Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information

Most well-known Internet worms, such as Code Red, Slammer, and Blaster, infected vulnerable computers by scanning the entire Internet IPv4 space. In this paper, we present a new scan-based worm called “routing worm”, which can use information provided by BGP routing tables to reduce its scanning space without ignoring any potential vulnerable computer. In this way, a routing worm can propagate twice to more than three times faster than a traditional worm. In addition, the geographic information of allocated IP addresses, especially BGP routing prefixes, enables a routing worm to conduct fine-grained selective attacks: hackers or terrorists can selectively impose heavy damage to vulnerable computers in a specific country, an Internet Service Provider, or an Autonomous System, without much collateral damage done to others. Routing worms can be easily implemented by attackers and they could cause considerable damage to our Internet. Since routing worms are scan-based worms, we bel...

• Type: Conference
• Year: 2005
• Where: PADS
• Authors: Cliff Changchun Zou, Donald F. Towsley, Weibo Gong, Songlin Cai
• Keywords: Modelling And Simulation, PADS 2005, Routing, Scan-based Worms, Vulnerable Computers