《计算机网络》课程教学资源（参考文献）How to 0wn the Internet in Your Spare Time

How to Own the Internet in Your Spare time Stuart Staniford* Ⅴ ern pa Nicholas Weaver t Silicon Defense ICS/ Center for internet research UC Berkeley stuartasilicondefense.com ernaicir org weaver acs. berkeley. edu Abstract Introduction If you can control a million hosts on the Internet, you can First. you can launch dis- bility of attackers to rapidly gain control of vast tributed denial of service(DDOS)attacks so immensely rs of Internet hosts poses an immense risk to the diffuse that mitigating them is well beyond the state-of- all security of the Internet. Once subverted, these the-art for dDos traceback and protection technologies hosts can not only be used to launch massive denial of service floods, but also to steal or corrupt great quantities Such attacks could readily bring down e-commerce sites news outlets. command and coordination infrastructure of sensitive information, and confuse and disrupt use of the network in more subtle ways specific routers, or the root name servers Second, you can access any sensitive information We present an analysis of the magnitude of the threat. We begin with a mathematical model derived from em- present on any of those million machines--passwords credit card numbers. address books. archived email pirical data of the spread of Code Red I in July, 2001.We patterns of user activity, illicit content--even blindly discuss techniques subsequently employed for achiev- searching for a"needle in a haystack, "i.e, information ing greater virulence by Code Red ll and Nimda. In this that might be on a computer somewhere in the Internet context,we develop and evaluate several new, highly vi ulent possible techniques: hit-list scanning(which cre- for which you trawl using a set of content keywor ates a Warhol worm), permutation scanning(which en- Third, not only can you access this information, but you ables self-coordinating scanning), and use of Internet- can sow confusion and disruption by corrupting the in- sized hit-lists(which creates a fiash worm) formation. or sending out false or confidential informa We then turn to the to the threat of surreptitious worms tion directly from a user's desktop that spread more slowly but in a much harder to detect In short, if you could control a million Internet hosts "contagion"fashion. We demonstrate that such a worm the potential damage is truly immense: on a scale where today could arguably subvert upwards of 10,000,000 In- such an attack could play a significant role in warfare tenet hosts. We also consider robust mechanisms by between nations or in the service of terrorism which attackers can control and update deployed worms Unfortunately it is reasonable for an attacker to gain con- In conclusion, we argue for the pressing need to de- trol of a million Internet hosts, or perhaps even ten mil- velop a"Center for Disease Controlanalog for virus- and worm-based threats to national cybersecurity, and lion. The highway to such control lies in the exploita sketch some of the components that would go into such Internet by exploiting security flaws in widely-used ser- a Center vices. Internet-scale w p89, ER89], but the severity of their threat has rapidly grown with(i) the increasing degree to which the In- We distinguish between the worms discus Research supported by DARPA via contract N66001-00-C-8045 t Also with the Lawrence Berkeley National Laborato niversity some sort of user action to abet their propagation hey tend to of California, Berkeley propagate more slowly. From an attacker's perspective, they also suf- al support from Xilinx, ST Microsystems, and the Cali- fer from the presence of a large anti-virus industry that actively seeks fornia MICRO program to identify and control their spread

How to 0wn the Internet in Your Spare Time Stuart Staniford∗ Vern Paxson† Nicholas Weaver ‡ Silicon Defense ICSI Center for Internet Research UC Berkeley stuart@silicondefense.com vern@icir.org nweaver@cs.berkeley.edu Abstract The ability of attackers to rapidly gain control of vast numbers of Internet hosts poses an immense risk to the overall security of the Internet. Once subverted, these hosts can not only be used to launch massive denial of service floods, but also to steal or corrupt great quantities of sensitive information, and confuse and disrupt use of the network in more subtle ways. We present an analysis of the magnitude of the threat. We begin with a mathematical model derived from em￾pirical data of the spread of Code Red I in July, 2001. We discuss techniques subsequently employed for achiev￾ing greater virulence by Code Red II and Nimda. In this context, we develop and evaluate several new, highly vir￾ulent possible techniques: hit-list scanning (which cre￾ates a Warhol worm), permutation scanning (which en￾ables self-coordinating scanning), and use of Internet￾sized hit-lists (which creates a flash worm). We then turn to the to the threat of surreptitious worms that spread more slowly but in a much harder to detect “contagion” fashion. We demonstrate that such a worm today could arguably subvert upwards of 10,000,000 In￾ternet hosts. We also consider robust mechanisms by which attackers can control and update deployed worms. In conclusion, we argue for the pressing need to de￾velop a “Center for Disease Control” analog for virus￾and worm-based threats to national cybersecurity, and sketch some of the components that would go into such a Center. ∗Research supported by DARPA via contract N66001-00-C-8045 †Also with the Lawrence Berkeley National Laboratory, University of California, Berkeley. ‡Additional support from Xilinx, ST Microsystems, and the Cali￾fornia MICRO program 1 Introduction If you can control a million hosts on the Internet, you can do enormous damage. First, you can launch dis￾tributed denial of service (DDOS) attacks so immensely diffuse that mitigating them is well beyond the state-of￾the-art for DDOS traceback and protection technologies. Such attacks could readily bring down e-commerce sites, news outlets, command and coordination infrastructure, specific routers, or the root name servers. Second, you can access any sensitive information present on any of those million machines—passwords, credit card numbers, address books, archived email, patterns of user activity, illicit content—even blindly searching for a “needle in a haystack,” i.e., information that might be on a computer somewhere in the Internet, for which you trawl using a set of content keywords. Third, not only can you access this information, but you can sow confusion and disruption by corrupting the in￾formation, or sending out false or confidential informa￾tion directly from a user’s desktop. In short, if you could control a million Internet hosts, the potential damage is truly immense: on a scale where such an attack could play a significant role in warfare between nations or in the service of terrorism. Unfortunately it is reasonable for an attacker to gain con￾trol of a million Internet hosts, or perhaps even ten mil￾lion. The highway to such control lies in the exploita￾tion of worms: programs that self-propagate across the Internet by exploiting security flaws in widely-used ser￾vices.1 Internet-scale worms are not a new phenomenon [Sp89, ER89], but the severity of their threat has rapidly grown with (i) the increasing degree to which the In- 1 We distinguish between the worms discussed in this paper— active worms—and viruses (or email worms) in that the latter require some sort of user action to abet their propagation. As such, they tend to propagate more slowly. From an attacker’s perspective, they also suf￾fer from the presence of a large anti-virus industry that actively seeks to identify and control their spread

Code Red I v2 Code Red ll Code Red ll 88-88。 Nimda Days since地y182001 Days Since Sept 20, 2001 Figure 1: Onset of Code Red I v2, Code Red Il, and Nimda: Figure 2: The endemic nature of Internet worms: Number Number of remote hosts launching confirmed attacks corre- of remote hosts launching confirmed attacks corresponding to sponding to different worms, as seen at the Lawrence berkeley different worms, as seen at the Lawrence berkeley National National Laboratory. Hosts are detected by the distinct URLs Laboratory, over several months since their onset. Since July, they attempt to retrieve, corresponding to the lIs exploits and 139, 000 different remote Code Red I hosts have been con- attack strings. Since Nimda spreads by multiple vectors, firmed attacking LBNL, 125,000 different Code Red ll hosts counts shown for it may be an underestimate and 63.000 Nimda hosts. Of these. 20. 000 were observed to be infected with two different worms, and 1, 000 with all three worms(Again, Nimda is potentially an underestimate because ternet has become part of a nation's critical infrastruc- we are only counting those launching Web attacks. ture, and (ii) the recent, widely publicized introduction of very very rapidly spreading Internet worms, such that this technique is likely to be particularly cur- surreptitious worms. These spread more slowly, but in a ent in the ds of attackers much harder to detect"contagion"fashion, masquerad- ing as normal traffic. We demonstrate that such a worm We present an analysis of the magnitude of the threat today could arguably subvert upwards of 10,000,000 In- We begin with a mathematical model derived from em- ternet host pirical data of the spread of Code Red I v2 in July and August, 2001(Section 2). We then discuss techniques Then in Section 6, we discuss some possibilities employed for achieving greater effectiveness and viru- by which an attacker could control the worm using lence by the subsequent Code Red II and Nimda worms cryptographically-secured updates, enabling it to remain (Section 3). Figures 1 and 2 show the onset and progress a threat for a considerable period of time. Even when of the Code red and Nimda