• PC World
• » Security

He's been a virus writer for seven years. He goes by the handle Melhacker and may have been responsible for the recent outbreak of the Bugbear worm, the second most prevalent worm on the Internet last year. He recently claimed to be working on a new virus, Scezda, that represents a new type of threat.

Scezda, as Melhacker described it, would fall into an emerging category of megaworms that combine features from some of this year's most prolific worms and viruses, including Sircam, Klez, and Nimda. It uses a random number generator to determine how long it will remain dormant on a target system. Then it randomly chooses one of many different methods to replicate itself.

This is the essence of the new era of megaworms, what some experts refer to as blended, or polymorphic, threats that rely upon multiple methods of propagation. And that's just one way in which the virus threat is evolving.

Current Threats

This past year, researchers at Sophos detected 7189 new viruses, worms, and Trojan horses, bringing the total to more than 78,000. On average, the Sophos virus labs produce detection routines for more than 25 new viruses each day.

Nine of the top ten viruses detected by all major virus-protection companies in 2002 were mass-mailing viruses that exploited known vulnerabilities in the Win32 application programming interface. And 87 percent of all reports of infections stemmed from Windows viruses.

"Worms that are targeting known [technical] vulnerabilities are continuing to climb," says Vincent Weafer, senior director of the Symantec Security Response group. "That's significant because you're moving away somewhat from social engineering," he added, referring to such virus-spreading tricks as messages that entice recipients to open infected attachments.

The most significant weakness exploited last year was the so-called malformed MIME vulnerability, originally discovered in 2001. Although a patch has been available for more than a year, viruses and worms have been able to capitalize on this vulnerability on unpatched machines to automatically execute a virus program when a user views an e-mail in preview mode.

Brid, Bugbear, Nimda, and Klez all use this vulnerability, says Weafer.

"Today, the line between worms and viruses is blurred as successful designs take on characteristics of both and spread over the Internet," says Dan Ingevaldson, team leader of Internet Security Systems' X-Force group. "The most successful worms act like a Swiss army knife, because they can spread by using many different proven methods, such as mass e-mail, Web server vulnerabilities, or peer-to-peer technologies."

Virus Evolution

In the near future, companies will need to be prepared to deal with increasingly stealthy viruses carrying more destructive payloads, say researchers. In a recent research paper, Stuart Staniford, chief executive of Silicon Defense, outlined the emerging "threat of surreptitious worms that spread more slowly but in a much harder to detect 'e-contagion' fashion."

"We demonstrate that such a worm today could arguably subvert upwards of 10 [million] Internet hosts," Staniford concludes.

Anti-Virus Emergency Response Team (AVERT) researchers at McAfee Security, a division of Network Associates, say they encountered a virus that took advantage of the Alternate Data Streams (ADS) feature in Microsoft's New Technology File System (NTFS) for its Windows XP, Windows 2000, and Windows NT operating systems. The ADS technology allows data to be stored in hidden files that are linked to visible NTFS files--and that can't be removed without deleting the NTFS file itself.

Users who don't have permission to write to a file can't add an ADS to it. And although Windows File Protection, introduced in Windows 2000, prevents hackers from replacing protected system files, it doesn't prevent an authorized user from adding ADSs, along with hidden, executable code, to those system files.

ADS's primary purpose is to enable compatibility with the Macintosh file system. But in September 2000, McAfee discovered a virus named Win2K.Stream that attempted to conceal itself in an ADS. This works because most antivirus products don't scan the ADS, says Vincent Gullotto, vice president of AVERT. McAfee has added this capability. But so far, Gullotto has seen no other instances of this technique.

Worms Take Up Espionage

The intentions of virus and worm writers are also changing. In the past, most worms and viruses destroyed data. Now, however, there are indications that the masters of malicious code are looking to steal that data.

"We'll see a progression toward targeting data," says Gullotto. "We saw that this past year with Sircam, which randomly took documents out of the MyDocuments folder."

Symantec's Weafer agrees. "Payloads have moved from data destruction to dropping Trojans and compromising machines, as well as sending information from the machine out of the network," he says. "You have to update your security patches."

Chris Wraight, a technology consultant at Sophos, says "combined cocktail threats" will be much harder for users to eradicate. Such a worm "might drop a Trojan, another virus, or it might replicate on another occasion," he says. So just because you've uncovered one instance of the malicious code, it doesn't mean you've discovered all infections.

New Targets

And while the vast majority of worms and viruses are written to target known vulnerabilities in Windows platforms, some researchers are warning Linux and Unix users to beware. The September outbreak of the Linux Slapper worm, for example, infected more than 20,000 machines and could be used for denial-of-service attacks, says Weafer. "We're mixing Linux and Windows systems in the corporate world all the time," he says. "People who have Linux and Unix systems assumed they were immune. We know that's not true."

Microsoft's .Net Framework may also become a major target for some virus and worm authors. A pseudonymous hacker, "Alcopaul," recently submitted a .Net-targeting worm he created to antivirus research labs for evaluation. Although Alcopaul says his worm, topeace.exe, doesn't destroy data, he claims that it is capable of turning off antivirus software, disabling firewalls, spreading to the Kazaa file-trading program, and mailing itself to e-mail addresses it harvests from the Temporary Internet Files folder via the Simple Mail Transfer Protocol.

Antivirus vendors are still studying Alcopaul's worm to determine what specific vulnerabilities it exploits. However, past .Net worms have infected .Net executable files.

Although only users running Windows XP with Service Pack 1 have the .Net Framework installed, Alcopaul's vision is on the future. And that's the rub for his targets--trying to find the right balance between acting on current threats and thinking about future ones.

For now, the best protection is to stick with the basics, Weafer says. "Pay attention to security updates and lock down unnecessary services."

Virus Trends to Watch

Proliferation of megaviruses: These worms and viruses change every time they replicate and target multiple vulnerability points instead of exploiting just one weakness.

Increased data theft: Like Sircam, which removed files from the user's MyDocuments folder, new viruses will be designed to steal data--not just destroy it.

Greater sophistication: Virus writers will exploit a broader range of weaknesses, such as attaching viruses to Windows NTFS files as linked, hidden Alternate Data Stream files.

.Net Threat: Virus and worm program writers are probing Microsoft's .Net Framework and developing programs that may leverage weaknesses in the framework and associated executable files.

• See more like this:
• virus,
• worm,
• Trojan horse,
• bugbear,
• megaworm,
• sircam,
• klez,
• nimda,
• sophos,
• Symantec,
• Norton,
• mcafee