THE EVOLUTION OF MALICIOUS AGENTS
                    http://www.zeltser.com/agents

                            Lenny Zeltser
                          lenny@zeltser.com
                              April 2000

                          Copyright (c) 2000
                         All Rights Reserved


  Abstract: This paper examines the evolution of malicious agents by
  analyzing features and limitations of popular viruses, worms, and
  trojans, detailing the possibility of a new breed of malicious
  agents currently being developed on the Internet.


1. TABLE OF CONTENTS

1. Table of Contents
2. Introduction
3. Rapidly Spreading Agents
   3.1 Overview
   3.2 The Morris Worm
   3.3 The Melissa Virus
4. Spying Agents
   4.1 Overview
   4.2 The Caligula Virus
   4.3 The Marker Virus
   4.4 The Groov Virus
5. Remotely Controlled Agents
   5.1 Overview
   5.2 Back Orifice
   5.3 NetBus
6. Coordinated Attack Agents  
   6.1 Overview
   6.2 Trinoo
   6.3 Tribe Flood Network
7. Advanced Malicious Agents
   7.1 Overview
   7.2 The RingZero Trojan
   7.3 The Threat of Advanced Malicious Agents
8. Appendix
   8.1 Key Features of Malicious Agents
9. Acknowledgements
   9.1 Reviewers
   9.2 References


2. INTRODUCTION

In the context of this paper, a malicious agent is a computer program
that operates on behalf of a potential intruder to aid in attacking a
system or network. Historically, an arsenal of such agents consisted
of viruses, worms, and trojanized programs. By combining key features
of these agents, attackers are now able to create software that poses
a serious threat even to organizations that fortify their network
perimeter with firewalls.

This paper examines the evolution of malicious agents by first looking
at replication and propagation mechanisms of programs such as the
Morris Worm and the Melissa Virus. These programs are effective for
illustrating the rate at which malicious agents can spread, as well as
for demonstrating the ease with which they are able to penetrate the
organization's network defenses.

Next, the paper discusses spying viruses such as Caligula, Marker and
Groov, which, after infecting a computer system, report their findings
to the home base. These viruses are limited in that their behavior has
to be programmed in advance. However, they are especially dangerous
because they utilize outbound connections to communicate with their
authors, and can be used as powerful reconnaissance scanners. Because
many firewall policies do not restrict outbound traffic such as HTTP
and FTP, these viruses are able to stay in contact with their authors
even when operating in an organization that considers itself secured
from the outside.

The paper proceeds by analyzing features and limitations of remotely
controlled agents such as Back Orifice and NetBus, as well as of
distributed denial-of-service software such as Trinoo and TFN. These
programs can provide attackers with the ability to remotely issue
commands on the infected machine. In addition, distributed
denial-of-service programs have the ability to coordinate actions of
multiple agents, providing their operators with multiple attack
launching points.  However, current versions of these programs do not
have propagation capabilities of viruses and worms, and are
effectively prevented from accepting commands from the operator by
most firewalls because the controlling traffic is primarily inbound.

Finally, the paper details the possibility of a new breed of malicious
agents that combine propagation capabilities of old-fashioned viruses
and worms with the interactivity of remotely controlled agents by
using outbound traffic to obtain instructions. In particular, the
paper focuses on the RingZero trojan, as an example of an existing
malicious agent that already exhibits many of these characteristics.

As the result of such evolution, organizations may be faced with a
remotely controlled worm that has the ability to infiltrate networks
via open channels such as e-mail or Web browsing, can be controlled
via outbound connections such as HTTP and FTP, which can pass through
many firewalls, and has propagation capabilities that maximize its
ability to perform an effective distributed attack.


3. RAPIDLY SPREADING AGENTS

3.1 Overview

A computer virus is probably the most prominent representative of the
malicious agents species. While there are several opinions regarding
the exact definition of a computer virus, people generally agree that
a virus contains program code that can explicitly copy itself, and by
doing so has the ability to "infect" other programs by modifying them
or their environment. As the result, a call to the infected program
facilitates further distribution and possible evolution of the
virus. [NF]

In order for a virus to propagate, it typically needs to attach itself
to a host program. A computer worm is similar to a virus in many
aspects, except that it is a self-contained program "that is able to
spread functional copies of itself or its segments to other computer
systems" without a dependency another program to host its code. [NF]

The Morris Worm and the Melissa Virus, discussed in this section, were
chosen primarily for the magnitude of the effect that they had on the
Internet community. Moreover, the techniques that these programs
employed to propagate themselves across the network are still
applicable today, and can be adapted as the infiltration and
replication mechanism for the advanced malicious agent examined at the
end of the paper.

However, a prominent limitation of these agents has been the lack of
control over their rate of propagation. Such functionality is present
in some of the agents discussed in this paper, and is considered an
important characteristic of an "advanced" malicious agent.

3.2 The Morris Worm

The infamous Morris Worm, also known as the Internet Worm, was a
self-contained program that exploited several common vulnerabilities
to spread itself across the network at a phenomenal rate. In fact,
within hours after it appeared in the evening of 2 November 1988, it
had disrupted most of the nation's major research centers. [GAO] Since
many publications already describe the history of the Morris Worm in
great detail, this paper limits itself to an overview of the worm's
methods of propagation to illustrate techniques that a malicious agent
can utilize to aggressively infiltrate the target's computing
environment.

