Worms: propagation phases, scanning strategies, and the outbreaks

What makes a worm a worm

A worm is a program that runs independently and propagates a complete, working version of itself to other machines. Both halves of that sentence do work. Independently separates it from a virus, which is parasitic on a host program and only runs when the host runs — a worm needs nothing launched by the user. A complete working version separates it from a virus fragment: every infected machine becomes a fully equipped launching pad in its own right.

That single property is why the Assignment 1 symptom — heavy network traffic while every application the user could have started is closed — points at a worm or a bot rather than at anything parasitic. The traffic is generated by a program the operating system is running on its own account.

Worms reach remote systems by five means: electronic mail or instant messaging, file sharing (via autorun, a vulnerability, or the user opening it), a remote execution capability, remote file access or transfer, and remote login.

Four phases

A worm runs the same four phases as a virus — dormant, propagation, triggering, execution. When a question asks how many phases worm propagation proceeds through, the answer is four, and it stays four under the finer-grained reading as well, because the propagation phase itself decomposes into four steps:

1. Search — find other systems to infect, by examining host tables, address books, buddy lists and lists of trusted peers, or by scanning ranges of network addresses.
2. Connect — establish a connection with a target, through one of the five access means above.
3. Copy — transfer a complete copy of itself to the target, often after checking whether the target is already infected.
4. Execute — run the copy on the target, sometimes disguising it by naming it after a system process, or by injecting its code into an existing process as an additional thread.

Be careful here, because this is exactly where the paper sets its trap: the epidemic model in the same section has three phases. Four phases of propagation; three phases of the epidemic curve. Two different numbers, one chapter.

Four scanning strategies

How does the search step choose targets?

• Random — each compromised host probes random addresses with a different seed. Simple and effective, but the traffic volume alone can cause disruption before the real attack starts, which also makes it loud and detectable.
• Hit-list — the attacker compiles a long list of vulnerable machines slowly and quietly in advance, then hands each newly infected machine a slice of the list. The scanning period is very short and hard to detect.
• Topological — uses information found on the victim machine itself to find the next targets.
• Local subnet — a machine infected behind a firewall scans its own subnet. This is the one that matters most for perimeter defence: a firewall that would have blocked the worm at the border is worthless once the worm is inside it.

The epidemic model

The classic model is a single differential equation. With I infected hosts out of a population of N susceptible machines and an infection rate $\beta$:

$$\frac{dI}{dt}=\beta \cdot I\cdot (N-I)$$

The product is the whole story. Growth is proportional to how many machines are already spreading (I) and to how many are left to find (N - I). Early on, N - I is nearly N and the second factor is effectively constant, so growth is exponential. Late on, I is large but N - I is nearly zero, so growth stalls. In between, both factors are substantial and the curve is at its steepest — this is the middle phase, approximately linear but rapid, and its flattening has a purely mechanical cause: infecting hosts increasingly waste their probes on machines that are already infected. Defenders sometimes take credit for that bend. They should not.

Three phases, then: exponential start, rapid near-linear middle, slow finish. And the strategic conclusion the model exists to justify: you must catch a worm in the slow start phase, while few hosts are infected — because by the time the curve is visibly steep, the response window has already closed. The exercise below integrates the equation so you can watch that window shut.

The named outbreaks

Each of these is examinable on one distinguishing fact. Learn them as a discrimination, not as a chronology.

• Morris (1988) — UNIX; three access methods: cracking the local password file (each user’s account name and simple permutations, then a built-in list of 432 candidate passwords, then the system dictionary), a bug in the finger protocol, and a trapdoor in sendmail’s debug option.
• Melissa (1999) — the first to combine virus, worm and Trojan aspects; a Word macro in an attachment; over 100,000 machines in three days. Note the date: the set text prints 1998, but Melissa was released on 26 March 1999, and 1999 is the year to give.
• Code Red (July 2001) — exploits Microsoft IIS, probes random IP addresses, then launches a denial-of-service flood against a government website. Second wave: ~360,000 servers in 14 hours.
• Code Red II (2001) — same IIS hole, but scans the local subnet and installs a backdoor.
• Nimda (2001) — five distribution methods, including reusing the backdoors Code Red II had left behind.
• SQL Slammer (2003) — a buffer overflow in Microsoft SQL Server; extremely compact; 90% of vulnerable hosts in 10 minutes. No e-mail involved at all.
• Sobig.F (2003) — exploited open proxy servers to turn machines into spam engines; at peak one message in 17.
• Mydoom (2004) — a mass-mailing worm that installs a backdoor, giving remote access to what is on the machine; replicated up to 1,000 times a minute.
• Conficker (2008) — still among the most common malware families years later even though the patch existed. Patch availability is not patch adoption.
• Stuxnet (2010) — deliberately rate-limited to stay below the detection threshold; four zero-days; targeted industrial control systems.
• WannaCry (2017) — an SMB vulnerability with a ransomware payload, halted by an accidental kill-switch domain.

The four that a paper likes to put in one question are Code Red, Slammer, Sobig.F and Mydoom, because all four are real worms with completely different signatures. Code Red = IIS plus random scanning plus a timed DoS flood. Slammer = SQL Server buffer overflow, fastest of all, no mail. Sobig.F = mass-mailed, but its payload is a spam relay. Mydoom = mass-mailed and a backdoor. Only the last one gives an attacker a way back in to take what is on the machine.