The 12kb bomb

Thursday, 18 March 2004, 12:43 PM EST

The average size of email-bourne viruses so far this year has been well under 20 kilobytes. A young virus writer, sitting in his underwear in his parent's dark basement, takes a hex editor and modifies a few bytes of the latest Netsky.M (16.5kb), Beagle.J (12kb) or Mydoom.G (20kb) mutation, spawns a new virus variant, and then releases it into the wild. The resulting few thousand compromised machines, a conservative estimate perhaps, will sit naked as drones or "bots" on the Internet, waiting patiently for their summons and commands.

A mere 12 kilobytes of action-packed code is impressive. For a 12 kilobyte Beagle, you get total system compromise, plus a highly effective spam engine. This short column, in comparison, is about 29kb of plain text and HTML. A 12 kilobyte binary is thus very small. The latest code that brings a Microsoft computer to its knees is small enough that it could be silk-screened onto an extra-large t-shirt: a walking time bomb, if you will. With today's monolithic software programs and operating systems, often barely fitting compressed on a CD-ROM, it's easy to see how small bits of malicious code can slip under the radar.

By Kelly Martin at SecurityFocus.

[ Read more ]

Related items


MagSpoof: A device that spoofs credit cards, disables chip-and-PIN protection

The device can wirelessly spoof credit cards/magstripes, disable chip-and-PIN protection, and predict the credit card number and expiration date of Amex cards after they have reported stolen or lost.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Nov 26th