worms as seen "in the wild" most traces of the worm have been removed from the network, such an"updatable worm st emains a SIg- In this context, we develop the threat of three new nificant threat techniques for highly virulent worms: hit-list scanning, Having demonstrated the very serious permutation scanning, and Internet scale hit-lists(Sec of the tion 4). Hit-list scanning is a technique for accelerat- threat, we then in Section 7 discuss an ious but we believe highly necessary strategy for addressing it ing the initial spread of a worm. Permutation scanning the establishment at a national or international level is a mechanism for distributed coordination of a worm of a"Center for Disease Control" analog for virus Combining these two techniques creates the possibility and worm-based threats to cybersecurity. We discuss of a Warhol worm, 2 seemingly capable of infecting most the roles we envision such a Center serving, and offer or all vulnerable targets in a few minutes to perhaps an thoughts on the sort of resources and structure the Cen- hour. An extension of the hit-list technique creates flash worm, which appears capable of infecting the vul- ter would require in order to do so. Our aim is not to nerable population in 10s of seconds: so fast that no comprehensively examine each role, but to spur further human-Imediated counter-response is possible discussion of the issues within the community We then turn in Section 5 to the threat of a new class of 2So named for the quotation"In minutes of fame

0 20 40 60 80 0 5000 10000 20000 Days Since July 18, 2001 Distinct Remote Hosts Attacking LBNL Jul 19 Aug 1 Sep 1 Sep 19 Oct 1 Code Red I v2 Code Red II Nimda Figure 1: Onset of Code Red I v2, Code Red II, and Nimda: Number of remote hosts launching confirmed attacks corre￾sponding to different worms, as seen at the Lawrence Berkeley National Laboratory. Hosts are detected by the distinct URLs they attempt to retrieve, corresponding to the IIS exploits and attack strings. Since Nimda spreads by multiple vectors, the counts shown for it may be an underestimate. ternet has become part of a nation’s critical infrastruc￾ture, and (ii) the recent, widely publicized introduction of very large, very rapidly spreading Internet worms, such that this technique is likely to be particularly cur￾rent in the minds of attackers. We present an analysis of the magnitude of the threat. We begin with a mathematical model derived from em￾pirical data of the spread of Code Red I v2 in July and August, 2001 (Section 2). We then discuss techniques employed for achieving greater effectiveness and viru￾lence by the subsequent Code Red II and Nimda worms (Section 3). Figures 1 and 2 show the onset and progress of the Code Red and Nimda worms as seen “in the wild.” In this context, we develop the threat of three new techniques for highly virulent worms: hit-list scanning, permutation scanning, and Internet scale hit-lists (Sec￾tion 4). Hit-list scanning is a technique for accelerat￾ing the initial spread of a worm. Permutation scanning is a mechanism for distributed coordination of a worm. Combining these two techniques creates the possibility of a Warhol worm,2 seemingly capable of infecting most or all vulnerable targets in a few minutes to perhaps an hour. An extension of the hit-list technique creates a flash worm, which appears capable of infecting the vul￾nerable population in 10s of seconds: so fast that no human-mediated counter-response is possible. We then turn in Section 5 to the threat of a new class of 2So named for the quotation “In the future, everyone will have 15 minutes of fame.” 0 50 100 150 0 500 1000 1500 2000 Days Since Sept. 20, 2001 Distinct Remote Hosts Attacking LBNL Oct 1 Oct 15 Nov 1 Nov 15 Dec 1 Dec 15 Jan 1 Jan 15 Nimda Code Red I v2 Code Red II Figure 2: The endemic nature of Internet worms: Number of remote hosts launching confirmed attacks corresponding to different worms, as seen at the Lawrence Berkeley National Laboratory, over several months since their onset. Since July, 139,000 different remote Code Red I hosts have been con- firmed attacking LBNL; 125,000 different Code Red II hosts; and 63,000 Nimda hosts. Of these, 20,000 were observed to be infected with two different worms, and 1,000 with all three worms. (Again, Nimda is potentially an underestimate because we are only counting those launching Web attacks.) surreptitious worms. These spread more slowly, but in a much harder to detect “contagion” fashion, masquerad￾ing as normal traffic. We demonstrate that such a worm today could arguably subvert upwards of 10,000,000 In￾ternet hosts. Then in Section 6, we discuss some possibilities by which an attacker could control the worm using cryptographically-secured updates, enabling it to remain a threat for a considerable period of time. Even when most traces of the worm have been removed from the network, such an “updatable” worm still remains a sig￾nificant threat. Having demonstrated the very serious nature of the threat, we then in Section 7 discuss an ambitious but we believe highly necessary strategy for addressing it: the establishment at a national or international level of a “Center for Disease Control” analog for virus￾and worm-based threats to cybersecurity. We discuss the roles we envision such a Center serving, and offer thoughts on the sort of resources and structure the Cen￾ter would require in order to do so. Our aim is not to comprehensively examine each role, but to spur further discussion of the issues within the community

