Viruses Worms and Trojan Horses

There used to be a clear distinction between a virus, a worm, and a Trojan horse. A virus is generally thought to be a piece of malicious code that modifies another piece of software on a system. Generally, this requires some form of user intervention (opening an e-mail attachment, inserting an infected disk, or the like). The Melissa virus is a good example. With Melissa, an infected Microsoft Word document is sent to the victim as an e-mail attachment. The Word document contains malicious macro code that causes the virus to propagate out to the first 50 addresses in the victim's address book. For more information on Melissa, see the Computer Emergency Response Team (CERT) advisory at http://www.cert.org/advisories/CA-1999-04.html.

A worm is a standalone tool that infects vulnerable systems. These vulnerable systems, in turn, infect other systems. A worm generally infects in an automated manner, although an action such as clicking an e-mail attachment might be required to start it. Code Red is an excellent example of a worm. Code Red has been extensively analyzed by many in the security industry. The analysis from CERT (available at http://www.cert.org/advisories/CA-2001-19.html) is probably the best place to start. Code Red took advantage of a flaw in Microsoft's indexing server (a part of Internet Information Server [IIS]) and proceeded to infect hundreds of thousands of systems. Because of the automated propagation of this worm, there was an inadvertent DoS effect on some parts of the Internet.

NOTE

The Cooperative Association for Internet Data Analysis (CAIDA) published an animation showing Code Red's infection of more than 340,000 systems in 24 hours. It can be viewed at the following URL: http://www.caida.org/analysis/security/code-red/.

A Trojan horse is an application that appears to have one function to the user but in reality does something completely different. The NetBus/Whack-a-Mole tool is a suitable example. This attack tool, often distributed by e-mail, appears to the user as a Microsoft Windowsbased game (and a pretty fun one at that). Although the user is playing the game, the application is installing a remote listener on a high TCP port, allowing the attacker to connect to the system and do a variety of attacks such as resetting the system and changing local system properties (see the following section on remote control software for an idea).

Today's malicious code often crosses the line between what is traditionally termed a virus, worm, or Trojan horse. Nimda, for example, was released in 2001. It propagated itself by traditional worm methods (infecting vulnerable IIS servers, searching for open network shares) but also acted like a virus by infecting files with Nimda, which was then propagated to other users by traditional virus distribution means. More information about Nimda can be found in the CERT advisory at http://www.cert.org/advisories/CA-2001-26.html. Detection difficulty varies widely based on the age of the attack. So-called zero-day attacks are attacks that are encountered for the first time anywhere by a particular organization. As such, they are very difficult to detect. Viruses that have been around for much longer are not subject to the same difficulty in detection.

Continue reading here: Rootkit

Was this article helpful?