COMP 2903 A 28 The Virus Underground Danny

COMP 2903 A 28 – The Virus Underground Danny Silver JSOCS, Acadia University

Clive Thompson The New York Times Magazine, Feb 8, 2004 • Clive Thompson started his blog, Collision Detection, in September 2002 • Collision Detection has become one of the most well-regarded blogs on technology and culture.

Viruses: An Example • Courtesy of Mario, 16 year old in Austria, online name “Second Part of Hell”, has written 150+ viruses / malware systems • Has created a tool to autogenerate viruses • Create a trojan horse *. mpeg in 1 minute – Format the computers harddrive – Overwrite every file – Execute on next system startup

2003 - Year of the Worm • For 12 months digital infections swarmed across the internet – Slammer – 75, 000 servers in 10 minutes (ATMs, Flight delays) – Blaster – flaw in Windows, used as a DDo. S against MS, message to Bill Gates – Sobig. F – automatically spread via email, 1 / 17 email messages on internet – Mydoom. A – spread by email, payload attacked website of SCO (Unix provider) • Estimated costs - as much as $82 B

Wash your Computer’s Hands Frequently • Now adays virus authors often do not distribute their code • They leave it along with operating details on various malware web sites • Their release is often by anonymous mischief makers who are would-be Ace hackers – Script Kiddies • “The modern virus epedemic is born of a symbiotic relationship between the people smart enough to write a virus and those dumb enough , or malicious enough, to spread it. ”

Script Kiddies • A second version of Blaster was release three days after the first - 48, 000 computers, $1 M in damages • Jeff Parsons arrested by the FBI, 18 years old, Minnesota • Parsons was a Script Kiddie – had found, slightly altered (including a ref to his person web page) and re-released the Blaster code • Sentenced to 18 months in jail (could have been 10 years)

Virus -vs- Worm • Virus: – Will arrive via email, often a payload of a worm – Deposits itself on a computer looking like a safe file: “hay-ya. mp 3”, but actually “hay-ya. mp 3. exe” – Require human intervention to excute – Often they do silly things like display a message • Worm: – Requires no human intervention (eg. Slammer) – Drops a payload, multiplies, mails itself onward

Does Malware Exploit Flaws or Popularity of Operating Systems? • MS most often blamed for poorly constructed OS code that allows malware to exist • However, many feel this is a function of popularity of use; that Mac OS and Linux would receive equal attention if businesses used them more • MS has $5 M fund for rewarding informants and have annouced $250, 000 bounties for the creators of Blaster, Sobig. F and Mydoom. B

Virus Writers are Nice Guys ? ? • They like to dream up virus and implement them, but not release them • Philet 0 ast 3 r is proud of a keylogger virus, but will not release it himself because he ethically does not believe in damaging others property • The art of virus creation is a drug. Best virus designs generates fame and “street cred” • The ultimate is to make an anti-virus alert and impress the anti-virus experts • Intellectually stimulating, socially exciting- online or in person • Attracts smart but alienated young man

So why not round them up? • Well. . In most countries it is not illegal to write a virus – freedom of speech • Illegal only when activated • Virus writers will place disclaimers on websites indicating their work is purely for educational purposes • Virus code is both a description of a crime (not illegal) and the crime (illegal when activated)

Malware and Organized Crime • This is what keeps anti-virus people awake at nights • Money is being invested in an ordered manner to create more insidious malware • Stealth worms and Netbots are now being used to steal passwords, money (Pay. Pal), facilitate blackmail, deny service

Malware and Organized Crime • Academics predict malware that will encrypt data on computers (cryptoviruses) and hold companies to pay ransom • Netbots that could survive reinstallation of an OS have been proposed • Now a national security issue • This has increased the level of legal pressure on traditional hackers