Network Worms

Introduction

Internet users are currently plagued by an assortment of malicious software (malware). The Internet provides not only connectivity for network services such as e-mail and Web browsing, but also an environment for the spread of malware between computers. Users can be affected even if their computers are not vulnerable to malware. For example, fast-spreading worms can cause widespread congestion that will bring down network services.

Worms and viruses are both common types of self-replicating malware but differ in their method of replication (Grimes, 2001; Harley, Slade, & Gattiker, 2001; Szor, 2005). A computer virus depends on hijacking control of another (host) program to attach a copy of its virus code to more files or programs. When the newly infected program is executed, the virus code is also executed. In contrast, a worm is a standalone program that does not depend on other programs (Nazario, 2004). It replicates by searching for vulnerable targets through the network, and attempts to transfer a copy of itself. Worms are dependent on the network environment to spread. Over the years, the Internet has become a fertile environment for worms to thrive.

The constant exposure of computer users to worm threats from the Internet is a major concern. Another concern is the possible rate of infection. Because worms are automated programs, they can spread without any human action. The fastest time needed to infect a majority of Internet users is a matter of speculation, but some worry that a new worm outbreak could spread through the Internet much faster than defenses could detect and block it. The most reliable defenses are based on attack signatures. If a new worm does not have an existing signature, it could have some time to spread unhindered and complete its damage before a signature can be devised for it.

Perhaps a greater concern about worms is their role as vehicles for delivery of other malware in their payload. Once a worm has compromised a host victim, it can execute any payload. Historical examples of worms have included:

• •

  Trojan horses: Software with a hidden malicious function, for example, to steal confidential data or open a backdoor;

• •

  Droppers: Designed to facilitate downloading of other malware;

• •

  Bots: Software to listen covertly for and execute remote commands, for example, to send spam or carry out a distributed denial of service (DDoS) attack.

These types of malware are not able to spread by themselves, and therefore take advantage of the self-replication characteristic of worms to spread.

This article presents a review of the historical development of worms, and an overview of worm anatomy from a functional perspective.

Background

The term “worm” was created by John Shoch and Jon Hupp at Xerox PARC in 1979, inspired by the network-based multisegmented “tapeworm” monster in John Brunner’s novel, The Shockwave Rider (Shoch & Hupp, 1982). They were aware of an earlier self-replicating program, Creeper, written by Bob Thomas at BBN, which propelled itself between nodes of the ARPANET. They invented a worm to traverse their internal Ethernet LAN seeking idle processors after normal working hours for the purpose of distributed computing. Because the worms were intended for beneficial uses among cooperative users, there was no attempt at stealth or malicious payload. Their worms were designed with limited lifetimes, and responsive to a special “kill” packet. Despite these safeguards, one of the worm programs believed to have been accidentally corrupted ran out of control and crashed several computers overnight.