Upload
myrtle-eaton
View
216
Download
2
Embed Size (px)
Citation preview
COMP 2903A28 – The Virus Underground
Danny SilverJSOCS, Acadia University
Clive ThompsonThe New York Times Magazine, Feb 8, 2004
• Clive Thompson started his blog, Collision Detection, in September 2002
• Collision Detection has become one of the most well-regarded blogs on technology and culture.
Viruses: An Example
• Courtesy of Mario, 16 year old in Austria, online name “Second Part of Hell”, has written 150+ viruses / malware systems
• Has created a tool to autogenerate viruses• Create a trojan horse *.mpeg in 1 minute– Format the computers harddrive– Overwrite every file– Execute on next system startup
2003 - Year of the Worm
• For 12 months digital infections swarmed across the internet– Slammer – 75,000 servers in 10 minutes (ATMs, Flight delays)– Blaster – flaw in Windows, used as a DDoS against MS, message to Bill
Gates– Sobig.F – automatically spread via email, 1 / 17 email messages on
internet– Mydoom.A – spread by email, payload attacked website of SCO (Unix
provider)
• Estimated costs - as much as $82B
Wash your Computer’s Hands Frequently
• Now adays virus authors often do not distribute their code
• They leave it along with operating details on various malware web sites
• Their release is often by anonymous mischief makers who are would-be Ace hackers – Script Kiddies
• “The modern virus epedemic is born of a symbiotic relationship between the people smart enough to write a virus and those dumb enough , or malicious enough, to spread it.”
Script Kiddies
• A second version of Blaster was release three days after the first - 48,000 computers, $1M in damages
• Jeff Parsons arrested by the FBI, 18 years old, Minnesota
• Parsons was a Script Kiddie – had found, slightly altered (including a ref to his person web page) and re-released the Blaster code
• Sentenced to 18 months in jail (could have been 10 years)
Virus -vs- Worm
• Virus:– Will arrive via email, often a payload of a worm– Deposits itself on a computer looking like a safe
file: “hay-ya.mp3”, but actually “hay-ya.mp3.exe”– Require human intervention to excute– Often they do silly things like display a message
• Worm:– Requires no human intervention (eg. Slammer)– Drops a payload, multiplies, mails itself onward
Does Malware Exploit Flaws or Popularity of Operating Systems?• MS most often blamed for poorly constructed OS
code that allows malware to exist• However, many feel this is a function of popularity of
use; that Mac OS and Linux would receive equal attention if businesses used them more
• MS has $5M fund for rewarding informants and have annouced $250,000 bounties for the creators of Blaster, Sobig.F and Mydoom.B
Virus Writers are Nice Guys ??
• They like to dream up virus and implement them, but not release them
• Philet0ast3r is proud of a keylogger virus, but will not release it himself because he ethically does not believe in damaging others property
• The art of virus creation is a drug. Best virus designs generates fame and “street cred”
• The ultimate is to make an anti-virus alert and impress the anti-virus experts
• Intellectually stimulating, socially exciting- online or in person• Attracts smart but alienated young man
So why not round them up?
• Well .. In most countries it is not illegal to write a virus – freedom of speech
• Illegal only when activated• Virus writers will place disclaimers on
websites indicating their work is purely for educational purposes
• Virus code is both a description of a crime (not illegal) and the crime (illegal when activated)
Malware and Organized Crime
• This is what keeps anti-virus people awake at nights
• Money is being invested in an ordered manner to create more insidious malware
• Stealth worms and Netbots are now being used to steal passwords, money (PayPal), facilitate blackmail, deny service
Malware and Organized Crime
• Academics predict malware that will encrypt data on computers (cryptoviruses) and hold companies to pay ransom
• Netbots that could survive reinstallation of an OS have been proposed
• Now a national security issue• This has increased the level of legal pressure
on traditional hackers