1
00:00:00,150 --> 00:00:01,110
In this lesson,

2
00:00:01,110 --> 00:00:03,240
we're going to explore computer worms.

3
00:00:03,240 --> 00:00:05,250
Now, a worm is a piece of malicious software,

4
00:00:05,250 --> 00:00:06,360
much like a virus,

5
00:00:06,360 --> 00:00:09,480
that can replicate itself without any user intervention.

6
00:00:09,480 --> 00:00:11,910
Now, the key difference here between a virus and a worm

7
00:00:11,910 --> 00:00:14,730
is that a virus requires a user to take some action

8
00:00:14,730 --> 00:00:15,930
such as opening a file,

9
00:00:15,930 --> 00:00:17,190
clicking on a malicious web link,

10
00:00:17,190 --> 00:00:19,680
or connecting a mass storage device to your system.

11
00:00:19,680 --> 00:00:22,560
But a worm, on the other hand, can actually replicate itself

12
00:00:22,560 --> 00:00:23,760
and spread throughout your network

13
00:00:23,760 --> 00:00:26,400
without a user's consent or their action.

14
00:00:26,400 --> 00:00:27,840
Now, this occurs because a worm

15
00:00:27,840 --> 00:00:29,250
will take advantage of vulnerabilities

16
00:00:29,250 --> 00:00:31,260
in our operating systems and applications

17
00:00:31,260 --> 00:00:33,900
if our organizations don't mitigate these vulnerabilities

18
00:00:33,900 --> 00:00:35,850
by selecting the appropriate security controls

19
00:00:35,850 --> 00:00:38,280
and performing appropriate security patching.

20
00:00:38,280 --> 00:00:40,380
So if a worm can scan your network

21
00:00:40,380 --> 00:00:41,820
and determine that one of your workstations

22
00:00:41,820 --> 00:00:43,320
is missing a security patch,

23
00:00:43,320 --> 00:00:45,600
that worm can take advantage of that vulnerability

24
00:00:45,600 --> 00:00:47,425
and then use it to spread from victim to victim

25
00:00:47,425 --> 00:00:50,460
across the network and across the world.

26
00:00:50,460 --> 00:00:53,280
Now, worms are very dangerous for two different reasons.

27
00:00:53,280 --> 00:00:55,170
First, they're dangerous because they can infect

28
00:00:55,170 --> 00:00:57,420
your workstation and other computing assets,

29
00:00:57,420 --> 00:00:59,160
but they're also really dangerous

30
00:00:59,160 --> 00:01:00,420
because they can cause disruption

31
00:01:00,420 --> 00:01:02,010
to your normal network traffic

32
00:01:02,010 --> 00:01:03,660
because they're constantly trying to replicate

33
00:01:03,660 --> 00:01:06,060
and spread themselves across the network.

34
00:01:06,060 --> 00:01:08,580
This begins to consume not just our network resources

35
00:01:08,580 --> 00:01:11,340
but also consumes compute power, processing power,

36
00:01:11,340 --> 00:01:13,260
memory power, and network capacity,

37
00:01:13,260 --> 00:01:16,080
which will slow down your system and your overall network.

38
00:01:16,080 --> 00:01:18,690
If the replication is occurring too rapidly, for example,

39
00:01:18,690 --> 00:01:20,760
this can actually cause a denial-of-service attack

40
00:01:20,760 --> 00:01:23,700
against your network and its associated servers.

41
00:01:23,700 --> 00:01:26,250
Now worms are best known for spreading far and wide

42
00:01:26,250 --> 00:01:29,310
over the internet in a relatively short amount of time.

43
00:01:29,310 --> 00:01:31,500
Even as far back as 2001,

44
00:01:31,500 --> 00:01:33,090
there was a worm named Nimda

45
00:01:33,090 --> 00:01:35,610
which is basically admin spelled backwards.

