Worm Hunters

This first paper is quite possibly my favorite. If you're a math nerd, a computer networking enthusiast, or just a fan of general badasses, I promise you'll appreciate this one. From a handful of packets these guys analyzed an internet virus, and could construct the entire infection tree, identify which of the victims' disks were corrupted, who started the worm.

Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event

by

Kumar, Paxson, and Weaver

Abstract

In this work we apply such an analysis to the propagation of the Witty worm, a malicious and well-engineered worm that when released in March 2004 infected more than 12,000 hosts worldwide in 75 minutes. We show that by carefully exploiting the structure of the worm, especially its pseudo-random number generation, from limited and imperfect telescope data we can with high fidelity: extract the individual rate at which each infectee injected packets into the network prior to loss; correct distortions in the telescope data due to the worm’s volume overwhelming the monitor; reveal the worm’s inability to fully reach all of its potential victims; determine the number of disks attached to each infected machine; compute when each infectee was last booted, to sub-second accuracy; explore the “who infected whom” infection tree; uncover that the worm specifically targeted hosts at a US military base; and pinpoint Patient Zero, the initial point of infection, i.e., the IP address of the system the attacker used to

unleash Witty.

PDF