2 An Analysis of Code red I a monthly resurgence, as seen in Figure 2. Why it con- tinues to gain strength with each monthly appearance re mains unknown The first version of the Code Red worm was initially We call this model the Random Constant Spread(RCS) seen in the wild on July 13th, 2001, according to Ryan model. The model assumes that the worm had a good [EDSOla, EDSOlb1, who disassembled the worm code random number generator that is properly seeded. We mising Microsoft IIs web servers using the ida vulner- be potentially compromised from the Interne ability discovered also by Eeye and published June 18th make the approximation that N is fixed-ignoring both [EDSolc] and was assigned CVE number CVE-2001- patching of systems during the worm spread and normal 0500cV01] deploying and removing of systems or turning on and off of systems at night. We also ignore any spread of the Once it infected a host, Code -Red spread by launching worm behind firewalls on private Intranets) 99 threads which generated random IP addresses, and K is the initial compromise rate. That is, the number then tried to compromise those IP addresses using the of vulnerable hosts which an infected host can find and same vulnerability. A hundredth thread defaced the web server in some cases compromise per hour at the start of the incident, when few other hosts are compromised. We assume that K However, the first version of the worm analyzed by a global constant, and does not depend on the processor Eeye, which came to be known as CRv1, had an apparent speed, network connection, or location of the infected ng. The random number generator was initialized with machine. (Clearly, constant k is only an approxima- a fixed seed, so that all copies of the worm in a particular tion. )We assume that a compromised machine picks thread, on all hosts, generated and attempted to compro- other machines to attack completely at random, and that mise exactly the same sequence of IP addresses. (The once a machine is compromised, it cannot be compro- thread identifier is part of the seeding, so the worm had a msed again, or that if it is, that does not increase the hundred different sequences that it explores through the rate at which it can find and attack new systems. We space of IP addresses, but it only explored those hun assume that once it is compromised, it stays that way dred.) Thus CRvI had a linear spread and never com- t is a time which fixes when the incident happens promised many machines On July 19th, 2001, a second version of the worm began We then have the following variables to spread. This was suspected informally via mailing list discussion, then confirmed by the mathematical analysi we present below, and finally definitively confirmed by a is the proportion of vulnerable machines which have been compromised disassembly of the new worm. This version came to be known as Crv2 or Code red I t is the time(in hours Code Red I v2 was the same codebase as cRyl in al most all respects--the only differences were fixing the Now, we analyze the problem by assuming that bug with the random number generation, an end to web some particular time t, a proportion of the machines site defacements, and a Ddos payload targeting the IP a have been compromised, and then asking how many addressofwww.whitehouse.gov more machines, Nda, will get compromised in the next amount of time dt. The answer is: We developed a tentative quantitative theory of what happened with the spread of Code red I worm. The new Nda=(Na)K(1-a)dt version spread very rapidly until almost all vulnerable IIS servers on the Internet were compromised. It stopped The reason is that the number of machines compromised trying to spread at midnight UtC due to an internal c in the next increment of time is proportional to the num straint in the worm that caused it to turn itself off. It then ber of machines already compromised(Na)times the reactivated on August Ist, though for a while its spread number of machines each compromised machine can was suppressed by competition with Code Red Il(see below ). However, Code Red Il died by design [SAol] server includes uis. new vulnerable machines have been added October 1. while Code red i has continued to make Internet