The basic objective of the Morris Worm was to gain access to another
machine so that it can replicate itself on the new machine and
reproduce further. [BP] The worm accomplished this by exploiting
implementation errors in several popular programs, as well as by
taking advantage of known host access loopholes to propagate itself
across the network. [JR]

Sendmail was, and still is, a popular program for providing e-mail
routing and delivery services to machines on the Internet. The worm
exploited a non-standard command available in a particular version of
sendmail to propagate from one machine to another.  As the worm
installed itself on the newly compromised host, the new instance of
the program began self-replicating further in a recursive manner. [JR]

Fingerd, intended to help remote Internet users share public
information about each other, is another program that the worm used to
propagate across the network. In this case, the worm took advantage of
a buffer overflow bug present in a particular version of fingerd,
which allowed it to execute a small arbitrary program on a remote
machine to copy itself across. [JR]

Another of the worm's propagation methods exploited trust features of
programs such as rexec and rsh, which administrators commonly used to
ease administration of multiple machines. [JR] This involved examining
local lists of host names that an infected host was aware of, and
attempting to connect to them in hopes that the infected machine is
trusted to execute commands on the remote machine.

Finally, the Morris Worm was able to infect systems by guessing user
passwords. The program tried to guess passwords based on a dictionary
of common words and on the information about the user that was locally
available. Upon gaining access, the worm was able to connect to the
remote machine by posing as a legitimate user. [JR]

Propagation techniques employed by the Morris Worm in 1988 can be very
effective on modern networks as well. Throughout the Internet's
history, buffer overflow bugs, loose trust relationships, and weak
user passwords have been frequently exploited to gain unauthorized
access to a networked system. If a worm-like agent is programmed to
take advantage of several common software vulnerabilities, it will
have the ability to rapidly propagate itself across the victim's
network. Techniques for controlling the agent's propagation rates and
attack behavior are discussed in subsequent sections of this paper.

3.3 The Melissa Virus

The discussion above illustrates how a malicious agent can
self-propagate by recursively attacking neighboring hosts from each
conquered machine. This way, the rate of infection may grow
exponentially. In a modern world, however, many organizations use
firewalls to separate their network from the Internet, which form a
substantial obstacle for the agent's attack mechanism by making it
very difficult to infiltrate the organization's network.

The Melissa Virus, which engulfed a large portion of Internet around
20 May 1999, was highly effective at penetrating defense perimeters
even of organizations that were protected by firewalls. In fact,
during the first weekend of its existence in the wild, the virus
infected at least 100,000 individual computers. [CC1] Once again,
since many other materials already cover the Melissa Virus in great
depth, this section focuses on the program's propagation mechanism
that is characteristic of an advanced malicious agent.

The technique utilized by the Melissa Virus to bypass most firewall
restrictions was very simple – the program was typically
transported as an attachment of an incoming e-mail message. [CC2]
Since most organizations allowed incoming e-mail attachments, the
virus was able to successfully penetrate the defense perimeter. Even
in cases where the organization scanned incoming e-mail for viruses,
the malicious code was undetected because the signature of the Melissa
Virus was unknown to anti-virus vendors at the time.  In fact, relying
on virus signatures as the only measure for protecting the network
against malicious agents is generally problematic, as there is always
a delay between the emergence of a new agent and a the release of
anti-virus software updates.

For the Melissa Virus to infect a machine, a recipient of the infected
message needed to open the attached document using Microsoft Word. In
fact, the Melissa Virus is not classified as a worm primarily because
user action is required for the program to propagate. [CC1] Once the
infected attachment was opened in Microsoft Word, the virus e-mailed
itself to the first 50 entries in every Microsoft Outlook MAPI address
book readable by the user who triggered the virus code. [CC2]

Although users could inadvertently spread the Melissa Virus by
manually exchanging infected documents, the major contributor to the
rapid spread of the virus was the technique of e-mailing itself to
other systems. Just like most firewalls did not prevent the virus from
entering the organizations via inbound e-mail, most firewall policies
did not block outbound virus propagation attempts that masked
themselves as ordinary outgoing e-mail traffic.

Moreover, an element of social engineering increased the likelihood
that the recipient of the infected message would trigger the virus
code by opening the attached document. In particular, the subject of
the infected e-mail contained the full name of the user whose account
the virus was sending the message from. [CC2] Since the list of
message recipients was compiled from the user's address book, the
recipients would most likely recognize the sender's name in the
Subject and From lines. Thinking that the message came from a friend,
virus recipients had a greater tendency to view the attachment.

As demonstrated by the rapid spread of the Melissa Virus, the
technique of propagating malicious agents via infected documents or
software is very effective. This method relies primarily on open
channels such as e-mail or Web browsing, which are rarely controlled
by firewalls, to infiltrate the organization's network. Once inside,
the agent can utilize replication techniques such as those employed by
the Morris Worm to self-propagate to neighboring hosts in an
intelligent and unconstrained manner.


