What Does a Spreading Worm Look Like?

quibbs0 writes "When a new worm spreads around the world, people want to know if they are protected. How fast is it? How does it spread? A new simulation program developed by Symantec Research Labs not only has the answers, it also provides pictures."

What a spreading worm *really* looks like.

[TripMaster Monkey]

What Does a Spreading Worm Look Like?

This [moviegoods.com] is what a spreading worm looks like.

^_^

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:What a spreading worm *really* looks like.

[Ced_Ex]

I was thinking more Fear Factor like... particular when they have them piled up on a plate or in a doughnut.

Re:What a spreading worm *really* looks like.

[pdbogen]

Am I the only one reminded of Alpha Centauri by that picture?

Re:What a spreading worm *really* looks like.

[Reziac]

I thought it might look rather like a flatworm, or perhaps a leech.

"When a new worm spreads around the world, people want to know if they are protected."

Well, I suppose that depends on whether it's an endangered species or not.

Re:What a spreading worm *really* looks like.

[Spacejock]

Like a centerfold without the legs?

When you say spreading....

[ZephyrXero]

...do you mean like this [okccc.edu]?

launching a windows executable from a link

[codepunk]

That is exactly what it looks like, a windows executable installer launched off of a web page with unknow origin.

Re:launching a windows executable from a link

[justforaday]

Certainly doesn't help that it's on the "enterprisesecurity" subdomain either...

Re:launching a windows executable from a link

[Shisha]

Odd; the simulation does not work on any of the platforms I use (OS X, Linux). So no pretty pictures for me. I guess that's because Linux (or OS X) are not "enterprise ready".

Is it a coincidence that the only platform, for which one can get programs simulating the spread of worms, is MS Windows?

Re:launching a windows executable from a link

[peculiarmethod]

Is it a coincidence that the only platform, for which one can get programs simulating the spread of worms, is MS Windows?

No. Who else will it matter to, except those just trying to convert people to another OS or an admin?

Re:Mac Worms

[allgood2]

First Netsky DOES NOT effect Mac OS. It can be received via email like numerous other PC viruses, but doesn't execute or cause any damage on a Mac OS X machine.

Second, Opener/Renepo IS NOT a virus or a worm. It doesn't spread and can not self-replicate. Opener/Renepo can cause damage to a Mac OS X system, but only if the user running it has permission to run it, and grants the app permission to run and perform the damage. It can't traverse the network, spread to others machines, or run without explicit per

Re:launching a windows executable from a link

[DenDave]

No shit eh? I ain't gonna download an executable from Symantic!! I don't trust these folks any further than I can throw 'em!!

Re:launching a windows executable from a link

[imipak]

That is exactly what it looks like, a windows executable installer launched off of a web page with unknow origin.

The origin looks pretty well-known to me. Don't you download software from the net? If not, where do you get your Windows updates from?

You mean...

[hummassa]

A linux binary that could chmod +x itself, and then execute? Preferently as root, so it can open a port in the iptables firewall? :-) Yeah, I didn't think so either.

Re:launching a windows executable from a link

[sp0rk173]

And then us BSD users will laugh, and slashdot will be ours!! BAHAHAHAHHAHAHAAHAH

...all three of us.

Fastest way to spread a worm...

[D4MO]

Linking directly to an MSI file in a slashdot story.

Re:Fastest way to spread a worm...

[boaworm]

I seem to be immune to these worms, I cannot doubleclick on the "msi" file.

boaworm$ ls -l *.msi
-rw-r--r-- 1 boaworm boaworm 2022400 28 Apr 17:16 SRL_Worm_Simulator.msi
mirage:~/Desktop boaworm$ chmod a+x SRL_Worm_Simulator.msi
mirage:~/Desktop boaworm$ ./SRL_Worm_Simulator.msi
-bash: ./SRL_Worm_Simulator.msi: cannot execute binary file
mirage:~/Desktop boaworm$

Poor me, my Panther cant even get that worm to RUN... i't should be dead scared, should it not ? Perhaps I need Tiger..

Re:Fastest way to spread a worm...

[Neurotoxic666]

You must be new here. People don't click the links.

Great thing for a security company to encourage

[Lord Bitman]

"So, what does a worm look like when it spreads? Install this program to find out!"

and ALT-F4 will activate "ultra mode"

Re:Great thing for a security company to encourage

[EvilTwinSkippy]

Also feel free to tune into our "super low lag" server at 127.0.0.1

Appropriate packaging

[PowerBert]

It's good to see the worm simulator is only slightly less platform independant than your average worm.

Perhaps Symantec figure the only ones who would want to look at a spreading worm are those most affected by it??

real plot?

[moz25]

Interesting, but I would be slightly more interested in a real-time actual plot. Do they have that available as well?

What Does a Spreading Worm Look Like?

[Zontar The Mindless]

And it's a .msi file, hence Windows only.

How appropriate.

Re:What Does a Spreading Worm Look Like?

[Zontar The Mindless]

Which requires a Windows installation.

You were saying?

Spreading Worm?

[TheFlyingGoat]

You mean one that's been stepped on? It looks something like this [moi-carine.com].

Hey, at least I'm not trying to launch an executable on you.

Re:Spreading Worm?

[toxcspdrmn]

Um - that is a millipede. The legs are a dead giveaway.

msi

[hugzz]

.msi format. usefull.

screenshots, anyone?

Re:msi

[Ford Prefect]

screenshots, anyone?

I installed it on a sacrificial Windows machine, and the results were something like this [google.com]. Eww!

Re:msi

[HaydnH]

Sure: http://www.jeanhaines.com/tmp/wormSim.html [jeanhaines.com]

*watches website get /.'ed!*

Haydn.

You want us to install a program?

[mrighi]

I can't believe Slashdot wants us to learn how a virus spreads by encouraging us to download an MSI executable off the home page!

That would be like me going to the doctor and having him ask me if I know how HIV is spread and then asking me to take my pants off.

Re:You want us to install a program?

[jafac]

No -
Remember, this is coming from Symantec:

it would be more like going to a Glaxo Marketing Rep's office, and having him demonstrate how HIV is spread, by bending you over his desk. Then charging you the $300 or so a day for the next ten years for AIDS meds his company makes.

Torren

[spadadot]

Ok, it's not that useful this time, but I'm doing this to learn :)

http://dload.digitalriviera.com/SRL_Worm_Simulator .msi.torrent [digitalriviera.com]

Re:Torren

[jericho4.0]

Actually, it's totally useless. It's a 404. But it's cool that you're figuring it out for next time....

Re:Torren

[bill_kress]

So, now we not only have somewhat untrusted code from a party who profits from the spread of virii, but we've now had it repackaged by a completely untrested third party.

I'm being ungrateful, just pointing out the ever-increasing irony.

Interesting article in IEEE spectrum

[karvind]

On similar theme, current issue of IEEE Spectrum has article on How to Hook Worms [ieee.org]

Re:Interesting article in IEEE spectrum

[notsoanonymouscoward]

beyond lame. they even try to rename honeynets to "Billy Goats". Also, once worms get a little wiser about their propagation schemes, this thing is history.

Re:Interesting article in IEEE spectrum

[johnkoer]

Man the IEEE makes everything so hard, this illustration should be good enough:

http://www.fish-hawk.net/tips/texas/worm7.jpg [fish-hawk.net]

Snake Oil for sale

[Marcus Erroneous]

Is it just me or do others see some issues with the people who provide the cure also providing the pictures documenting the severity of the infection? Symantec, for one, has already been slammed for sounding the alarms and hyping the dangers in order to elevate the demand for their product. Now I'm to trust their software that shows dramatic footage!! of these insidious worms assaulting the world as we know it.
Next you'll probably want me to go ask the Bush camp if we should invade Iran or the Democrats if we should repeal the two term law and re-elect Clinton again. On my way I'll stop by the car dealership and see if my current car is okay or if I should get a new one just to be safe.

Re:Snake Oil for sale

[utexaspunk]

while i agree that the antivirus companies have some dubious tactics, i dunno if this is really all that inappropriate. people studying diseases often study transmission patterns and infection rates, but we don't accuse them of any impropriety. you'd expect an oncologist to have some decent pictures of a cancer spreading, wouldn't you?

Re:Snake Oil for sale

[Taladar]

The difference is that doctors usually sell medication or a cure, not a preventive product.

Re:Snake Oil for sale

[Jane_Dozey]

How about a major drugs company showing the spread of a nasty disease that they happen to sell medication for?

Re:Snake Oil for sale

[iritant]

On its own I wouldn't discount what Semantec says. However, "simulations" generally involve models, and those models have assumptions. What are the assumptions in this model, I wonder? We already know that a virus can travel roughly at the speed of a disk drive's ability to write.

It would be more interesting to see a study of computer-based virii versus biological ones. How about some real epidemiologists take a crack at it? Perhaps they already have..

Anyone? Anyone? Bueller?

Re:Snake Oil for sale

[Monkelectric]

Symantec has been hitting the press very hard, this is just the latest in their ongoing attempt to convince us they dont suck.

Re:Snake Oil for sale

[qualico]

...and using /. to do it!

Re:Snake Oil for sale

[Kz]

I was wondering why the absurt .msi format, but after reading your post i'm thinking it might be a strange tactic...

don't you have to turn down security levels on IE to see those things? if more and more content is provided that way, more people will put their browser in the 'hole-ridden' setting... and therefore will need more symantec software

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:*Yawn*

[-brazil-]

If they look all the same to you, you didn't look at all of them. The Slammer looks radically different from all the others. Due to its tiny size and rapid mode of travel (UDP packets sent to random IP numbers), it spread extremely quickly to nearly all vulnerable systems - but only relatively few systems (those running MS SQL server) were vulnerable.

Goodbye Slashdot.

[shippo]

I've been reading (and occasionally posting) to Slashdot for years.

However this farcical link to a .MSI file has convinced me that you are now just a bunch of clueless morons.

Goodbye.

Re:Goodbye Slashdot.

[utexaspunk]

and all the comments mentioning the stupidity of the .msi link didn't make us not morons? everyone agrees the editors suck, but i think it's safe to say most of us don't come here for the quality articles. most of us don't even read them! we're here for the discussion.

anyway, don't let the door hit you on the way out!

Re:Goodbye Slashdot.

[Lothsahn]

...you must be new here.

Re:Goodbye Slashdot.

[sehryan]

Can I have your UserID?

Re:Goodbye Slashdot.

[qualico]

lol, beat me to it.

Can you post your account on eBay?
#56 here I come!

Re:Goodbye Slashdot.

[Vaystrem]

Bah its not worth it its just a '6 digit id' ;)

Re:Goodbye Slashdot.

[Any Web Loco]

Can I have yours?

Re:Goodbye Slashdot.

[toofast]

How long before we start seeing low slashdot ID's for sale on eBay...

Re:

[account_deleted]

Comment removed based on user account deletion

Agent USA

[Sporkinum]

Agent USA was the original virus simulator. It was a game for the Atari 800 in 1985.

Re:Agent USA

[Just Some Guy]

Agent USA was the original virus simulator. It was a game for the Atari 800 in 1985.

Are you sure about that [corewar.co.uk]? It seems like that claim could easily go to Agent USA or Corewars (or something else entirely - Lisp hackers are notorious for inventing clever amusements (like Emacs (which probably has a Corewars-mode (oh, it does [sourceforge.net])))).

Under OSX it looks like this ...

[rewinn]

Running OS X 10.3.9, I get:

1. "No default application specified for SRL_Worm_Simulator.msi"

... so I specify Windows Media Player and get:

2. "Cannot play back the file. File format is invalid"

[Is SRI hinting at something???]

Re:Under OSX it looks like this ...

[pdbogen]

No, but OS X is hinting that .msi is a Micro-Soft Installer...

Re:Under OSX it looks like this ...

[night_flyer]

possibly because it is a program, not a video file?
(MSI=MicroSoft Installer)

Re:Under OSX it looks like this ...

[rewinn]

Ah, maybe so ... but a well-designed program, when asked to open a data file it cannot recognize, might suggest alternative courses of action, perhaps even comparing the extension (...or whatever they call it these days...) to a list of standard extensions .... at least those used by the program's own vendor.

I can't believe that I'm that much smarter than the largest software vendor in the world ....

Slammer/Sapphire

[carambola5]

I've already see how a worm spreads. Especially one that initially grows exponentially with a time constant of 8.5 seconds. Yes, 8.5 seconds.

Slammer [caida.org]

Pay attention to the time and infected hosts data at the bottom.

CAIDA did this for earlier worms...

[m0rningstar]

... and in a WWW based format, as opposed to the executable from an AV company. I think it was two of their researchers -- Colleen Shannon and David Moore. The animation for Code Red is here [caida.org] .

end to end linkage

[Anonymous Coward]

One of the reasons that worms spread exclusively on Windows is because you need end to end linkage. A simplified model is if I wanted to send a message to Kevin Bacon, I'd talk to friend A who knows an actor, who talks to Friend B, then friend C, who then talks to Kevin. If I tell someone who doesn't speak the language, the linkage is broken and my original message can no longer propogate.

In other words, a computer can only infect other computers through being infected itself (unless if the system is just serving files). Worms can't move through unsupported systems. Once it hits OS X or Linux system, it can't move anywhere. Windows is the only OS with critical mass high enough to achieve this. Symbian for mobile devices. This is why you won't see any Windows CE worms unless if it gains in terms of marketshare.

Re:end to end linkage

[daniel_mcl]

Another reason is that the Windows architecture, unlike Linux or the BSD core of OS X, was never designed to be used in network or multiuser settings and even now that NT-based systems are the norm the old DOS mentality prevails. A large number of the exploits in Windows are based on the ability to embed executable code in pretty much anything that should not have executable code in it -- word processor documents, emails, etc.

It's not hard at all to find whatever flavor of UNIX system you want in huge con

Re:end to end linkage

[Taladar]

Then why don't we see Linux worms infecting webservers? After all webservers are much easier to find having a public domain name and all.

you're wrong

[ArbitraryConstant]

"Windows is the only OS with critical mass high enough to achieve this. Symbian for mobile devices. This is why you won't see any Windows CE worms unless if it gains in terms of marketshare."

The Witty worm could only infect Windows machines running a specific version of specific firewall software. The vulnerable population was about 12000 machines worldwide. It infected virtually the entire vulnerable population in under an hour.

If/when there's a worm for MacOS X or Linux, there will be more than enough m

Anyone figure out?

[doombob]

I was wondering if anyone has figured out how to write new simulations for it. This would be more interesting and useful if you could write your own simulations with your own paramaters to test how the networks you are on would compare. I tried editing the simulations that are provided but all that is affected is the speed at which the percentages change.

Re:Anyone figure out?

[alecks]

Yes you can, but you need a hex editor. Load up the exe and goto this address: 23HX,12BA... change the H to an F... This will let you literally drag and drop simulation (.sim) files in the loader and run them. I showed this to my boss earlier today and he's been busi all morning creating sim files to try out.

In other news...

[qw(name)]

Symantec has issued yet another warning that the world will end as soon as all the worms and viruses unite against true carbon-based life forms. Symantec CEO John W. Thompson was quoted as saying, "If people would have heeded all our warnings about the coming war between reality and virtual reality we would not be headed for certain doom." At that point he started crying as his company's stock soared to record highs.

Up next, Symantec issues a warning to the Mac/UNIX community saying that their computers are too safe from Windows-based viruses. "We can no longer support operating systems that flaunt their security in face of corporate IT managers everywhere when millions of starving children are dying of malnutrition."

The Weekly World News news service will be right back after this message from our sponsor, Symantec. Ensuring your fear, uncertainty and doubt since 1982.

Brek Girl Simulation

[buckhead_buddy]

I like that 1970's American television ad with the cute girl who visually demonstrates exponential growth while trying to advertise something like Brek shampoo.

"I [infected] two friends.
And they [infected] two friends.
And so on.
And so on.
And so on."

Withe the screen splitting at each phrase and winding up with 32 versions of the cute girl, it's much more visually entertaining than this demo.

Re:Brek Girl Simulation

[kevcol]

Faberge Wheat Germ and Honey shampoo.

I remember using that stuff as it was in our bathroom- I can still remember the smell. I remember thinking 'Why the hell would you put honey in a shampoo? To attract insects?'

Yellow?

[SmokeyMirror]

So I read the article and I find this bit here: As the worm spreads, nodes in the network and on the globe start turning colors. Symantec Yellow represents patched and secure machines

Tell me Symantec hasn't trademarked a shade of yellow.

From TFA

[Laurentiu]

The Worm Simulator will be rolled out initially to members of the Symantec Sales organization for demonstrations to enterprise customers. In addition, the Worm Simulator could become a future television star during news coverage of worm outbreaks, enabling viewers to watch a virus as it spreads. Symantec Security Response intends to use the simulator for TV appearances as well.

Translation:
We invented a new, computer-assisted sales pitcher. It could also be used as a FUD spreader on TV.

Missing some factors

[Shoten]

It seems like they fail to take a number of things into account with the sim. For one, when I ran the Sasser simulation, it followed a pretty straightforward and accurate progression. Things went slowly at first, and then picket up speed as time progressed.

But within 20 days, there were no infected nodes, anywhere; as someone who works in a penetration testing lab without a firewall, I really have to say that this is not real. And within 52 days, 100% of the world was patched. What? It was more than 95% within 30 days too, and I don't believe that either. There's no accounting for new systems coming out of the box (and onto the net) without patches, and no representation for the fact that there will never, ever be 100% coverage for any patch.

That said, it is a pretty interesting tool to see how things spread, both globally and within an organization. You just have to keep in mind that it doesn't tell the whole story.

Re:Missing some factors

[NoOneInParticular]

Well, maybe these days the owners of the countless spamming zombies are patching 'their' windows machines ;)

Re:Missing some factors

[krunk4ever]

don't you get it? this is how symantec views the world. they believe everyone is using their software. they believe that in their ideal world, that virii and worms exist, but is not a problem that can't be solved and is solvable. they believe that when such a worm gets released, their stock prices will go up and more of their software will be sold.

they believe if you use norton av, then the maximum # of days your computer can be affected is 20days (the maximum time they forsee themselves to write a patch a

Re:Your Missing a factor!

[cbiltcliffe]

There's still that XP Pro Corporate "trial" version that's making the rounds on P2P networks, too.

No service packs, and a difficult time getting them to actually work on it if you download them.

I know plenty of people who would think nothing of downloading and installing this on their system. Heck, I know of a few business that think nothing of downloading and installing this, then selling the system.

Real data: Analysis of the Witty worm

[G4from128k]

/. discussed the Witty worm [slashdot.org] back in 2004. This analysis [caida.org] used UCSD Network Telescope IP block (containing 1/256 of IPv4 space) to sample the randomly spewed packets created by the worm. They were able to analyze quite a few interesting features, including the fact that the worm was jump-started by an infection of about 110 PCs at the outset, 24-hour cycles in infected/reinfected machines, and data on the distribution of bit-rates of worm transmitters.

Speaking of spreading worms...

[Anonymous Coward]

How timely this article!

Today an internal customer asked me why Slashdot seemed to be broken. I check the firewall logs and, lo and behold, discover 66.35.250.150 triggered the firewall's IDS for tweaking port 2000/TCP.

Why was /. poking at that port on my firewall, particularly considering what's usually there [sans.org]?

Are you protected

[Turn-X Alphonse]

Are you protected in 2 answers

Do you understand computers and how to run one securely? Yes/No if Yes continue, if no then you arn't.
Is a patch finished and installed? If yes then you're fine. If no then you arn't protected.

Obviously opening strange program files comes under number 1, but they may make it three points if you wish.

Make the "pictures" a PowerPoint presentation...

[faloi]

If it's gonna be a marketing pitch, they should at least make it PowerPoint so the people that try to get money to buy the solutions can make it management friendly... A few slides, some small buzzwords and presto! People get funding! Makes me crazy...Crazier. Whatever.

It's a virus!!!

