. .: .:.. :.. .. .:.::. :. ..: <<-==ÜÛÛÛÛÛÜ=ÜÛÛÛÛÛÜ=ÜÛÛÛÛÛÜ===< .:: ÛÛÛ ÛÛÛ:ÛÛÛ ÛÛÛ.ÛÛÛ ÛÛÛ .:. . .:.ÜÜÜÛÛß.ßÛÛÛÛÛÛ.ÛÛÛÛÛÛÛ:.. ...ÛÛÛÜÜÜÜ:ÜÜÜÜÛÛÛ:ÛÛÛ ÛÛÛ.::. >===ÛÛÛÛÛÛÛ=ÛÛÛÛÛÛß=ÛÛÛ ÛÛÛ=->> .: .:.. ..:. .: ..:.::. ::.. :.:. I-Worm.Serotonin by Benny/29A Ladies and gentlemen, I am maximaly proud to present you my newest creation, the most complex worm project I have ever done. I've been working on this code for almost one year. Much time had been spent not only by coding and debugging, but also researching in unknown field. I hope you will like the result. This worm is the final mix of many new and progresive ideas and technologies. Some ideas in this stuff are a bit old and described in some articles of mine about some thoughts that I would like to realise; and finaly now became the time to change them to working code. And something is A VERY HOT NEW stuff, born in my brain sometimes. The worm is pretty huge for assembler code - first generation binary size is 32kB and the number may increase in next generations. Nevertheless for such a big amount of functions integrated together it is not much. Well, this seems to be the top stuff I've ever made in my eyes. It is not easy job to describe the whole behavior of the worm in a few lines, so the description is divided to sub-articles: (1) Principles of genetic programming (GP) (2) Interneting (3) Microsoft .NET (MSIL PE) EXE file infection (4) E-mail spreading (5) AntiVirus and firewall programs killing So, let's start. Principles of genetic programming (GP) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ There are tons of websitez that deeply describes what the GP is (just visit google.com and search), so I will be short. GP is style of programming that is inspired from natural biologic evolution - yeah, that thing that created so complex biocomputers like you are. By Darwin's theory only the best organisms can survive in the wild; they pass their genetic material on then. Evolution is done by genetic material pairing and its slow mutation. Pairing allows to create not only the good stuff, but also to improve it. Mutation increases the probability of abnormal genetic material creation, which is done by light random changes in genetic code. [Mutation sometimes causes that retarded organism is created, but sometimes the miracle happens and better organism got born.] Then it's a matter of time when the suffient variant become generated. And which genetic material is good and which not? The one that will give the organism chance to survive. I decided to took the concept from GP and implement it in Serotonin. Whole code is divided to two parts - common code and genotype code. Common code remains same for all possible versions of worm. It's the base code which handles all crucial operations. Genotype code is that part which may differ in each version. And even it is still needed by worm, each part is replaceable, updateable and independent from hosting environment (can be used anytime, anywhere). There can be also more than one code routine - worm can choose by itself which exact code it will use. Such code is very effectively manageable, importable, exportedable and eraseable. You can imagine genotype like set of independent procedures of special type (so called gens), where each type of gen is used when needed, but which concrete gen of needed type will be selected is up to worm. Yeah, worm has very flexible modular structure which allows to implement GP. Two different copies of worms with different genotypes can exchange them, compile all existing gens into one genotype (pairing process) and replace old genotype with the new one - in simple words, this gives the worm an ability to update some parts of itself and change the behavior of itself at runtime. This can be also called as functional morphing. Pairing (A+B=C) and mutation (C->Z): A B C Z _ _ (1) (1) (1) (1) (2) + (2) = A(2) (2)A (3) (3) _(3)_ -> _(3)_ (1) B(3) (2)B - (3)_ That's not all. The worm also supports light mutation (note that this kind of mutation is something different from polymorphism/metamorphism), so the amount of possible variants ain't equal to number of possible genotype pairs. Each time the worm pairs two genotype it also passes the genotype structure and randomly removes some gens - but the code garants that there will stay at least one gen of each type, so the code still remain functional. And each time the worm executes it randomly changes some important variables that specify a behavior of worm (see below). This gives the worm pretty good potential to adapt itself to current environment. Here is a little example: There is one colony of worms, say at university no.1, where most users use MS Outlook. And so the worms will use the gen that can extract e-mail addresses from MS Outlook. Mutations working with another gen won't work there and they will disappear (die, not survive). In case the worm will spread to another network, say at university no.2, where most users use MS Outlook Express, most of worms won't be able to work there. But some of them will be mutated so they will use another gen which can handle OE and will survive. The worm is adaptable and such organisms, by Darwin's theory, have better chances to survive in-the-wild. And where they will get that right new gen? See following "Interneting" sub-article. Now, the mutation variables. You won't understand them well now, so keep reading on and you will got it soon :-) Here comes the list of them: source code label description mut_mailnum number of infected e-mail addresses which will cause the server termination. mut_sleep_time number of minutes the worm should spend in sleep mode mut_ipsnum number of IP addresses stored in database which will cause the server termination. mut_clientnum number of handled clients which will cause the server termination. mut_time number of minutes the server may run. exceeding this limit causes the server termination. mut_nonstop_traffic boolean value which says that the server will broadcast every recieved genotype on, to all