2 An Analysis of Code Red I The first version of the Code Red worm was initially seen in the wild on July 13th, 2001, according to Ryan Permeh and Marc Maiffret of Eeye Digital Security [EDS01a, EDS01b], who disassembled the worm code and analyzed its behavior. The worm spread by compro￾mising Microsoft IIS web servers using the .ida vulner￾ability discovered also by Eeye and published June 18th [EDS01c] and was assigned CVE number CVE-2001- 0500 [CV01]. Once it infected a host, Code-Red spread by launching 99 threads which generated random IP addresses, and then tried to compromise those IP addresses using the same vulnerability. A hundredth thread defaced the web server in some cases. However, the first version of the worm analyzed by Eeye, which came to be known as CRv1, had an apparent bug. The random number generator was initialized with a fixed seed, so that all copies of the worm in a particular thread, on all hosts, generated and attempted to compro￾mise exactly the same sequence of IP addresses. (The thread identifier is part of the seeding, so the worm had a hundred different sequences that it explores through the space of IP addresses, but it only explored those hun￾dred.) Thus CRv1 had a linear spread and never com￾promised many machines. On July 19th, 2001, a second version of the worm began to spread. This was suspected informally via mailing list discussion, then confirmed by the mathematical analysis we present below, and finally definitively confirmed by disassembly of the new worm. This version came to be known as CRv2, or Code Red I. Code Red I v2 was the same codebase as CRv1 in al￾most all respects—the only differences were fixing the bug with the random number generation, an end to web site defacements, and a DDOS payload targeting the IP address of www.whitehouse.gov. We developed a tentative quantitative theory of what happened with the spread of Code Red I worm. The new version spread very rapidly until almost all vulnerable IIS servers on the Internet were compromised. It stopped trying to spread at midnight UTC due to an internal con￾straint in the worm that caused it to turn itself off. It then reactivated on August 1st, though for a while its spread was suppressed by competition with Code Red II (see below). However, Code Red II died by design [SA01] on October 1, while Code Red I has continued to make a monthly resurgence, as seen in Figure 2. Why it con￾tinues to gain strength with each monthly appearance re￾mains unknown.3 We call this model the Random Constant Spread (RCS) model. The model assumes that the worm had a good random number generator that is properly seeded. We define N as the total number of vulnerable servers which can be potentially compromised from the Internet. (We make the approximation that N is fixed—ignoring both patching of systems during the worm spread and normal deploying and removing of systems or turning on and off of systems at night. We also ignore any spread of the worm behind firewalls on private Intranets). K is the initial compromise rate. That is, the number of vulnerable hosts which an infected host can find and compromise per hour at the start of the incident, when few other hosts are compromised. We assume that K is a global constant, and does not depend on the processor speed, network connection, or location of the infected machine. (Clearly, constant K is only an approxima￾tion.) We assume that a compromised machine picks other machines to attack completely at random, and that once a machine is compromised, it cannot be compro￾mised again, or that if it is, that does not increase the rate at which it can find and attack new systems. We assume that once it is compromised, it stays that way. T is a time which fixes when the incident happens. We then have the following variables: • a is the proportion of vulnerable machines which have been compromised. • t is the time (in hours). Now, we analyze the problem by assuming that at some particular time t, a proportion of the machines a have been compromised, and then asking how many more machines, N da, will get compromised in the next amount of time dt. The answer is: N da = (N a)K(1 − a)dt. (1) The reason is that the number of machines compromised in the next increment of time is proportional to the num￾ber of machines already compromised (N a) times the number of machines each compromised machine can 3One possibility is that, since the default install of Windows 2000 server includes IIS, new vulnerable machines have been added to the Internet

