ABSTRACT This minor research report is about the computer worm which is a self-navigating malicious program that is being utilized by many attackers to damage the target machine substantially. This report begins by giving an idea of what exactly is computer worm, then we discuss about the mechanism which this malicious code uses to attack the target machine, then we discuss about the various worms which have been discover and design till now, an overview is given about this worm infects the system and the exten to which these worms have cause damage. After that we discuss various prevention tools which are design to detect and eliminate such worms. In the end we discuss about the future potential worms and predicted what kind code will be written and how much damage it can cause to system or network.

INTRODUCTION Everyone, almost everyone and every big organization like bank, pharmaceutical companies, and retail chain companies uses computer these days to do most of the important work so it is understood that their computer will contain certain sensitive information which they do not want to disclose, and as result such kind of information need security, and the term information security was introduced. In this minor research paper we discuss about one malicious code which is a serious threat to such information called WORM. A computer worm is a kind of malicious program which has the capability of reproducing itself and uses computer network to distribute throughout the network, this malicious code unlike virus is independent of other program for the purpose of propagation and infecting the system. It is a kind of malware that most of the time enters the system through the medium of infected e-mail, worms usually hunt for the system with vulnerabilities which they can easily exploit and cause substantial damage to the entire system, once the worms enter the system or any network depending upon the payload which is the code which the author of the worms designs, will destroy the system like some worms will completely corrupt the documents in the system some worms will hinder the performance of the system by utilizing the resources some worms will replicate itself and sends itself to everyone on the contact list of the target machine. This research report discusses the various mechanisms which worm uses to navigate and infect the system, and also this report contains description of various worms detected till now and various tools and system design to prevent them.

MECHANISM In this section we discuss how a worm starts the infection and how it propagates through the machine to multiply the effect of it on the machine. There are certain techniques through which worm discovers its target and infects it, this techniques are discuss below 1. Target locater: If a worm wants to infect any machine. It must first discover if that machine exist. To check the existence of the machine, the worms follow certain techniques. They are a) Scanning: This technique involves searching a set of addresses to identify the vulnerable hosts. The scanning can performed in either of the two ways, they are Sequential scanning in which worms working through an address block using ordered set of addresses and Random scanning in which worms trying to address out of a block in pseudo-random fashion) b) Pre-generated Target Lists: Here an attacker creates a hit list of certain or probable targets, there is chance that this list is created we in advance before the attack begins. There are some scanning techniques like are Stealthy scans, Distributed scanning, DNS searches, Just listen and also there are some public surveys that list such as Netcraft Survey with the help of this worms just see for particular criteria such as the operating system that the machine is running, what the servers are running, what is the version of operating systems etc. c) Internal Target Lists: Many applications include information about the other hosts providing vulnerable services. Such target lists might be used in creation of ’topological’ worms, where worm looks for the local information to hunt new victims by discovering the local communication topology d) Passive: Worms design with this intention does not seek out victim machines. Instead, they either wait for potential victims to contact or rely on user behaviour to hunt for new targets. Even though they are potentially slow these worms produce no uncharacteristic traffic patterns during the target discovery, which makes them dangerous.

2. Infection Propagator: This is an important strategy which worms used in which worms transfer itself to a new node and gets control of it, here this technique is carried out when any worm makes an assumption that the system it has infected has similar characteristic to the system which it transfer itself to. 3. Remote Control and Update Interface: Another vital element of a worm is remote control using a communication module. Without such a module, the worm’s creator does not have control over worm network by broadcasting control messages to copies of worm, such remote control facilitates the attacker in using the worm as a DDoS (distributed denial of service) tool on the zombie network to infect several unknown targets. The attacker can change the behaviour of the worm and even broadcast new infection policy to as many compromised nodes as possible 4. Payload: It is the most important component of worm, it is basically a code which contains script which is designed with an intention of how it will affect the machine. Different attacker will have different payload for their worm depending on their goal and imagination behind designing the worms. Recently it is becoming popular to install an SMTP (Simple Mail Transfer Protocol) spam relay as the payload of a worm

DIFFERENT TYPES OF WORMS 1. E-mail worms: This type of worms have the capability of distributing itself through infected e-mail messages, here e-mails are specially coded to be infected. AN e-mail can have a link which is directed to a certain infected websites which are infected with worm's payload. The worms are activated when a user clicks on the infected link or downloads the infected attachment which contains the worm's payload. When such type of worms spread it generates new e-mail addresses with common names as a result we cannot determine that whether the sender's address is genuine or not. Different ways through which worms are spread include Windows MAPI functions, MS Outlook, direct connection to SMTP servers which has worm’s own SMTP API.

