Hello everyone,
today we're taking a look at the AnnaKournikova worm.
This worm was VERY widespread in February of 2001,
and took down several email networks all over the world
due to its widespread nature.
We're gonna take a look at what makes it tick,
and we're also going to see it spread via email,
you can see here I've got two computers setup.
There's a third off to the side acting as an email server.
And we're going to watch the worm spread from this first computer
here on the left to the second one, and see what it does.
And, fun fact -
if you're watching this video the day I published it, [Feb 11 2022]
it is actually the 21st anniversary of the worm [Feb 11 2001]
So, happy 21st birthday AnnaKournikova...worm...
Not the *real* Anna Kournikova.
Anyway let's get right to it.
We're gonna press enter here on the left keyboard
[heavy old laptop keyboard THUNK sound]
Which executes the worm.
And then we're gonna shift focus over to the right computer.
And see what it does!
[worm anticipation builds]
If you were very observant you saw that email pop up for a brief
second before it got sent.
So we should see it any second now on the other computer.
Let's take a look!
[hope you enjoy the video]
So here we are on the second computer, I'm just going about my day,
and I'm gonna check my email...
...see what we got.
[the suspense is killing me, and probably the computer too]
...Nothing.
[when viruses fail part 3,523]
[Outlook email sound be-doops softly]
Oh hey look!
We've got a new email from our friend Roger.
"Here you have" with a nice winky face and a nose.
"Hi, check this."
And we have our - ooh, Anna Kournikova dot JPEG.
That sounds pretty tempting to me.
;)
I'm not gonna worry about that dot VBS part at the end.
Cuz when I look at it, all I see is AnnaKournikova.JPG.
That's because, of course, the worm uses the classic trick
of a double file extension to hide the true file extension.
In this case the full filename is AnnaKournikova.JPG.VBS,
But Windows' default behavior hides the real file extension
if it knows what it is.
In this case, Windows knows what "VBS" files are,
and hides that part from the user, so they think it's just a JPG.
Same tactic was used in the LoveLetter
[ILOVEYOU] worm the year before this worm,
and judging by the scale of the issues the Internet had
it still worked.
The worm itself is actually pretty simple. If we edit it,
it's less than 50 lines long.
I've added some formatting here so it's a little more readable.
But the gist of it is just the email portion,
there's no damage or anything like that.
There's a small payload that activates in January.
But in general it's not very harmful at all.
[good news for users everywhere, bad news for this channel]
So let's go ahead and run it and see what it does.
So we have now run AnnaKournikova.
[go AnnaKournikova go!]
If we take a look real quick, will we see it send?
Nope, not in this case. You can see my test emails
sent to the other computer, but we do not see this worm.
That's because AnnaKournikova covers its tracks [sneaky]
As soon as it sends, it deletes that email from your 'sent' folder.
So you can't go back and tell that the worm was sending out files.
Now one of the reasons this was so widespread
was that unlike LoveLetter, which limited itself to
the first 50 contacts in your address book,
AnnaKournikova sends it to
everyone [email BE-DOOPs on the other computer]
And if you listen you could hear the email arriving on
the other computer.
So just like that the worm has spread to a new computer,
and can continue spreading from there.
The worm drops its file here in the Windows directory of course.
Yeah I wanna see it!
I know what I'm doing...maybe...
[spoiler: no he doesn't]
And here it is, AnnaKournikova.JPG
...of course, dot VBS.
And we also added a registry key here
[Model M clacking virus-ly]
[mockingly] reg-ed-UT...
[properly] Regedit.
If we look at HKEY\Current_User...Software....
We now have a key called "OnTheFly"
and "mailed" is set to 1.
So the worm is also careful not to mail itself more than once
per machine with this registry key.
It sets this as soon as it emails itself so that it won't email itself again.
Which probably could've had far more drastic consequences
had it been continually emailing itself all over the world
over and over.
[would probably be pretty cool to see that in a video on this channel, but oh well. next time.]
You might notice the other key here
"Worm made with VBSWG 1.50b"
[that's quite the acronym]
That's right!
This worm was made and released in one day
because the author downloaded a VBS worm generator program,
typed in what he wanted it to say, and what he wanted the
attachment to be, and what exactly he wanted it to do,
and sent it on out into the world.
Took just a few hours from him downloading the program and
and sending it out for it to crash mail servers worldwide.
[those poor, poor servers]
And it was really for no other reason
than people didn't know enough about internet security
and were curious enough to click AnnaKournikova.jpg
that showed up in their email 50 times from random people
they knew.
You'd think if you were receiving the same email with the same
text and the same message body
from multiple different people you know,
that probably don't know each other,
you might be a little suspicious.
