1

1. To discuss the history of computer virus outbreaks.

2. To examine the difference between computer worms and viruses.

3. To discover the various types of computer worms and viruses and how to protect a computer.

4. To assess the consequences associated with computer worms and viruses. 2

• Is a malicious computer program created by a user with objectives to harm or steal another’s property • Is also referred to as

Malware

• Is important for users to be aware of

Computer Virus:

a malicious computer program created by a user with objectives to harm or steal another’s property 3

• Is a piece of code attaching itself to a larger, more frequently used program – it then modifies the program – this is referred to as “piggybacking” • Is active and running only when the host program is active • Is designed to multiply and infect other programs the computer runs • Protect themselves by hiding in a host program

Host Program:

a large, frequently run program attached to the virus

Piggybacking:

the act of a computer virus attaching itself to another computer program 4

• Begins to carry out whatever malicious activity it is supposed to, once it has multiplied and infected other programs – the malicious activity is known as the payload • Can spread fast, slow or not spread at all – if the virus programmer made an error in designing the virus then it will not spread at all • Can remain dormant in a computer until a specified time • Can delete all data and files on a computer

Payload:

the malicious activity a computer virus or worm is designed to do 5

• Can affect different parts of the computer

– such as: • the hard drive • a CD/DVD Drive • any type of storage device

• Can spread through virtually any computer to server or computer to computer contact

– Examples of spreading medians: • Internet • downloading attachments or music • CD or thumb drive 6

• Is an independent program

– it does not attach itself to files or programs

• Is classified by two types:

– a network worm – a host worm

Computer Worm:

an independent program which multiplies itself by copying a segment of itself onto another computer 7

• Can contain malicious instructions to hinder a computer’s performance • Uses flaws or holes in the network to gain access to individual computers

– this gives worms the ability to move extremely fast through a network infecting computers • it could possibly infect an entire network of computers within seconds 8

• Multiplies by copying a segment of itself onto another computer over a network – the segments of the worm, on various computers in a network, remain in contact with each other – if one segment of the worm fails or is removed, then the other remaining segments must find another computer, prepare it for the worm and then add the segment to the rest of the worm – this is how the worm moves through a network

Network Worm:

a computer worm which copies different segments of itself to computers linked together in a network 9

• Is completely contained on one running computer • Copies itself to another computer through a network • Deletes itself from the original computer, once it has moved to another computer • Does not fragment or segment itself – a network worm does run different segments of itself on different computers

Host Worm:

a computer worm which copies itself to another computer in a network and then deletes itself completely from the previous computer in which it was contained 10

• Include: – they both usually contain malicious instructions • designed to harm a computer and annoy a user – they cause an increasing amount of damage • the more computers the worms or viruses infect the more computers they have access to infect by networking 11

• Include: – protecting themselves by hiding in host programs or changing their appearance to evade detection – destroying evidence of their presence and wrongdoings – spreading through a network, the Internet, software, e-mails or memory devices (such as a rewritable CD) – causing system or network slowdowns 12

• Include:

– a virus requires a host program • a worm is an independent program – a virus modifies other programs • a worm usually does not – a virus only executes when the host program is running • a worm is always active 13

• Include: – a virus uses host programs to replicate • a worm replicates itself over a network – a virus needs to be activated or downloaded (such as a virus sent through e-mail, it must be double clicked in order for it to be able to run) • a worm does not need to be activated – it will move or copy itself to a computer without the user’s knowledge 14

Virus • requires host program • modifies other programs • only active when host is active • uses host to replicate • requires user involvement to be activated or downloaded Worm • independent program • does not modify other programs • always active and running on the computer • self replicating over a network • copies itself to a computer without the users permission or knowledge 15

• Is a malicious program disguised in a seemingly innocent program • Is an analogy referencing the “Trojan Horse” used by the Greeks to obtain access to the city of Troy – The Greeks were losing in the battle to overtake the city of Troy, so their leader Odysseus, built a seemingly innocent giant wooden horse with a hollow belly, large enough for soldiers to hide in. He offered it to the Trojans as a sign of peace. The Trojans accepted the gift and celebrated their victory. Then at night while they were sleeping, the Greeks snuck out of the horse, which they were hiding in, and took the city of Troy.

Trojan Horse:

a malicious program disguised inside of another program seemingly beneficial or harmless 16

• Will generally gain access to administrative areas on a computer – once it has gained access to these areas, it will create a back door – this gives the creator of the Trojan horse unauthorized access to the user’s computer and the information it contains • Will sometimes monitor keystrokes and browsing activity – this information is sent to companies sending the user content and information they did not request • Can be discreet – meaning they do not leave any trace of their presence 17

• Began in 1949 when John Von Neumann wrote a paper called “Theory and Organization of Complicated Automata”

– this paper assumed a computer program could self-replicate – this theory was later called “Core Wars” 18

• Became a reality in 1982 when the first virus called the “Elk Cloner” was created by Rich Skrenta – The virus created by Skrenta was created as a prank on his friends. He modified floppy disks containing games or software which were swapped within his group of friends. Instead of running the software or game the disk displayed taunting messages.

