Skip to main content icon/video/no-internet
icon backReturn to Entries

Worms

Internet worms are malicious software programs that self-propagate across a network and the Internet by infecting hosts and in some cases launching malicious activities. The infection occurs by exploiting network services or weaknesses and flaws in software design available on a host. A host that has been infected by a worm actively discovers and spreads a copy of the worm to other vulnerable hosts on the Internet. Unlike a virus that searches for files in a computer system to attach itself to or that requires some sort of user intervention for propagation, a worm has the ability to search for new targets and propagate itself across networks. Worms often cause harm to services and networks such as denial-of-service (DoS) attacks, espionage, eavesdropping, stealth, cyberwar, and other cybercrimes. Worm infection often begins with a single host, which then targets a set of Internet Protocol (IP) addresses on the Internet, searching for more vulnerable hosts. If the worm successfully hits a vulnerable host, it then transfers over a copy of itself to the new host, which begins executing the worm code. This entry examines how Internet worms multiply, their propagation and activation, and several infamous worm outbreaks on the Internet.

Worm Target Discovery

Internet worms have attracted widespread attention due to their ability to propagate themselves. An Internet worm spreads by employing various target discovery techniques to exploit a vulnerable host. On infecting a vulnerable host, the worm uses the victim host to spread copies of itself automatically by using scanning techniques (scanning worms) or by infecting topological neighbors (topological worms). This technique of probing a set of addresses or working through a set of ordered addresses to identify vulnerable hosts is known as scanning. The scanning strategy of a worm is broadly classified as (a) random, (b) permutation, (c) topological, (d) localized, (e) hit-list, (f) stealthy, and (g) routable scanning behaviors.

Random Scanning

Random scanning is the most common and simple target-finding strategy, where worms generate pseudorandom IP addresses and then try to connect to them. Most scanning worms propagate by probing pseudorandom addresses, and on infecting a vulnerable host, the copy of the worm is then transferred to the infected host, which in turn uses the same strategy on the victim to find more vulnerable hosts. Random scanning strategy probes addresses multiple times, scans addresses that are not used, and has no determination of whether hosts are already infected.

Permutation Scanning

In permutation scanning, an infected host is assigned with part of a pseudorandom permuted IP address space to find and infect vulnerable hosts. This is achieved by dividing up the IP address space within which each new worm instance is given part of the IP address space to scan and infect. The scanning behavior starts randomly, then the infected hosts work their way through the assigned IP address space to find more vulnerable hosts. In addition, if the worm encounters an already infected host, it assumes that another worm is working through that sequence of permutation, and therefore, it chooses a new random point and proceeds with the scanning.

...

  • Loading...
locked icon

Sign in to access this content

Get a 30 day FREE TRIAL

  • Watch videos from a variety of sources bringing classroom topics to life
  • Read modern, diverse business cases
  • Explore hundreds of books and reference titles

Read next

More like this

Sage Recommends

We found other relevant content for you on other Sage platforms.

close

Have you created a personal profile? Login or create a profile so that you can save clips, playlists and searches

close
close
close Signed In to profile You are signed in as:
close
Logged in Institution Institution