In this lesson,
we're going to explore computer worms.
Now, a worm is a piece of malicious software,
much like a virus,
that can replicate itself without any user intervention.
Now, the key difference here between a virus and a worm
is that a virus requires a user to take some action
such as opening a file,
clicking on a malicious web link,
or connecting a mass storage device to your system.
But a worm, on the other hand, can actually replicate itself
and spread throughout your network
without a user's consent or their action.
Now, this occurs because a worm
will take advantage of vulnerabilities
in our operating systems and applications
if our organizations don't mitigate these vulnerabilities
by selecting the appropriate security controls
and performing appropriate security patching.
So if a worm can scan your network
and determine that one of your workstations
is missing a security patch,
that worm can take advantage of that vulnerability
and then use it to spread from victim to victim
across the network and across the world.
Now, worms are very dangerous for two different reasons.
First, they're dangerous because they can infect
your workstation and other computing assets,
but they're also really dangerous
because they can cause disruption
to your normal network traffic
because they're constantly trying to replicate
and spread themselves across the network.
This begins to consume not just our network resources
but also consumes compute power, processing power,
memory power, and network capacity,
which will slow down your system and your overall network.
If the replication is occurring too rapidly, for example,
this can actually cause a denial-of-service attack
against your network and its associated servers.
Now worms are best known for spreading far and wide
over the internet in a relatively short amount of time.
Even as far back as 2001,
there was a worm named Nimda
which is basically admin spelled backwards.
Now, Nimda was able to propagate against the entire internet
in just 22 minutes, which is really impressive,
especially because most internet connections back then
were extremely slow and relied upon dial-up modems.
Now, there's another major worm that we saw back in 2009
and this one was called Conficker.
Now, Conficker was probably one of the largest worms
that we've seen to date as cybersecurity professionals
because it was able to infect
between nine and 15 million machines.
This worm was going through and infecting
as many machines as it could find,
and all these machines
were missing a critical security patch
for the Windows operating system
specifically the Microsoft patch
known as 08-067.
Now, this security patch
was designed to solve a software vulnerability
inside the way Windows was doing file and printer sharing.
Conficker would actively scan every resource
on an infected organization's internal network
as well as across the internet.
And whenever it found a machine
without that security patch installed,
it would then execute some malicious code
to take over that infected machine
and add it to a larger botnet
that the attacker could then use
for other malicious purposes.
Now, luckily, cybersecurity professionals
were able to shut down the attacker's botnet
before it was used for any malicious or nefarious purposes.
But Conficker does show the true power
of how far and wide these worms can spread
especially when you're using an internet connected system.
So remember, a worm is a piece of malicious software
that can self replicate without any user interaction.
This is the key difference between a virus and a worm
because a virus requires some kind of user action
like opening a file, clicking on a malicious web link,
or connecting a malicious storage device to your system
to cause the system to get infected in the first place.
Worms, though, will simply continually search out
a new network connection
and scan any resources it finds
to try and exploit some kind of known vulnerability
in order to take over that machine and infect it
as well as infecting your network.