46
00:01:35,610 --> 00:01:38,400
Now, Nimda was able to propagate against the entire internet

47
00:01:38,400 --> 00:01:41,130
in just 22 minutes, which is really impressive,

48
00:01:41,130 --> 00:01:43,680
especially because most internet connections back then

49
00:01:43,680 --> 00:01:46,950
were extremely slow and relied upon dial-up modems.

50
00:01:46,950 --> 00:01:50,160
Now, there's another major worm that we saw back in 2009

51
00:01:50,160 --> 00:01:52,080
and this one was called Conficker.

52
00:01:52,080 --> 00:01:53,940
Now, Conficker was probably one of the largest worms

53
00:01:53,940 --> 00:01:56,100
that we've seen to date as cybersecurity professionals

54
00:01:56,100 --> 00:01:57,090
because it was able to infect

55
00:01:57,090 --> 00:01:59,910
between nine and 15 million machines.

56
00:01:59,910 --> 00:02:01,710
This worm was going through and infecting

57
00:02:01,710 --> 00:02:03,420
as many machines as it could find,

58
00:02:03,420 --> 00:02:04,500
and all these machines

59
00:02:04,500 --> 00:02:06,360
were missing a critical security patch

60
00:02:06,360 --> 00:02:07,890
for the Windows operating system

61
00:02:07,890 --> 00:02:09,840
specifically the Microsoft patch

62
00:02:09,840 --> 00:02:12,570
known as 08-067.

63
00:02:12,570 --> 00:02:13,890
Now, this security patch

64
00:02:13,890 --> 00:02:15,660
was designed to solve a software vulnerability

65
00:02:15,660 --> 00:02:18,810
inside the way Windows was doing file and printer sharing.

66
00:02:18,810 --> 00:02:21,270
Conficker would actively scan every resource

67
00:02:21,270 --> 00:02:23,550
on an infected organization's internal network

68
00:02:23,550 --> 00:02:25,020
as well as across the internet.

69
00:02:25,020 --> 00:02:25,980
And whenever it found a machine

70
00:02:25,980 --> 00:02:27,750
without that security patch installed,

71
00:02:27,750 --> 00:02:29,640
it would then execute some malicious code

72
00:02:29,640 --> 00:02:31,350
to take over that infected machine

73
00:02:31,350 --> 00:02:33,090
and add it to a larger botnet

74
00:02:33,090 --> 00:02:34,170
that the attacker could then use

75
00:02:34,170 --> 00:02:36,120
for other malicious purposes.

76
00:02:36,120 --> 00:02:38,100
Now, luckily, cybersecurity professionals

77
00:02:38,100 --> 00:02:40,110
were able to shut down the attacker's botnet

78
00:02:40,110 --> 00:02:42,990
before it was used for any malicious or nefarious purposes.

79
00:02:42,990 --> 00:02:45,000
But Conficker does show the true power

80
00:02:45,000 --> 00:02:47,280
of how far and wide these worms can spread

81
00:02:47,280 --> 00:02:50,070
especially when you're using an internet connected system.

82
00:02:50,070 --> 00:02:52,710
So remember, a worm is a piece of malicious software

83
00:02:52,710 --> 00:02:55,890
that can self replicate without any user interaction.

84
00:02:55,890 --> 00:02:58,170
This is the key difference between a virus and a worm

85
00:02:58,170 --> 00:03:00,660
because a virus requires some kind of user action

86
00:03:00,660 --> 00:03:03,090
like opening a file, clicking on a malicious web link,

87
00:03:03,090 --> 00:03:05,580
or connecting a malicious storage device to your system

88
00:03:05,580 --> 00:03:08,310
to cause the system to get infected in the first place.

89
00:03:08,310 --> 00:03:10,590
Worms, though, will simply continually search out

90
00:03:10,590 --> 00:03:11,730
a new network connection

91
00:03:11,730 --> 00:03:13,560
and scan any resources it finds

92
00:03:13,560 --> 00:03:16,020
to try and exploit some kind of known vulnerability

93
00:03:16,020 --> 00:03:18,090
in order to take over that machine and infect it

94
00:03:18,090 --> 00:03:19,790
as well as infecting your network.