
	Where results make sense

Topic: Worm

In the News (Tue 2 Dec 08)

Damian Green

Sumner Redstone

Crimson Tide

Tommy Tuberville

Bill Clinton

Wayne Rooney

Vilasrao Deshmukh

Wake Forest

Grand Slam

Oklahoma State

	What is worm? - a definition from Whatis.com
		In a computer, a worm is a self-replicating virus that does not alter files but resides in active memory and duplicates itself.
		Worms use parts of an operating system that are automatic and usually invisible to the user.
		A bot worm is a self-replicating malware program that resides in current memory, turns infected computers into zombies (or bots) and transmits itself...
	searchsecurity.techtarget.com /sDefinition/0,,sid14_gci213386,00.html (295 words)

	worm blog
		WORM aims to be a true workshop, with a primary goal of fostering the development of preliminary work and helping nucleate a malcode research community.
		To this end, WORM aims to bring together both academic researchers and practitioners that fight malware in the fields.
		WORM is open to two classes of submissions: research papers and panel proposals.
	www.wormblog.com (2320 words)

	WORM 2005
		Such worms are increasingly being used as delivery mechanisms for various types of malicious payloads, including remote-controlled "zombies", spyware and botnets.
		WORM aims to be a true workshop, with a primary goal of fostering the development of preliminary work and helping nucleate a worm-research community.
		Finally, WORM is soliciting proposals for a discussion panel on a topic relevant to the workshop.
	www1.cs.columbia.edu /~angelos/worm05 (642 words)

	worm blog: papers
		Worms are self-replicating malicious programs that represent a major security threat for the Internet, as they can infect and damage a large number of vulnerable hosts at timescales where human responses are unlikely to be effective.
		Sophisticated worms that use precomputed hitlists of vulnerable targets are especially hard to contain, since they are harder to detect, and spread at rates where even automated defenses may not be able to react in a timely fashion.
		We assume that a worm has already penetrated a system and is trying to hide its presence and propagation attempts from an IDS.We focus on stealthy worms that cannot be reliably detected by increases in traffic because of their low propagation factor.We first give an example of a simple polymorphic worm.
	www.wormblog.com /papers (15799 words)

	A Tour of the Worm
		If the worm's files are somehow captured before the worm can delete them, the object files have been loaded in such a way as to remove most non-essential symbol table entries, making it harder to guess at the purposes of worm routines from their names.
		Finally, new worms lose all of the history of infection that their parents had, so the children of a worm are constantly trying to re-infect the parent's host, as well as the other children's hosts.
		The worm is careful to skip the loopback device and any local interfaces (in the event that the current host is a gateway); when it finishes, it randomizes the order of the list and adds the first 20 gateways to the host table to speed up the initial searches.
	world.std.com /~franl/worm.html (10633 words)

	Worm Composting
		This brief introduction to worm composting is only a basic guide, and while we have tried to include all the necessary information to get you and your worms started, we recommend that you also read the book - it is full of useful and fascinating details about this process.
		Worms have been known to crawl out of the bedding and onto the sides and lid if conditions are wrong for them.
		worms in the hallway, worms on the stairs."
	cityfarmer.org /wormcomp61.html (2032 words)

	121 worms live fishing bait.com, dendro and red worms for fishing bait, composting worms, UK based secure online worm ...
		121 worms live fishing bait.com, dendro and red worms for fishing bait, composting worms, UK based secure online worm sales, world-wide export.
		Our Worm beds are undergoing a rebuild and expansion program due to huge demand.
		Unfortunately we will be unable to supply fishing bait worms for a while.
	121-worms-live-fishing-bait.com (49 words)

	CAIDA : analysis : security : code-red (Site not responding. Last check: )
		The first version of the worm spread slowly, because each infected machine began to spread the worm by probing machines that were either infected or impregnable.
		CAIDA's ongoing analysis of the Code-Red worms includes a detailed analysis of the spread of Code-Red version 2 on July 19, 2001, a follow-up survey of the patch rate of machines infected on July 19th, and dynamic graphs showing the prevalence of Code-Red version 2 and CodeRedII worldwide.
		worms have the potential to both damage infected machines and to interfere with networks and services due to congestion caused by the spread of the worm.
	www.caida.org /analysis/security/code-red (2320 words)

	wormhome
		Worm is a poetry selection that is distributed free via email every month or so.
		Worm is formatted as HTML we recommend you use up-to-date proprietary security.
		All poets appearing in ~ (the poetry) Worm ~ have granted a limited copyright waiver for electronic replication [only] of that collection as a whole [only].
	www.villarana.freeserve.co.uk /wormhome.htm (280 words)

	W32/Nachi.worm
		Once running, the worm terminates and deletes the W32/Lovsan.worm.a process and applies the Microsoft patch to prevent other threats from infecting the system through the same hole.
		To check whether the target machine is on the network, the worm sends an ICMP ping to potential victim machines, and upon a reply, sends the exploit data.
		The first is to detect the Vulnerability that the worm uses to exploit the machine.
	vil.nai.com /vil/content/v_100559.htm (1680 words)

