Free Essay

Worms and Trojan Horses

In:

Submitted By acevols
Words 1046
Pages 5
The ILOVEYOU worm was first reported in Hong Kong on 4 May 2000 and spread westward on that day. The ILOVEYOU worm affected computers at more than half of the companies in the USA and more than 105 mail servers in Europe. Internal e-mail systems at both the U.S. Senate and Britain's House of Commons were shut down. It was estimated that the ILOVEYOU worm did more damage than any other malicious program in the history of computing: approximately US$ 9 × 109. On 4 May 2000, MessageLabs filtered ILOVEYOU from one in every 28 e-mails, the all-time highest daily infection rate seen by MessageLabs. The ILOVEYOU incident was commonly reported as a virus in the news media, but it was actually a worm, because this malicious program did not infect other programs. I call this worm by the subject line of e-mail that propagated this worm. Norton Anti-Virus calls it VBS.Loveletter.A. The ILOVEYOU worm arrived at the victim's computer in the form of e-mail with the ILOVEYOU subject line and an attachment. The e-mail itself was innocuous, but when the user clicked on the attachment to read the alleged love letter, LOVE-LETTER-FOR-YOU.TXT.VBS, the attachment was a Visual Basic program that performed a horrible sequence of bad things:
Deletion of files from victim's hard disk. The worm overwrote files from the victims' hard disk drive, specifically targeting files with extensions:*.JPG, *.GIF, and *.WAV, amongst many others (i.e., files containing audio/visual data), *.CSS (i.e., cascading style sheets called by HTML 4.0 documents). some later versions deleted *.COM or *.EXE files, which prevented the computer from starting when rebootd. Some later versions deleted *.INI files.
The worm overwrote a copy of itself to a file with the name of the original file, appending the extension *.VBS, so the total number of files on the victim's hard disk would be unchanged and the damage more difficult to immediately detect. Further, if a victim clicked on one of these files, the ILOVEYOU worm would be activated again on that one victim. By overwriting files, instead of merely deleting files, the worm made it much more difficult (perhaps impossible) to recover the original file on the victim's hard drive. For example, if the worm had merely deleted files, then the victim could restore the files from the Recycle Bin or Trash Can. In addition, the worm marked files of type *.MP3 as hidden, so they would no longer appear in directory listings, then copied the worm to new files *.MP3.VBS.
Password theft
The attachment LOVE-LETTER-FOR-YOU.TXT.VBS automatically set the Microsoft Internet Explorer start page to a URL at a web server in the Philippines, which would download WIN-BUGSFIX.EXE to the victim's machine. The worm then set the victim's machine to run WIN-BUGSFIX.EXE the next time the victim's machine was booted. WIN-BUGSFIX.EXE was a Trojan Horse program that collected usernames and passwords from the victim's hard drive and e-mailed them to an address in the Philippines, mailme@super.net.ph. (That was a really stupid feature, since law enforcement agents, within 12 hours of the initial release of the worm, identified the person who owned that e-mail address.) Furthermore, there was a copyright notice in the Trojan Horse's code!

An Internet Service Provider in Europe alerted the web server in the Philippines at 08:30 GMT on Thursday, 4 May 2000, and WIN-BUGSFIX.EXE was removed from the website, which prevented most of the harm in Europe and the USA from this password-collecting program. Later, the web server in the Philippines was overwhelmed (i.e., a kind of a denial of service attack) with requests from the worm for WIN-BUGSFIX.EXE. This Trojan Horse program had been previously submitted as a thesis proposal at a computer college in the Philippines. The proposal was rejected with handwritten comments "This is illegal." and "We don't produce burglars." The student then dropped out of the college without earning a degree. A copy of the student's rejected thesis proposal is posted at Richard M. Smith's website.
Worm propagates
The worm transmitted itself using features of the earlier Melissa program: scanning the address book in Microsoft Outlook, and then transmitted a copy of the ILOVEYOU e-mail to all of those e-mail addresses. This method of transmission rapidly disseminated the worm to millions of victims. In comparison, Melissa sent copies to only the first 50 entries in the Microsoft Outlook address book, while ILOVEYOU sent copies to every address in the that victims' book. The worm also sent copies to other people on the same Internet Relay Chat channel that the victim was using.
Police in the Philippines knew the name and location of the suspect within 12 hours of the initial release of the worm, but the police were hampered by the lack of laws there for computer crimes. The closest relevant Philippine law was designed to cover credit card or bank account fraud, but was broad enough to cover unauthorized taking of goods and services. However, the police were not able to find sufficient evidence for prosecutors to apply this fraud statute. On 7 June 2000, police and prosecutors in the Philippines closed their investigation of the ILOVEYOU worm, because the creation and release of this worm was not a crime in the Philippines. On 21 August 2000, prosecutors dropped all charges against the people who apparently designed and released the ILOVEYOU worm. This example shows the international nature of computer crime: a criminal in one country can rapidly cause havoc all over the world, using the international reach of the Internet. In contrast, a criminal who physically moves from one country to the next would need to pass though immigration and customs controls at each border, as well as become subject to personal jurisdiction in each country. One of the first steps companies used to ward off the ILOVEYOU virus was to screen out notes with ILOVEYOU in the subject line. However, hackers quickly introduced copycat variations with subject lines variously identifying "JOKE" and "Mother's Day!" as the content, but containing the same or similar VBScript code.

