The 12kb bomb

Thursday, 18 March 2004, 12:43 PM EST

The average size of email-bourne viruses so far this year has been well under 20 kilobytes. A young virus writer, sitting in his underwear in his parent's dark basement, takes a hex editor and modifies a few bytes of the latest Netsky.M (16.5kb), Beagle.J (12kb) or Mydoom.G (20kb) mutation, spawns a new virus variant, and then releases it into the wild. The resulting few thousand compromised machines, a conservative estimate perhaps, will sit naked as drones or "bots" on the Internet, waiting patiently for their summons and commands.

A mere 12 kilobytes of action-packed code is impressive. For a 12 kilobyte Beagle, you get total system compromise, plus a highly effective spam engine. This short column, in comparison, is about 29kb of plain text and HTML. A 12 kilobyte binary is thus very small. The latest code that brings a Microsoft computer to its knees is small enough that it could be silk-screened onto an extra-large t-shirt: a walking time bomb, if you will. With today's monolithic software programs and operating systems, often barely fitting compressed on a CD-ROM, it's easy to see how small bits of malicious code can slip under the radar.

By Kelly Martin at SecurityFocus.

[ Read more ]

Related items




Spotlight

Lessons learned developing Lynis, an open source security auditing tool

Posted on 15 October 2014.  |  Lynis unearths vulnerabilities, configuration errors, and provides tips for system hardening. It is written in shell script, installation is not required and can be performed with a privileged or non-privileged account.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //