Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Researchers Develop Code That Stops Local Scanning Worms

In tests, algorithm was an efficient estimator of worm virulence and could determine the size of the susceptible host population after only a few infections

Self-propagating worms are malicious computer programs, which, after being released, can spread throughout networks without human control, stealing or erasing hard drive data, interfering with pre-installed programs and slowing, even crashing, home and work computers. Now a new code, or algorithm, created by Penn State researchers targets the "stealthiest" of these worms, containing them before an outbreak can occur.

"In 2001 the 'Code Red' worms caused $2 billion dollars worth of damage worldwide," said Yoon-Ho Choi, a postdoctoral fellow in information sciences and technology at Penn State. "Our algorithm can prevent a worm's propagation early in its propagation stage."

Choi and his colleagues' algorithm defends against the spread of local scanning worms that search for hosts in "local" spaces within networks or sub-networks. This strategy allows them access to hosts that are clustered, which means once they infect one host, the rest can be can be infected quickly. There are many types of scanning worms, but Choi calls these worms the stealthiest because they are the most efficient and can evade even the best worm defenses.

A worm outbreak can begin with the infection of a single computer. After infection, a worm begins to probe a set of random, local or enterprise IP addresses, searching for more vulnerable hosts. When one is found the worm sends out a probe, or packet, to infect it. "A local scanning worm can purposely scan a local or enterprise network only," said Choi. "As the size of the susceptible population increases, the worm's virulence increases."

The researchers' algorithm works by estimating the size of the susceptible host population. It then monitors the occurrence of infections within it and sets a threshold value just equal to or below the average number of scans necessary to infect a host by an infected host.

If the scanning worm's number of scans carrying a specific destination port number exceeds the threshold, the algorithm quarantines the worm. The algorithm then breaks down the network into many small networks, or cells, which in some cases might be only one computer. A worm can spread within the cells, but not between the cells. This way the algorithm can isolate an infected host or small cluster of infected hosts housing the worm.

"By applying the containment thresholds from our proposed algorithm, outbreaks can be blocked early," said Choi.

To test the effectiveness of their algorithm the researchers ran a series of computer simulations and emulations using different scanning strategies of local scanning worms. Results showed that their algorithm was an efficient estimator of worm virulence and could determine the size of the susceptible host population after only a few infections.

"Our evaluation showed that the algorithm is reliable in the very early propagation stage and is better than the state-of-the-art defense," said Choi. Choi, working with Lunquan Li, assistant professor at the Institute of Microelectronics of Chinese Academy of Sciences, Beijing, and his Penn State colleagues, Peng Liu, associate professor, information sciences and technology, and George Kesidis, professor, electrical engineering and computer science and engineering, published their work in the February issue of Computers and Security.

According to Choi, local scanning worms are constantly evolving. They are becoming more complicated and increasingly efficient. As a result, worm outbreaks pose a real threat to networked systems. Because many networked home and office computers are susceptible to local scanning worms this algorithm may be an effective defense against damaging worm outbreaks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-20466
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.
CVE-2020-20467
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.
CVE-2020-20468
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
CVE-2021-24368
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.