This is interesting because it tells us that a worm like this can compromise all vulnerable machines on the Internet fairly fast. 与25558*8日之 Figure 3 shows hourly probe rate data from Ken Eich- mann of the Chemical Abstracts Service for the hourly probe rate inbound on port 80 at that site. Also shown is a fit to the data with K=1. 8.T=11.9. and with 100000 the top of the fit scaled to a maximum probe rate of 510,000 scans/hour. (We fit it to fall slightly below the 0246810121416 data curve. since it seems there is a fixed background Hour of the day rate of web probes that was going on before the rapid rise due to the worm spread. ) This very simple theory 一# of scans一群 of unique IPs 一 Predicted群 of scan can be seen to give a reasonable first approximation ex planation of the worm behavior. See also Section 4.3 for alidation of the theory via simulation igure 3: Hourly probe rate data for inbound port 80 at the Chemical Abstracts Service during the initial outbreak of Code Note that we fit the scan rate. rather than the number of Red I on July 19th, 2001. The t-axis is the hour of the day distinct IPs seen at this site. The incoming scan rate seen (CDT time zone), while the y-axis is probe rate, the number at a site is directly proportional to the total number of in- of different IP addresses seen, and a fit to the data discussed the text fected IPs on the Internet, since there is a fixed probabil ity for any worm copy to scan this particular site in the current time interval. however. the number of distinct compromise per unit time(K(1-a)), times the incre- IPs seen at a site is distorted relative to the overall in- ment of time(dt).(Note that machines can compromis fection curve. This is because a given worm copy, once K others per unit time to begin with, but only K (1-a) it is infected, will take some amount of time before it once a proportion of other machines are compromised gets around to scanning any particular site. For a small address space, this delay can be sizeable and causes the distinct IP graph at the given site to lag behind the over This give us the differential equation all Internet infection rate graph =Ka(1-a) (2) Two implications of this graph are interesting. One is that the worm came close to saturating before it turned with solution itself off at midnight UTC(1900 CDT), as the num- K(t-r) ber of copies ceased increasing a few hours before the 1+ek(t-T (3) worm s automatic turnoff. Thus it had found the bulk of the servers it was going to find at this time. Secondly, the infection rate was about 1.8 per hour-in the early where T is a constant of integration that fixes the time stages of the infection, each infected server was able to position of the incident. This equation has been well known for many years as the logistic equation, and gov erns the rate of growth of epidemics in finite systems Although Code Red I turned itself off at midnight UTC when all entities are equally likely to infect any other on July igth, hosts with inaccurate clocks kept it alive entity(which is true for randomized spreading among and allowed it to spread when the worm code al Internet-connected servers, in the absence of firewall fil- lowed it to re-awaken on August Ist. Figure 4 show tering rules that differentially affect infectability from or similar data and fit for that incident. The K here is about to different addresses) 0. 7. Since the worm code-base was the same. this lower pread rate indicates that the number of vulnerable sys- This is an interesting equation. For early t(significantly tems was a little less than 40% as many as the first time before T), a grows exponentially. For large t(signifi- around. That is, the data appears consistent with slightly cantly after T), a goes to 1(all vulnerable machines are more than half the systems having been fixed in the 11 compromised). The rate at which this happens depends days intervening only on K(the rate at which one machine can compro se others), and not at all on the number of machines

0 100,000 200,000 300,000 400,000 500,000 600,000 0 2 4 6 8 10 12 14 16 Hour of the day Number seen in an hour # of scans # of unique IPs Predicted # of scans Figure 3: Hourly probe rate data for inbound port 80 at the Chemical Abstracts Service during the initial outbreak of Code Red I on July 19th, 2001. The x-axis is the hour of the day (CDT time zone), while the y-axis is probe rate, the number of different IP addresses seen, and a fit to the data discussed in the text. compromise per unit time (K(1 − a)), times the incre￾ment of time (dt). (Note that machines can compromise K others per unit time to begin with, but only K ·(1−a) once a proportion of other machines are compromised already.) This give us the differential equation: da dt = Ka(1 − a) (2) with solution: a = e K(t−T) 1 + eK(t−T) , (3) where T is a constant of integration that fixes the time position of the incident. This equation has been well known for many years as the logistic equation, and gov￾erns the rate of growth of epidemics in finite systems when all entities are equally likely to infect any other entity (which is true for randomized spreading among Internet-connected servers, in the absence of firewall fil￾tering rules that differentially affect infectability from or to different addresses). This is an interesting equation. For early t (significantly before T), a grows exponentially. For large t (signifi- cantly after T), a goes to 1 (all vulnerable machines are compromised). The rate at which this happens depends only on K (the rate at which one machine can compro￾mise others), and