But maybe I'm giving the end user a little too much credit.
Now like I said there is one very small payload,
let's take a look at that.
If we edit this, let's see what date. If the month now is one
and the day now is 26
then we're opening a website.
So January 26th
which happens to be the author's birthday.
He was 20 years old when he wrote and released AnnaKournikova
I use the term "wrote" VERY loosely here.
[How to write globally spreading Internet Worms for Dummies, on sale $19.99]
Let's see what happens.
Here we go, here's Microsoft Internet Explorer -
Yeah I know I'm connected.
Not really, I'm on a local network, it's all very isolated.
[so lonely]
Not that I'm worried about reigniting the second spreading
of AnnaKournikova.
But we're not connected to the Internet for real.
It would launch the website of a Dutch retailer,
however even if I was connected,
this website doesn't exist as it did back then,
because they went out of business.
The website is still there, it's just an "under construction"
page, so you're not missing much.
But come on, even if it was there, would you really care
to see a Dutch retailer website from a worm?
Does it make much sense?
[no it doesn't]
It'd be like if I wrote a worm and had it open walmart.com.
Alright, that's enough of this.
[clippy reappears, menacingly]
Now one aspect that made worms like this so dangerous
was its ability to be easily edited.
Much like major earthquakes where you have the big event
that has long lasting effects - in this case, AnnaKournikova.
Anybody who receives this in their email can simply
right-click and edit it, just like I did here,
and view all the source code.
Visual Basic Script isn't a compiled language,
you don't have to assemble the assembly file
and then link the object file into your EXE
which you can then run.
You can just right click it, look at it, type in some new code
and you're good to go.
So just like that major earthquake has some aftershocks
that always follow up with [usually] less impact than the original
so, too, did these major VBS worms in the early 2000s.
So we're gonna try to do that now. I'm gonna edit this.
I'm gonna make a brand new variant of AnnaKournikova.
So I'm gonna add this right here in this...
[keyboard plunk]
Day 26 Month 1 routine.
And I'm gonna make it a little bit more...dangerous...
[the rise of evil dan has commenced]
I have quickly added three lines which should try to delete
all the files in the root of the C drive.
And we're gonna see if my syntax is correct and if it works.
First I gotta close this, I've gotta stop the worm from running.
So "wscript" is our worm, we'll end that.
Come into Windows, we'll delete this one.
And go into Regedit and delete the key that says not to
mail itself again.
Delete "OnTheFly."
And we are now clean of AnnaKournikova.
That was a complete removal video right there.
[that'll be $250, thanks]
It's not complicated to clean this one up,
but it is if you have a new variant of it.
We're gonna rename this file..."cool script."
[enter key pressed hackingly]
Oh hey look, AnnaKournikova tried to replace itself.
Unfortunately, a bug in the code
causes the replacement to be 0 bytes.
It did not finish rewriting its code there so,
sorry AnnaKournikova, you're gone.
And real quick, just for fun we're gonna change the message
body to: "Sup jerk..."
And...
[typing] "You suck! Betcha won't run this cool script I mean JPG"
And like the classic virus author I am, I'm gonna totally
forget to include the .JPG part of that extension.
[typing to complete the hacking masterpiece]
Alright here we go, let's see if I did it right.
You know I just realized this would probably kill my system too.
Uh oh!
Do we still have files in the C drive?
Eh I'm not gonna worry about it.
[email ba-doops once more]
Oop, I hear it arrived on the other one.
Okay I don't know if this is just Windows XP being Windows XP
or if I totally messed something up by deleting those files.
If it even deleted them, I don't know.
But we're not responding on Explorer.
Let's get Explorer back here -
Oop, it came back on its own, thank you Explorer.
Umm, it's still frozen.
Let's try restarting.
[concerned] Um, yes, Windows XP?
[viral anticipation intensifies]
Hmm...
Oh, we gotta stop the worm.
Ohhhh...kay, uhhh....
[what is happening]
There we go, that took it a bit.
Now unfortunately, my file deletion payload did not end up
working as I had hoped.
Maybe I need to download the Visual Basic worm creator as well
But it did successfully send emails.
If we take a look at the other computer now,
we can see I've sent it quite a few times.
So "Here you have" and then "Sup Jerk,"
"Betcha won't run this cool script, I mean JPG."
And my brand new variant is indeed attached.
So we have succeeded in creating a brand new variant
of AnnaKournikova.
Whether or not that's a good thing, I don't really know.
[you tell me in the comments]
But, that is about it for the AnnaKournikova worm.
Thank you very much for watching,
take care :)