Worms, Viruses and Other Creepy Computer Things: What you need to know Cabinet Retreat September 12, 2003

Overview Explaining viruses, worms, etc. Virus statistics Symptoms and Indicators WSU’s experience Security and protection strategies

What are these things? Virus Worm Trojan (horse) Hoaxes Denial of Service (DOS)

Computer programs that can spread across computers and networks by making copies of themselves, usually without the user’s knowledge. A virus program has to be run before it can infect your computer. Viruses have ways of making sure that this happens. They attach themselves to other programs or hide in code that is run automatically when you open certain kinds of files.

What can viruses do? (Payload) Display messages Play pranks Deny access Steal data Corrupt data Delete data Disable hardware

Worm A special kind of computer program that can replicate itself and consume computer memory, but it cannot attach itself to other programs. They create exact copies of themselves and use communications between computers (like email) to spread.

Trojan Horse Programs that do things that are not described in their specifications. The user runs what they think is a legitimate program, allowing it to carry out hidden, often harmful functions. For example a program that claims to fix the ‘millenium bug’ actually overwrites the hard disk. These programs are sometimes used to infect a computer with a virus. Backdoor Trojans are programs that allow other computer users to take control of your PC over the internet.

Hoaxes Hoaxes are not viruses but are deliberate or unintentional email messages warning people about a virus or other malicious software program. Some hoaxes cause as much trouble as viruses by sending massive amounts of unnecessary email. Hoaxes may: Contain warnings about viruses and their damaging consequences Tell the reader to forward to as many people as possible Contain technical sounding language describing the virus Contain bogus comments from officials: FBI, software companies, news agencies, etc.

Denial of Service An attack specifically designed to prevent the normal functioning of a system – preventing the lawful access to the system by authorized users. Such attacks can be caused by destroying or modifying data or by overloading the system until service is delayed or prevented.

Operating System Attacks Exploit bugs in operating systems – usually fixed by software vendors (i.e. Microsoft) as soon as identified. Users must apply most recent security patches for protection

Network Attacks Exploit limitations of network to disconnect a user, but usually don’t cause the computer to crash. Firewall on the network (not on your desktop without expert assistance) may help.

Virus Statistics First virus identified in 1981 – steadily growing in number and sophistication ever since 1 in 4,000 emails infected in 1999 1 in 700 emails infected in 2000 1 in 300 emails infected in 2001 Estimates are that 1 in 100 emails will be infected in 2004

Virus Statistics Over 85,000 identified viruses worldwide 3,855 new viruses in the first 6 months of 2003 – a 17.5% increase from the same period in 2002 Additional 778 new viruses in August 2003 In August 2003, almost 40% of virus reports to Sophos (our mail server screener) were on the W32/So-big-F virus Hoaxes are on the rise – most aimed at Bill Gates August 2003 – one of the worst months in the history of computer security

Symptoms and Indicators Programs take longer to start or run slowly Disk access time seems excessive Access lights turn on for non-referenced devices Unexplained decreases in available memory Sudden reduction in disk space Unexplained hidden files appear Email message with strange attachment Anti-virus program will not run Strange sound or music plays from speakers unexpectedly

Symptoms and Indicators continued… Someone tells you they’ve received messages from you that you know you didn’t send Strange dialog boxes appear on screen New icons appear on your desktop that are not associated with any program you installed Computer starts sometimes – sometimes not Out of memory message appears when you should have plenty of memory

WSU Computer Virus Experience Four major attacks during 2003 (so far…): When: January 24 What: W32.SQLExp Description: Worm also known as the slammer – attacks Microsoft SQL databases. WSU experience: This worm affected both servers and workstations – several hundred in total. It took several days to clean all servers.

WSU Experience continued….. When: August 11 What: W32.Blaster Worm Description: Uses the RPC interface to infect other computers and create denial of service attacks, flooding the network with data WSU experience: On August 13th, 37% of all scanned computers on the WSU network were vulnerable. Complicated by return of several thousand unprotected student computers. Over 40,000,000 network packets were dropped/screened from infected student computers during a single 60-90 minute period.

More WSU experience……. When: August 18 What: W32.Sobig.F@mm Kind of Infection: Virus. Description: A mass mailing worm that sends itself to other computers. Uses email spoofing to disguise the originating address. WSU experience: On a normal day we block about 500 infected emails per day. The day this virus appeared, we blocked 97,000 infected emails.

More WSU experience……. When: August 19 What: W32/Welchia Kind of Infection: Worm Description: Also a mass mailing worm that sends itself to other computers. The worm tries to infect other computers, and then performs a Denial of Service (DoS) attack where the infected system floods the network with data aimed at specific computers. In this instance the attack was directed at the Microsoft site which provides operating system updates. WSU experience: Approximately 1000-1500 student computers were infected, causing extremely high volumes of network traffic to traverse the WSU network.

Security and Protection Strategies Never download from people or sites you aren’t 100% sure about Even if you know the source, be aware of what the file is before you open it Unhide file extensions to identify executable files Never use automatic preview features of programs Never blindly type commands

Security and Protection Strategies Keep virus protection updated Don’t think that just because you have virus protection, you’re safe – you’re not! Keep security patches updated Backup!!!! Don’t download from public newsgroups (Usenet) Subscribe to an email alert service Forward warnings to only one authorized person to avoid hoaxes

Please….. Practice Safe Computing