© 2006
A computer worm is a self-replicating computer program, similar to a computer virus. A virus attaches itself to, and becomes part of, another executable program; however, a worm is self-contained and does not need to be part of another program to propagate itself. They are often designed to exploit the file transmission capabilities found on many computers. The main difference between a computer virus and a worm is that a virus can not propagate by itself whereas worms can. A worm uses a network to send copies of itself to other systems and it does so without any intervention.... Read more |
Klez |
| Klez is a computer worm that propagates via E-mail. It first appeared in the end of 2001. A number of variants of the worm exists. Klez infects Microsoft Windows systems, exploiting a vulnerability in Internet Explorer, used by both Outlook and Outlook Express to render HTML mail. The email through which the worm spreads always includes a text portion and one or more attachments. The text portion consists of either an HTML internal frame tag which causes buggy email clients to automatically execute the worm, or a few lines of text that attempt to induce the recipient to execute the... Read more |
Code Red |
| The Code Red worm was a computer worm released on the Internet on July 13, 2001. It attacked computers running Microsofts IIS web server. The most in-depth research on the worm was performed by the programmers at eEye Digital Security. They also gave the worm its name, a reference to a variety of Mountain Dew soft drink and the phrase "Hacked By Chinese!" (see Red Scare) with which the worm defaced websites. The worm exploited a vulnerability in the indexing software distributed with IIS, described in MS01-033, for which a patch had been available a month earlier. The payload of... Read more |
Bagle |
| Bagle is a computer worm affecting Microsoft Windows. The first strain, Bagle.A, did not propagate widely. A second variation, Bagle.B is considerably more virulent. Bagle is a mass-mailing worm. It copies itself to the Windows system directory (Bagle.A as bbeagle.exe, Bagle.B as au.exe) and opens a backdoor on TCP port 6777 (Bagle.A) or 8866 (Bagle.B). It does not mail itself to addresses containing the strings "@hotmail.com", "@msn.com", "@microsoft" or "@avp". The initial strain, Bagle.A, was first sighted on January 18, 2004. It was not widespread and stopped spreading after January 28, 2004. The second strain, Bagle.B, was first sighted on... Read more |
| Overlay networks, Network overlays: SSL VPN | |
| NIDS, Okena: Network Intrusion Detection | |
© 2006