Similar Documents

Premium Essay

It240 Check Point Threat Categorization

... | |File – Is a place where data is stored on a computer, there are many different types of files and most if not all data is stored in a file. | |Multipartite - divided or having many sectors, very applicable to computers since they have many parts and are divided into sectors and sections. | |Macro – Instructions, usually one that can automatically turn into more instructions. | |Trojan horse - A virus that allows a backdoor into a computer affecting the computer without the users knowledge and allows the information stored | |on the infected computer to be stolen. | |E-mail worms – A worm that spreads through the user of the user’s email account(s). | |Instant messaging worms – A worm that can replicate it’s self and uses the user’s buddy list and address book on an instant messaging application to | |spread itself....

Words: 829 - Pages: 4

Premium Essay

Malware

...malware: Adware, Bot, Bug, Ransomware, Rootkit, Spyware, Trojan Horse, Virus, and Worm. Each one of these types of malware has a specific function and effect on the end user’s computer system. Adware is an application that usually comes bundled with an application downloaded from the internet, in which it monitors the internet activity and provides advertisement according to the internet browsing behaviors. Bots are programs designed to run automated tasks. Bots gain popularity in being used on systems to run DDoS attacks. Bugs are flaws within the applications that an attacker can take advantage to exploit the computer system. Ransomware is an application that infects the computer system and encrypts files and holds the system hostage until the end user pays a fee for the unlocking mechanism. Rootkit is a malicious piece of software that is very stealth and allows the attacker to collect all kinds of information from the system and even remote control it. Spyware is related to Adware in which spies on the user’s activity without their knowledge and collects data such as keystrokes, logins, monitoring internet activity, etc. Trojan Horse is an application that disguises itself as something safe and known to the user and in reality contains a malicious application when installed. A Virus is a type of malware that has the ability to copying itself by attaching or modifying an existing executable file in the computer system. Worms are similar to viruses, the only difference is that they...

Words: 1143 - Pages: 5

Premium Essay

Computer Viruses

...sometimes used as a catch-all phrase to include all types of malware (malicious software). Malware includes computer viruses, computer worms, Trojan horses, most rootkits, spyware, dishonest adware and other malicious and unwanted software, including true viruses. Viruses are sometimes confused with worms and Trojan horses, which are technically different. A worm can exploit security vulnerabilities to spread itself automatically to other computers through networks, while a Trojan horse is a program that appears harmless but hides malicious functions. A Trojan horse, or Trojan, is malicious software designed to secretly access a computer system without the owner's permission or approval. It appears to perform a desirable function for the user prior to run or install but instead, it facilitates unauthorized access of the user's computer system. On the other hand, a computer worm is a self-reproductive malware computer program. It uses a computer network to send copies of itself to other computers on the network and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a virus, it does not need to attach itself to an existing program. Worms may cause some harm to the network, if only by consuming bandwidth, however, viruses corrupt or modify files on a targeted computer. Worms and Trojan horses, like viruses, may harm a computer system's data or...

Words: 341 - Pages: 2

Premium Essay

Sec280

...security. Most people are willing to give full access to their computers to people that they think are trustworthy. It is easy for a trusted friend to steal your personal information or mistakenly download a virus, Trojan horse, or worm. The best known way of attacking a system is with a computer virus. A computer virus attaches itself to a program or file allowing it to spread to every computer it encounters. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it actually cannot infect your computer unless you run or open the malicious program. (The Difference Between a Computer Virus, Worm and Trojan Horse, 2011) One of the most common ways an intruder use to invade your home computer is a Trojan horse program. A Trojan horse program will be hidden, in what appears to be legitimate software or files from a legitimate source. The effects of a Trojan horse vary from something annoying like adding icons to your desktop. It can be more malicious and give the intruder access to your computer and your personal information. Another method used by hackers is a computer Worm. Worms are typically installed when a person opens an infected email attachment or a message that contains executable scripts. Computer worms spread from one computer to another, creating holes...

Words: 397 - Pages: 2

Premium Essay

Computer Viruses

...Today, many people rely on computers to do homework, work, and create or store useful information. Therefore, it's important for the information to be stored and kept properly. It's also extremely important to protect computers from data loss, misuse and abuse. For example, businesses need to keep their information secure and shielded from hackers. Home users also need to ensure their credit card numbers are secure when participating in online transactions. A computer security risk is any action that could cause loss of information to software, data, processing incompatibilities or damage to computer hardware. An intentional breach in computer security is known as a computer crime, which is slightly different from a cybercrime. A cybercrime is known as illegal acts based on the Internet and is one of the FBI's top priorities. There are several distinct categories for people that perpetrate cybercrimes, and they are: hacker, cracker, cyberterrorist, cyberextortionist, unethical employee, script kiddie and corporate spy. A hacker is defined as someone who accesses a computer or computer network unlawfully. They often claim that they do this to find leaks in the security of a network. The term cracker refers to someone intentionally accessing a computer or computer network with malice in mind. They access computers with the intention of destroying or stealing information. Both crackers and hackers are having advanced network skills. A cyberterrorist is someone who uses a computer...

Words: 1026 - Pages: 5

Free Essay

Computer Security

...Security: Worms and viruses Nowadays, in the domain of computer sciences, there is a big problem to face: Worms and viruses. Being in the technology is a good thing, but being n the technology without knowing how to avoid the consequences of the technology is worse. Viruses and worms affect the computer and damage, or in other words corrupt some files that are important to the good functioning of the computer. Viruses have many ways of penetration that computers user ignore, and that’s what makes the damage even more severe. First of all, let’s start by defining a viruses and a worm. A virus is a malware program (not a computer program), that auto run, and replicates by adding copies of their code into other computer program, any other type of data that it comes across. This will create an overall corruption of your database and your computer. In reality, there are three categories of computer infections malwares and we defined the first one which is viruses. The two second malwares are worms and Trojan horses. In a questions of codes or designs they are all similar, but the differences come in the way these three categories act. Contrarily to viruses that need a human action to spread, such as sharing files, running an infected program, and so on, worms have the ability to auto spread themselves, which mean that they don’t require the action of a human. They can travel by themselves by taking advantages on files and other information’s that runs through the system. A Trojan horse...

Words: 1076 - Pages: 5

Premium Essay

Virus

...A computer virus is a computer program that can replicate itself[1] and spread from one computer to another. The term "virus" is also commonly, but erroneously, used to refer to other types of malware, including but not limited to adware and spyware programs that do not have a reproductive ability. Malware includes computer viruses, computer worms, Trojan horses, most rootkits, spyware, dishonest adware and other malicious or unwanted software, including true viruses. Viruses are sometimes confused with worms and Trojan horses, which are technically different. A worm can exploit security vulnerabilities to spread itself automatically to other computers through networks, while a Trojan horse is a program that appears harmless but hides malicious functions. Worms and Trojan horses, like viruses, may harm a computer system's data or performance. Some viruses and other malware have symptoms noticeable to the computer user, but many are surreptitious or simply do nothing to call attention to themselves. Some viruses do nothing beyond reproducing themselves. An example of a virus which is not a malware, but is putatively benevolent, is Fred Cohen's compression virus.[2] However, antivirus professionals do not accept the concept of benevolent viruses, as any desired function can be implemented without involving a virus (automatic compression, for instance, is available under the Windows operating system at the choice of the user). Any virus will by definition make unauthorised...