4. SPYING AGENTS

4.1 Overview

The threat of spying, or espionage-enabled, malicious agents gained
spotlight in 1999 with the emergence of viruses such as Caligula and
Marker, which demonstrated the growing trend of virus authors to
create agents that take advantage of the Internet connectivity in one
way or another. [SYM1]

Spying agents are especially dangerous because they can transmit
sensitive information from the organization to the author of the
virus. Much like the Melissa Virus, these programs typically
infiltrate the network defense perimeter via open channels such as
e-mail or Web browsing. To increase the likelihood of establishing a
successful link back to the home base, spying agents typically mask
outbound transmissions as mundane e-mail or Web browsing traffic.

Espionage characteristics of such viruses can be used to perform
reconnaissance probes that often precede many successful
attacks. Moreover, the agent's ability to communicate with its author
may lead to the development of a virus that dynamically modifies its
behavior in response to instructions from its operator. Because
outbound connections are used for these communications, the
organization's firewall will rarely block the transmissions.

This section of the paper concentrates on methods that a malicious
agent can utilize to establish an effective communication channel, as
well as on the threats that spying agents pose to modern defense
systems.

4.2 The Caligula Virus

The Caligula Virus, known to virus enthusiasts as W97M/Caligula,
caught the public's eye around January 1999 [SYM1] primarily because
of its attack on PGP, which is a common encryption program hailed for
effective confidentiality features. When activated, the virus
attempted to locate a PGP secret keyring file, which stores sensitive
user information, and transmitted it to the author of the virus. [XF1]

Although a password was usually required to read contents the PGP
secret keyring, Caligula demonstrated a powerful technique for
obtaining sensitive information from an attack target – the virus
initiated outbound sessions using the computer's built-in ftp.exe
command to communicate with the author. [TR] Because most firewall
policies allow users to retrieve FTP files from the outside, the virus
can use a protocol such as FTP to initiate connections to the home
base from inside the victim's network.

4.3 The Marker Virus

The Marker Virus, also known as W97M/Marker, first appeared in the
wild in April 1999. This virus is particularly interesting because it
kept a log of date and time of infection, as well as personal
information about its victims. [NAI1] After infecting a machine, the
virus retrieved user information that could be viewed manually via
Microsoft Word's Tools menu. This information was then uploaded to the
author's FTP site using the computer's built-in ftp.exe command. The
virus ensured that the information is transmitted only once by setting
a flag in the Windows registry. [SYM2]

The technique of using ftp.exe resembled the one employed by the
Caligula Virus for a reason – both agents seem to have originated
from a virus exchange group known as CodeBreakers. In fact, Caligula
also used the Windows registry to limit the number of outbound
communications. [KW] Both viruses seem to have been developed in
response to a paper published in 1997, which described practical
attacks on PGP, and prophesized a "bright future for 'espionage
enabled' viruses." [JM]

By maintaining the infection trail, a spying agent allows its operator
to study relationships between members of the targeted
organization. For instance, a report listing personal information
about victims and times of infection can be used to infer how closely
these individuals work together. Such information can be used for a
targeted computer-based, as well a social-engineering attack.

4.4 The Groov Virus

The Groov Virus, also known as W97M/Groov.a, was discovered in May
1998. Even though it significantly preceded the emergence of the
Marker and Caligula viruses, it already exhibited characteristics of
spying viruses. After infecting a machine, Groov uploaded the victim's
IP configuration, obtained via the built-in ipconfig.exe command, to
an external FTP site. [NAI2]

Groov sent its reports to an FTP site belonging to an anti-virus
vendor Frisk Software International, apparently in an attempt to
overwhelm the company's network with unsolicited traffic. [NAI2] In
fact, this might be considered an early attempt at a distributed
denial-of-service attack.

Most importantly, by supplying specific site-specific information to
its authors, a virus can be used as a powerful reconnaissance tool,
helping the attacker to study the network topology of potential
targets. In this scenario, transmitted IP configuration information
may divulge critical details about the organization's internal
infrastructure. Information reported this way presents an insider's
view of the network, and is invaluable for performing directed attacks
against a specific site, especially when correlated with results of
external network scans.


5. REMOTELY CONTROLLED AGENTS

5.1 Overview

Remotely controlled agents such as Back Orifice and NetBus may provide
the attacker with complete control of the victim's machine. The extent
of such control is far greater than the one associated with typical
viruses or worms, and is a highly desirable characteristic of an
advanced malicious agent.

In essence, programs such as Back Orifice and NetBus share a lot of
functionality with remote administration tools [PC1] such as Symantec
pcAnywhere. The major distinction between these two classes of
software arises from their intended use. Both can be used by network
administrators for legitimate purposes, as well as by attackers for
purposes that are often not as noble.

Remotely controlled software is usually comprised of two components: a
light-weight server that runs on the infected machine, executing
commands as dictated by its operator, and a client, which runs on the
attacker's machine and remotely controls the server component over the
network.

The agent's server component is typically written to be as stealthy as
possible to decrease the possibility of accidental discovery. Servers
belonging to multiple agents may coexist peacefully on the same
machine. In fact, this scenario is often desirable to the intruder, as
it introduces an element of fail-over to the attack. [PC2]

Before a machine can be remotely controlled, it must be "infected" by
the server component of the agent. This is usually accomplished using
methods that are employed by most viruses – via open inbound
channels such as e-mail or Web browsing. However, it is possible that
an advanced remotely controlled agent may exhibit worm-like behavior
by self-propagating itself across the network.

