The 12kb bomb

Thursday, 18 March 2004, 12:43 PM EST

The average size of email-bourne viruses so far this year has been well under 20 kilobytes. A young virus writer, sitting in his underwear in his parent's dark basement, takes a hex editor and modifies a few bytes of the latest Netsky.M (16.5kb), Beagle.J (12kb) or Mydoom.G (20kb) mutation, spawns a new virus variant, and then releases it into the wild. The resulting few thousand compromised machines, a conservative estimate perhaps, will sit naked as drones or "bots" on the Internet, waiting patiently for their summons and commands.

A mere 12 kilobytes of action-packed code is impressive. For a 12 kilobyte Beagle, you get total system compromise, plus a highly effective spam engine. This short column, in comparison, is about 29kb of plain text and HTML. A 12 kilobyte binary is thus very small. The latest code that brings a Microsoft computer to its knees is small enough that it could be silk-screened onto an extra-large t-shirt: a walking time bomb, if you will. With today's monolithic software programs and operating systems, often barely fitting compressed on a CD-ROM, it's easy to see how small bits of malicious code can slip under the radar.

By Kelly Martin at SecurityFocus.

[ Read more ]

Related items




Spotlight

Compromised cPanel "Account Suspended" pages redirect to exploit kit

The code redirects visitors to another URL where the Fiesta exploit kit is hosted, which then tries to detect and exploit several vulnerabilities in various software. If it succeeds, the visitors are saddled with a banking Trojan.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Feb 27th
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //