1. Internet Worm propagation
Find new targets
IP random scanning
Compromise targets
Exploit vulnerability
Newly infected join infection army

2. Worm Infection Incidents
Code Red (Jul. 2001) : 360,000 infected in 14 hours
Slammer (Jan. 2003) : 75,000 infected in 10 minutes Congested parts of Internet (ATMs down…)
Blaster (Aug. 2003) : 150,000 ~ 8 million infected DDOS attack (shut down domain windowsupdate.com)
Witty (Mar. 2004) : 12,000 infected in half an hour Attack vulnerability in ISS security products
Sasser (May 2004) : 500,000 infected within two days
Infection faster than human response !

3. Email Virus and Attacks
Viruses:
Executable code in attachment
Social engineering trick to fool users to click attachment
Sender is your friend (faked header information)
appears to come from security, failed report, etc
Infection procedure:
Set up SMTP engine
Find all addresses to send to
Avoid some domains

4. Honeypot and HoneyNet
Honeypot: A honeypot is a fictitious vulnerable IT system used for the purpose of being attacked, probed, exploited and compromised
Attract attack
Analyze attacking code, attacking behavior
Find out how to defend
HoneyNet: a network (physical/virtual) of honeypots
Covering a large number of IP addresses
Monitor more attacking incidents

5. New Attack Trend --- Botnet
Botnet: a network of infected hosts controlled by an attacker
Each host is installed with “bot”
Hosts can be compromised by any mechansims
, worm scan, network share, malicious web…
Attacks: DDoS (extortion), spam, phishing, ads abuse, new attack
attacker
controller
controller
bot
bot
bot