggesting the country of origin to be China. However, infected E-mails were found to be released from a computer in Canada. Hi-Tech firms including Microsoft, Dell, NTL were among victims of Nimda

How to prevent computer worm infections:

• Install updates on the operating system on regular basis.
• Use firewalls to reduce access to systems by malicious software.
• Use antivirus software.
• Never click on attachments or links in messages that are suspicious. 
• Make use of encryption to protect sensitive data stored on computers, mobiles, and servers.

Even though some worms are just made to propagate through the new victim systems but most worms are attached with viruses, rootkits, and other malware which can cause further damage. 

Some more big-time malware attacks of all time: