1. Worms, Viruses and Other Creepy Computer Things:
What you need to know
Cabinet Retreat
September 12, 2003

2. Overview Explaining viruses, worms, etc. Virus statistics
Symptoms and Indicators
WSU’s experience
Security and protection strategies

3. What are these things? Virus Worm Trojan (horse) Hoaxes
Denial of Service (DOS)

4. Computer programs that can spread across computers and networks by making copies of themselves, usually without the user’s knowledge.
A virus program has to be run before it can infect your computer. Viruses have ways of making sure that this happens. They attach themselves to other programs or hide in code that is run automatically when you open certain kinds of files.

5. What can viruses do? (Payload)
Display messages
Play pranks
Deny access
Steal data
Corrupt data
Delete data
Disable hardware

6. Worm
A special kind of computer program that can replicate itself and consume computer memory, but it cannot attach itself to other programs. They create exact copies of themselves and use communications between computers (like ) to spread.

7. Trojan Horse
Programs that do things that are not described in their specifications. The user runs what they think is a legitimate program, allowing it to carry out hidden, often harmful functions. For example a program that claims to fix the ‘millenium bug’ actually overwrites the hard disk. These programs are sometimes used to infect a computer with a virus. Backdoor Trojans are programs that allow other computer users to take control of your PC over the internet.

8. Hoaxes
Hoaxes are not viruses but are deliberate or unintentional messages warning people about a virus or other malicious software program. Some hoaxes cause as much trouble as viruses by sending massive amounts of unnecessary .
Hoaxes may:
Contain warnings about viruses and their damaging consequences
Tell the reader to forward to as many people as possible
Contain technical sounding language describing the virus
Contain bogus comments from officials: FBI, software companies, news agencies, etc.

9. Denial of Service
An attack specifically designed to prevent the normal functioning of a system – preventing the lawful access to the system by authorized users. Such attacks can be caused by destroying or modifying data or by overloading the system until service is delayed or prevented.

10. Operating System Attacks
Exploit bugs in operating systems – usually fixed by software vendors (i.e. Microsoft) as soon as identified. Users must apply most recent security patches for protection

11. Network Attacks
Exploit limitations of network to disconnect a user, but usually don’t cause the computer to crash. Firewall on the network (not on your desktop without expert assistance) may help.

12. Virus Statistics
First virus identified in – steadily growing in number and sophistication ever since
1 in 4,000 s infected in 1999
1 in 700 s infected in 2000
1 in 300 s infected in 2001
Estimates are that 1 in 100 s will be infected in 2004

13. Virus Statistics Over 85,000 identified viruses worldwide
3,855 new viruses in the first 6 months of 2003 – a 17.5% increase from the same period in 2002
Additional 778 new viruses in August 2003
In August 2003, almost 40% of virus reports to Sophos (our mail server screener) were on the W32/So-big-F virus
Hoaxes are on the rise – most aimed at Bill Gates
August 2003 – one of the worst months in the history of computer security

14. Symptoms and Indicators
Programs take longer to start or run slowly
Disk access time seems excessive
Access lights turn on for non-referenced devices
Unexplained decreases in available memory
Sudden reduction in disk space
Unexplained hidden files appear
message with strange attachment
Anti-virus program will not run
Strange sound or music plays from speakers unexpectedly

15. Symptoms and Indicators continued…
Someone tells you they’ve received messages from you that you know you didn’t send
Strange dialog boxes appear on screen
New icons appear on your desktop that are not associated with any program you installed
Computer starts sometimes – sometimes not
Out of memory message appears when you should have plenty of memory

16. WSU Computer Virus Experience Four major attacks during 2003 (so far…):
When: January 24
What: W32.SQLExp
Description: Worm also known as the slammer – attacks Microsoft SQL databases.
WSU experience: This worm affected both servers and workstations – several hundred in total. It took several days to clean all servers.

17. WSU Experience continued…..
When: August 11
What: W32.Blaster Worm
Description: Uses the RPC interface to infect other computers and create denial of service attacks, flooding the network with data
WSU experience: On August 13th, 37% of all scanned computers on the WSU network were vulnerable. Complicated by return of several thousand unprotected student computers. Over 40,000,000 network packets were dropped/screened from infected student computers during a single minute period.

18. More WSU experience……. When: August 18 What: W32.Sobig.F@mm
Kind of Infection: Virus.
Description: A mass mailing worm that sends itself to other computers. Uses spoofing to disguise the originating address.
WSU experience: On a normal day we block about 500 infected s per day. The day this virus appeared, we blocked 97,000 infected s.

19. More WSU experience……. When: August 19 What: W32/Welchia
Kind of Infection: Worm
Description: Also a mass mailing worm that sends itself to other computers. The worm tries to infect other computers, and then performs a Denial of Service (DoS) attack where the infected system floods the network with data aimed at specific computers. In this instance the attack was directed at the Microsoft site which provides operating system updates.
WSU experience: Approximately student computers were infected, causing extremely high volumes of network traffic to traverse the WSU network.

20. Security and Protection Strategies
Never download from people or sites you aren’t 100% sure about
Even if you know the source, be aware of what the file is before you open it
Unhide file extensions to identify executable files
Never use automatic preview features of programs
Never blindly type commands

21. Security and Protection Strategies
Keep virus protection updated
Don’t think that just because you have virus protection, you’re safe – you’re not!
Keep security patches updated
Backup!!!!
Don’t download from public newsgroups (Usenet)
Subscribe to an alert service
Forward warnings to only one authorized person to avoid hoaxes

22. Please….. Practice Safe Computing