|
Computer wormFrom Wikipedia, the free encyclopedia.
A computer worm is a self-replicating
computer program, similar to a computer virus. A virus attaches itself to, and
becomes part of, another executable program; a worm is self-contained and does
not need to be part of another program to propagate itself.
The
name 'worm' was taken from The Shockwave Rider, a 1970s science fiction novel
by John Brunner. Researchers writing an early paper on experiments in distributed
computing noted the similarities between their software and the program described
by Brunner and adopted the name.
The first
worm to attract wide attention, the Morris worm, was written by Robert Tappan
Morris, Jr. at the MIT Artificial intelligence Laboratory. It was released on
November 2, 1988, and quickly infected a great many computers on the Internet
at the time. It propagated through a number of bugs in BSD Unix and its derivatives.
Morris himself was convicted under the US Computer Crime and Abuse Act and received
3 years' probation, community service and a fine in excess of $10,000.
In addition to replication,
a worm may be designed to do any number of things, such as delete files on a host
system or send documents via email. More recent worms may be multi-headed and
carry other executables as a payload. However, even in the absence of such a payload,
a worm can wreak havoc just with the network traffic generated by its reproduction.
Mydoom, for example, caused a noticeable worldwide Internet slowdown at the peak
of its spread.
A common payload is for
a worm to install a backdoor in the infected computer, as was done by Sobig and
Mydoom. These zombie computers are used by spam senders for sending junk email
or to cloak their website's address.[1] Spammers are thought to pay for the creation
of such worms [2] [3], and worm writers have been caught selling lists of IP addresses
of infected machines.[4] Others try to blackmail companies with threatened DDOS
attacks.[5] The backdoors can also be exploited by other worms, such as Doomjuice,
which spreads using the backdoor opened by Mydoom.
Whether
worms can be useful is a common theoretical question in computer science and artificial
intelligence. The Nachi family of worms, for example, tried to download then install
patches from Microsoft's website to fix various vulnerabilities in the host system
(the same vulnerabilities that they exploited). This eventually made the systems
affected more secure, but generated considerable network traffic, rebooted the
machine in the course of patching it, and, maybe most importantly, did its work
without the explicit consent of the computer's owner or user. As such, most security
experts deprecate worms, whatever their payload. | |
|
|
|
BluePink 