Since most remotely controlled clients operate by sending commands
inbound with respect to their server components, most firewalls
effectively block the controlling traffic.  As the result, current
versions of agents such as Back Orifice and NetBus pose the highest
threat to home users, who are rarely protected by firewalls.

To increase the possibility of successfully establishing a control
connection, an advanced remotely controlled agent may utilize outbound
traffic that is initiated by the agent's server component, similarly
to the way a spying agent connects to its home base. This is discussed
in greater detail later in this paper. Instead, this section focuses
on the extent of remote-controlling capabilities of agents such as
Back Orifice and NetBus.

5.2 Back Orifice

Back Orifice is probably the most famous remotely controlled agent
currently available on the Internet. Its original version was released
on 3 August 1998 by a group known as the Cult of the Dead Cow. They
released the second version of the program, known as Back Orifice 2000
(BO2K) on 10 July 1999, [CDC1] reinforcing its stance as a leading
remotely controlled agent among "hackers" and pranksters.

Some of the features supported natively by BO2K are keystroke logging,
file share management, port redirection, audio/video capture, file and
registry access, cached password retrieval, process control, as well
as a wealth of other remote-controlling actions. In addition, Back
Orifice provides programming API that allows developers to extent
native BO2K functionality by writing their own plug-ins. For example,
currently available plug-ins enhance the communication mechanism of
BO2K by encrypting its control traffic, making the transmissions very
difficult to decipher and detect. [CDC2]

Because the Back Orifice server component tends to propagate via
e-mail attachments or trojanized software downloads, its life cycle is
typically detached from its client counterpart. As the result, it is
often difficult for the attacker to locate a particular instance of
the Back Orifice server. To alleviate this task, several BO2K plug-ins
allow the server to register with the home base, which is usually
accomplished via e-mail. [CDC2] Because this traffic is outbound, it
will not be stopped by many firewalls. However, since remote-control
communications are sent in the inbound direction, most firewall
configurations will prevent the Back Orifice client from connecting to
the infected machine.

5.3 NetBus

The first version of NetBus predated Back Orifice, and was released in
March 1998 with the intent of letting people "have some fun with
his/her friends" and, according to the author, was meant to be neither
an administration tool, nor a hacking tool. [PC2] The current version
of the program, NetBus 2.0 Pro, was released on 19 February 1999, and
rivals BO2K by offering similar functionality in a slightly different
package. NetBus 2.0 Pro is being marketed by a company called
UltraAccess Networks Inc. as a "remote administration and spy tool."
[UA1]

Although NetBus supports plug-ins, it seems to lack the support of the
developer community enjoyed by Back Orifice. Nonetheless, NetBus
stands out from Back Orifice by having rudimentary built-in
capabilities to control multiple NetBus server modules with a single
client. This command-broadcasting functionality is reminiscent of
popular denial-of-service tools, but is limited in that NetBus
executes commands sequentially, while tools such as Trinoo and TFN can
commandeer their servers in parallel.

NetBus 2.0 Pro was written to require physical access to the computer
to install the server component in stealth mode to prevent
inappropriate use. [UA] However, several unofficial versions of the
program are available that mask its server as an ICQ patch, [GG] or as
a silent trojanized program. [ANON]


6. COORDINATED ATTACK AGENTS

6.1 Overview

Software such as Trinoo and Tribe Flood Network (TFN) is typically
discussed in the context of distributed denial-of-service (DoS)
attacks. These tools are designed to disrupt normal system functions
by flooding the network with large amounts of traffic, and differ from
their earlier counterparts primarily in the ability to centrally
control a large group of distributed agents during an attack. Service
disruptions to high-profile Internet sites such as Yahoo!, eBay,
Amazon, and CNN in February 2000 drew a lot of attention to this
method of attack. [CNN]

The architecture of existing distributed DoS tools is similar to
remotely controlled agents such as Back Orifice and NetBus in that the
programs are split into server and client components.  However, while
clients of most remotely controlled agents typically run on the
attacker's system, client components of distributed DoS software
usually run on compromised machines. As the result, an attacker
launching a distributed DoS attack is further removed from the target,
and can control one or more clients, each of which can control
multiple attack servers. [DD1]

Investigating such attacks is particularly difficult because agents
are spread across the Internet, and are rarely under the
administrative control of a single legitimate entity. In addition, the
multi-tier design of these tools, as well as IP-spoofing features
present in newer versions of the software, make the task of tracing
the offending traffic to the attacker a very difficult one, removing
the notion of accountability for one's actions.

Programs such as Trinoo and TFN are primarily single-purpose, having
been designed specifically to conduct denial-of-service
attacks. However, the technology used by these programs to act in
unison during an attack can be built into a general-purpose agent
capable of performing actions in a coordinated manner.

Since the release of Trinoo and TFN, new programs were written that
improved upon the original versions of these tools. However, this
section concentrates on methods employed by Trinoo and TFN to
illustrate techniques that can be used to centrally command an army of
distributed attack agents.