not at all on the number of machines. This is interesting because it tells us that a worm like this can compromise all vulnerable machines on the Internet fairly fast. Figure 3 shows hourly probe rate data from Ken Eich￾mann of the Chemical Abstracts Service for the hourly probe rate inbound on port 80 at that site. Also shown is a fit to the data with K = 1.8, T = 11.9, and with the top of the fit scaled to a maximum probe rate of 510,000 scans/hour. (We fit it to fall slightly below the data curve, since it seems there is a fixed background rate of web probes that was going on before the rapid rise due to the worm spread.) This very simple theory can be seen to give a reasonable first approximation ex￾planation of the worm behavior. See also Section 4.3 for validation of the theory via simulation. Note that we fit the scan rate, rather than the number of distinct IPs seen at this site. The incoming scan rate seen at a site is directly proportional to the total number of in￾fected IPs on the Internet, since there is a fixed probabil￾ity for any worm copy to scan this particular site in the current time interval. However, the number of distinct IPs seen at a site is distorted relative to the overall in￾fection curve. This is because a given worm copy, once it is infected, will take some amount of time before it gets around to scanning any particular site. For a small address space, this delay can be sizeable and causes the distinct IP graph at the given site to lag behind the over￾all Internet infection rate graph. Two implications of this graph are interesting. One is that the worm came close to saturating before it turned itself off at midnight UTC (1900 CDT), as the num￾ber of copies ceased increasing a few hours before the worm’s automatic turnoff. Thus it had found the bulk of the servers it was going to find at this time. Secondly, the infection rate was about 1.8 per hour—in the early stages of the infection, each infected server was able to find about 1.8 other servers per hour. Although Code Red I turned itself off at midnight UTC on July 19th, hosts with inaccurate clocks kept it alive and allowed it to spread again when the worm code al￾lowed it to re-awaken on August 1st. Figure 4 shows similar data and fit for that incident. The K here is about 0.7. Since the worm code-base was the same, this lower spread rate indicates that the number of vulnerable sys￾tems was a little less than 40% as many as the first time around. That is, the data appears consistent with slightly more than half the systems having been fixed in the 11 days intervening

Finally, with probability 1/8 it would choose a random address from the whole Internet 200000 This strategy appears quite successful. The localized 150.000 preading allows the worm to quickly infect parts of the Internet that contain many vulnerable hosts, and also 100000 means that the infection often proceeds quicker since hosts with similar Ip addresses are often close together in the network topology also. This strategy also allows a 0邮 02468101214161820 once it manages to pass through the external firewal Hour of the day Unfortunately, developing an analytic model for the # of scans一暑 Predicted群 of scans spread of a worm employing this type of localized scan- ning strategy is significantly more difficult than the mod eling effort in Section 2, because it requires incorpo- igure 4: Hourly probe rate data for inbound port 80 at the rating potentially highly non-homogeneous patterns of Chemical Abstracts Service, for Code Red Is reemergence on population locality. The empirical data is also harder August Ist. The x-axis the time of day on August Ist( Central to interpret, because Code Red I was quite active when US Time). The y-axis shows the monitored probe rate and a it Code Red ll was released. Indeed, it appears that Code for the data discussed in the text Red Il took a while to overcome Code Red I(see Fig ure 1), but fully determining the interplay between the 3“ Better” worms-practice two appears to be a significant undertaking In this section, we explore the strategies adopted by the 3.2 Multi-vector worms-Nimda two major worms released subsequent to Code Red I “ Code red ir and“ Nimda As well illustrated by the Nimda worm/virus(and, in- deed, the original Internet Worm[Sp89, ER89), malev 3.1 Localized scanning-Code Red ll olent code is not restricted to a single technique. Nimda began on September 18th, 2001, spre ead ve and maintained itself on the internet for months after it The Code Red II worm was released on Saturday August started. Nimda spread extensively behind firewalls, and 4th, 2001 and spread rapidly [CEO1, SA01. The worm illustrates the ferocity and wide reach that a multi-mode code contained a comment stating that it was"Co worm can exhibit. The worm is thought to have used at Red Il"but it was an unrelated code base. It did use the least five different methods to spread itself. same vulnerability, however-a buffer overflow