The discovery of the W32/Sdbot-UJ worm, which employed the technique of network sniffing, has shone a bit of light on a dark corner of the worm universe. W32/Sdbot-UJ has sometimes been reported as the first worm to perform network sniffing, but almost certainly it was not. It may have been the first such to be captured and analyzed by an AntiVirus vendor, I don't know.
This worm employs a technique thought for years by some security professionals to be used by "slow scanners". I say "thought to be used" because it turns out this particular class of worms is difficult to study and not perceived universally as much of a threat. Some professionals even dispute whether Slow Scanners exist, yet. (Everyone seems to agree that if they don't, they will soon enough.)
Slow Scanner worms are not widely reported in the media, partly because they are not as flashy as the worms that hit millions of machines in a day and whose propagation efforts are so aggressive that they bring the internet to a crawl.
Slow Scanners are typically memory resident -- they don't write anything to the filesystem, they blink out of memory if you try to inspect them. They don't they don't do anything to the machine they infect. They don't write to the Windows registry, they don't open trojan backdoors, and they don't attempt to spread rapdily.
Instead, a Slow Scanner performs reconnaissance of the local network environment, very, very slowly. They may send only a few packets an hour or a day, looking for certain open ports or other responses indicating a system type (say a router, or a Windows server or a BIND server) for example, or a particular vulnerability. The worm may not probe anything at all for hours or days. Slow scanners gather data about a network, often by "scanning", sending packets out to see what sort of response comes back. But Slow Scanners don't just scan, they also gather data by sniffing and keystroke logging. After gathering data for a while, the worm will report back out to a web site or IRC channel or email address. After sending a single report, it may blink itself out of memory.
Other worms do most of this stuff too, but Slow Scanners are very difficult to detect because they try to fly low and slow -- under the radar -- to evade detection. Once in a while they try to spread to another machine, but never to all other vulnerable machines they can find, just the occasional one, usually not within the same network segment.
Slow Scanner Worms hint at a dark corner of the cracker underground, hidden beneath the noise of the script kiddies and their thousands of variant mass propagating worms, and the drone of frantic AntiVirus efforts. People running corporate and government networks want to believe the popular profile of the virus writer -- worms are written by bored teenage kids seeking attention in their peer group -- other bored teenage programmers -- and they don't really mean any harm.
Increasingly there is evidence that at least some worms are written for profit, not fun, and possibly for other purposes, perhaps even tailored to a given victim network, such as espionage. Slow Scanners sport all the hallmarks of being written for a stealthy and sinister purpose: they are designed to perform network reconnaissance as a precursor to a sophisticated, targeted intrusion. They propagate very slowly, so as to evade detection, even by sophisticated heuristics (rules of thumb) in modern IDS/IPS and AntiVirus systems.
Here are some links to stories about one of the first widespread sniffing worms. It wasn't a Slow Scanner, but it almost certainly borrowed a technique that's been used for years.
Sniffing worm snoops network PCs
Computer worm 'sniffs' out passwords (September 2004)
Sniffing Worm in Real World Circulation
Technorati Tags: adware, antivirus, botnets, malware, spyware, virus, Windows, worm
Comments