Words: 271 - Pages: 2

Premium Essay

Trojan Virus

...Trojan horse viruses got their name from the siege of Troy, when the Greeks placed a large wooden horse outside the gates of Troy. The Trojans assumed it was a peace offering from the Greeks, and moved the horse inside the gates. The wooden horse was of course filled with hidden warriors, and once inside the gates, they broke out of the horse, and demolished the Trojans. Trojan horse programs work the same way. Trojan horses can destroy files and data, but commonly contain spyware, and even backdoor programs. Trojans are usually contained in software downloads from unknown or untrusted sources. Some people don't consider a trojan horse to be a virus, because it does not reproduce itself as a virus does, however it's ability to destroy files and install programs without the user knowing do indeed make it a virus. When a trojan horse is being used as spyware, it monitors your computer activities, and may even record keystrokes. This information is then sent to a third party, without you being aware of it. It may also cause pop up ads to display on your computer. The real danger is that information such as passwords and credit card and banking information can be delivered to that unknown third party, opening you up for identity theft. When the trojan horse installs a backdoor program, it sends information to the third party, making it possible for hackers to get into your system, via the backdoor, and to use the system just as if it were their own. They will often do...

Words: 573 - Pages: 3

Free Essay

I.T. 240 Threat Categorization

...virus spreads throughout the system multiple times making even the simplest functions inoperable. A macro is a piece of code (information) data that is attached to a file, mainly word processors, such as Microsoft word, and Excel. Trojan horse in computers are programs that allow the execution of harmful actions that can delete data, block data, modify data, and disrupt networks. Trojan horses are like dormant cells that wait for the right time to make their appearance, they lay in wait most of the time in harmless programs. Email worms are spread through emails, they usually spread via attachment. These type of worms need to be opened before they can do anything. Worms can take up much needed memory and cause computers, web servers, and network servers to stop responding. Instant messaging worms are spread through instant messages, and their main purpose is to replicate themselves and infect users. This type of worm can cause a network to shut down or allows hackers to gain control of the user’s device. IRC worms or Internet Relay Chat worms are similar to email worms, they have to be accepted, usually via attachment, usually through a copy of a URL that has a copy of the worm embedded in it. This type of worm...

Words: 490 - Pages: 2

Premium Essay

Security Threats

...Security Threats & Vulnerabilities As information technology grows also does the need to protect technology or information on the system. Before we can protect the information on a system we need to know what to protect and how to protect them. First must decide what a threat to our system is. A Security threat is anything or anyone that comprise data integrity, confidentiality, and availability of a system. Another security issue for systems is Vulnerabilities in software that can be exploited by people that want to do harm to a system. It’s up to the personnel or team that’s in charge of protecting the system from threats and vulnerabilities. The personnel that secure information technology systems are known as (ISO) Information Security Officer, (IASO) Information Assurance Security Officer, (ISM) Information Security Manager ect. No matter what name the personnel there job is the same to protect information systems. Security Officers will have to set policies that govern the system and create plan on how to handle security threat and vulnerabilities. Security threats can consist of any number issues ranging from physical attack, spoofing, password attacks, identity theft, virus attacks, and Denial of Service attacks, Social Threats, Espionage, malware, spyware, Careless Employees, and hackers. We will disuse all of these threats and ways to prevent them later in the report. In 2010 Kevin Prince, CTO, Perimeter E-Security "As these security threats are becoming more...

Words: 2408 - Pages: 10

Free Essay

It 240 Week 8

...following terms in your own words: Boot sector File Multipartite Macro Trojan horse E-mail worms Instant messaging worms IRC worms File-sharing networks worms Internet worms * Explain how each virus or worm functions and spreads. Determine in which category the threat you researched in Week Seven belongs. Your response must be between 200 and 300 words. A boot sector threat is a type of virus that infects host computers by writing the malicious code to the boot sector of the drive that’s infecting. This method of infiltration ensures that whenever the infected volume attempts to boot, the virus will boot first. File threats are virii that attach themselves to executable program files such as .exe files. After being run, the virus then effects other programs as they attempt to run, or infect the entire directory or volume in which they’ve been introduced. A multipartite threat is a threat with attributes of both boot sector and file viruses. These types of threats can spread from the MBR or boot sector to infect executable programs, or spread from a single file to infect the boot sector. A macro is a type of formula language used in complex tasks in software such as Microsoft word or excel. These threats are capable of assigning multiple key commands to one action . Macros infect systems through a document file type and infect he host once the file is accessed. A Trojan Horse threat is a threat that presents itself as a legitimate piece of software...