2. Internet worms: This type of worms have capability of scanning network resources which are being utilize by local computers on those networks and look for such type of systems via internet which are vulnerable. The intentions of such kind worms are to gain full access of the vulnerable systems by attacking it. Un-patched systems are also attacked by such kind of worms in which they can easily send request or infected data packets as result of which, worm downloader are installed or the worm itself infects the system.

3. Instant Messaging worms (IM worms): Now days many people communicate and contact their friends through instant messaging application, so attacker concentrates on such application and develops a payload of worm in such a way that it infects the system of the user using this application. Here the attacker broadcast the message in the application and the message contains the link which directs to the website which infected by the worm or an attachment in which contains the worm downloader or the worm itself, if any unsuspected user opens up the message and access the link or attachment his or her system gets infected

4. IRC worms: This is a subtype of instant messaging worms, here the attacker uses chat channels in the messaging application to broadcast infected message containing link to the infected website or an attachment, by downloading which, the user's system gets infected by the worm. 5. File-Sharing Network worms: This worm is also has name called P2P worms. This type worms targets system on which certain file sharing application are running, here the worm in certain shared folder of the application has a file containing payload which will infect the system on its access by the user, the attacker keeps the name of the file in such a way that any unsuspicious user might access it and his or her system gets infected.

6. I-Worm Rays: This computer worms easily transmits and has the capability of being very destructive in nature. This worm is usually in the infected e-mail and it infects the system easily, when any user opens this infected e-mail it spreads through the system rapidly and destroys the whole collection of documents inside the system and also the performance of the system is substantially reduced. The infected e-mail is given either an attractive name or common name so that any unsuspicious user accesses it.

7. Worm Klez: This worm is also known as Klez. This worm back in 2000 infected the operating system of Microsoft through an e-mail. This worm made a security breach in the Microsoft windows through internet explorer application with the aid of IFRAME VULNERABILITY. This worm on opening an e-mail gets into the system infects it and spread through the network to which the system is connected and also it creates a file with a name K which is a windows exe file.

8. I Love You: It is the most famous worm in the history, it was also known as love letter, it affected millions of system in 2000. The distribution of this worm started with an e-mail which contained an attachment which was named I Love You. On downloading the attachment from the e-mail the worm rapidly spreads throughout the system and make unwanted and dangerous modification in it and then makes a duplicate of itself and sends it to all the contacts on the contact list of that user

9. Slammer worms: It was the fastest spreading worm in the history of deliberate software attack, it has also has another name call sapphire. Back in 2003, the distribution begin through internet, infecting almost 90% of vulnerable systems in a span of 15 minutes, causing substantial damage to financial, government, transportation systems. The vulnerabilities which this worm exploited was the two buffer overrun vulnerabilities in SQL server desktop engine and database server of the same, the technique with which these vulnerabilities were exploited were stack overflow and heap overflow techniques. The total size of this worm was 404 bytes and it used to scan the vulnerable system at very high rate and for navigation it used UDP protocol so in single transfer the entire worm was transmitted.

10. Blaster worms: This worm first came in to picture in 2003 was multistage worm which infected nearly half million systems. The vulnerability which this worm exploited was the remote procedure call (RPC) of Microsoft operating system which were Windows 2000 and XP, the technique which this particular worm uses to infect the system is as follows. If the victims TCP connection is opened to 135 port then the payload is sent to this target machine, if the machine is vulnerable the code will run and will have a remote execution from the host which is an attacker and if the XP operating system is unpatched it automatically reboots and the file mblast.exe is stored on the target machine using TFTP protocol.

