Introduction

Let's face it; the Internet is a dangerous place, and it's not getting any better. Statistics show a rapid increase in the rate of Internet-based attacks. The ability of attackers to rapidly compromise large numgers of system poses a "real and present danger" to the overall security of the Internet. A thousand zombie hosts can cause a lot of damage, but the damage that can be caused by the tens of thousands that can be taken over by an Internet worm are staggering.

A Bit Of History


The Internet had its beginnings back in 1965 when ARPA sponsored a study on the "cooperative network of time-sharing computers". By 1966, the first ARPANET plan was developed. Over time this simple experimental network grew into what is know as today's Internet. Interestingly, in 1985 the ARPANET was brought to its knees by on 27 October because of an accidentally-propagated status-message virus. This was not the first virus however.

As early as 1949, self-replicating programs were being developed, and in 1981, several viruses were infecting the Apple world. The first computer viruses were simple because the computing capability was so limited. Most early viruses would simply copy themselves to a new location, then progress from there. Eventually, as more computing power became available, more complex viruses were developed. This included the addition of code to be executed once the virus had replicated itself to a new disk or computer.

Computer "worms" were first considered as a means of automating network management tasks. Experiments were performed at Xerox Palo Alto Research Center in 1982. The key problem noted was controlling the propagation of these programs. This became especially apparent to a young Robert Morris; a 23 year old doctoral student at Cornell University. Morris unleashed a worm on the Internet, not realizing that he had drastically miscalculated the rate of propagation and the impact it would have on compromised systems. The worm spread at a phenominal rate, must faster than originally intended. When Morris realized his worm was spreading faster than he anticipated and tried to post removal instructions. Unfortunately, these instructions were not received because most administrators had removed themselves from the Internet.