Hello everyone, today we're taking a look at the Mydoom email worm.
This worm surfaced in early 2004 and quickly spread to over a million computers worldwide
and through their efforts combined, helped take down one website for about 2 weeks.
So we'll go ahead and take a look at what it does. We'll go ahead and run the email.
This would arrive in an email that looked sort of like this.
Messages would sometimes be different but they'd all generally be variants on
"Message could not be displayed, check the attachment for your message."
And, of course, the attachment is an .exe file or a .tiff or .bat or a .scr which contains the email worm.
So I'll go ahead and run it.
And we get this fake message - it pretends to be a corrupted email message.
In reality, it's just disguising the fact that the worm has now infected your system.
Down here in the bottom right, we see we have a mock-up of a Kazaa shared folder.
And the worm has actually dropped itself in here as Winamp 5.
So, if you have ever downloaded Winamp with a text file icon, in 2004 from Kazaa,
you may have been infected with Mydoom.
We can see it dropped one file here to system32, "shimgapi.dll".
This is a backdoor that opens up a port on your computer that allows
pretty much anybody else to enter in and do bad things to your computer.
A number of future worms actually exploited this
and used computers previously infected with mydoom to further infect more computers.
There's one other file that the worm dropped in the system32 folder
Just gotta find it really quick."taskmon.exe". It has our familiar blurred notepad icon, which, of course, is the worm.
Now, this worm started its payload on February 1st, at about 8:09 or something am, something very specific in the PST.
At that time, it would have a 25% chance of launching a distributed Denial of Serivce (DoS) attack
against sco.com, which belonged to the Sco group.
You can look them up on wikipedia if you really want to know what they do
or at least did, because they went under.
But anyway, that website does not exist anymore,
so I've edited the host file to point to my website.
Now this worm won't actually do much damage to my own stuff.
This is one computer running it.
Mydoom infected over a million computers,
so when you have a quarter of a million computers all blasting a website
with a DDoS attack, of course that webstie's gonna go down.
But with this one computer attacking my website,
nothing's really gonna happen. But it's pretty fun to watch.
So, I'll shrink down the virtual machine a little bit,
and we have WireShark running, and we're listening for any connections going out to my website.
So we're gonna change the date to the first of February,
when the worm is programmed to start attacking, and we're just gonna restart
until this worm starts attacking my website.
So let's go ahead and do that.
And here we go.
You can see already the massive amount of traffic being pushed out of this virtual machine.
Already, just since I started talking, 30,000 packets have been sent.
It really is a massive amount of traffic that this worm puts out.
So you can imagine. This kind of attack multiplied across multiple thousands of computers,
it's gonna be a big one.
If we look at our virtual machine, it's having trouble coping with all this.
Our CPU is just, solid, at 100%.
You'll actually notice, in the shared folder,
every time I restarted to attempt to get the worm to land on that one quarter chance of doing the DoS attack,
it added a new file into our Kazaa shared folder.
So it's kinda like counting the rings on a tree,
every time you restart, you get a new file on here.
so we had to restart 4 times for this to actually work.
Once the worm has initiated the DoS attack,
it cancels the spreading routines for that boot of the computer.
So if your computer boots and it decides it wants to do this DoS attack,
it will not add a new file to your shared folder, and will not run the email spreading routines.
Interestingly enough, this worm actually stops its spreading routines entirely on February 12th, 2004.
So it has a built in "self destruct" date.
After 11 days of DoS attacks, the worm stops itself.
However it does not uninstall the backdoor that it installed on your system.
In order to truly clean your system, you'd need to remove the worm's files
as well as the backdoor, "shimgapi.dll".
This worm had a lot of media coverage
generally because of how widespread it was.
I know F-Secure's weblog I read pretty religiously back in the day
started to cover this worm and then wound up being a general malware blog.
which was actually really interesting.
That's really about it for mydoom. There's nothing outright destructive about it.
But it is pretty interesting to take a look at it in action and see what it actually does.
Thank you for watching.