Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

03:30 PM
Javvad Malik
Javvad Malik
Connect Directly
E-Mail vvv

780 Days in the Life of a Computer Worm

This is a story of a worm, from the time it was coded and deployed onto the Internet. It is narrated by the worm in the first person.

Zero Day
According to Abe, my programmer, I am a worm. He named me Libby, after Kate Libby from the movie Hackers. His previous projects have been named Ginger, Trinity, and Angela.

Day 1
Abe is gleeful at the prospect of unleashing me on the world. I have to scan all the devices I come across on my journeys. Whenever I find a machine running a Windows version prior to Windows 8, I must connect via a vulnerable anonymous login and null session, then use the null session to send commands to Abe's master server, which downloads a payload.

It sounds quite boring. 

Day 2
I could operate a lot faster if Abe didn't continually bug me from his command and control center wanting an update on how many devices have been "pwned."

Day 3
Abe has been sleeping, so I've been able to progress at a much faster rate. Having scanned 3,259,928 devices, I calculate that at the current rate I would have scanned half of today's Internet-connected devices in the next 3.5 years and still not have found anything. I find this thought quite depressing.

Day 4
I saw a beautiful botnet earlier this morning and wanted to scan it. But my logic told me that it's wrong to try and infect a device someone else had already infected. If you infect the wrong machine, you can be caught in a sandbox. It's like a virtual hell, where there is no Internet and researchers disassemble you to find out how you work. I have often thought about forming a malware union to prevent such acts from happening. But I know the Trojans will veto my proposal.

Day 15
Abe has been paying less attention to me lately. I'm assuming he has lost hope that I will ever infect a device. Although I am not particularly fond of Abe, I feel like I should cheer him up by sending an alert to the command and control center that I have successfully found a vulnerable device. I can then later amend the logs to indicate it was a false positive.

Day 19
Abe is still ignoring me. Perhaps generating 50 false positives per hour was a bit excessive. He muttered something about modifying Trinity and left.

Day 30
I have found a fundamental flaw in my code, which means unless there is a Commodore 64 running MSSQL with port 1274 open I will not ever be able to exploit a vulnerability. This is quite unfortunate as it means I am destined to scan until I have exhausted every device on the Internet. Given the number of current devices, factoring in new devices that are being added daily, subtracting devices being removed, factoring in energy reserves and the possibility of a giant tsunami wiping out humanity, I have approximately 134.2 years to go.

Day 93
To ease the boredom, I have decided to replicate myself. This goes against my program as I can only replicate myself once I have successfully infected a machine. But if I attach myself to port 443 on a WAF, the false positive will be encrypted, thus tricking my code into initiating the replication. If my clone asks why it is not within an infected machine, I will simply state that I was caught in a 443 stream from which I could not escape, which initiated subroutine 3 to replicate so that it would be possible to escape via generation of a temporal SSL session to escape the WAF. I've had a lot of time to think about this.

I now have a clone named Ishmael. It will be amusing to see it introduce itself to other machines by saying, "Call me Ishmael, call me Ishmael." Unfortunately, there is a bug in the replication process that means Ishmael isn't a perfect clone and requires constant babysitting. I do not mind as it has given me something meaningful to do.

Day 109
Ishmael is becoming quite annoying. It has yet to scan a single device. So, far from helping me finish my job in half the time, it has hindered me considerably. It doesn't make much conversation other than continually asking what different colored lights mean. I am resisting the temptation to disassemble it myself.

Day 172
How can it be possible for me to replicate a total idiot? I voiced my disappointment to Ishmael the other day, to which it said it wished it could blue screen and die. I am feeling like I made a mistake replicating. I told Ishmael that I was sorry and maybe it would cheer up if it scanned the device 7 hops down.

It never did return from the honeypot.

Day 482
Scanning is progressing with no further incident. I nearly slipped in between the cracks of two load balancers today. That is the most excitement I've had in quite some time.

Day 572
Today I was caught in a 443 stream from which I could not escape. This initiated subroutine 3 to replicate, and I now have another clone named Linc.

Day 650
It's been 49 days since I last received any word from Linc since he disappeared behind the Great Firewall of China. I'd like to think it's found a vast number of devices to infiltrate and is bringing the infrastructure of the Chinese military down. In reality, I doubt it made it that far.

Day 779
Earlier today, I was deep scanning an unusual device. It turns out that it was under the protection of some kind of unified threat detection platform that orchestrated responses and quarantined me into a sandbox. I am in cyber hell and unable to continue my journey.

I heard one of the researchers say they'll share my traits as IoCs on OTX.

Day 780

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.


Javvad Malik is a London-based IT Security professional. Better known as an active blogger, event speaker and industry commentator who is possibly best known as one of the industry's most prolific video bloggers with his signature fresh and light-hearted perspective on ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-21
MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\MyQ\PHP\Sessions directory. The "Select server file" feature is only intended for administrators but actually does not require autho...
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the log_edit.php files failing to filter the csa_to_user parameter, remote attackers can exploit the vulnerability to obtain database sensitive information.
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate to admin privileges.
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability. The if_get_addbook.php file does not have an authentication operation. Remote attackers can obtain username information for all users of the current site.