	CAIDA : analysis : security : witty (Site not responding. Last check: )
		The worm payload of 637 bytes is padded with data from system memory to fill this random size and a packet is sent out from source port 4000.
		With previous Internet worms, including Code-Red, Nimda, and SQL Slammer, a few hosts were seeded with the worm and proceeded to spread it to the rest of the vulnerable population.
		Previous worms have lagged several weeks behind publication of details about the remote-exploit bug, and large portions of the victim populations appeared to not know what software was running on their machines, let alone take steps to make sure that software was up to date with security patches.
	www.caida.org /analysis/security/witty (3054 words)

	[No title]
		A giant poisonous worm that lives beneath the sands of the Gobi and can kill with the power of electricity can surely only be the stuff of legend.
		The first time you hear about the Mongolian Death Worm you assume it has to be a joke; it sounds too much like the monster from a B-movie or an especially dire comic book to be true.
		A five-foot (1.5m) long worm dwelling in the vast and inhospitable expanses of the Gobi Desert, the creature is known to Mongolia’s nomadic tribesmen as the allghoi khorkhoi (sometimes given as allerghoi horhai or olgoj chorchoj) or intestine worm’ for its resemblance to a sort of living cow’s intestine.
	www.forteantimes.com /articles/182_deathworm1.shtml (536 words)

	CERT Advisory CA-2003-04 MS-SQL Server Worm
		This worm is being referred to as the SQLSlammer, W32.Slammer, and Sapphire worm.
		Activity of this worm is readily identifiable on a network by the presence of 376-byte UDP packets.
		Compromise by the worm confirms a system is vulnerable to allowing a remote attacker to execute arbitrary code as the local SYSTEM user.
	www.cert.org /advisories/CA-2003-04.html (880 words)

	Glossary of terms
		Spyware Trojans and spyware worms are Trojans and Win32 worms that also exhibit behaviour attributed to spyware.
		Spyware worm is a term used to describe malware that has the ability to self-replicate without a host program and send information from a computer to a third party without the user's permission or knowledge.
		Many of these worms also replicate is the same way as Word 97 macro viruses.
	www.sophos.com /pressoffice/news/articles/2001/11/va_glossary.html (3606 words)

	The Morris Internet Worm (Site not responding. Last check: )
		The primary difference between worms and other illicit computer programs (often referred to as viruses) is the method of operation the programs use in order to reproduce and spread.
		Once the worm discovers an internet connection, all that it must do is download a copy of itself to that location, and continue running as normal.
		Now it has been 7 years since the Worm was defeated, but it is still worth looking at what happened, both in terms of how the program operated, and as to what conditions allowed it to do what it did.
	snowplow.org /tom/worm/worm.html (754 words)

	Worm spreading through Microsoft Plug-and-Play flaw
		The worm, dubbed Zotob by antivirus firm F-Secure, started spreading early Sunday morning, according to a statement posted by the company.
		The worm is the first major program since the Sasser worm to target a vulnerability in Microsoft Windows computers to spread.
		If a computer is infected with the program, the worm starts a file-transfer protocol (FTP) server and attempts to spread further, according to an analysis by the Internet Storm Center, a group of volunteers who monitor network threats on behalf of the SANS Institute.
	www.securityfocus.com /news/11281 (501 words)

	CNN.com - Computer worm grounds flights, blocks ATMs - Jan. 26, 2003
		Worms of this nature are often precursors to a different type of attack called "distributed denial of service." In that case, computers infected with a worm or other program are directed to send a flood of information to a specific Internet location and force it off-line.
		"[Saturday's worm] is the recruitment of soldiers, not telling the soldiers where to aim their guns," Paller said.
		In many cases, a worm's creator brags about his or her activities online and is caught that way.
	www.cnn.com /2003/TECH/internet/01/25/internet.attack/index.html (878 words)

	W32/Lovsan.worm.a
		The worm also creates a remote access point, allowing an attacker to run system commands at their choosing.
		The worm attempts to exploit the DCOM RPC vulnerability on the found systems to create a remote shell on TCP port 4444.
		The worm scans the local class C subnet, or other random subnets, on port 135.
	vil.nai.com /vil/content/v_100547.htm (1645 words)

	F-Secure Computer Virus Information Pages: Santy
		If the worm is able to exploit the vulnerablity, it will attempt to transfer itself to the victim host in 20-byte chunks.
		The worm is written to a file "m1ho2of" on the victim.
		After the transfer is complete, the worm will use the exploit once again to execute the code using the system default Perl interpreter.
	www.f-secure.com /v-descs/santy_a.shtml (372 words)

	CNN.com - Worm strikes down Windows 2000 systems - Aug 17, 2005
		David Perry of Trend Micro, an Internet monitoring firm, said the latest worm may have been derived from the Zotob worm, which was first reported over the weekend.
		Improved firewalls and faster patches may have limited the worm's spread, said Jeff Havrila, a technical analyst with the U.S. Computer Emergency Readiness Team, a coalition of public and private groups that combats computer attacks.
		He also said it is unclear how long the worm may take to run its course, noting that many people are away on summer vacation and may be affected only when they return.
	www.cnn.com /2005/TECH/internet/08/16/computer.worm/index.html (681 words)

