Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information (2005)
Cached
Download Links
| Citations: | 48 - 5 self |
BibTeX
@TECHREPORT{Zou05routingworm:,
author = {Cliff C. Zou and Don Towsley and Weibo Gong and Songlin Cai},
title = {Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information},
institution = {},
year = {2005}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Most well-known Internet worms, such as Code Red, Slammer, and Blaster, infected vulnerable computers by scanning the entire Internet IPv4 space. In this paper, we present a new scan-based worm called "routing worm", which can use information provided by BGP routing tables to reduce its scanning space without ignoring any potential vulnerable computer. In this way, a routing worm can propagate twice to more than three times faster than a traditional worm. In addition, the geographic information of allocated IP addresses, especially BGP routing prefixes, enables a routing worm to conduct fine-grained selective attacks: hackers or terrorists can selectively impose heavy damage to vulnerable computers in a specific country, an Internet Service Provider, or an Autonomous System, without much collateral damage done to others. Routing worms can be easily implemented by attackers and they could cause considerable damage to our Internet. Since routing worms are scan-based worms, we believe that an effective way to defend against them and all other scan-based worms is to upgrade IPv4 to IPv6 --- the vast address space of IPv6 ( 2 IP addresses for a single subnetwork) can prevent a worm from spreading through scanning.
Keyphrases
selective attack worm ip address information scan-based worm ip address vulnerable computer potential vulnerable computer new scan-based worm heavy damage single subnetwork geographic information vast address space autonomous system much collateral damage specific country well-known internet worm fine-grained selective attack internet service provider effective way traditional worm code red entire internet ipv4 space considerable damage
