COMP 2903 A28 – The Virus Underground

1. COMP 2903A28 – The Virus Underground Danny Silver JSOCS, Acadia University

2. Clive ThompsonThe New York Times Magazine, Feb 8, 2004 • Clive Thompson started his blog, Collision Detection, in September 2002 • Collision Detection has become one of the most well-regarded blogs on technology and culture.

3. Viruses: An Example • Courtesy of Mario, 16 year old in Austria, online name “Second Part of Hell”, has written 150+ viruses / malware systems • Has created a tool to autogenerate viruses • Create a trojan horse *.mpeg in 1 minute • Format the computers harddrive • Overwrite every file • Execute on next system startup

4. 2003 - Year of the Worm • For 12 months digital infections swarmed across the internet • Slammer – 75,000 servers in 10 minutes (ATMs, Flight delays) • Blaster – flaw in Windows, used as a DDoS against MS, message to Bill Gates • Sobig.F – automatically spread via email, 1 / 17 email messages on internet • Mydoom.A – spread by email, payload attacked website of SCO (Unix provider) • Estimated costs - as much as $82B

5. Wash your Computer’s Hands Frequently • Now adays virus authors often do not distribute their code • They leave it along with operating details on various malware web sites • Their release is often by anonymous mischief makers who are would-be Ace hackers – Script Kiddies • “The modern virus epedemic is born of a symbiotic relationship between the people smart enough to write a virus and those dumb enough , or malicious enough, to spread it.”

6. Script Kiddies • A second version of Blaster was release three days after the first - 48,000 computers, $1M in damages • Jeff Parsons arrested by the FBI, 18 years old, Minnesota • Parsons was a Script Kiddie – had found, slightly altered (including a ref to his person web page) and re-released the Blaster code • Sentenced to 18 months in jail (could have been 10 years)

7. Virus -vs- Worm • Virus: • Will arrive via email, often a payload of a worm • Deposits itself on a computer looking like a safe file: “hay-ya.mp3”, but actually “hay-ya.mp3.exe” • Require human intervention to excute • Often they do silly things like display a message • Worm: • Requires no human intervention (eg. Slammer) • Drops a payload, multiplies, mails itself onward

8. Does Malware Exploit Flaws or Popularity of Operating Systems? • MS most often blamed for poorly constructed OS code that allows malware to exist • However, many feel this is a function of popularity of use; that Mac OS and Linux would receive equal attention if businesses used them more • MS has $5M fund for rewarding informants and have annouced $250,000 bounties for the creators of Blaster, Sobig.F and Mydoom.B

9. Virus Writers are Nice Guys ?? • They like to dream up virus and implement them, but not release them • Philet0ast3r is proud of a keylogger virus, but will not release it himself because he ethically does not believe in damaging others property • The art of virus creation is a drug. Best virus designs generates fame and “street cred” • The ultimate is to make an anti-virus alert and impress the anti-virus experts • Intellectually stimulating, socially exciting- online or in person • Attracts smart but alienated young man

10. So why not round them up? • Well .. In most countries it is not illegal to write a virus – freedom of speech • Illegal only when activated • Virus writers will place disclaimers on websites indicating their work is purely for educational purposes • Virus code is both a description of a crime (not illegal) and the crime (illegal when activated)

11. Malware and Organized Crime • This is what keeps anti-virus people awake at nights • Money is being invested in an ordered manner to create more insidious malware • Stealth worms and Netbots are now being used to steal passwords, money (PayPal), facilitate blackmail, deny service

12. Malware and Organized Crime • Academics predict malware that will encrypt data on computers (cryptoviruses) and hold companies to pay ransom • Netbots that could survive reinstallation of an OS have been proposed • Now a national security issue • This has increased the level of legal pressure on traditional hackers