Worst Nightmares Come Alive

Before we start

This document has been written with great care. I urge you to read the complete document before commenting on it. Furthermore, I urge you to think about it for a while before commenting on it. If you have constructive comments please send it to:

roelof@cube.co.za

You may replicate this document at will - but please do not butcher it - copy the whole document, and give me credit. I would also appreciate it if you let me know where you publish it - just to keep track of it.

Regards, Roelof Temmingh, South Africa. 99/07/29

Contents:
Part I: Introduction to your worst nightmare
Part II: The bare bone basics
Part III: Detail design
Part IV: QWRNA (Questions We Rather Not Ask)

"I guess it was bound to happen someday - please spread the word". This message was posted to a computer mailing list by Gene Spafford on 03 November 1988 - back in the days when the Internet, still in its infancy, was a tool for academics and a toy for geeks. Spafford is referring to an Internet-born computer worm (a type of self-sustained virus) that eventually managed to effect more then 10% of the 60,000 hosts then connected to the Internet. Despite the fact most of the world hadn't heard of the Internet or email before, and the fact that the Dukakis-Bush election was just days way, the incident made it to the front page of most major newspapers. This was not because the worm was particularly viscous - it was actually quite benign - but because people recognized the potential for large-scale damage the worm represented. Were it not for a small programming error in the worm's code it may never even have been discovered. Ten years ago the "Morris Worm" shocked the world into realizing the fragility of Internet. Today, very little has changed. Despite ten years of new knowledge and experience the Internet today is as least as vulnerable to Morris-type attacks as it was ten years ago. In fact, even more so. Consider the following:

1. Ten years ago the Morris worm used weaknesses common to a number of different UNIX systems to take control of the computers and propagate itself. Today the same operating system is installed on 90% of all desktop computers. A single program could attack all these machines.

2. Ten years ago the Internet belonged to an elite group of specialists and professionals. They understood their computers intimately and managed them closely. Today every home has a computer and a connection to the Internet. The average computer user can't tell "email" from "mpeg".

3. Ten years ago the Internet was used primarily by scientists, researchers and academics. Today it is a major business conduit. Billions of dollars are moved over the Internet daily in various forms and most companies would simply not be able to ANY business without their IT computer systems.

The widespread use of firewalls on computer systems does little to alleviate the risk. The threat here is not an attack from some hacker on the Internet, but a program run unwittingly on a computer already inside the protected network. The sections that follow show exactly just how feasible such a program is. While reading you will note the following frightening truths:

• Just how relatively easy such a program is to write. Similar programs already exist and are widely known.

• Just how easy such a program is to spread. The Internet is the perfect mass distribution system and its strength is also its weakness.

• Just how easy such a program is to hide. The average user doesn't understand half the processes running on the system legitimately, let alone a program doing its utmost to conceal itself.

• Just how hard such a program is to stop. The program can spread at the speed of light, take any form, hide itself and mutate with every new installation. Immeasurable damage could be done before it is eventually stopped.

• Just how ugly such a program could be. This kind of software could bring entire sectors of industry to their knees. A well-planned infection with malicious intent would make the Morris Virus of '88 look like a mild case of the flu.

So what can be done to prevent this from happening? Not too much I'm afraid. Like the citizens of a volcanic island we need to be aware, stay alert and hope we spot the eruption early enough to prevent a disaster. Here are some precautions a company can take:

1. Policy. The use of any unauthorized software should be prohibited.

2. User education, user education, user education. Make your users aware of the dangers of running software from untrusted sources.

3. Audits. Perform regular checks to see what's installed and running on your PCs.

4. Operating systems. A strong operating system with proper multi-user support can minimize the damage done by a worm. Install Microsoft NT rather then Windows 95 or 98. Consider using other operating systems, like Line or BSD.

5. Diversity. By mixing a number of operating systems one can minimize the amount of damage a virus or worm could do. This, however, introduces added complexity in the management of the all the different systems. Your call...

6. Network security. Firewalls, file encryption, operating system security, etc. all make it more difficult for the would be worm. In particular virus scanners and HTML, FTP and SMTP content scanners help us weed out these kinds of threats. Consider stripping executable attachments and other active content completely.

7. Host-based IDS. Intrusion detection systems may detect attacks either on the network or the computers themselves.

8. Assume the worst. Plan for disasters with disaster recovery sites, backups, and business continuity plans. Test and practice with these systems.

As you read the description that follows, imagine the consequences of the release of such an animal and ask yourself how long it will be before we are again saying to ourselves "I guess it was bound to happen someday..."

Part II: The bare bone basics

This is the part of the document that will try to give a very basic understanding of the Trojan/virus. It is suppose to raise questions - these questions will be dealt with in the third section. It will only give the reader an idea of the dynamics of the virus. It's the "press release" part of it.