	Win32.Poza.A
		Win32.Poza is a worm using the exploit described in MS03-026 to gain access to unpatched Windows installations.
		The worm is capable of keeping live connections to 20 exploited machines simultaneously.
		One of the offsets used by the worm must be different for each of these operating systems, in order for the exploit it uses to work.
	www3.ca.com /virusinfo/virus.aspx?ID=36265 (869 words)

	Net worm using Google to spread \| CNET News.com
		The Santy worm uses a flaw in the widely used community forum software known as the PHP Bulletin Board (phpBB) to spread, according to updated analyses.
		The worm is the latest twist on using Google as an attack tool, a practice known as Google hacking.
		For "X," the worm inserts a number representing how far the current instance of the program is descended from the original worm release.
	news.com.com /Net+worm+using+Google+to+spread/2100-7349_3-5499725.html (894 words)

	What is worm? - A Word Definition From the Webopedia Computer Dictionary
		(2) When used in all capital letters, WORM is an acronym for for write once, read many, an optical disk technology that allows you to write data onto a disk just once.
		Unlike CD-ROMs, there is no single standard for WORM disks, which means that they can only be read by the same type of drive that wrote them.
		Cone Drive: Worms and Worm Gears - Specializes in the design and manufacture of industrial pumps, gears and gearboxes for the pump and power transmission industries.
	www.webopedia.com /TERM/w/worm.html (582 words)

	Nachi worm infected Diebold ATMs
		The Nachi worm compromised Windows-based automated teller machines at two financial institutions last August, according to ATM-maker Diebold, in the first confirmed case of malicious code penetrating cash machines.
		Though ATMs typically sit on private networks or VPNs, the most serious worms in the last year have demonstrated that supposedly-isolated networks often have undocumented connections to the Internet, or can fall to a piece of malicious code inadvertently carried beyond the firewall on a laptop computer.
		"But worms are always going to be able to infect a lot more interesting machines than individual intruders are." Moreover, before reaching an ATM network, a human attacker would likely encounter more alluring high-finance targets along the way.
	www.securityfocus.com /news/7517 (724 words)

	Worm Suppliers
		Written in the style of "books for dummies", this is a great how-to book on how to grow worms for composting, for a business, or for the product produced from growing worms and composting(vermicompost).
		The directive specifies the worm species and exporting countries currently approved for export to Canada, and the protocol for obtaining approval to import worm species from a new source country."
		Growing all natural Soil Amendments, Worms, and Worm Castings with over 5,000 square feet of growth area and hundreds of thousands of Red Wiggler Composting worms.
	www.cityfarmer.org /wormsupl79.html (1568 words)

	W32.Welchia.Worm - Symantec.com
		As of February 26, 2004, due to a decreased rate of submissions, Symantec Security Response has downgraded this threat to a Category 2 from a Category 3.
		The worm specifically targets machines running Microsoft IIS 5.0 using this exploit.
		Read the document, "Detecting traffic due to RPC worms," for additional information.
	www.symantec.com /security_response/writeup.jsp?docid=2003-081815-2308-99 (281 words)

	SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System (Site not responding. Last check: )
		A worm has started spreading early afternoon EDT (evening UTC Time) and is expected to continue spreading rapidly.
		The worm may launch a syn flood against windowsupdate.com on the 16th.
		The worm uses the RPC DCOM vulnerability to propagate.
	isc.sans.org /diary.html?date=2003-08-11 (532 words)

	Ask the Answer Worm!
		It’s a dirty job but someone has to do it--S.K.Worm, the official annelid, or worm, of the U.S. Department of Agriculture's Natural Resources Conservation Service answers students questions about soil.
		I'm the official annelid, or worm, of the U.S. Department of Agriculture's Natural Resources Conservation Service.
		And it's my job to make you and everybody else naturally resourceful about natural resources.
	www.nrcs.usda.gov /feature/education/squirm/skworm.html (107 words)

	WORM_MSBLAST.A - Description and solution
		TrendLabs has received several infection reports of this new worm, which exploits the RPC DCOM BUFFER OVERFLOW.
		This worm has been observed to continuously scan random IP addresses and send data to vulnerable systems on the network using port 135.
		For general overview of the MSBLAST family of worms, please refer to the Virus Encyclopedia entry for WORM_MSBLAST.GEN.
	trendmicro.com /vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A (218 words)

	CERT Advisory CA-2003-20 W32/Blaster worm
		The CERT/CC is receiving reports of widespread activity related to a new piece of malicious code known as W32/Blaster.
		This worm appears to exploit known vulnerabilities in the Microsoft Remote Procedure Call (RPC) Interface.
		Once this file is retrieved, the compromised system then runs it and begins scanning for other vulnerable systems to compromise in the same manner.
	www.cert.org /advisories/CA-2003-20.html (1045 words)

Try your search on: Qwika (all wikis)