2024-04-16

computer security

Top 10 worst computer viruses (Sasser & I Love You)

DATARECOVERYUNION.COM15 mins

2. Sasser
Shaun Nichols: Just how much damage can a virus do? Well, take the Sasser worm as one example. This relatively simple little attack managed to cripple airlines, news agencies and even knocked out government systems.

Perhaps most frustrating, however, was that Sasser infection was very easy to prevent. The vulnerability which the attack exploited had been patched for months, and all users had to do was install the most recent security updates from Microsoft.
Sasser was a stark warning that has yet to be heard by many. Unpatched systems are still pervasive around the world, leaving users vulnerable to Sasser and countless other malware attacks that target patched vulnerabilities.

Iain Thomson: I remember the Sasser outbreak well, as I was on holiday and staying with friends in New York when it struck. Being the token geek I spent a good few hours fixing my friend’s computer and cursing the fool who wrote the worm that had me sitting in front of a computer screen when I could be sipping cocktails in Greenwich Village.

The worm caused havoc, not just shutting down a news agency’s systems but causing Delta to cancel some flights and leaving the British coastguard crippled for hours, putting lives at risk. If I’d been a seaman in peril I’d want serious words with the 17-year old author, Sven Jaschan. He was caught after Microsoft put a bounty on his head, something they should do more often.

Jaschan got away with a suspended sentence because he wrote the code before reaching the age of 18. He also caused a storm by accepting a job with a security company in his German homeland. This is not done in the security industry and caused the company, Securepoint, to be shunned by others in the field

1. I Love You
Shaun Nichols: They say you always hurt the ones you love. In 2000, this was taken to extremes when the ILoveYou attack racked up some $5.5bn in damages.

The concept was pretty simple: a user receives a file from a known email contact under the title ‘LoveLetter’ or ‘ILoveYou’. When the attachment is opened, the virus is launched. After infecting the host, the virus then took control of the user’s email program and sent the same ‘ILoveYou’ message to every user in the host’s address book.

Love must have been in the air, because the virus was potent enough to infect some 10 per cent of internet-connected machines at its peak. At a time when many users were still trying to learn the finer points of the internet, ILoveYou was a major wakeup call to some of the dangers on the web.

Iain Thomson: Everybody wants to be loved and ILoveYou was brilliant social engineering. It helped that the virus was spammed out in the early days of internet use and there were a lot of newbies online who had only a vague idea about viruses and how dangerous they could be.

Email was a trusted format and, because the messages came from people the recipient actually knew, the likelihood of them being opened was much higher.

Things are different today, although there are still plenty of people who get caught by social engineering attacks, but ILoveYou makes it so high in the list because it was a brilliant piece of social engineering.

Read More

Top 10 worst computer viruses (Nimda & MyDoom)

DATARECOVERYUNION.COM05 mins

Computer Viruses4. Nimda
Iain Thomson: A week after the 11 September atrocities a new virus hit the internet in a big way. Nimda was one of the fastest propagating viruses in history, going from nowhere to become the most common virus online in 22 minutes, according to some reports.

The reason for this speed was that Nimda used every trick in the book to spread itself. It used email, open network shares, IIS vulnerabilities and even web sites to spread. It hit pretty much every version of Windows available and appeared all over the place.

In the paranoid days after the terrorist attack some speculated that this was a digital 11 September, and some security consultants got large speaking fees for suggesting just that. In fact, it was nothing of the sort and was just another attempt at large scale infection.

Shaun Nichols: In the days following the 11 September attacks, everyone was on edge and all types of threats were given plenty of attention. This, in part, helps to explain why Nimda got the attention it did.

Nimda not only played on hype; the worm was also especially virulent due to the sheer number of methods it used to propagate. In addition to spreading via email, Nimda used web site exploits to infect HTML pages and local machine exploits to spread between individual files.

The result was an extremely effective virus circulating at a time when people were more sensitive to all types of threats, both online and offline.

3. MyDoom
Shaun Nichols: Ah yes, the old ‘infect the host then resend to the entire address book’ attack method. Like many other attacks, MyDoom used the tried-and-true practice of spreading through email and address books.

But MyDoom went a step further and targeted peer-to-peer networks. The worm not only spread itself through address books but through the shared folder of users who ran the Kazaa file sharing application.

While definitely skilled programmers, MyDoom’s creators also seemed to be fans of good old-fashioned vigilante justice. One of the early tasks performed by infected users was to take part in a denial-of-service attack against SCO, the infamous software vendor that once tried to lay claim to the patents for Linux.

Iain Thomson: MyDoom was interesting because it was one of the first to use peer to peer as a transmission device, as Shaun notes.

Kazaa was at the peak of its popularity and was causing headaches for Hollywood and the security community. If I had £1 for each time a security expert ranted about the stupidity of using peer-to-peer networks I’d be a rich man. Downloading a file onto your computer from an untrusted source? Madness.