TOOLS TO PREVENT WORMS FROM ATTACKING THE SYSTEM In this section we discuss about the tools which are used to analyze the vulnerability and configuration of the system of which attacker takes advantage to make the payload of the worm and attack the system accordingly. 1. Kuang: It is a system based on certain rules which discover inconsistencies in the protection modules made by the UNIX system administrators. It helps the manager in making better protection decision using 'what if' protection mechanism. The main intention of kuang is to find the security holes in configuration made for protection by the system manager and not the holes in the operating system. The kuang describes the protection configuration in the unix system from the attacker's perspective, using this method the system performs reverse chaining process to find the vulnerabilities. The liability of the system is not being capable to find the vulnerability at network level.

2. NetKuang: This system is an extension of kuang, having the capability to find the vulnerability at the network level, reason bad protection configuration of the system at network level. Here multiple systems are checked on the network using techniques like parallel and bread first search. The limitation of this system is that it finds only single match in the network, even though there could be multiple paths between privileges of start and end.

3. Noose (Networked Object-Oriented Security Examiner): It is a distributed system, which makes vulnerability analysis on the object modelling based system. It combines the process of host and network based scanning procedure, and the results of such scans are stored in the object classes. It also collects vulnerability analysis data of different programs and presenting it in the form of integrated database, and elaborates how different combination of such vulnerabilities may have effect on the systems. The intelligence of this system is designed in such manner that it immediately installs the missing security patches after the verification of missing security patches.

4. TrendCenter- Predict the next worm: The perspective of TrendCenter is IDS models and 'detect and respond ' models are ineffective in countering worms, and as result it believes in the application of 'predict and prepare' model. The way this model functions is, from many IDEs it aggregates information about the vulnerability and after correlating it all information collected, it predicts what kind of worm any attacker could possibly design or code to exploit such kind of discovered vulnerabilities.

5. Other System: In this section, there are certain standalone and networked tools or systems which are designed to detect vulnerability, effectiveness, integrity of the security configuration of the system, they are COPS(Computer oracle password and security system), SATAN(Security administrator tools for analyzing network), ISS and Nessus which hunt of known vulnerabilities in the system through scanning. System administrator can refer websites like Dshield.org and incidents.org which maintains a list of top 10 vulnerabilities in the system, with the help of which they can fix the bugs in the network. Apart from this, this site also provides information about the possible ip addresses from which the attack could be launch.

Future Worms 1. Warhol worms: Attackers after designing this worm have the capability of gaining information about 10,000 to 50,000 computer systems which have good network connection. When this worm attacks such big network, the author have distributed control over the worms and have the facility of updating the worm payload remotely, and this worm uses hit-list scanning technique.

2. Flash Worms: This worm is an improved version of warhol worms, this worm uses divide and conquer strategy, what it does is the hit list which this worm has, it partitions it into small blocks and then attack each block individually by sending a child worm to each host in the partitioned blocks of the hit list which this worm has, this type of attack is also known as parallel attack, here the child worm starts attacking the host before receiving the entire hit list of host and this increase the parallelism process, this worm on the high bandwidth network can infect any machine on its network within 30 seconds.

3. Stealth worms: This worm in comparison to flash worm distributes itself at measured rate with no suspicious communication pattern because of which it becomes undetectable. The main intentions of such worms without getting detected, attack as many host as possible, such kind of worms create trap door for other high speed worms, plant viruses like Trojan horse which can attack the host machine on getting triggered by the attacker and also place time bombs on to the system which can cause substantial damage to the system when it goes of for which most of the time no recovery is possible.

4. Polymorphic worms: This type of worms are design in such manner that they change their mode of attack or functionality as they navigate to different machines, though there is no precise description of such worms. Here the code of the worm contains an additional module called mutation code because of which the worm changes it functionality on different machines, such type of worm have the capability of reprogramming itself according to the different parameters of the system to discover vulnerabilities in the system.

CONCLUSION This minor research report concludes that computer worm a malicious self replicating program code is a potential threat to information security and even after discussing various dangerous worms detected till now and the various tools and systems design to prevent and eliminate this malicious program. There is still potential for new worm to designed and become a threat to information security

REFRENCES * http://www.it.iitb.ac.in/~shravan/Seminar/report.pdf * http://seclab.cs.ucdavis.edu/papers/Cheetancheri-thesis.pdf * http://computerworm.net/ * http://www.icir.org/vern/papers/taxonomy.pdf