Worm

• scholarworks.sjsu.edu/cgi/viewcontent.cgi?article=1020&context=computer_eng_pub

A virus is a type of malware that attaches (not necesssarily) itself to legitimate programs or files and spreads from one system to another System.

• typically causing harm by:
  • corrupting data
  • stealing sensitive information
  • disrupting normal operations
• It is a variant of “virus”
  • It infects systems
  • It replicates
  • It spreads to other systems or programs

Computer worms are a major category of malware attacks and are specifically categorized as standalone malicious programs. They are also listed as an example of information warfare weapons.

Definition and Characteristics

Worms are defined by their ability to replicate, execute, and spread across network connections independently without human intervention.

Key characteristics include:

• Self-Replication: Unlike a virus, a worm is a standalone program that does not require a host file or application to attach itself to in order to replicate. It copies itself to identified vulnerable devices to continue the infection cycle.
• Propagation Method: Worms often use a computer network to spread themselves, relying on security failures or exploiting vulnerabilities in server software or the underlying operating system to access and infect a machine. They spread through the infected network.
• System Impact: Worms typically consume network bandwidth, system memory, and other resources, leading to excessively overloaded servers and degradation of system performance. Although viruses almost always corrupt or modify files, worms generally do not modify or corrupt stored programs or files, but they almost always cause harm by consuming bandwidth.
• Vulnerability Exploitation: Worms exploit system vulnerabilities to cause unanticipated behavior in legitimate software or hardware.
• Speed: A worm can spread more rapidly than a virus.
• Payload: Worms often carry a payload designed to damage the host system.

Usage and Propagation

Worms are crucial to system hacking and frequently serve as the initial infection vector:

1. Botnet Creation: Attackers use worms to install backdoors (payloads) in infected computers, effectively turning them into zombies that create a botnet. These compromised systems are then used to launch further cyber-attacks, such as distributed denial-of-service (DDoS) attacks.
2. Network Spreading: Once installed, worms spread the infection to other systems in the network. They can use mechanisms like IRC, Outlook, or other applicable mailing programs to spread themselves after installation.
3. Hiding: Layer 4 tar pits, which slow down the spreading of worms and backdoors, can be identified by analyzing the TCP window size.

Worm Infection Process (Cyber Kill Chain Adaptation)

The typical steps for infecting a system using a worm are:

1. Creation: An attacker creates the worm using tools such as Internet Worm Maker Thing or Batch Worm Generator.
2. Delivery: The worm is deployed via phishing emails, malicious websites, network shares, or infected USB drives. An attacker may include a worm in a phishing email, which, when downloaded, installs a backdoor.
3. Infection/Execution: When the user clicks on a malicious link or downloads content, the worm infects the system by executing its payload.
4. Scanning and Propagation: The infected system uses the worm to scan for other vulnerable devices in the network. The worm then copies itself to these identified systems, propagating the infection.
5. Post-Infection: The worm installs backdoors or alters system settings to remain active, continuously stealing and exfiltrating data from the infected devices.

Tools and Examples

Worm-Related Tools

• WormGPT: This is an AI-powered tool designed to assist cybersecurity professionals in automating the generation of worm-like scripts and payloads. It is an AI-based chatbot capable of generating personalized and convincing fake emails, often trained on Business Email Compromise (BFC) vectors, for launching spear phishing attacks.
• Internet Worm Maker Thing / Batch Worm Generator: Tools used to create and customize computer worms.

Examples of Computer Worms

Specific examples of modern computer worms mentioned in the sources include:

• SSH-Snake
• Raspberry Robin
• P2PInfect