6.2 Trinoo

Trinoo, also known as trin00, was originally discovered on a number of
compromised Solaris systems around August 1999, although reports of
initial testing of the program date back to June 1999. [DD2] Since
then, Trinoo has been ported to a number of other Unix-based systems,
and around February 2000 the first Windows version of the agent was
discovered. [XF2]

To "infect" a machine with a Trinoo component, the attacker needs to
obtain administrative access to the system. This is usually
accomplished by first scanning large ranges of network blocks to
identify potential candidates, and exploiting specific system
vulnerabilities, such as buffer overflow bugs, to gain remote access
to the systems. A subset of compromised machines is then chosen for
the Trinoo network, and the program's client and server components are
installed by running an automated installation script. [DD1]

Once a Trinoo network is set up, the attacker can control Trinoo
server components, also known as daemons, by remotely manipulating the
program's client components, also known as masters. A connection to
the master system can be established via the Telnet protocol by
connecting to a specific port and supplying proper login credentials.
Password-based access control is used for communications between all
nodes of the Trinoo network, to prevent investigators, as well as
competing attackers from usurping the agents. If a connection attempt
is made to the master during an ongoing session, the system sends a
warning to the previously authenticated user, providing the attacker
with an opportunity to clean up and retreat. [DD1]

Once connected to the master, the attacker can control the army of
Trinoo daemons by issuing commands that start or stop
denial-of-service attacks against specified hosts.  Acting on behalf
of the attacker, the Trinoo master communicates with its daemons via a
proprietary text-based protocol that uses UDP as the underlying
transport protocol. For example, when the attacker issues the "do"
command to a Trinoo master, the master sends the "aaa" command to its
daemons, which signals the daemons to attempt to overwhelm the
specified host with UDP packets. The attack is automatically
terminated after a pre-determined period of time, or when the attacker
issues the "mdie" command to the master, which then sends the "dle"
command to its daemons, signaling them to shut down. [DD1]

Network traffic between the attacker, the masters, the daemons, and
the victim is inbound with respect to the destination of a particular
communication segment. As the result, organization whose firewalls
block high-numbered UDP ports can effectively disrupt the
communication between Trinoo nodes. However, firewalls cannot protect
an organization from a distributed DoS attack, since the very nature
of Internet-based communications allows the attacker to consume
target's resources by flooding the network's entry point with
unsolicited traffic.

6.3 Tribe Flood Network

Tribe Flood Network, or TFN, was discovered approximately at the same
time as Trinoo, around October 1999. Both programs are similar in
purpose and architecture. The original version of TFN has a more
primitive access control mechanism, but excels in the subversive
nature of its control channel, and supports a wider variety of
distributed denial-of-service attacks. While Trinoo limits itself to
UDP packets when attacking a site, TFN can execute ICMP floods, UDP
flood, Smurf-style attacks, and has a way of providing the attacker
with an administrative back door to the agent's host. [DD3] TFN is
controlled via command-line execution of its client component, which
can be accomplished by connecting to the client machine through
standard remote administration tools such as Telnet or SSH, as well as
via a backdoor that the attacker may have set that up for this
purpose. [DD3]

The mechanism employed by TFN servers to communicate with their
clients is particularly interesting because it is based purely on ICMP
"echo reply" packets. [DD3] Such packets are normally generated in
response to ICMP "echo request" messages that are produced by the
"ping" command to verify network accessibility of a machine.

To provide their users with the ability to issue outbound ICMP "echo
request" commands, many network administrators do not block inbound
ICMP "echo reply" packets from entering the network. Had the program
used ICMP "echo request" messages instead, the machines hosting its
agents would generate ICMP "echo reply" packets in response, creating
traffic that might have drawn unnecessary attention to the
communications. In addition, several popular network-monitoring tools
do not process ICMP traffic properly, [DD3] increasing the likelihood
that TFN communications can proceed uninterrupted.

By utilizing ICMP "echo reply" traffic for its communications, TFN
illustrates a simple yet effective approach to circumventing security
mechanisms, which forms the basis of many attacks since the early days
of the Internet – if a protocol defines an expected mode of
behavior, attempt to exploit the protocol by violating the
specifications or by following the path not expressly mentioned in the
specifications. In case of TFN, ICMP specifications do not consider
the existence of "echo reply" packets without corresponding "echo
request" messages. In addition, TFN servers use the identifier field
of the ICMP packet to relay commands to their clients, [DD3] although
the field is officially dedicated to matching "echo reply" to "echo
request" messages. [JP]


7. ADVANCED MALICIOUS AGENTS

7.1 Overview

Throughout its course, this paper highlighted prominent properties of
various malicious agents in an attempt to illustrate how they can be
used to create a new breed of attack agent. The list below summarizes
key features and limitations of programs discussed so far:

  o Rapidly Spreading Agents such as the Morris Worm illustrated
    highly aggressive modes of self-propagation, while the Melissa
    Virus demonstrated how an agent could effectively infiltrate an
    organization through open channels such as incoming e-mail or Web
    access. Despite their effect on the Internet community, these
    agents might not have reached their fullest potential because
    their behavior has been programmed in advance.

  o Spying Agents use outbound connections to communicate with their
    operators. The Caligula Virus employed this mechanism to transmit
    private information to an external site, the Marker Virus
    maintained an infection trail that could reveal relationships
    between people in the target organization, while the Groov Virus
    reported network details that could be used to obtain an insider's
    perspective of the organization's computing infrastructure. This
    technique has been used to obtain information from the attackers
    to guide the agent throughout its lifecycle.

  o Remotely Controlled Agents such as Back Orifice and NetBus are
    extremely stealthy and provide the attacker with real-time remote
    control of the computer that rivals actually sitting in front of
    the machine. Support for plug-ins that expand native functionality
    of the programs allows these agents to mutate easily. However, due
    to the inbound direction of the controlling traffic, many
    firewalls can effectively disrupt their communication channels.

  o Coordinated Attack Agents such as Trinoo and TFN are particularly
    powerful because they provide the attacker with the ability to
    centrally command an army of distributed agents while attempting
    to conceal attacker's identity. Recent versions of these tools
    support communications over encrypted channels, making such
    attacks very difficult to investigate. The behavior of these
    agents can be controlled in real time; however, many firewalls can
    disrupt these communications because they are typically sent in
    the inbound direction. In addition, current versions of these
    programs are limited in their ability to self-propagate, and often
    require manual action on behalf of the attacker to spread to new
    hosts.

In the context of this paper, an advanced malicious agent is one that
builds upon strengths of each class of programs described above, and
alleviates their deficiencies. The RingZero trojan, discussed in this
section, is an example of an existing program that exhibits many
characteristics of an advanced malicious agent.

7.2 The RingZero Trojan

Large-scale reports of activity associated with the RingZero trojan
became available in September 1999, but it was not until October 1999
that an instance of the program was found in the wild and presented
for detailed analysis. [JG] Nonetheless, RingZero sightings date back
to August 1999, and describe unsolicited e-mail messages that claimed
to contain a "really class program." In one of the variations of
the program, the attachment was a trojanized version of a game that
allowed the user to "shoot" holes into the screen using the
mouse cursor as a pistol. Another distribution contained a tainted
version of a shareware program called iNTERNET Turbo. [NAI3]

Using the now classic technique of propogating via e-mail attachments,
RingZero infected enough machines that in the beginning of October
security analysts began noticing unusual network traffic that
originating from over one thousand hosts. [JG] Anti-virus software
could not protect machines from being infected with RingZero, since
the vendors did not yet know the trojan’s signature at the time.

The RingZero trojan was comprised of two agents that coexisted on the
same machine. One of them, named pst.exe, used the victim's
computer to scan the Internet for proxy servers, which are commonly
used to access Web sites on behalf of proxy server users. This is the
traffic that analysts were seeing in their logs. When pst.exe found an
active proxy server, the module directed the server to relay a message
to an external Web site in an attempt to record the existence of the
newfound server. The exact reason for maintaining a list of Internet
proxy servers is unclear, but possibilities range from utilizing the
servers for anonymous access to Web sites, to using them to relay
future HTTP-based attacks. [TW]

The second executable comprising RingZero was named its.exe, and
attempted to connect to two external Web sites. Once connected, the
agent attempted to retrieve a file that was encoded in a way that
prevented analysts from studying its contents. The exact purpose of
this file remains unclear, but it is likely that the file provided
some form of instructions to the trojan, altering its behavior as the
attacker deemed necessary. [JG]

Once its.exe downloaded the data file from its Web sites, the trojan
connected to an Internet mail server in Finland, attempting to use the
server as a relay for sending e-mail to thousands of users of a
popular instant messaging service. Messages contained a fabricated
return address, and were meant to reach as many people as possible. In
the body of the message, recipients were encouraged to visit the
"Biggest Proxy List" at the Web site where RingZero maintained
the database of its findings. It is possible that the author of the
trojan wanted a lot of people to connect to the site to increase the
chances of concealing his or her identity – the more people looked
at the list, the harder it would be to find the author's connection
information in the server's access logs.

Overall, RingZero exhibited characteristics that, until then, were
rarely seen in a single program. The trojan spread rapidly via
channels such as e-mail or Web browsing. Once inside an organization,
it had the ability to act as a spying agent, collecting confidential
information and performing internal network scans. It possessed a
remote-controlling mechanism that was based on outbound connections,
and allowed the attacker to control the agent's actions and
propagation rate in a stealthy manner despite most firewalls. It
operated in a distributed manner, directing infected machines across
the Internet to automatically consolidate the agent's findings in a
centralized location. [JG]

Since neither the source code, nor the contents of the data file for
RingZero were available, there is still much unknown about this
trojan. Its actions around October 1999 did not seem to have an
especially malicious purpose, although some reports indicate that one
of its versions attempted to steal cached passwords from the user's
machine. [WH]

Yet, the analyzed version of RingZero did not seem designed
specifically to bypass firewalls, was louder than its apparent
functions called for, and did not exhibit aggressive propagation
techniques such as exploitation of known software
vulnerabilities. Perhaps, it was meant as nothing more than a tool for
gathering statistics about Internet proxy servers. On the other hand,
perhaps it was a prototype of an advanced malicious agent that
effectively demonstrated some of the threats currently materializing
on the Internet.