[CProgrammer98]

Don;t open the link, it will wipe your hard drive and steal all your passwords, empty your bank account and blow up your monitor and printer...

Seriously, this is exactly how this shit spreads - get someone to download something "cool" - one reason why I never get crack patches from the warez sites...

an even better question: ...

[cutecub]

What does a spreading Worm Simulator look like?

Thanks to the Slashdot effect, I think we're gonna find out.

-S

Sober

[SlashDread]

I wish I was not. That would explain why 30% of all email is Sober at the moment. As it is now, booze is not to blame.

Sober, installs itself by tricking naive people in opening the Trojan disguised as

Sorta like the MSI link in this article....

I wonder, will I get drunk when opening it on my Windows 2003 Terminal Server?

If so, I might be inclined.

Thanks Symantec!

[qualico]

When Symantec software spreads like a worm from local distribution chains, ( BestBuy, Staples, FutureShop etc. ), demand for computer repair goes up.

Why?
Because their software breaks every machine it touches.
Worse, the computers they are installed on have not just one Virus, but many.

I tell my customers its like selling a condom with a hole in it.
You could have had so much more fun without the protection they weren't providing in the first place.

A false sense of security is worse than no security at all.

Screenshot

[HaydnH]

Someone above requested a screenshot, I've replied above but for those that missed the reply and can't run .msi files, here's a screenie:

http://www.jeanhaines.com/tmp/wormSim.html [jeanhaines.com]

Haydn.

p.s: thank god I'm at work so I can open .msi files!

the funny thing so far

[oliderid]

The funny thing so far i've seen concerning worm and viruses is the Windows media center. I was looking at a new flat TV screen in an electronic shop. They were promoting the Microsoft media center. The funny thing was a little popup window at the right of the taskbar. "Windows did not find any anti-virus software on this computer." or something like. Lol...Thanks but I prefer my good old Television. Olivier

According to the sim..

[cioxx]

It looks like the entire continet of Africa is running Macs.

Unbiased?

[Shook18]

There is honestly no way that this "research" by a anti-virus company could be even remotely unbiased; they are going to exaggerate the hell out of this to make normal internet worms look like ebola.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Hmmmm. Interesting...

[SamMichaels]

From McAfee...

--snip--
WARNING: SRL_Worm_Simulator.msi is infected with the W32/WormSimulator.B@mm virus!

ACTION: Clean/Delete threat.

It looks like you're attempting to run a competitor's program. Stop it, you insensitive clod.
--snip--

That was a weird virus warning I got when I downloaded that ;)

It looks like a web page linking to an executable!

[wernst]

Hmmmm

Let's see. How does a spreading worm look? Perhaps it looks like users blindly downloading an EXECUTABLE program for Windows after essentially being told that "this is a safe download" becuase it is linked to from the front page a major website.

I'm not sure whether to laugh or cry at the humor or the irony.

If this thing is a virus that Norton has preprogrammed its antivirus product to ignore, I'll be laughing myself into an early grave...

how come i can't stop the earth from spinning?

[krunk4ever]

i hate the globe part of the program. it's bad interface imo. all the fun stuff happens when i'm stuck on part of the ocean. should've made a pause button and rotate left/right for the globe.

Re:Darn Linux

[ZephyrXero]

You can run virii with Wine [newsforge.com] ;)

Re:Darn Linux

[Total_Wimp]

Pretty much depends on the virus. Your average Outlook mail worm will have problems with most Wine on Linux setups.

Of course this automatically leads me to think about how to get around the difficulties virii might encounter using Wine. Which in turn causes me stop, hit my head and shout "DOH!" because I realize I'm trying to troubleshoot a virus for proper functionality and I really have much better things I should be doing.

You win.

Re:Don't Download it

[leuk_he]

No it is not. At least my norton antivirus enterprise edition 10.0 with updated signatures does not flag this file.

I should be safe.

ps: ;)

ps2: Note to moderators: this is funny, not informative!

Re:Don't Download it

[qw(name)]

Oh dear! I made fun of Slashdot. Quick! Quick! Mod it overated!

"When Mods Go Bad." Next on Fox.