How do worms work? Vivek Ramachandran Nagraj – An Indian comic book hero, who commands all the...
-
Upload
mildred-booth -
Category
Documents
-
view
217 -
download
1
Transcript of How do worms work? Vivek Ramachandran Nagraj – An Indian comic book hero, who commands all the...
How do worms work?
Vivek Ramachandran
Nagraj – An Indian comic book hero, who commands all the snakes of the world.
Disclaimer
• This tutorial is to understand how worms work! I wrote my own “nice worm” at IIT Guwahati to understand more about worms and their spreading pattern and behavior
• If you use this knowledge to do unethical stuff like releasing a worm – the liability is yours!
• Stop watching this video NOW ! if you have any malicious intent in mind
Talk Outline
• What are worms?
• The life cycle of a simple worm:
• scanning for a victim• exploiting the victim• cloning itself onto the victim• running the clone to further spread infection• stealth techniques used to hide itself
• What will we code in this section?
What are worms?
• A worm is a self replicating program • Self-replicating => it makes copies of itself and
sends them over to hosts across a network• All copies have the same functionality and
generally lack any sort of synchronization among themselves
• Worms are hated because:• Bandwidth consumption• Might crash computers they infect• Infected computers may be used for other attacks such as
DDoS, Phishing attacks etc
Types of worms
• Network worms – generally exploits a service such as RPC and spreads
• Email worms – use mass emails to spread and either target the email client (Outlook) or rely on user intervention (a click) to spread
• IRC worms …• IM worms …• File sharing worms …• XSS worms – MySpace ?? …
The life cycle of a simple worm
• Scanning for a victim
• Exploiting the victim
• Cloning itself onto the victim
• Running the clone to further spread infection
• Stealth techniques used to hide itself
The life of a worm …
(1)
(2)
(2)
(2)
Victim
Victim
Victim
Victim
The life of a worm
Worm createdVictim found
Scans for Victim
Send Exploit
Get a copy
Scan
Rooted !!
Scanning for a victim
• Random scan – random IP• Selective random scan – IP from global
and local routing addresses• Full scan – scan all IP addresses• Divide and conquer scan – divide IP
addresses among child worms• Subnet scan – detect and scan local
subnet• Etc etc
Exploiting the victim• What is an exploit? – simply put: a piece of code which
provides “access” to a victim computer by utilizing some flaw in the logic of a program running on the victim computer
• By “access” I mean the ability to run commands/programs on the remote computer
• Network worms use what is called a “remote exploit” – an exploit which can be launched remotely and which gives some code running privileges on the victim
• Find a suitable exploit to use in the worm
• Understand the exploit• Black box approach (wrapper around the exploit)• White box approach (modifying the exploit)
Cloning itself onto the victim
• Once the victim has been exploited the worm needs to get a copy of itself on the victim
• Tftp?? Blaster worm• Http server ??• Ftp server ??• Compile source??• Include worm in the shellcode??• …
Running the clone to further spread infection
• Once the clone has been downloaded run it
• Make it a service??• Add a registry entry for startup??• …• Clone starts scanning again• Clone finds a victim• Cycle continues …
Stealth techniques used to hide itself
• Hide process
• Hide files
• Hide activity
• Delete logs
• …rootkit…??
The life of a worm
Worm createdVictim found
Scans for Victim
Send Exploit
Get a copy
Scan
Rooted !!
What will we code in this section?
• IP scanner code (random, sequential, subnet scans)
• Understanding an exploit enough so you can to use it
• Transporting a copy of the worm
• A simple framework for making worms whenever an exploit is released
Let the games begin!