Defense and Detection Strategies

319 Pages·2004·2.89 MB·English

by  Nazario, Jose.

Defense and Detection Strategies
against Internet Worms
For quite a long time, computer security was a rather narrow field of
study that was populated mainly by theoretical computer scientists, electri-
cal engineers, and applied mathematicians. With the proliferation of open
systemsingeneral,andoftheInternetandtheWorldWideWeb(WWW)in
particular, this situation has changed fundamentally. Today, computer and
networkpractitionersareequallyinterestedincomputersecurity,sincethey
require technologies and solutions that can be used to secure applications
related to electronic commerce. Against this background, the field of com-
puter security has become very broad and includes many topics of interest.
The aim of this series is to publish state-of-the-art, high standard technical
booksontopicsrelatedtocomputersecurity.Furtherinformationaboutthe
series can be found on the WWW at the following URL:
http://www.esecurity.ch/serieseditor.html
Also,ifyou’dliketocontributetotheseriesbywritingabookaboutatopic
related to computer security, feel free to contact either the Commissioning
Editor or the Series Editor at Artech House.
ForalistingofrecenttitlesintheArtechHouse
ComputerSecuritySeries,turntothebackofthisbook.
Defense and Detection Strategies
against Internet Worms
Jose Nazario
Artech House
Boston (cid:127) London
www.artechhouse.com
LibraryofCongressCataloging-in-PublicationData
AcatalogrecordofthisbookisavailablefromtheU.S.LibraryofCongress.
BritishLibraryCataloguinginPublicationData
Nazario,Jose
DefenseanddetectionstrategiesagainstInternetworms.—
(ArtechHousecomputersecuritylibrary)
1.Computerviruses 2.Computernetworks—Securitymeasures 3.Internet—Securitymeasures
I.Title
005.8’4
ISBN 1-58053-537-2
CoverdesignbyYekaterinaRatner
©2004ARTECHHOUSE,INC.
685CantonStreet
Norwood,MA02062
Allrightsreserved.PrintedandboundintheUnitedStatesofAmerica.Nopartofthisbookmaybereproduced
orutilizedinanyformorbyanymeans,electronicormechanical,includingphotocopying,recording,orbyany
informationstorageandretrievalsystem,withoutpermissioninwritingfromthepublisher.
Alltermsmentionedinthisbookthatareknowntobetrademarksorservicemarkshavebeenappropriately
capitalized.ArtechHousecannotattesttotheaccuracyofthisinformation.Useofaterminthisbookshouldnot
beregardedasaffectingthevalidityofanytrademarkorservicemark.
InternationalStandardBookNumber:1-58053-357-2
ALibraryofCongressCatalogCardNumberisavailablefromtheLibraryofCongress.
10987654321
ToBeth,Maus,andMiso
.
Contents
Foreword . . . . . . . . . . . . . xvii
Preface . . . . . . . . . . . . . . xxi
Acknowledgments . . . . . . . . . . xxvii
1 Introduction . . . . . . . . . . . . . 1
1.1 Whyworm-basedintrusions? 2
1.2 Thenewthreatmodel 3
1.3 Anewkindofanalysisrequirement 4
1.4 Thepersistentcostsofworms 5
1.5 Intentionsofwormcreators 6
1.6 Cyclesofwormreleases 7
1.6 References 8
Part I Background and Taxonomy . . . . . . 9
2 Worms Defined . . . . . . . . . . . . 11
2.1 Aformaldefinition 12
2.2 Thefivecomponentsofaworm 12
2.3 Findingnewvictims:reconnaissance 14
2.4 Takingcontrol:attack 15
2.5 Passingmessages:communication 15
2.6 Takingorders:commandinterface 16
vii
viii Contents
2.7 Knowingthenetwork:intelligence 17
2.8 Assemblyofthepieces 18
2.9 Ramenwormanalysis 19
2.10 Conclusions 21
2.10 References 21
3 Worm Traffic Patterns . . . . . . . . . . 23
3.1 Predictedtrafficpatterns 23
3.1.1 Growthpatterns 23
3.1.2 Trafficscanandattackpatterns 25
3.2 DisruptioninInternetbackboneactivities 26
3.2.1 Routingdata 26
3.2.2 Multicastbackbone 27
3.2.3 Infrastructureservers 28
3.3 Observedtrafficpatterns 28
3.3.1 Fromalargenetwork 28
3.3.2 Fromablackholemonitor 30
3.3.3 Fromanindividualhost 31
3.4 Conclusions 34
3.4 References 34
4 Worm History and Taxonomy. . . . . . . . 37
4.1 Thebeginning 38
4.1.1 Morrisworm,1988 39
4.1.2 HI.COMVMSworm,1988 41
4.1.3 DECNetWANKworm,1989 42
4.1.4 Hackingkits 43
4.2 UNIXtargets 44
4.2.1 ADMw0rm-v1,1998 44
4.2.2 ADMMillenniumworm,1999 45
4.2.3 Ramen,2000 46
4.2.4 1i0nworm,2001 47
4.2.5 Cheeseworm,2001 48
4.2.6 sadmind/IISworm,2001 48
4.2.7 X.c:Telnetdworm,2001 49
4.2.8 Adore,2001 49
Contents ix
4.2.9 Apacheworms,2002 50
4.2.10 VariationsonApacheworms 51
4.3 MicrosoftWindowsandIIStargets 53
4.3.1 mIRCScript.iniworm,1997 53
4.3.2 Melissa,1999 54
4.3.3 LoveLetterworm,2001 54
4.3.4 911worm,2001 55
4.3.5 Leavesworm,2001 56
4.3.6 CodeRed,2001 56
4.3.7 CodeRedII,2001 58
4.3.8 Nimda,2001 59
4.3.9 Additionale-mailworms 60
4.3.10 MSNMessengerworm,2002 60
4.3.11 SQLSnake,2002 61
4.3.12 Deloder,2002–2003 62
4.3.13 Sapphire,2003 62
4.4 Relatedresearch 63
4.4.1 Agentsystems 64
4.4.2 Webspiders 64
4.5 Conclusions 65
4.5 References 65
5 Construction of a Worm . . . . . . . . . 69
5.1 Targetselection 69
5.1.1 Targetplatform 70
5.1.2 Vulnerabilityselection 71
5.2 Choiceoflanguages 72
5.2.1 Interpretedversuscompiledlanguages 72
5.3 Scanningtechniques 74
5.4 Payloaddeliverymechanism 75
5.5 Installationonthetargethost 76
5.6 Establishingthewormnetwork 77
5.7 Additionalconsiderations 78
5.8 Alternativedesigns 78
5.9 Conclusions 80
5.9 References 80