1. A Taxonomy of Computer Worms Ashish Gupta Network Security April 2004

2. Overview What are worms ? The six factors on taxonomy Target Discovery Propagation Activation Payloads Attackers End

3. Worm vs a virus 1. Self propagates across the network 2. Exploits security or policy flaws in widely used services 3. Less mature defense today

5. + Attacker Target Discovery Carrier Activation Payload OVERVIEW

6. Target Discovery

7. Scanning sequential, random Target Lists pre-generated, external (game servers), internal Passive

8. Target Discovery Internal Target Lists –Discover the local communication topology –Similar to DV algorithm –Very fast ?? Function of shortest paths –Any example ? –Difficult to detect Suggests highly distributed sensors

9. Toolkit potential http://smf.chat.ru/e_dvl_news.htm http://viruszone.by.ru/create.html http://lcamtuf.coredump.cx/worm.txt  Worm tutorialhttp://lcamtuf.coredump.cx/worm.txt

10. Carrier

11. Self-Carried active transmission Second Channel e.g. RPC, TFTP ( blaster worm ) Embedded e.g. web requests

12. Activation

13. Human Activation Social Enginnering e.g. MyDoom  SCO Killer ! Human activity-based activation e.g. logging in, rebooting Scheduled process activation e.g. updates, backup etc. Self Activation e.g. Code Red

18. MyDoom : Fastest Ever http://www.cnn.com/2004/TECH/internet/01/28/mydoom.spreadwed/

19. Payload

20. Internet Remote Control Internet DOS : paper’s dream realized Data Damage: Chernobyl, Klez Physical World Damage Human control  Blackmail !

21. Attacker

22. Curiosity Pride and Power Commercial Advantage Extortion and criminal gain Terrorism  Example Cyber Warfare

23. Theodore Kaczynski Born in ChicagoChicago extremely gifted as a child American terrorist who attempted to fight against what he perceived as the evils of technological progressAmericanterrorist eighteen-year-long campaign of sending mail bombs to various people, killing three and wounding 29.mail bombs The first mail bomb was sent in late 1978 to Prof. Buckley Crist at Northwestern University1978Northwestern University

24. + Attacker Target Discovery Carrier Activation Payload CONCLUSION

25. ??? given the target discovery/propagation methods of worms, –how to detect it? –with only network traffic header data? –at ISP? at edge routers? at end hosts?