Will a smart worm be made in the near future?

[Taeho Oh]

Will a smart worm be made in the near future?

Nowadays, many bugs are found in the software and many worms are made in a
short time. Foutunately, the worm usually doesn't destroy any data in the
PC until now. And it's very easy to know something is wrong in the PC or
network. Because the network speed slows down quickly when the PC are infected
by a worm. However, I think it will not be true in the future.

I just tried to think the smart worm scenario.
1) The worm doesn't cause network slow down.
Usually, the worm uses wide network bandwidth and causes a kind of denial of
service effect. It is because the worm tries to infect other PC very fast. But
I think if the worm uses P2P technique, exchange the infected PC list with
other worms, network load can be reduced significantly and network will work
ok. Surely, sanity check is needed to check if the infected PC list is not
spoofed. I think the worm which doesn't cause denial of service effect is more
dangerous than the worm which causes denial of service effect because usually
it's not detected easily.
2) The worm destroys the data severely.
If the worm destroys the critical data in the every PC at the same time. It may
be a disaster. What is the critical data? Someone may think that the windows
system dlls or some important boot configuration files. But I think the
important data is the recently modified files. The worm has a recently modified
file list and overwrite the files with garbage data at the same time. And how
do you feel if the worm deletes all ".c", ".cpp", ".h", ".doc", ".xls", ".txt",
mailbox, database files and doesn't touch any ".exe", ".ini", ".dll" in your
hard drive?
3) The worm destroys the hardware severely.
Many people will ask for this, "is it really possible?". The answer maybe yes
or no. As you know, many hardware vendors support the firmware upgrade. It
means that if the worm want to delete the firmware, it can do it. How do you
feel if the worm deletes the firmwares of m/b bios, video card, hard drive,
cd/dvd rom drive? You may not be able to use the hardwares unless you send them
to a/s.
4) The worm upgrades itself.
The worm programmer sends updated exploit code to the worm and upgrade itself
and distributes it to other worm by using P2P technique. Surely, sanity check
is needed.
5) The worm hides itself.
The worm can hides itself. For example, it is not seen by task manager and
explorer.

I think there are other many possible techniques to make the worm smart. I am
not sure everything I mentioned here is technically possible. But in my
opinion, it's possible. What can we do to protect our PC from those kinds of
smart worm?

--
Taeho Oh ( ohhara@postech.edu, ohhara@plus.or.kr ) http://ohhara.sarang.net
Postech ( Pohang University of Science and Technology ) http://www.postech.edu
PLUS ( Postech Laboratory for Unix Security ) http://www.plus.or.kr

[Jose Nazario]

your worst case scenario all depends on what your goal is.

widespread financial devastation can occur through many mechanisms.
hardware destruction is just one of them, but in the end what does that
get you? you would probably disrupt a national economy for a few months,
and probably cause a few business to go bankrupt.

causing this disruption can occur through many different means, however.
causing everyone's hardware to go belly up isn't even required. remember
the klez mail-based worm/virus? it would spew random documents from a
system to random recipients. various private documents from sensitive
sources wound up publicly viewable. think about the likely damage of
corporate secrets getting out, including private methods and techniques.

long term DDoS attacks can cripple enterprises. as long as you have an
army of hosts you gathered with a worm, why not do something useful with
it? flood an opponent with spam, flood 'em with packets, etc ...

besides, if you do flooding for pay (or spam for pay), you'll make a few
bucks. why not use a worm, a highly efficient mechanism to deliver a
payload far and wide, to do this.

the worm's spread as a DDoS is a double edged sword. in a matter of a few
hours widespread filtering was going on in the core for the SQLSlammer
worm. but for a few hours it fouled a lot of things up. this is because
the worm used a service that had no business going across the backbone.
now consider such a worm using a service that is critical to Internet
operations, is DNS on UDP. how soon would that get blindly filtered?
network saturation to the point that infections cannot occur any longer
occurs only after you've gone well beyond a critical mass and widespread
topological dispersion.

i cover a number of these proposed worst-case scenarios in my book
"Defense and Detection Strategies against Internet Worms" (2003, Artech
House). they include some zalewski has proposed, i have proposed (along
with anderson, wash and connolley), weaver has proposed, and staniford has
proposed.

more recently vogt investigated the effects of propagation methods on the
pace of a worm's progress:

http://www.securityfocus.com/data/library/WormPropagation.pdf

you should definitely have a look at this and consider what would happen
if the host were "killed" too soon after infection.

lastly, a very recent paper from weaver and paxson is worth reading:

http://www.dtc.umn.edu/weis2004/weaver.pdf

the looks at pretty much the scenario you schemed up with more detail. in
the end it's a lot of speculation, but if you're interested in potential
large-scale hardware damage have a look at that.

finally, ptacek and myself presented some work we're currently working on,
a theory of wormability, at cansecwest last month. in it we discuss
scenarios like "printer slammer" (a fast moving worm targetted at embedded
printers ... imagine every printer in major enterprises being shut down),
which we feel are very real threats (printer vulnerabilities which allow
for network code execution, slow remediation rates, costly downtime).

as to your points 4 and 5, upgradable and stealthy worms are already out
there and yep, they're sinister. we said back in 2000 and 2001 that you'd
be seeing them appear more significantly and yep, we are.

in short you're not the first person to scheme this up, you wont be the
last, and i encourage you to think about goals (ie widespread financial
devastation, in your case) and ways of doing it without ultimately
stopping the worm. remember, what you seek to destroy is also your home
(the network and host systems).

________
jose nazario, ph.d. jose@monkey.org
http://monkey.org/~jose/ http://infosecdaily.net/