19

• Was created as what is now known as a boot sector virus – a copy of the virus is downloaded off of a disk when the computer is booted up – then when someone else inserts a disk into the computer, the virus is downloaded to the new disk • Began as an innocent prank – however this prank opened the door for numerous, harmful viruses to be created 20

• Progressed in the 80’s and 90’s, when hackers developed new ways to steal information and inhibit regular computer use • Took significant strides with the following viruses: – “The Brain” in 1986 created in Pakistan by brothers Basit Amjad and Farooq Alvi • this was a boot sector virus and technically the first stealth virus, which means if anyone attempted to view the infected sector, the virus would replace it with the clean, original version of the sector 21

• •

Stealth Virus:

a virus in which if anyone attempts to view an infected sector, the virus will replace it with the clean, original version of the sector

Boot Sector Virus

: a virus which copies itself onto a computer off of a disk when the computer is booted up; then when someone else inserts a disk into the computer, the virus is downloaded to the new disk 22

• Has been developed by hackers experimenting with other ideas of viruses and then building on them • Was greatly effected by the “Vienna Virus” – this virus was picked apart by Ralph Burger – he then wrote a book called Computer Viruses: A High Tech Disease 23

• Explained the process of creating a virus • Was widely publicized it • Made computer viruses popular, and hackers began widely creating and distributing viruses

24

• Begins with the idea of computer viruses • Made its first significant stride around 1980 when researchers at Xerox Palo Alto Research center developed the first worm for experimental research – this worm was developed to handle mail, administer diagnostics and execute other functions – was created without malicious intentions 25

• Was created by Robert Morris in 1988 • Was the first worm to be distributed over a network without other users being aware of its presence • Was designed for experimental purposes • Was released onto a network to remain present without negatively affecting the network 26

• Began clogging the network – by multiple versions of the worm being run on the same machine at once – this slowed the system by using all of its processing power, and inhibited new users from accessing the network – Robert Morris went on trial and was convicted and received a fine, probation and community service • Affected approximately 6,000 servers and caused between $10 million to $100 million dollars worth of damage 27

• 1949 – John Von Neumann wrote a paper theorizing a self-replicating computer program • 1980 – Researchers at Xerox Palo Alto Research developed the first experimental worm • 1982 – First virus, “Elk Cloner”, was created by Rich Skrenta • 1986 – “The Brain” was created by brothers Basit and Amjad and Farooq Alvi • 1988 – “The Vienna Virus” was picked apart by Ralph Burger who then wrote a book explaining how to create a virus • 1988 – “Morris Worm” was the first worm was released damaging computers 28

• 1993 – The “SatanBug” was created devastating many computers – the FBI investigated and discovered the creator was a child • 1996 – The “Concept Virus” was released and devastated the computer world – first virus widely affecting Word ® documents • 1999 – The “Melissa Worm” was released – this macro devastated many commercial organizations because of their high usage of Word ® and Excel ® • 2001 – “Code Red” worm was discovered – provided control of the Web server to anyone who knew the security had been compromised 29

• Are at both the state and federal level – meaning a hacker can be prosecuted at the state level if the virus did not leave the state or at the federal level if it crossed state boundaries • if it is prosecuted at the federal level the U.S. Secret Service will generally investigate • Are usually considered a felony • Can be found on http://www.ncsl.org/programs/lis/cip/viruslaws.h

tm – this is for individual state legislation 30

• Began in 1986 with the Computer Fraud and Abuse Act – this lays out the prosecution for using the computer for fraud – the punishment varies depending on: • the amount of damage caused by the worm • if the amount of damage caused was intentional – this would be difficult to find evidence • if the worm or virus was created for commercial advantage or personal financial gain – the punishment for such a crime is imprisonment for up to 20 years and/or a fine • the fine is decided by a judge 31

• Was amended in 1994 and 1996

– it was amended because of: • innovative worms and viruses • clarification issues – the fines and punishments remained the same 32

• Arose from distinguishing whether something was a worm, virus or Trojan horse

– the legislation was amended so all of the above would fall under the following statement • "transmission of a program, information, code, or command" that "cause[s] damage to a computer, computer system, network, information, data or program." 18 U.S.C. Sec. 1030(a)(5)(A).

