Internet Worms: Methods, Countermeasures and Famous Incidents Presented by: Tran To Brian Tully.
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms...
-
Upload
jennifer-bruce -
Category
Documents
-
view
220 -
download
0
Transcript of Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms...
![Page 1: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/1.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
The Future of Internet Worms
Jose NazarioCrimelabs Research
![Page 2: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/2.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Disclaimer
• Will not build
• Intrusion detection
![Page 3: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/3.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Overview
• Introduction
• Six Components
• Problems in Current Worm Paradigms
• Evolution of Worm Networks
• Detection Strategies
• Conclusions
![Page 4: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/4.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Worms Defined
• Automated intrusion agents
• Infect one host, launch, infect again
• Self propelled– viruses require carrier programs
![Page 5: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/5.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Worms in History
• Morris worm
• Persistent Windows worms
• Rise of Linux worms (2000 …)
• Examples: Win32.Bremer, Ramen, sadmind/IIS
![Page 6: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/6.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Why Worms?
• Ease– write and launch once– many acquisitions– continually working
• Pervasiveness– weeds out weakest targets– penetrates difficult networks
![Page 7: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/7.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Two Futures
• Small increases– better rootkits– encryption– increased attack capabilities
• Paradigm shift
![Page 8: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/8.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Six Components of Worms
• Reconnaissance
• Specific Attacks
• Command Interface
• Communication Mechanisms
• Intelligence Capabilities
• Unused and Non-attack Capabilities
![Page 9: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/9.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Reconnaissance
• Target identification
• Active methods– scanning
• Passive methods– OS fingerprinting– traffic analysis
![Page 10: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/10.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Specific Attacks
• Exploits– buffer overflows, cgi-bin, etc.– Trojan horse injections
• Limited in targets
• Two components– local, remote
![Page 11: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/11.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Command Interface
• Interface to compromised system– administrative shell– network client
• Accepts instructions– person– other worm node
![Page 12: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/12.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Communications
• Information transfer
• Protocols
• Stealth concerns
![Page 13: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/13.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Intelligence Database
• Knowledge of other nodes
• Concrete vs. abstract
• Complete vs. incomplete
![Page 14: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/14.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Unused and Non-attack Capabilities
• Remainder of exploits
• Non-exploit capabilities
• Various possibilities
![Page 15: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/15.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Assembled Pieces
A
U
Com
I
R
Cmd Cmd
R
I
Com
U
A
![Page 16: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/16.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Questions?
![Page 17: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/17.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Current Limitations
• Limited capabilities
• Growth and traffic patterns
• Network structure
• Intelligence Database
![Page 18: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/18.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Limited Capabilities: Recon
target
target
target
target
target
RPC
LPD
FTP
SNMP
IIS
![Page 19: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/19.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Limited Capabilities: Attack
target
1
2
3
if {1|2|3} attackelse abortend
?
![Page 20: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/20.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Traffic Growth Rates
Tworm=kN(Tscansnscans)(Tcommncomms)t
fTworm=Tworm_______
Ttot
Traffic, hence profile, increases with time.
![Page 21: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/21.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Traffic Growth Patterns
108642
16000
14000
12000
10000
8000
6000
4000
2000
0
Infection Round
Ob
serv
atio
ns
Infected hosts
Actual Traffic
![Page 22: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/22.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Network Structure
. .
Early Later
![Page 23: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/23.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Network Topology
Early Later
![Page 24: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/24.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Limitations of Directionality
.
. .
.. .
..
..
.
. .
.
.
.
.
..
.
. .
..
..
.
.. .
.
..
.
. .
. .
...
... .
.. .
..
..
.
. .
.
.. .
..
.
..
..
.
. .
.
.
.
.
.
.
.
Target Network
![Page 25: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/25.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Intelligence Database
N
N
N
N
I
N
N
N
I
![Page 26: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/26.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Limitations Conclusions
• Highly visible
• Easily Blocked– need a signature
• Unable to achieve a specific target
• Readily caught
![Page 27: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/27.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Questions?
![Page 28: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/28.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Future Considerations
• Dynamic behavior
• Dynamic updates
• Communications mechanisms
• Infection mechanisms
• Network topologies
• Communications topology
• New targets
![Page 29: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/29.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Dynamic Behavior
TCP
GREICMP 8.053/UDP
80/TCP
SMTP
NNTP
Communications channels
![Page 30: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/30.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Dynamic Behavior
Communications
Attacks
Platform
Dynamic invocation of capabilities
![Page 31: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/31.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Dynamic Network Roles
Target
R
I
A
Not every node contains all components
![Page 32: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/32.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Updates to the Nodes
Publish
Retrieve
![Page 33: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/33.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Embedding Messages
• Images
• Text
• MP3 files
• Usenet, web, mailing lists
• Freenet, Gnutella, Napster
![Page 34: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/34.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Stealth Broadcasts
M'
S
N N N N
M'=M+m
![Page 35: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/35.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Signed Updates
KR( )
KU(KR( ))
U
U
Source verification
![Page 36: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/36.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Communications Topology
Broadcast from central site
![Page 37: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/37.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Communications Topology
Store and forward
![Page 38: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/38.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Passive Methods
N
Target acquisition
![Page 39: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/39.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Payload Injection
N
![Page 40: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/40.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Network Topology
. ....
..
Guerilla network
![Page 41: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/41.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Network Topology
Target
Directed tree
![Page 42: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/42.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
New Targets
• Embedded devices– bugs– prevalence on broadband
• Large audience targets– Akamai clients– Political, financial motivations
![Page 43: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/43.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Questions?
![Page 44: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/44.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Worm Detection
• Challenges– Fast moving– Always adding new nodes
• Traditional Worm Paradigm– Analyze one node, know all– Same signature for all nodes
Hard to distinguish between worms and aggressive or scripted attackers
![Page 45: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/45.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Worm Signatures
• Correlation Analysis– Scans, attacks– Quick succession of scans across hosts– Quick follow up of attacks with scans
• Growth of Traffic– exponential
![Page 46: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/46.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
New Challenges
• Identifying communications channels
• Identifying all scans, attacks– Constantly changing
• Larger Picture
![Page 47: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/47.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Defenses
• Traditional paradigms
• Detection– anomaly detection– agent based IDS– focus on common parts
![Page 48: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/48.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Defenses
• NIDS– Hone in on common parts
• Poison Injections– Null, shutdown payloads
• Traffic analysis– Identifying communications partners
All are labor intensive
![Page 49: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/49.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Conclusions
• Worms will evolve– increased use of hiding tools
• Impending paradigm shift– not all nodes look alike– update capable– No one signature
![Page 50: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/50.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Acknowledgements
• Crimelabs– Rick– Chris– Jeremy– Brandon– Ben
• Michal Zalewski• Simple Nomad• Dug Song
• Blackhat
![Page 51: Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms” The Future of Internet Worms Jose Nazario Crimelabs Research.](https://reader035.fdocuments.us/reader035/viewer/2022062500/5697bf7c1a28abf838c83ebb/html5/thumbnails/51.jpg)
Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”
Questions?