computer worm

4. Nimda
Iain Thomson: A week after the 11 September atrocities a new virus hit the internet in a big way. Nimda was one of the fastest propagating viruses in history, going from nowhere to become the most common virus online in 22 minutes, according to some reports.

The reason for this speed was that Nimda used every trick in the book to spread itself. It used email, open network shares, IIS vulnerabilities and even web sites to spread. It hit pretty much every version of Windows available and appeared all over the place.

In the paranoid days after the terrorist attack some speculated that this was a digital 11 September, and some security consultants got large speaking fees for suggesting just that. In fact, it was nothing of the sort and was just another attempt at large scale infection.

Shaun Nichols: In the days following the 11 September attacks, everyone was on edge and all types of threats were given plenty of attention. This, in part, helps to explain why Nimda got the attention it did.

Nimda not only played on hype; the worm was also especially virulent due to the sheer number of methods it used to propagate. In addition to spreading via email, Nimda used web site exploits to infect HTML pages and local machine exploits to spread between individual files.

The result was an extremely effective virus circulating at a time when people were more sensitive to all types of threats, both online and offline.

3. MyDoom
Shaun Nichols: Ah yes, the old ‘infect the host then resend to the entire address book’ attack method. Like many other attacks, MyDoom used the tried-and-true practice of spreading through email and address books.

But MyDoom went a step further and targeted peer-to-peer networks. The worm not only spread itself through address books but through the shared folder of users who ran the Kazaa file sharing application.

While definitely skilled programmers, MyDoom’s creators also seemed to be fans of good old-fashioned vigilante justice. One of the early tasks performed by infected users was to take part in a denial-of-service attack against SCO, the infamous software vendor that once tried to lay claim to the patents for Linux.

Iain Thomson: MyDoom was interesting because it was one of the first to use peer to peer as a transmission device, as Shaun notes.

Kazaa was at the peak of its popularity and was causing headaches for Hollywood and the security community. If I had £1 for each time a security expert ranted about the stupidity of using peer-to-peer networks I’d be a rich man. Downloading a file onto your computer from an untrusted source? Madness.

The attack on SCO was also fascinating. SCO was, and to an extent still is, the most hated IT company among users, even more than Microsoft at the time. A worm that attacked a company was something new and raised all sorts of possibilities.