33

• Against computer worms and viruses comes from anti-virus software and good judgment from the computer user – use good judgment when opening suspicious e mails or downloading attachments • if it really does not look important, then do not open it • viruses in e-mails can find a user’s e-mail list then send itself in an attachment to all of the contacts on the list 34

• May be completed by scanning all disks and files used on another computer before opening files – this is an easy feature contained in anti-virus software • Requires users to scan attachments and downloads from the Internet by an anti-virus software before opening them 35

• Calls for users in a computer lab to clean up or “reboot” a computer before using – this can be done with a simple action called Disk Cleanup • it can be found by going to Start>All Programs>Accessories>System Tools> Disk Cleanup • this removes all potentially harmful temporary Internet files – also be sure to log out when using a public computer 36

• Requires users to back up all important information periodically – in case a virus or worm does destroy all files contained on a computer • Involves users to advise caution when accepting copied software – sometimes software will be considered public domain, where the manufacturer will give it to users at little or no cost – be sure the copied software is from a trusted source 37

• Is the most common form of computer protection against viruses and worms • Was first introduced in 1990 • Needs to be high-quality – there is free anti-virus software on the Internet which will not protect a user’s computer as well as a program paid for • Needs to updated regularly – most software will update itself regularly when connected to the Internet, be sure to install all updates possible 38

• Recommended for Windows

®

includes:

– McAfee VirusScan ® – Norton AntiVirus ®

• Recommended for Mac

®

includes:

– McAfee Virex ® – Intego VirusBarrier ® – Norton AntiVirus ® 39

1. List one similarity and one difference of Worms and Viruses.

2. There are two types of computer worms a network worm and a

a. server worm b. host worm c. Trojan horse d. Morris worm 40

3. A Trojan horse will generally attempt to gain access of which type of area on a computer?

a. administrative b. memory or storage c. network links d. hard drive 4. Imprisonment time for a computer virus can range from 0 to a. 10 years b. 15 years c. 20 years d. 25 years 41

5. The first virus created in 1982 was the ______________ virus: a.

Trojan horse b.

c.

d.

Morris burger elk Cloner 6. A virus in which if anyone attempted to view an infected sector, the virus would replace it with the clean, original version of the sector is known as a(n) a.

b.

boot sector virus stealth virus c.

d.

elk Cloner virus Morris virus 42

7. A Trojan horse will possibly: a. monitor keystrokes b. monitor browsing activity c. clog a network d. both a and b e. none of the above 8. Computer files generally back themselves up automatically, so there is no need to frequently back up important files.

a. true b. false 43

•

Computer Fraud and Abuse Act.

fa86.html

(2003, January). Retrieved October 9, 2008, from Laws and Texas Tech University System Policies Affecting Computer Use: http://www.depts.ttu.edu/itts/documentation/laws/lpctexts/c •

Economics.

(2008). Retrieved October 9, 2008, from About.Com: http://kb.iu.edu/data/aehm.html

•

Hacker Marks 25th Anniversary of First Computer Virus.

(2007, September 6). Retrieved October 9, 2008, from FOXNews.Com: http://www.foxnews.com/story/0,2933,295813,00.html

• Kutner, T. (2007).

Tips from Tonna for your PC.

Retrieved October 9, 2008, from Computer Lynx: http://www.computer-lynx.com/a-virus-or-worm.htm

• Lehtinen, Rick, and G. T. Gangemi. Computer Security Basics, 2nd Edition. O'Reilly, 2006.

44

• • • • •

Computer Viruses: Making the Time Fit the Crime.

October 9, 2008, from Ford Marrin Esposito Witmeyer & Gleser, L.L.P: http://www.fmew.com/archive/virus/ (1997). Retrieved Fosnock, C. (2005).

Computer Worms: Past, Present, and Future.

Retrieved October 9, 2008, from East Carolina University: http://www.infosecwriters.com/text_resources/pdf/Computer_Worms_P ast_Present_and_Future.pdf

Protecting your computer from viruses.

(2007). Retrieved October 9, 2008, from University of Washington: http://www.washington.edu/computing/virus.html#HOW

The History of Computer Viruses.

(2008). Retrieved October 9, 2008, from Virus Scan Software: http://inventors.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=inve ntors&cdn=money&tm=10&gps=166_142_1436_695&f=10&tt=14&bt=1 &bts=0&zu=http%3A//www.virus-scan-software.com/virus-scan help/answers/the-history-of-computer-viruses.shtml

Worms.

(2007). Retrieved October 9, 2008, from Cybercrime: http://cybercrime.planetindia.net/worms.htm 45

Production Coordinator:

Jessica House

Production Manager:

Dusty Moore

Project Coordinator:

Maggie Bigham

Graphic Designer:

Ann Adams

Executive Producers:

Gordon Davis, Ph.D., Jeff Lansdell © MMIX CEV Multimedia, Ltd.

46