Access for sale: a new class of worm

The damage inflicted by viruses and worms has been limited because the payloads that are most lucrative to malware authors have also posed the greatest risks to them. The problem facing authors of this self-reproducing malware is that monetizing each intrusion requires the author to risk communication with the infected system or its owner. The tool of choice for malware authors looking to minimize risk and maximize loot has been the carefully target attack, often employing a trojan horses or attack script. However, attacker’s preferences would likely change if they could infect a large number of systems using a worm and sell access to infected systems to other black hats. We introduce a new type of worm that enables this division of labor, installing a back door on each infected system that opens only when presented a system-specific ticket generated by the worm’s author. The risk to the worm’s author is minimized because he need not communicate with the infected systems. This...

• Type: Conference
• Year: 2003
• Where: WORM
• Authors: Stuart E. Schechter, Michael D. Smith
• Keywords: Infected Systems, Malware, Malware Authors, Security Privacy, WORM 2003