Chapter 248 Spread

Edward received a copy of the worm sample in the first place.

Of course, he has no way to get the source code of the worm, only the binary executable version.

However, this does not mean that he reverse engineered and studied these codes, but the difficulty has increased a lot since then. Fortunately, this is the work they often deal with.

Because the process name of the worm is "tree", the name of the worm in the official document is called "tree".

After getting the copy, Edward immediately began to analyze it.

After converting binary files into assembly language, he found that there were great difficulties in reading the source code this time. The code of the tree worm is very long and chaotic. Often after reading the previous piece of code, he must jump to a long distance to continue reading, and then after reading more than ten lines, he has to go back to the front.

He had to look back and forth like a dance. At the same time, he kept recording the real function of the code, guessing what the code wanted to accomplish and what the attack on the span network was for.

At the same time, he also submitted the alert of the worm to the emergency response security center of the span network, warning other colleagues, stating the harm of the worm, because he took advantage of people's panic when they were in trouble.

When people encounter uncontrollable emergencies, they usually lose their original calmness and rationality. At this time, the brain will refuse to think. If there is a stimulus from the outside world, he will involuntarily follow the instructions of the outside world.

This simple principle is often used by fraud groups to carry out fraud. Such incidents occur one after another in the criminal field. It is the simplest and most effective fraud method. Although the forms are very variable, they are essentially the same.

However, it seems to be the first time to appear on the Internet.

There are very important files and data in everyone's computer. Once these data are lost, it will cause unbearable consequences. Therefore, when you turn on the computer and see that the monitor is brushing line by line, and your files are being deleted one by one, you will immediately fall into panic.

When they see the small line of text at the bottom of the display screen, they will immediately follow the content of the text without thinking. Even if someone realizes that their password may be stolen, is there anything more important than saving the files on the disk?

Edward was deeply touched by this, and he also learned about such a situation from many system administrators, so he concluded that the worm was very harmful.

Unfortunately, Edward's alert was released too late.

When the span network security center in other places saw his alarm, their phone had already been blown up. Even the network security center's own computer was found to be infected with this worm.

NASA is the first stop, followed by a similar infection reported by the U.S. Department of Energy. In addition, several scientific research institutions have also seen similar situations sporadically, and the speed is still increasing rapidly.

The tree worm immediately attracted great attention from the span network security emergency center. When they learned about the transmission speed and infection efficiency of the worm, they were shocked.

An emergency team called "anti-tree" was immediately formed. The team was composed of many security experts, including span network security experts from all over the country, as well as computer security engineers from dec.

Although Edward is strictly a network manager, not an official security officer, because he is familiar with the vms system and has a deep research in the field of vms system viruses, he often publishes some of the latest research results in this regard on internal forums, so this time he was also under the team. Theodore, the responsible person, was admitted to the group.

The problem of worm infection is becoming more and more serious, and system administrators from all over the world are constantly calling the anti-tree team to report the latest progress.

The launch mission of the air base has been temporarily cancelled, and an accurate time cannot be given when it can be launched.

The delay was strongly protested by some scientists again, because the explorer's rocket had their scientific research project. They had been waiting for the launch for too long, but it was delayed at the last minute every time.

However, there is no way. Many major computers around NASA are currently completely at a standstill. More and more worms are being overloaded and slower, while the computer experts in the security team still haven't come up with effective solutions.

"Edward, how is the worm analysis going? Have you found anything?" A bald middle-aged man wearing round glasses walked into Edward's office. It was Theodore who was appointed as the leader of the anti-tree group.

This unlucky job made his bare head smoother.

There are no other members here except him and Edward. The other members of the group conduct research in their own places and communicate through regular teleconferences.

Edward is sitting in front of the computer, looking at the dense assembly code in the monitor with his eyes wide open, and constantly adjusting the upper and lower positions of the code with the keyboard to find the corresponding number of lines to read.

"This worm's code is so bad!" Edward sighed, "It's like holding a plate of Italian noodles. When I picked up one and thought it was like this, I found that its tail was still connected to a big ball! The author must have deliberately encrypted the code to prevent it from being cracked. At present, the only thing that can be sure is that this worm has a strong learning function. After collecting everyone's accounts and passwords, it will constantly try to attack computers that have not been cracked, and even make analogy guesses according to the rules of these password accounts in order to infect more computers... This is really bad. It's funny. It's the first time I've encountered such a powerful hybrid worm.

When Theodore heard the news, he looked even worse. NASA officials keep calling and urging them to solve the matter quickly. Because since the outbreak of the worm, they have almost entered a state of information vacuum, and all work must be done manually.

They have to be anxious. NASA has stored too much important valuable information in the span computer. Although this information has not been classified and classified, the information in it is extremely precious. It has taken millions of hours to collect and analyze this information.

For every second, another computer may be infected.

Some system administrators of uninfected span nodes are very panicked. In order not to be infected by other computers on the network, they have disconnected the nodes' network connection, because they are also connected to the computers of many scientific research institutions in their next-level network.

For example, that's what the California Jet Lab does. System administrators are frightened by the worm because it has more than 6,000 employees and has close links with the California Institute of Technology. In order to avoid being implicated, they can only choose to disconnect from the network.

Although this is the case, you may miss the worm patch released by the span network security team, but you have to wait until the patch comes out.

Theodore held a group conference call, hoping that everyone can speed up the analysis and cracking of worms through communication.

However, to his disappointment, other members found nothing useful about it at all.

They may be good at operating computer software or solving some simple algorithm problems, but few people have more in-depth research on the security problems of vms systems.

This is because the vms system rarely has security problems, and the span network center office rarely recruits computer engineers who are proficient in vms security issues.

Even Edward was not a regular employee, but was transferred by Theodore to help.

Therefore, Edward's discovery is the most important discovery.

However, Todd, another engineer who is very familiar with the decnet protocol, finally provided a very uncertain message.

He is good at protocol analysis, so he cares more about the situation when worms send and receive packets to the outside world.

He monitored that the tree worm would send information to the outside world at a certain random time. According to the information packet he intercepted, he analyzed it and found that the information was a fragment of some confidential data in NASA. Therefore, he speculated that the tree worm may have stolen Nasa's confidential information. Everyone was shocked after hearing the news!

That is to say, this worm is not like the virus or worm of the previous computer. It is just a prank made by a talented hacker boy to show his talent. This is a worm that steals confidential information!

Theodore had to report this information to the leaders of Goddard National Space Data Center.

When they held a conference call, the tree worm was spreading out at a very fast speed. Worms have spread beyond NASA's network, and computers in the hepnet have begun to appear.

The U.S. Department of Energy, the U.S. Department of Defense, the FBI, the Department of Education... These important nodes on the span network have been captured one after another.

In these institutions, there are more confidential information, some of which are even highly confidential.

For example, the U.S. Department of Energy has two groups of people, some of which are relatively open. They only conduct civil energy research, while the other part of them are awesome. What they usually study is how to better manufacture and use nuclear energy products such as atomic bombs and hydrogen bombs.

This is not just a matter of NASA.