7.3 The Threat of Advanced Malicious Agents

Functionality of RingZero, combined with the experimental nature of
its behavior, suggests that advanced malicious agents are being
actively developed by the attacker community. On one hand, there is
nothing particularly ingenious about these programs, as they exhibit
characteristics already present in other software for some
time. However, the incorporation of all these features into a single
package makes such agents especially dangerous. The very existence of
RingZero demonstrates that the technology behind advanced malicious
agents is no longer theoretical.

The agent's use of outbound connections for obtaining instructions
from the operator is something that was rarely seen in earlier
programs. This feature blends the agent's communications into everyday
browsing activities of the organizations, and makes its control
traffic very difficult to block.

Furthermore, advanced malicious agents utilize multiple sites for
staying in touch with the operator, creating redundancy in the control
network. Attacks conducted with the help of such agents are very
difficult to stop, since all control sites need to be disabled to
terminate the control channel. This "advanced" architecture is
distributed in both attack and control capabilities, and allows the
attacker to direct the attack in a completely detached manner by
updating instruction files on one or more home base sites.

Having experienced tremendous difficulties in defending against
distributed attacks from programs such as Trinoo and TFN,
organizations will find themselves highly vulnerable to attacks from
advanced malicious agents. Such attacks will be harder to notice
because open channels will be used, harder to stop because multiple
agents and multiple control sites will be involved, and harder to
trace because the attacker will be controlling the agents in a
distributed and disconnected fashion. No, this is not a prediction of
a doom's day – this is simply an indication that the need for
qualified security administrators is unlikely to subside any time
soon.


8. APPENDIX

8.1 Key Features of Malicious Agents

The following matrix consolidates key features of malicious agents
that were discussed in this paper. Please refer to appropriate
sections in the paper for a detailed discussion of these elements, as
the table format does not allow providing description of the items. In
particular, when presence of firewalls is mentioned below, it is
assumed that the firewalls are tightly configured to allow only a
limited set of services to enter the organization's network.

            Morris Melis. Marker Calig. Groov Back  Net- Trinoo TFN  Ring-
            Worm   Virus  Virus  Virus  Virus Orif. Bus              Zero

Aggressive  Yes    No     No     No     No    No    No   No     No   Poss.
self-
propagation

Propagat.   Yes    Yes    Yes    Yes   Yes    Yes   Yes  Part   Part Yes
despite
firewalls

Aggressive  Yes    Part   No     No    Part   Yes   Yes  Yes    Yes  Poss.
attack when        (Dos)               (DoS)
no firewalls

Aggressive  No     Part   No     No    Part   No    No   Part   Part Poss.
attack desp.      (DoS)               (DoS)
firewalls

Revealing   No     No     Yes    Yes   Yes    Yes   Yes  No     No   Yes
confident.
information

Remotely    No     No     No     No    No     Yes   Yes  Yes    Yes  Yes
controlled
when no
firewalls

Remotely    No     No     No     No    No     No    No   No     No   Yes
controlled
despite
firewalls

Acting in   No     No     No     No    No     No    No   Yes    Yes  Yes
coordinated
distributed
fashion

The folowing abbreviations were used in the table above to fit its
contents into typical terminal window: "Poss." stands for "Possibly;"
"Part" stands for "Partly;" "Propagat." stands for "Propagation;"
"Desp." stands for "Despite."


9. ACKNOWLEDGMENTS

9.1 Reviewers

The following individuals contributed their time and energy to this
paper by reviewing its draft version, offering insightful technical
and stylistic feedback.

  o Slava Frid. slava@fridnet.com.

  o PCHelp. http://www.nwi.net/~pchelp.

  o Rourke McNamara. http://www.rourkem.com.

9.2 References

[ANON] Anonymous. NetBus Pro. URL:
http://www.multimania.com/cdc/netbus2pro.html (22 April 2000).

[BP] Bob Page. "A Report on the Internet Worm." 7 November 1988. URL:
ftp://coast.cs.purdue.edu/pub/doc/morris_worm/worm.paper
(22 April 2000).

[CC1] CERT Coordination Center. "Frequently Asked Questions About the
Melissa Virus." 24 May 1999. URL:
http://www.cert.org/tech_tips/Melissa_FAQ.html (22 April 2000).

[CC2] CERT Coordination Center. "CERT Advisory
CA-99-04-Melissa-Macro-Virus."  27 March 1999. URL:
http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html
(22 April 2000).

[CDC1] Cult of the Dead Cow. News. 3 August 1998. URL:
http://www.cultdeadcow.com/news.html (22 April 13 2000).

[CDC2] Cult of the Dead Cow. Back Orifice 2000 Feature List. URL:
http://www.bo2k.com/featurelist.html (22 April 2000).

[CDC2] Cult of the Dead Cow. Software Download. URL:
http://www.bo2k.com/warez.html (22 April 2000).

[CNN] Cable News Network. "Cyber-Attacks Batter Web Heavyweights."
9 February 2000.
http://www.cnn.com/2000/TECH/computing/02/09/cyber.attacks.01
(22 April 2000).

