This article will detail what worms are and how they operate and will examine the different types of worms afflicting systems worldwide.
A little about worms
Worms belong to a self-replicating category of malware that can search for computers in a local area network (LAN) and wireless networks to deliver a malicious payload or perform a programmed task. Common examples of these tasks include deleting files and stealing information. A common attack point for worms is vulnerabilities that exist in operating systems. All the more motivation to keep your system updated! Some have classified worms as viruses, but this view is ignoring a major difference between the two — a virus requires user input (activation) to perform its programmed task, and a worm does not. This ability to function without user input makes worms a potentially much more dangerous threat in contrast to viruses, because a virus can lie dormant for a long time if the application it is attached to is not run often, or the user input required is rarely performed. What’s especially interesting about worms is how they have evolved over time. The first worm to spread over the internet is known as the Morris worm. Invented by Robert Morris, this worm’s sole goal was to spread. It did not perform any other tasks, nor did it have a payload to inflict upon infected systems. The first recorded worm that carried a payload was called Witty, and it focused on attacking a specific manufacturer’s firewall and information security products. Since then, payload-delivering worms have been the norm instead of the exception.
Worm life cycle (or lack thereof)
Unlike viruses, worms do not have an easily quantifiable life cycle. This is based on the fact that worms act independent of the actions of third parties. As a system becomes infected, the worm will replicate, find other computers on the infected computer’s network, and perform its programmed task. This process can be completed in such a short amount of time there is no life cycle to speak of, aside from infection, replication and spreading throughout the network.
Different types of worms
There are several different types of worms in use today, each having their own method of infecting a target system.
Email worms
As the name suggests, email worms infect target systems by using the email client of said system. Email worms initiate their infections either by way of an infected email attachment that infects the system when the file is downloaded and opened, or by a malicious link that will infect the system when clicked. A landmark instance of email worms afflicting the information security landscape was the ILOVEYOU worm. Launched in 2000, this worm had infected millions of systems by the time it ran its course.
Internet-based worms
Another well-represented worm in existence is the internet-based worm. This type is not picked up via web browsing; instead, it spreads when an infected system scans the internet for vulnerable machines that it can infect. This type of worm takes advantage of systems that have not received recent security and operating system updates. By focusing on the vulnerabilities that have been recently fixed, all the worm needs to do is locate a computer that has not installed these updated. Many users not updating means many potential targets and many headaches spread around.
Bot worms
Bot worms are a nasty type of worm that infects a system and then turns it into an unwitting bot or zombie. The infected system is then used in conjunction with other infected system to form botnets. Botnets are used by attackers to launch large-scale, coordinated attacks.
File-sharing network worms
Despite their attractive, easy access to valuable files, file-sharing networks have a glaring security weakness: you really don’t know what you are downloading. Remember that blockbuster film that you just downloaded for free? It may contain one of these worms. This type of worm uses downloads just like these to enter your system, after which it will be subject to whatever malicious actions the worm is programmed to do (along with copious self-replication, of course).
Chat room and instant message worms
This type of worm is similar to the email worm in that it will use the user’s chat room contact list or instant messenger to send out messages containing malicious links. These links will send you to a malicious website laden with worms in its code or may simply download the worm itself. This type of worm has some downsides associated with it (from the attacker’s perspective) — they require user input by way of accepting the message/clicking the infected link and the worm will only be able to access contact lists of the respective infected chat room or instant messenger.
Conclusion
Worms do indeed operate similarly to viruses in that they self-replicate and will perform a programmed task toward a malicious end. However, they are a different breed unto themselves. Viruses suffer from the capability limitation of required user input, while worms can perform their programmed tasks and move from computer to computer, without any user input at all. This minor difference in programming makes worms a more formidable information security foe and a more serious threat overall.
Sources
Worm, TechTarget Different Types of Computer Worms, Techwalla A Brief History of the Worm, Symantec What is a computer worm and how does it spread?, Emsisoft