The attack on SCO was also fascinating. SCO was, and to an extent still is, the most hated IT company among users, even more than Microsoft at the time. A worm that attacked a company was something new and raised all sorts of possibilities.

Read More

Top 10 worst computer viruses (Storm & Melissa)

DATARECOVERYUNION.COM15 mins

worst computer viruses6. Storm
Shaun Nichols: Before Conficker came around and got everyone worked into a lather, Storm was the big bad botnet on the block. First appearing in early 2007 as a fake news video on European flooding, the Storm malware menaced users for more than a year.

The huge botnet was also influential for its continued use of social engineering tactics. The malware disguised itself as everything from video files to greeting cards, and attacks were continuously refreshed to coincide with holidays and current news events.

While Storm has since been eclipsed by newer botnets, the name still brings to mind one of the most menacing attacks seen in recent years.

Iain Thomson: When extreme weather hit Europe the damage was bad enough, but the Storm code made things much worse. At a time when many were seriously concerned about the health and safety of friends and family, the last thing anyone needed was an infection.

But Storm was a classic piece of social engineering. At a time when people are concerned they don’t always  think of the consequences, be it approving torture or opening an email attachment.

This kind of social networking is nothing new, of course, but the Storm malware did it very well indeed and proved very effective as a result.

5. Melissa
Shaun Nichols: It was a classic love story. Boy meets girl, girl dances for money, boy goes home and writes computer virus for girl, computer virus gets out of hand and causes millions of dollars in damage. It’s the Romeo and Juliet of our time.

When a New Jersey hacker wrote a small bit of code named after a stripper he met in Florida, he had no idea of the chaos that would ensue. The Melissa virus, as it came to be known, got way, way out of hand.

The virus spread like wildfire throughout the net, and an unintended effect of the worm led to a glut of email traffic that overflowed servers and caused tons of damage and lost work time to corporate IT systems.

The hacker himself was later caught and sentenced to a year and half in prison. Next time he wants to impress a girl, hopefully he’ll stick to chocolates and jewelery.

Iain Thomson: Now, I’ve done some stupid things to impress girls, things that cause me to bite my fist with embarrassment nowadays and one that left me with a small amount of scar tissue, but writing a computer virus makes these pale by comparison.

The real damage of Melissa was not in the code itself, but in its spamming capabilities. The software caused a massive overload of email systems and generated enough traffic to make it highly visible. Current computer malware writers have taken note of code like Melissa and now fly much lower under the wire to attract less attention.

Read More

Top 10 worst computer viruses (Conficker & ExploreZip)

DATARECOVERYUNION.COM05 mins

computer viruses8. Conficker
Shaun Nichols: The global catastrophe that wasn’t, the third form of the Conficker attack provided nice theatrics but little in the way of actual damage.

The premise was pretty simple: Conficker.C would spread to as many machines as possible throughout March. Each infected machine was given a huge list of domains, one of which would be contacted by 1 April.

The deadline made all the difference. Now, Conficker wasn’t just a simple malware infection, it was a ‘ticking time bomb’, and a looming menace that would unleash carnage. Or at least that’s what the story turned into when unscrupulous security vendors and tech-newbie news outlets got hold of the story.

Then the deadline passed and, pretty much as every reasonable person in the industry predicted, Conficker didn’t do much of anything. The botnet remains intact and still poses a threat, but nothing near the utter cyber-carnage that many spoke of.

Iain Thomson: Conficker has now started its attacks and has proved to be just another botnet builder like most other malware.

However, the media panic over Conficker has shown that people are still scared of viruses. As Bruce Schneier pointed out at RSA last week, Conficker hit all the right buttons. It had a funny sounding name, was mysterious and was set to do something on a ‘magic’ date.

Conficker has, however, served a useful purpose. It spreads via a vulnerability that has had a patch available since last October. If my company’s servers got hit by a vulnerability that old, my IT manager would be getting a stern talking to, possibly involving a thumbscrew and a hot pair of pliers.

7. ExploreZip
Iain Thomson: ExploreZip was written over a decade ago but is still to be found in the wild today, a good example of how persistent these little programs can be.

ExploreZip, like most viruses of the time, targeted Windows systems a nd was spread via email. The recipient got an email reading ‘I have received your email and I shall send you a reply ASAP. Till then take a look at the attached zipped docs.’

Clicking on the attachment booted the virus onto the user’s computer and it immediately spammed itself out to all of the contacts in Outlook. More worryingly it also overwrote Word documents with lines of zeros, and did some damage to the operating system itself. As destructive worms go it wasn’t too bad, but in the pre-Millennium days of 1999 it certainly caused a panic.

Shaun Nichols: Often, viruses aren’t meant to be overtly destructive. Older viruses often did damage through unintended conflicts, while newer malware tries to remain undetected in order to steal data or hijack programs.

This wasn’t the case with ExploreZip, however. Upon receiving the virus, users would open an attachment that would immediately begin damaging the host computer.

This seems pretty scary at first. But when you think about it, a damaged hard drive is still far less serious than a hijacked bank account.

Read More