worm in database. this may cause the nonstop network traffic among wormnet - worms will exchange genotypes without becoming idle. this may theoreticaly flood network if bigger count of worms have this option set ON. The main purpose of these variables is to reduce amount of running worms in case the worm "think" it's spreaded out enough or there's just a need to terminate itself. The last variable is present becoz of testing purposes. I'm not sure at all what it can cause (I had no large network for deep testing), so let's call it "payload" :-) Interneting ÄÄÄÄÄÄÄÄÄÄÄÄ Well, that was my primary idea - computer worm simulating how the real biological organisms work. Some principles only of course, I'm not God :P But if I wanted to simulate a real life in computer network, I had to give my worm some elementary social abilities. I had an idea that the worm should communicate via its own worm network (wormnet) (communication should be encrypted by some asymetric algorithm) by his own communication protocol. It should also be able to exchange its genetic information and so update itself and other worms in colony (this process should maximally act as a real fucking :). Wormnet MUST be decentralized, such like Gnutella P2P network. Here is a description of the model (from http://www.limewire.com/index.jsp/p2p): "Unlike a centralized server network, the Gnutella network does not use a central server to keep track of all user files. To share files using the Gnutella model, a user starts with a networked computer, which we'll call "A," equipped with a Gnutella " servent" (so called because the program acts as a combination of a "server" and a "client"). Computer "A" will connect to another Gnutella-networked computer, "B." A will then announce that it is "alive" to B, which will in turn announce to all the computers that it is connected to, "C," "D," "E," and "F," that A is alive. The computers C, D, E, and F will then announce to all computers to which they are connected that A is alive; those computers will continue the pattern and announce to the computers they are connected to that computer A is alive. Although the reach of this network is potentially infinite, in reality it is limited by "time-to-live" ( "TTL") constraints; that is, the number of layers of computers that the request will reach. Most Gnutella servents will reject any network messages which have TTL's that are excessively high." This is the way Serotonin works (for TTL stuff see mut_nonstop_traffic mentioned above). It can exchange public keys used for encrypted communication and genotypes, it can pair them into one and mutate the result and also it can exchange some strategic informations, which are significant for next actions. This means a finishing the question about next existence of worm. Worm can completely remove itself from infected computer. Immediately after execution it copies itself to address space of EXPLORER.EXE and deletes from disk and also removes its data stored in registry. While terminating it also removes itself from memory. Microsoft .NET (MSIL PE) EXE file infection ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ I had an idea the worm should be able to infect MSIL-PE-EXE files. Unlike Donut, my first virus for .NET, it should be able to implant IL code the way normal file viruses infect normal EXE files. Firstly I thought I will have to figure out how metadata are stored and invent some algorithm to work with it. I found out .NET Framework provides complete, relatively well documented interface for compilers (ilasm.exe and csc.exe compilers use it too) that can be (ab)used. It has great advantage - worm does not need to understand details of metadata structures, it just calls proper functions over COM interface. I also thought that easiest way will be just add new section to PE file and inside metadata create reference to IL code stored there, but it could not work. Although the PE file was Ok, CLR environment wasn't able to execute it. MSIL-PE-EXE files have fixed structure and if you will change it a bit, the program won't work. Fortunately I found next interface for linkers which the EXE file generation process makes even more easier than the original idea could. Although the interface ain't documented much (there's almost NO documentation), methods are relatively easy to use and it hadn't taken much time to figure out how to make it working. The result of my reseach work is worm that can extract metadata from original program, implant there new methods (and other needed structures) and generate new EXE file with new metadata. After execution of infected program a worm IL code gets control, creates normal PE EXE file (worm dropper) and executes it. When finished it sets control back to host's IL code so user won't see anything suspicious. Even on disk there won't appear anything because the worm deletes its dropper file after execution (see above). Worm can recursively walk thru all sub-directories on C:\ path and search there for MSIL files. I still can't believe it, but it seems so - it works perfectly! The worm can infect only files that does NOT have strongname (hash), v-table fixups and CLR resource. It can also disable System File Protection under WinXP before modifying a victim file (thnx to Ratter/29A!). As a bonus I created an include file COR.INC which describes all important CLR structures and enables to use CLR functions from inside ASM files. I hope someone will find it useful. E-mail spreading ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Part of worm that handles a spreading is new and original too. At first there is a special way to get list of e-mail addresses - the worm have 3 gens for this stuff. 1st can extract them from MS Outlook address book, 2nd from MS Outlook Express and 3rd can parse all MS Internet Explorer cache and find addresses inside html documents. But the way of spreading is mostly impressing. Serotonin abuses a bug (or feature?) of MS Outlook Express - this mail client allows to include HTML tags, including