1. Computer Viruses and Worms* *Referred to slides by Dragan Lojpur, Zhu Fang at Florida State University

2. Definition of Virus A virus is a small piece of software that piggybacks on real programs in order to get executed A virus is a small piece of software that piggybacks on real programs in order to get executed Once it ’ s running, it spreads by inserting copies of itself into other executable code or documents Once it ’ s running, it spreads by inserting copies of itself into other executable code or documents

3. Typical things that some current Personal Computer (PC) viruses do Display a message Display a message

4. Typical things that some current Personal Computer (PC) viruses do Erase files Erase files Scramble data on a hard disk Scramble data on a hard disk Cause erratic screen behavior Cause erratic screen behavior Halt the PC Halt the PC Many viruses do nothing obvious at all except spread! Many viruses do nothing obvious at all except spread! Display a message Display a message

5. Executable Viruses Traditional Viruses Traditional Viruses pieces of code attached to a legitimate program pieces of code attached to a legitimate program run when the legitimate program gets executed run when the legitimate program gets executed loads itself into memory and looks around to see if it can find any other programs on the disk loads itself into memory and looks around to see if it can find any other programs on the disk

6. Boot Sector Viruses Traditional Virus Traditional Virus infect the boot sector on floppy disks and hard disks infect the boot sector on floppy disks and hard disks By putting its code in the boot sector, a virus can guarantee it gets executed By putting its code in the boot sector, a virus can guarantee it gets executed load itself into memory immediately, and it is able to run whenever the computer is on load itself into memory immediately, and it is able to run whenever the computer is on

7. E-mail Viruses Moves around in e-mail messages Moves around in e-mail messages Replicates itself by automatically mailing itself to dozens of people in the victim ’ s e- mail address book Replicates itself by automatically mailing itself to dozens of people in the victim ’ s e- mail address book Example: Melissa virus, ILOVEYOU virus Example: Melissa virus, ILOVEYOU virus

8. Melissa virus March 1999 March 1999 the Melissa virus was the fastest-spreading virus ever seen the Melissa virus was the fastest-spreading virus ever seen Someone created the virus as a Word document uploaded to an Internet newsgroup Someone created the virus as a Word document uploaded to an Internet newsgroupInternet newsgroupInternet newsgroup People who downloaded the document and opened it would trigger the virus People who downloaded the document and opened it would trigger the virus The virus would then send the document in an e- mail message to the first 50 people in the person's address book The virus would then send the document in an e- mail message to the first 50 people in the person's address book

9. Melissa virus Took advantage of the programming language built into Microsoft Word called VBA (Visual Basic for Applications) Took advantage of the programming language built into Microsoft Word called VBA (Visual Basic for Applications)

10. Prevention Updates Updates –Windows has a feature called Critical Updates –An entire branch of Microsoft dedicated to staying one step ahead of the hackers –When a possible security loophole is fixed, you need to download the patch right away Anti-Viruses Anti-Viruses More secure operating systems More secure operating systems e.g. UNIX

11. Worms Worm - is a self-replicating program, similar to a computer virus. A virus attaches itself to, and becomes part of, another executable program; however, a worm is self-contained and does not need to be part of another program to propagate itself. Worm - is a self-replicating program, similar to a computer virus. A virus attaches itself to, and becomes part of, another executable program; however, a worm is self-contained and does not need to be part of another program to propagate itself.

12. Morris Worm The first worm to attract wide attention, the Morris worm, was written by Robert Tappan Morris, who at the time was a graduate student at Cornell University. The first worm to attract wide attention, the Morris worm, was written by Robert Tappan Morris, who at the time was a graduate student at Cornell University.Robert Tappan MorrisRobert Tappan Morris It was released on November 2, 1988. The level of replication created system loads that not only brought it to the attention of system administrators, but also disrupted the target computers. It was guessed that the cost in "potential loss in productivity" caused by the worm and efforts to remove it ranged at each system from $200 to more than $53,000 It was released on November 2, 1988. The level of replication created system loads that not only brought it to the attention of system administrators, but also disrupted the target computers. It was guessed that the cost in "potential loss in productivity" caused by the worm and efforts to remove it ranged at each system from $200 to more than $53,000

13. Morris Worm Morris himself was convicted under the US Computer Crime and Abuse Act and received three years probation, community service and a fine in excess of $10,000. Morris himself was convicted under the US Computer Crime and Abuse Act and received three years probation, community service and a fine in excess of $10,000. Robert Tappan Morris is now a professor at MIT Robert Tappan Morris is now a professor at MIT Robert Tappan Morris Robert Tappan Morris

14. Worms… Worms – is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well. Worms – is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well. They are often designed to exploit the file transmission capabilities found on many computers. They are often designed to exploit the file transmission capabilities found on many computers.