The Package
The package is a single executable. The executable contains two parts, a normal functional program, and the Active Ingredient (AI). The normal program can be anything, but should be of interest for the Internet community. Examples could include: screensavers. auto playing AVI,MPEGs, flash movies, anti virus software, a new hacking tool or even an anti virus solution.

The type of package could be customized to suit the way of transportation.

Initial infection
The package will be distributed on the Internet. This is done by "robots". These "robots" will upload the infected package to FTP servers, mass mail the package to users, repackage existing software to contain the AI, and DCC the package at random to users connected to IRC servers. The 'net should be flooded by infected programs, all different in size and apparent functionality.

Conventional virus spreading methods can also be used. Initial infection could last in the order of 2 months.

Upon first execution on client machine
A user will obtain the package, and execute it.

• Settle in. AI will rename itself to a non-suspect filename. The AI will take the necessary precautions to ensure that it will be executed every time the host is restarted.

• Registration on server AI should wait until it detects the possibility to connect to a server on the Internet. When this happens, the AI should contact a predefined web server(s), uploading information to this site. It will save a file on this site containing detailed information of the host. Each AI will save the file with a unique name / serial number.

Day to day activity of AI
The AI will monitor activity, and if it detects traffic to the World Wide Web, it will periodically check for instructions, posted on the predefined web server. These commands will be downloaded from the World Wide Web, and executed on the host. The commands are to be found in a file that match the serial number that the AI registered in the initial contact. The AI will execute all commands found in the command file. If the AI cannot find the command file, it will fall back to a general command file. If it cannot find this file it will proceed with preprogrammed instructions.

Spreading further
Every host that is infected "reports" to one of the predefined servers. It will update a counter file. Every host that is infected with the initial spread will increment a number stored in the "infection count" file. When this file reach a critical mass, all AIs will begin secondary infection procedure:

The AI will extract all email addresses contained within the address book of popular mailers (Outlook, Netscape, Eudora). The AI will start sending email with attachments to addresses harvested from the mailers. The attachment will be the package. The rate at which the AI will send mail can be controlled via command files.

Part III: Inner workings

This section will try to explain consideration that should be taken, technical specifications etc. It is aimed at people who understand the underlying technology. It is mainly aimed at programmers that know their stuff.

Initial infection

• Repackage bots Robots that will download executables from frequently visited sites (Tucows etc.), and repackage it to contain the package. These bots could be instructed to visit certain sites more frequent than others and to target certain files. These bots should have the ability the decompress distributions, repackage, and compress it as well.

• DCCsend bot Robots on multiple IRC channels that will at random DCC the package to clients that are detected running the de facto standard Windows client (Mirc). Robots could be written with intelligence to con users to accept the DCC. Bots could be situated in "Warez" channels, spreading the repackaged commercial software.

• FTP put bot Robots that will search the Internet for FTP servers with writable /pub and /incoming directories, and drop the package in those directories.

• Mail bot These bots will be not unlike the mass mailer programs, mailing the package to many individuals, posing as representatives from various organizations such as Hotmail, Geocities etc, with package as free "gift". This "gift" can be something like a new screensaver or HTML writer.

Note that all transport mechanism implies that the receiver is connected to the Internet on some way or another.

The AI itself can be coded in different forms, so that there will be hundreds of different code signatures - this will make it difficult for anti virus vendors to develop a program that will search for code signatures.

First contact
When the user downloaded the package, he/she will execute it. The package will run the normal program, and the AI will also execute. The AI will install itself within the system, in such a way that it will always execute at startup. It will also disguise itself, by renaming itself to a non-suspect filename. This name will contain random letters, and should not be longer than 6 letters. At every restart, it will rename itself again (and modify the startup correctly). It could also modify the startup method -e.g. modifying the registry, or the win.ini.

The AI must be able to detect itself. This will ensure that the AI will not be installed every time the package is executed. This can be done by "marking" the host - it will not reveal where the AI is located, just that it has been infected. This "marking" will furthermore hamper the detection process later on, as this mark has to be removed before the host can be re-infected for lab purposes.

The AI will proceed to determine if it is situated in an online environment (it can open a session to a machine on the Internet). If direct connection is not possible, it will determine if a proxy is present (registry), and use the proxy to connect to the Internet. Ideally, the AI will monitor network traffic with destination port 80, and determine the best path out - be that direct, or via a proxy. As this could involve installing a custom packet driver, the AI could monitor CPU load across different applications, and register an online situation when a browser (IE or Netscape) uses CPU load.

The AI will only try to make a connection if it can safely determine that there is an already open connection to the 'net.

The AI will contain a list of web servers that will be ready to accept the registration. For every AI, this list will contain random preferences. The AI will try to contact the web server with higher preference and send a report to the web server. The AI will send the report in the same way that browsers upload files to web servers. This list could typical contain up to 75 different locations.

The initial report that the AI will send to the web server should contain: