Subject: A document about Worms

From: Moshe Zadka <[email-masked]>
Date: Thu, 18 May 2000 11:13:11 +0300 (IDT)

http://lcamtuf.na.export.pl/worm.txt

---

From: [email-masked]
Date: Thu, 18 May 2000 11:24:26 +0300

> http://lcamtuf.na.export.pl/worm.txt

I liked the wormnet idea.
But I think of doing a java implememntation.

1) almost all machines have JVM, it comes with browesers, operating systems,
etc. we usually don't care about speed - but size may be important. GC is good
- if the virus has a memory leak its a dead giveaway. ofcourse I'd have to keep
  jvm compatibility. thats not trivial.

2) can xml-rpc be used for wormnet? it goes through firewalls, it passes
code...

3) A java program can modify its own byecode.

--
Chen Shapira	Web Developer and Linux Activist
The algorithm for finding the longest path in a graph is NP-complete.
For you systems people, that means it's *real slow*.

---

From: Omer Mussaev <[email-masked]>
Date: Thu, 18 May 2000 10:38:12 +0300

http://www.melrose.k12.mn.us/url/reviews/main/ka7/ka7.htm

in short - it lets you put AMD Thunderbird ("Athlon Xeon"), and tweak
every possible frob in that.

The fun part is that Abit (manufacturer) claims that board to be
overclocker's heaven...

--
Omer Mussaev    051-308-214   mailto:[email-masked]
systems programmer, Mercury Interactive/RND/Conduct/core

---

From: "Nadav Har'El" <[email-masked]>
Date: Fri, 19 May 2000 00:12:57 +0300

> I liked the wormnet idea.

By the way, people who are interested in this sort of stuff should probably
look into the bugtraq mailing lists. Most of the messages there are boring,
outlining buffer overflaws in obscure NetBSD applications and security holes
in Microsoft products, but some of the messages are interesting ones, like
in this case.

>   jvm compatibility. thats not trivial.

Even if Java could be used to start an infectection on a new machine, some
code running on the invaded machine will always need to be written in machine
language (or C, or some low-level language) because you'll want to make low-
level changes to the operating systems: for the worm to be as successful as
the these guys say (and trust me: I've seen similar worms in action, and they
do work), it will need to do a better job of hiding itself then it can usually
do as a Java applet or application.

You can't patch the kernel with Java code. I mean, not that you can't program
a patch-program in Java - what you can't do is to make the source of this
kernel patch be written in Java. Not unless you have a Java compiler on the
machine. And most systems don't have one. In fact, most systems don't even
have a Java application runner - and can only run applets in a browser, and
these are pretty limited by security precautions.

Anyway, by having special rootkit/exploit/etc. codes for a small number of
different architechtures (say, Linux, Solaris and Dec Alpha) you can probably
take over 80% of the Unix machines. And as your appetite grows, you can feed
the wormnet codes for new types of machines, and it will pass it to the
active breakin "spearheads".

> 2) can xml-rpc be used for wormnet? it goes through firewalls, it passes

Can you explain? What is xml-rpc (I know XML, and RPC, but not XML-RPC), and
how is it relevant to going through firewalls?

All firewalls need to let some info in and out, otherwise you could simulate
this firewall by not paying your ISP bills :) Take the simplest example where
the firewall only passes the following things:
1. An inside user can get web-pages from the outside on his browser, by using
   a proxy server on the firewall.
2. The inside user can send email to the outside (by using the firewall as a
   relay).

Even in this ideal setting the worm can work (and typical corporate firewalls
pass through much more, making breakin much easier!) the worm can work. It
can do the following:

1. Infiltrate a common website, or several of them. Say, yahoo.com.
2. Assume there's a bug in the webbrowser used inside the firewall, that
   generates a buffer overflow when passed a certain HTML page, and can get
   arbitrary code running on that machine. If you don't know what these
   buffer overflows are and how they can cause your machine to execute
   malicious code, read the bugtraq mailing list (or if people are interested,
   I can write a summary about this subject here).
3. Now, trojan yahoo.com's server to generate the malicious page in 1/1000 of
   the times. Users won't notice: in 1/1000 of the times they view the page
   the browser will dump core (or the Windows equivalent) - and unknowingly
   to them also run the malicious code. If the browser is not buggy, the
   user may see rubbish, so a "refresh" or whatever to get read of the evidence
   quickly is recommended.
   1/1000 is not noticable, but if 100 users behind the firewall use the broken
   into sites 10 times a day, it very very likely that one of the users will
   get the trojan page.
4. This malicious code (which will run on a specific platform, but codes like
   that can be designed for various platforms) will start some sort of worm
   process on the inside machine.
5. This worm process will email it's parent saying it's in. Then it will look
   at the browser's configuration to see the proxy it needs to use, and then
   use that proxy to fetch a certain webpage from the parent worm's machine.
   Of course, this wouldn't be a real webpage - it will be a package of code,
   scripts, local exploits, and so on, that will get the worm root access and
   full control of the machine.
6. Then, the worm will spread inside the Intranet, behind the firewall, just
   as it does on the whole Internet without firewalls.

:(

This is all assuming the firewall is some sort of A1 secure machine, and can't
be broken into. If you can break into the firewall machine itself, then you'll
have an even easier time breaking into the entire network behind it.

-- 
Nadav Har'El                        |     Thursday, May 18 2000, 14 Iyyar 5760
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Linux: Because rebooting is for adding
http://nadav.harel.org.il           |new hardware.