in Mi- crosoft's Iis Web server with Cve number CVE-2001 0500. When successful, the payload installed a root By infecting Web servers from infected client ma- backdoor allowing unrestricted remote access to the in- chines via active probing for a Microsoft Iis vul- fected host. The worm exploit only worked correctly nerability(CVE-2000-0884) when IIs was running on Microsoft Windows 2000; on Windows NT it caused a system crash rather than an By bulk emailing of itself as an attachment based on email addresses determined from the infected The worm was also a single-stage scanning worm that By copying itself across open network shares chose random IP addresses and attempted to infect them However, it used a localized scanning strategy, where it By adding exploit code to Web pages on com was differentially likely to attempt to infect addresses promised servers in order to infect clients which close to it. Specifically, with probability 3 8 it chose a random IP address from within the class B address space (16 network) of the infected machine. With probability By scanning for the backdoors nd by code 1/2 it chose randomly from its own class A(/8 network) Red ii and also the“ sadmind

0 50,000 100,000 150,000 200,000 250,000 0 2 4 6 8 10 12 14 16 18 20 Hour of the day Number seen in an hour # of scans Predicted # of scans Figure 4: Hourly probe rate data for inbound port 80 at the Chemical Abstracts Service, for Code Red I’s reemergence on August 1st. The x-axis the time of day on August 1st (Central US Time). The y-axis shows the monitored probe rate and a fit for the data discussed in the text. 3 “Better” worms—practice In this section, we explore the strategies adopted by the two major worms released subsequent to Code Red I: “Code Red II” and “Nimda.” 3.1 Localized scanning—Code Red II The Code Red II worm was released on Saturday August 4th, 2001 and spread rapidly [CE01, SA01]. The worm code contained a comment stating that it was “Code Red II,” but it was an unrelated code base. It did use the same vulnerability, however—a buffer overflow in Mi￾crosoft’s IIS Web server with CVE number CVE-2001- 0500. When successful, the payload installed a root backdoor allowing unrestricted remote access to the in￾fected host. The worm exploit only worked correctly when IIS was running on Microsoft Windows 2000; on Windows NT it caused a system crash rather than an in￾fection. The worm was also a single-stage scanning worm that chose random IP addresses and attempted to infect them. However, it used a localized scanning strategy, where it was differentially likely to attempt to infect addresses close to it. Specifically, with probability 3/8 it chose a random IP address from within the class B address space (/16 network) of the infected machine. With probability 1/2 it chose randomly from its own class A (/8 network). Finally, with probability 1/8 it would choose a random address from the whole Internet. This strategy appears quite successful. The localized spreading allows the worm to quickly infect parts of the Internet that contain many vulnerable hosts, and also means that the infection often proceeds quicker since hosts with similar IP addresses are often close together in the network topology also. This strategy also allows a worm to spread very rapidly within an internal network once it manages to pass through the external firewall. Unfortunately, developing an analytic model for the spread of a worm employing this type of localized scan￾ning strategy is significantly more difficult than the mod￾eling effort in Section 2, because it requires incorpo￾rating potentially highly non-homogeneous patterns of population locality. The empirical data is also harder to interpret, because Code Red I was quite active when Code Red II was released. Indeed, it appears that Code Red II took a while to overcome Code Red I (see Fig￾ure 1), but fully determining the interplay between the two appears to be a significant undertaking. 3.2 Multi-vector worms—Nimda As well illustrated by the Nimda worm/virus (and, in￾deed, the original Internet Worm [Sp89, ER89]), malev￾olent code is not restricted to a single technique. Nimda began on September 18th, 2001, spread very rapidly, and maintained itself on the Internet for months after it started. Nimda spread extensively behind firewalls, and illustrates the ferocity and wide reach that a multi-mode worm can exhibit. The worm is thought to have used at least five different methods to spread itself. • By infecting Web servers from infected client ma￾chines via active probing for a Microsoft IIS vul￾nerability (CVE-2000-0884). • By bulk emailing of itself as an attachment based on email addresses determined from the infected machine. • By copying itself across open network shares • By adding exploit code to Web pages on com￾promised servers in order to infect clients which browse the page. • By scanning for the backdoors left behind by Code Red II and also the “sadmind” worm [CE03]