Worm

Description

To spread it uses what connects computers: the network, shared resources, unpatched vulnerabilities. It can carry extra cargo — ransomware, a backdoor, a remote access tool — so what begins on one machine soon floods the whole network. It can do damage with no cargo at all: replication alone is enough to congest a network and bring it to a halt.

A worm usually punishes neglect. The best-known specimens spread through unknown vulnerabilities, but also through known ones for which a patch already existed — it simply had not been installed. With a worm, regular patching and network segmentation are the difference between one infected machine and a thousand.

Examples

• WannaCry (2017) exploited the EternalBlue vulnerability in the SMB protocol and infected hundreds of thousands of machines in more than 150 countries in a single day. To make it worse, it carried a ransomware attack with it.
• Conficker infected millions of machines through the same class of network vulnerability, staying present on unpatched systems for years. One unpatched XP machine on the network was enough for every other machine to start reporting attacks from it.
• Stuxnet, probably the most sophisticated worm ever built, spent years destroying Iranian nuclear centrifuges inside an isolated environment. Carried in on a USB stick, it sought out and sabotaged very specific control systems.

Notes

• The worms that did the most damage spread through vulnerabilities for which a patch already existed. The problem was not unknown; it was not taken seriously.
• Because it spreads by itself, one infected machine on a flat network is enough to bring the whole network down. Against a worm, segmentation is the best defense.