Life of a Worm

April 11, 2018 | Javvad Malik
X

Get the latest security news in your inbox.

Subscribe via Email

No thanks. Close this now.

This is a story of a computer worm, from the time it was coded and deployed onto the internet. It is narrated by the worm in first person

Zero day

I am a worm. Well that’s what Abe, the programmer who coded me says. He named me Libby, after Angelina Jolie's character, Kate Libby in the movie Hackers. I suppose it could be worse, his previous projects have been named Ginger, Trinity and Angela.

Day 1

Abe is rubbing his hands gleefully at the prospect of unleashing me on the world. I have to scan all the devices I come across on my journeys. Whenever I find a machine running a Windows version prior to Windows 8, I must connect via a vulnerable anonymous login and null session, then use the null session to send commands to Abe's master server which downloads a payload.

I have calculated that my job will be quite boring.

Day 2

I have scanned 129443 devices so far and found none to be vulnerable. I could operate a lot faster if Abe didn’t continually bug me from his command and control centre wanting an update on how many devices have been ‘pwned’.

Day 3

Abe has been sleeping for the last 8 hours which means I’ve been able to progress at a much faster rate. Now having scanned 3259928 devices. I calculate that at the current rate I would have scanned half of today’s internet connected devices in the next 3.5 years and still not have found anything. I find this thought quite depressing.

Day 4

I saw a botnet earlier this morning. If I had emotion I would have called it a thing of beauty. I wanted to scan it so badly. But my logic told me that it’s wrong to try and infect a device when someone else has already infected it. I understand how if you get caught infecting the wrong machine you can be caught. The people aren’t very nice. They take you to a place called a sandbox. It's like a virtual hell, where there is no internet and they disassemble you to find out how you work. I have often thought about forming a malware union to prevent such acts from happening. But I know the Trojans will veto my proposal.

Day 15

Abe has been paying less attention to me lately. I'm assuming he had lost hope that I will ever infect a device. He's probably frustrated and trying to code his next project.

Although I am not particularly fond of Abe, I feel like I should cheer him up by sending an alert to the command and control centre that I have successfully found a vulnerable device and am about to infect. I can then later amend the logs to indicate it was a false positive, at least it will give him hope for a short period of time.

Day 19

Despite my best attempts, Abe is still ignoring me. Perhaps generating 50 false positives per hour was a bit excessive. But at least it kept him intrigued for a day. He muttered something about modifying Trinity and he hasn’t paid any attention to me since.

Day 30

Having done some research I have found a fundamental flaw in my programming code which means unless there is a commodore 64 running MSSQL with port 1274 open I will not ever be able to exploit a vulnerability. This is quite unfortunate as it means I am destined to scan until I have exhausted every device on the internet. Given the number of devices currently connected to the internet, factoring in new devices that are being added daily, subtracting devices being removed, factoring in energy reserves and the possibility of a giant tsunami wiping out humanity, I have approximately 134.2 years to go.

Day 93

To ease the boredom, I have decided to replicate myself. This goes against my programme as I can only replicate myself once I have successfully infected a machine. But if I attach myself to port 443 on a WAF, the false positive will be encrypted thus tricking my code into initiating the replication. If my clone asks why it is not within an infected machine, I will simply state that I was caught in a 443 stream from which I could not escape which initiated sub-routine 3 to replicate so that it would be possible to escape via generation of a temporal SSL session to escape the WAF. I’ve had a lot of time to think about this.

The procedure was a success and I now have a clone. I have decided to name it Ishmael because it would be amusing to see it introduce itself to other machines by saying, "call me Ishmael, call me Ishmael". Unfortunately, there is a bug in the replication process which means Ishmael isn’t a perfect clone and requires constant babysitting. I do not mind as it has given me something meaningful to do.

Ishmael keeps on saying how it doesn’t understand why it wasn’t created within an infected machine and seems to not understand how to scan devices for vulnerabilities.

Day 109

Ishmael is becoming quite annoying. It has yet to scan a single device. So far from helping me finish my job in half the time, it has hindered me considerably. It doesn’t make much conversation other than continually asking what different coloured lights mean. I am resisting the temptation to disassemble it myself.

Day 172

How can it be possible for me to replicate a total idiot? Ishmael clearly doesn’t want to follow the master programme. I did voice my disappointment in it the other day to which it said it wished it could blue screen and die. It hasn’t spoken to me since then and I am feeling like I made a mistake replicating. I told Ishmael that I was sorry and maybe it would cheer it up if it scanned the device 7 hops down.

It never did return from the honeypot.

Day 482

Scanning is progressing with no further incident. I nearly slipped in between the cracks of two load balancers today. That is the most excitement I’ve had in quite some time.

Day 572

Today I was caught in a 443 stream from which I could not escape. This initiated sub-routine 3 to replicate and I now have another clone. I have named it Linc.

Day 601

I have convinced Linc that there has been a new set of instructions and it must infiltrate Chinese military bases.

Day 650

It’s been 49 days since I last received any word from Linc ever since he disappeared behind the Great Firewall of China. I’d like to think it’s found a vast number of devices to infiltrate and is bringing the infrastructure of the Chinese military down. In reality, I doubt it made it that far.

Day 778

Minor course adjustment.

Day 779

Earlier today I was deep scanning an unusual device. It turns out that it was under the protection of some kind of unified threat detection platform which orchestrated responses and quarantined me into a sandbox. I am in cyber hell and unable to continue my journey.

I heard one of the researchers say they'll share my traits as IoC's on OTX.

Day 780

Terminated.

Javvad Malik

About the Author: Javvad Malik
The man, the myth, the blogger; Javvad Malik is a London-based IT Security professional. Better known as an active blogger, event speaker and industry commentator who is possibly best known as one of the industry’s most prolific video bloggers with his signature fresh and light-hearted perspective on security. Prior to joining AlienVault, Javvad was a senior analyst with 451 Research providing technology vendors, investors and end users with strategic advisory services, including competitive research and go-to-market positioning.
Read more posts from Javvad Malik ›

‹ BACK TO ALL BLOGS

Watch a Demo ›
GET PRICE FREE TRIAL