A Study of Mass- mailing Worms By Cynthia Wong, Stan Bielski, Jonathan M. McCune, and Chenxi Wang, Carnegie Mellon University, 2004 Presented by Allen Stone

Mass-Mailing Worms  Background (Morris, Code Red, and Slammer)  Analysis of SoBig and MyDoom worms  Anomalies  TCP  IP addresses  DNS  Traffic In General  Discussion and Conclusions  Protection

Worms – What are they? “A self-replicating computer program, similar to a computer virus. A virus attaches itself to, and becomes part of, another program; however, a worm is self- contained and does not need to be part of another program to propagate itself. They are often designed to exploit the file transmission capabilities found on many computers.” - Wikipedia (wikipedia.org)

The Morris Worm  The first internet worm, written by Robert T. Morris, Jr., a first-year Computer Science Student at Cornell University.  Infected roughly six thousand machines nationwide in November of  Performance of victim machines drastically reduced because of propagation attempts.

Scanning Worms  Typical worms use aggressive IP scanning to find potential victim machines that are vulnerable to the exploit it carries.  Code Red, 2001  359,000 computers infected within 14 hours.  IIS exploit – spread through web scanning.  Slammer Worm, 2002  75,000 hosts – number doubled every 8.5 seconds.  UDP packet crafted against SQL Server.  Zero Day Exploits

Mass-mailing Worms  Sends itself via .  Usually infects with attachments.  Harvests addresses from address book, web cache, and hard disk. (unlike viruses)  No need to acquire new targets.  Tricks users into running malicious code on their own machines.  Some worms use their own SMTP engine.

Analysis  The SoBig and MyDoom mass-mailing worms  Real network trace data, collected from the edge router of CMU’s Electrical and Computer Engineering Department  Two Week Periods (Aug. – Sept and Jan. – Feb. 2004)

Infected or chatty? Heuristics of suspicion  Outgoing SMTP connections on a controlled network not going to an authorized mail server.  Message payload – Similar to the payload sizes of known worm traffic from Symantec.  Admittedly not 100 percent accurate.

Worm Effect – TCP Traffic  Scanning worms have spikes in all kinds of traffic, caused by scanning for other boxes to compromise.  Mass-mailing worms use to spread to potential victim boxes through mail service over TCP.

Worm Effect – TCP Traffic

Since the worms use their own SMTP engines, there should be no outbound SMTP traffic spikes from the existing mail servers. There is a spike in traffic with SoBig, but not MyDoom. Spoofed s from the harvest of addresses creates false guesses, which create backscatter. SoBig is more aggressive than MyDoom during propagation.

Worm Effect – Distinct IPs  Normal boxes that are not infected touch an average number of distinct IPs in a given day.  Infected boxes use addresses from all over, from the harvest.  The number of distinct IPs an infected system touches should be noticably larger.  The number of IPs a mail server touches should not change, intuitively, since they already send to new IPs on a regular basis.

Worm Effect – Distinct IPs  Infected boxes experienced a rise  Mail servers did as well, despite the expectation.  Attributed also to the spoofing effort.

Worm Effect - DNS  DNS related events expected to rise, since SMTP needs to resolve the IP associated with addresses.  New cache entry, refreshed cache entry, cache entry expiration

Worm Effect - DNS

Worm Effect – Overall Traffic  HTTP traffic dominates the network, with over 90% of all inbound and outbound traffic.  Do the infected systems make a large impact on that fact?

Worm Effect – Overall Traffic

Discussion and Conclusions  Mass-mailing worms show significant and noticeable impact on a network.  Prevention measures at the DNS Server, rather than at the SMTP Server.  Detection focused on Outgoing TCP, DNS, and Distinct IP’s, rather than on whole-network anomaly, due to the impact of HTTP.

Discussion and Conclusions  Both worms overran the network.  SoBig moreso than MyDoom.  SMTP servers still affected, even with mail clients on the worms, due to backscatter.  Antivirus software on Mail Servers actually counter-productive as a defense measure.

Protection  Detect worms either at the border router or individual systems.  Utilize DNS servers to limit the spread of the worm, possibly quarantining malicious traffic.  Pay strict attention to outgoing SMTP traffic and investigate spikes in such traffic.

Sources  “A Study of Mass-mailing Worms”  Wong, Bielski, McCune, Wang, CMU 2004  Proceedings of the 2004 AMC workshop on rapid malcode.  “The Spread of the Sapphire/Slammer Worm”  Moore, Paxson, Savage, Shannon, Staniford, Weaver   “Code-Red: a case study on the spread and victims of an Internet worm”  Moore, Shannon, Claffy  Proceedings of the 2 nd ACM SIGCOMM Workshop on Internet measurement.  “The Cornell Commission: On Morris and the Worm”  Eisenberg, Gries, Hartmanis, Holcomb, Lynn, Santoro  Communications of the ACM, Vol. 32, Issue 6.