Words: 644 - Pages: 3

Premium Essay

Malware

...A Brief History “In 1949, Von Neumann established the Theory of Self-Reproducing Automata, where he presented for the first time the possibility of developing small replicating programs able to control other programs with a similar structure In 1959, in Bell Computer’s laboratories, three young programmers: Robert Thomas Morris, Douglas Mcllroy and Victor Vysottsky created a game called CoreWar, based on the theory of Von Neumann and in which programs fought between each other, trying to occupy as much memory as possible and eliminating opposing programs. This game is considered the precursor to computer viruses. In 1972, Robert Thomas Morris created the first virus as such: Creeper, which could infect IBM 360 on the ARPANET (the predecessor of the Internet) and show an on-screen message saying “I’m the creeper, catch me if you can”. To eliminate it, a virus called Reaper was created to search for it and destroy it”…………………...PANDA SECURITY ( 2011) Malware Overview Retrieved from http://www.google.com/images?rlz=1T4ADFA_enUS391US392&q=virus+clipart&um=1&ie=UTF-8&source=univ&sa=X&ei=nOx7TfqZEoXorAGvu5zCBQ&ved=0CDMQsAQ&biw=1174&bih=463 Malicious software, better known as Malware, is the most sophisticated type of threat to a computer system. Malware is simply code that is designed with purpose and intent to destroy, steal, disrupt or damage someone’s data, computer system or network. Malware is software that is written...

Words: 3874 - Pages: 16

Free Essay

Internet Technology

... | ____ 2. A _____ is a program that copies itself repeatedly in memory or on a network, using up resources and possibly shutting down the computer or network. |a. |computer virus |c. |Trojan horse | |b. |worm |d. |all of the above | ____ 3. A _____ is a malicious-logic program that hides within or looks like a legitimate program and usually is triggered by a certain condition or action. |a. |computer virus |c. |Trojan horse | |b. |worm |d. |all of the above | ____ 4. The _____ is the destructive event or prank a malicious-logic program is intended to deliver. |a. |zombie |c. |cracker | |b. |hash |d. |payload | ____ 5. Computer viruses, worms, and Trojan horses deliver their payload on a computer when a user _____. |a. |opens an infected file...

Words: 331 - Pages: 2

Premium Essay

Cyber Crime

...facilitated by computer networks or devices, the primary target of which is independent of the computer network or device.[citation needed] Crimes that primarily target computer networks or devices include:  Computer viruses  Denial-of-service attacks  Malware (malicious code) Crimes that use computer networks or devices to advance other ends include:  Cyberstalking  Fraud and identity theft  Information warfare  Phishing scams Malware From Wikipedia, the free encyclopedia Beast, a Windows-based backdoorTrojan horse. Malware, short for malicious software, is software used or created to disrupt computer operation, gather sensitive information, or gain access to private computer systems. It can appear in the form of code, scripts, active content, and other software.[1] 'Malware' is a general term used to refer to a variety of forms of hostile, intrusive, or annoying software.[2] Malware includes computer viruses, worms, trojan horses, spyware, adware, and other malicious programs. In law, malware is sometimes known as a computer contaminant, as in the legal codes of several U.S. states.[3][4] Malware is not the same as defective software, which is software that has a legitimate purpose but contains harmful bugs that were not noticed before release. However, some malware is disguised as genuine software, and may come from an official company website. An example of this is software used for harmless purposes that is packed with additional tracking software that...

Words: 3033 - Pages: 13

Premium Essay

On-Line Security: Attacks and Solutions

...EVREN KUCUKKAYA E-COMMERCE SEMINAR Elias A. Hadzilias, PhD NTUA Assignment: On-line security: attacks and solutions 2012 ISG – INTERNATIONAL MBA Table of Context 1. INTRODUCTION ................................................................................................................................... 3 2. MAIN TYPES OF MALWARE ................................................................................................................. 4 2.1. Computer Viruses ............................................................................................................................. 4 2.1. Computer Worms ............................................................................................................................. 5 2.3. Trojan Horses.................................................................................................................................... 6 2.4. Spyware ............................................................................................................................................ 6 2.5. Backdoor........................................................................................................................................... 6 2.6. Spams ............................................................................................................................................... 7 2.7. Keyloggers ....................................................................................................

Words: 5692 - Pages: 23