[DD1] David Dittrich, University of Washington. The DoS Project's
"Trinoo" Distributed Denial of Service Attack Tool. 21 October
1999. URL: http://staff.washington.edu/dittrich/misc/trinoo.analysis
(22 April 2000).

[DD2] David Dittrich, University of Washington. The "Stacheldraht"
Distributed Denial of Service Attack Tool. 31 December 1999. URL:
http://staff.washington.edu/dittrich/misc/stacheldraht.analysis
(22 April 2000).

[DD3] David Dittrich, University of Washington. The "Tribe Flood
Network" Distributed Denial of Service Attack Tool. 21 October
1999. URL: http://staff.washington.edu/dittrich/misc/tfn.analysis
(22 April 2000).

[GAO] United States General Accounting Office. Report to the Chairman,
Subcommittee on Telecommunications and Finance, Committee on Energy
and Commerce House of Representatives. "Virus Highlights Need for
Improved Internet Management." June 1989.  URL:
http://www.worm.net/GAO-rpt.txt (22 April 2000).

[GG] Gerhard Glaser. NetBus Page. URL:
http://home.t-online.de/home/TschiTschi/netbus_pro_eng.htm
(22 April 2000).

[JP] J. Postel. RFC 792. "Internet Control Message Protocol."
September 1981. URL: http://www.faqs.org/rfcs/rfc792.html
(22 April 2000).

[JR] Joyce K. Reynolds. RFC 1125. "The Helminthiasis of the Internet."
December 1989. URL: http://www.worm.net/rfc1135.txt (22 April 2000).

[JM] Joel McNamara. "Practical Attacks on PGP." 9 August 1997. URL: 
http://www.eskimo.com/~joelm/pgpatk.html (22 April 2000).

[JG] John Green. The Hunt for the RingZero Trojan. October 1999. URL:
http://www.sans.org/audioplay/ringzero (22 April 2000).

[KW] Ken Williams. Interesting People List Archive.
"Re: PGP key stealing virus Caligula." 6 February 2000. URL:
http://www.interesting-people.org/199902/0027.html (22 April 2000).

[NAI1] Network Associates, Inc. Virus Information
Center. W97M/Marker.c. 7 September 1999. URL:
http://vil.nai.com/villib/dispVirus.asp?virus_k=10337
(22 April 2000).

[NAI2] Network Associates, Inc. Virus Information Center.
W97M/Groov.a. URL:
http://vil.nai.com/villib/dispVirus.asp?virus_k=98011 (22 April 2000).

[NAI3] Network Associates, Inc. Virus Information Center.
RingZero.gen. URL:
http://vil.nai.com/villib/dispVirus.asp?virus_k=10356
(22 April 20 2000).

[NF] Nick FitzGerald. "Frequently Asked Questions on
Virus-L/comp.virus." Release 2.00. 9 October 1995. URL:
http://www.faqs.org/faqs/computer-virus/faq (22 April 2000).

[PC1] PCHelp. "The Back Orifice 'Backdoor' Program." 4 November
1999. URL: http://www.nwi.net/~pchelp/bo/bo.html (22 April 2000).

[PC1] PCHelp. NetBus FAQ Mirrored from the Original Site. URL:
http://www.nwi.net/~pchelp/nb/faq.html (22 April 2000).

[SYM1] Raul K. Elnitiarta. Symantec AntiVirus Research
Center. W97M.Cali.A. 12 February 1999. URL:
http://www.symantec.com/avcenter/venc/data/w97m.cali.a.html
(22 April 2000).

[SYM2] Symantec AntiVirus Research Center. W97M.Marker. URL:
http://www.symantec.com/avcenter/venc/data/marker.html
(22 April 2000).

[TR] Trend Micro, Inc. Trend Virus Encyclopedia. W97M_CALIGULA. URL:
http://www.antivirus.com/pc-
cillin/vinfo/virusencyclo/default5.asp?VName=W97M_CALIGULA
(22 April 2000).

[TW] Tim White. Incidents Mailing List Archive. "The Proxy Port
Scanning: 80, 8080, 3198, RingZero, etc." 17 October 1999. URL:
http://www.securityfocus.com/templates/archive.pike?list=75&msg=34AF5551A7EFD2
11AA4C00A0C99D27C93A5765@isoexch03 (22 April 2000).

[UA1] UltraAccess Networks, Inc. Frequently Asked Questions. URL:
http://www.netbus.org/faq.html (22 April 2000).

[UA2] UltraAccess Networks, Inc. NetBus Pro Features. URL:
http://www.netbus.org/features.html (22 April 2000).

[XF1] ISS X-Force Vulnerability and Threat Database.
ISS Vulnerability Alert. 19 February 1999. URL:
http://xforce.iss.net/alerts/advise20.php3 (22 April 2000).

[XF2] ISS X-Force Vulnerability and Threat Database.
ISS Vulnerability Alert. 28 February 1999. URL:
http://xforce.iss.net/alerts/advise44.php3 (22 April 2000).

[WH] Wason Han. Symantec AntiVirus Research Center.
28 October 1999. URL:
http://www.symantec.com/avcenter/venc/data/ringzero.trojan.html
(22 April 2000).


                 Copyright (c) 2000 by Lenny Zeltser
                    http://www.zeltser.com/agents
                          lenny@zeltser.com