How to 0 wn the Internet in Your

How to 0 wn the Internet in Your Spare Time Authors: Stuart Staniford, Vern Paxson, Nicholas Weaver Publication: Usenix Security Symposium, 2002 Presenter: Melvin Rodriguez for CAP 6133, Spring’ 08 1

How to 0 wn the Internet in Your Spare Time n Thread Launch DDOS (Distributed Denial of Service) n Access Sensitive / Restrictive Information n Corrupt information’s Integrity Level n Cause Significant Damage 2

How to 0 wn the Internet in Your Spare Time n Worms n Programs that self replicate exploiting systems flaws n Propagate quickly n Hard to detect (initially) n Constantly Improving Can Spread Fast 3

How to 0 wn the Internet in Your Spare Time n Propagation Techniques Used n Hit-list scanning n n Internet scale hit-lists n n Targeting Internet enable devices Topology Aware n n Faster propagation Permutation scanning Distributed coordination of a worm Uses victims information Flash Worm n Quick and Concentrated The Name of the Game is : The Faster the Better 4

How to 0 wn the Internet in Your Spare Time n Significant Worms Attacks n Code Red I n n MS IIS vulnerability Spread by launching threads of random IP addresses Random generator used fixed seed IP address Code Red I version 2 n n n Same code as Code Red I Fixed random generator Added a direct DDo. S Constantly Evolving: New Improved Versions 5

How to 0 wn the Internet in Your Spare Time n Significant Worms Attacks n Code Red II n n Different code from previous Code Reds Use same vulnerability previously used Installed a root backdoor Infected local machines Use of Different Techniques 6

How to 0 wn the Internet in Your Spare Time n Significant Worms Attacks n Nimda n Five different techniques - Probe Copy Email Append Web code Use backdoors Combination of different techniques: Multi-vector Approach 7

How to 0 wn the Internet in Your Spare Time n Significant Worms Attacks n Nimda Infection 8

How to 0 wn the Internet in Your Spare Time n Significant Worms Attacks n Nimda n Very successful propagation rate § Unknown signature § Firewalls allow email flow n Complete functionality is still Unknown More Research is Needed 9

How to 0 wn the Internet in Your Spare Time n Other Advance Worm Characteristics / Features n Updates and Controls n n n Direct Worm-to-Worm Communication Programmable Remote Updates Remote Control Modification after Infection 10

How to 0 wn the Internet in Your Spare Time n Other Advance Worm Characteristics / Features n Stealth contagion n Slow spread Non predetermined pattern Effectiveness depends on various factors § On targets specific traffic using common traffic patterns § Exploit peer-to-peer (P 2 P) systems flaws § Size of targeted network § Remote Usage Slow propagation - Undetected Infection 11

How to 0 wn the Internet in Your Spare Time n High Level Cyber Center of Disease Control Concept n Mission n Monitor progression n Identify threats n Foster research n Main Roles n Identifying outbreaks n Rapidly analyzing pathogens n Fighting infections n Anticipating new vectors n Proactively devising detectors for new vectors n Resisting future threats 12

How to 0 wn the Internet in Your Spare Time n Summary n Worms are a threat affecting all levels of internet security n They are constantly evolving and improving n Worms combine several techniques to avoid detection and increase infections effectiveness n Conclusion n More research is needed n Need for a centralized organization to bind and establish collaboration efforts at all Industry levels n Worms can cause a significant level of damage / disruption of Internet services and lost of revenue 13

How to 0 wn the Internet in Your Spare Time n Contributions n Explained the Threat and How Dangerous n Presented techniques used for infecting systems n Discussed known worms attacks n Overview of techniques used n Discussed main characteristics and features n An high level overview of a centralized Cyber Center of Disease Control mission and roles 14

How to 0 wn the Internet in Your Spare Time n Weaknesses n Title is misleading n n No enough explanation on statistics n n Better presentation of material Hypothesis without actual data to support n n No proven hypothesis Material is not easy to follow n n Points towards ‘how to’ approach Use of possible scenarios without real data CCDC deployment idea not fully developed n Open items for further discussion 15

How to 0 wn the Internet in Your Spare Time n How to Improve n Updating the title n Expand on CDC concept n n Present how it would operate Organization and cooperation with other Agencies § NSA, USCERT, Military, Commercial, etc Additional analysis and description of Worms n Rearrange the material sequence n Re-group topics n Depict International deployment / cooperation n 16