[gharibah]

want to ask a question :-

Are there network worms which leave their signatures in the source of the web page?

In other words,
Can we detect a worm by analysing the web-page (by trying to find the worm signature in the source of the webpage)?

In other words,
Can an intrusion prevention system identify worms by analysing the web pages?

In plain words,
If you open an infected webpage (by notepad), can you find a worm signature in it?

I hobe to get an answer.

Any help is greatly appreciated.

[RudiVisser]

Worm? What type of worm?

A virus that acts as a proxy between you and a website?

There's a million different types of "worms" so if this is true for one, it probably won't be true for another. The only way you're going to find this out is from your own research on your own "worms".

[firebolt]

Thats why they invented encryption.

[gharibah]

MageUK, on 1 Jul, 2009 - 03:44 AM, said:

Worm? What type of worm?

A virus that acts as a proxy between you and a website?

There's a million different types of "worms" so if this is true for one, it probably won't be true for another. The only way you're going to find this out is from your own research on your own "worms".

I ask about internet worms.

firebolt, on 1 Jul, 2009 - 04:07 AM, said:

Thats why they invented encryption.

please, explain.

[RudiVisser]

What type of internet worm??? According to some definitions, advertisements are internet "worms" as they store a million cookies on your computer.

Give us an example, or just take a look for yourself, download a page without a "worm" and then "install" (or whatever you'd do) the "worm" and check it again. Simples!

[gharibah]

MageUK, on 1 Jul, 2009 - 06:54 AM, said:

What type of internet worm??? According to some definitions, advertisements are internet "worms" as they store a million cookies on your computer.

Give us an example, or just take a look for yourself, download a page without a "worm" and then "install" (or whatever you'd do) the "worm" and check it again. Simples!

This is a good suggestion; but I don't have a worm sample that I can install or run on my computer.
If you have one please post it (if you have a link, remember to post it as a text not as an active link to avoid infecting others).

It is prefered to be one of the following worm:-
CodeRed worm
CodeGreen worm
Nimda worm
Santy worm
Samy worm
Sql slammer worm
Beagle worm
Sasser worm
Bugbear worm

Thanks very much.

[RudiVisser]

Okay well one that I recognised was the sasser virus, and that doesn't touch web pages.

What exactly are you trying to do with this? Just wondering.

[gharibah]

I'm asked to give an approve or counterapprove about weather the internet worms can be detected by analysing the web-pages.
This is what I said in the first post.

I Preferred the above worms specifically beacause I know their signatures (I found them by searching on google).

What exactly I wanted to do is to run the worm and search for its signature in the web page (i.e the HTML code of the webpage).

I have another way, if i knew an infected webpage, I can search for a worm signature on it; but still I don't have a webpage that I'm sure it is infected with a specific worm.

[RudiVisser]

Hmm, but it's very rare that a computer capable of getting a worm (ie. non-server systems, since they should be locked down) would be hosting a website anyway, so I'm still not sure I understand what you're trying to acheive from it.

[gharibah]

really, I don't understand your tention!!!

I want to say that I'm a beginner and have little information a bout web develpment and almost no information a bout worm or virus programming; otherwise I wouldn't come here and ask a question like this.

Anyway,
Thanks for your help.

[RudiVisser]

There is no tension... I just don't have a clue what you're trying to do.

You said you wanted to detect signature of worms?? But if you don't even know if they leave signatures, why??

[no2pencil]

gharibah, on 1 Jul, 2009 - 09:55 AM, said:

I'm asked to give an approve or counterapprove about weather the internet worms can be detected by analysing the web-pages.

I thin that what you are describing is Adware/Spyware. Adware/Spyware runs on a website & gathers information about the viewers, through malicious cookies or malicious applications.

A worm would bounce from IP to IP collecting data on users of subnets across the internet, & return that data to a source, & would act independent of a website.

A virus would be like the worm, except that it copies itself to the machines.

Viruses are programs that self replicate
Worms gather data
Spyware & Adware target 1 person for advertisement or data collecting

Know your terminology

[CamoDeveloper]

Our company once got attacked by a virus that would intercept the post from a forum to update content on the page and interject a javascript routine that wrote out a path to an IP address with a folder containing a virus file. It was pretty neat seeing how it worked but was kind of easy to find out where the file location was since the creator wrote the IP address in ASCII characters. It turns out that one of our clients had it on their machine and when we would go to the clients sites to view our updates it attached it to our machines.

One way of seeing if a website has Adware/Spyware is knowing how your site works. If it takes longer than normal for the site to load a page, submit a form, or anything else than normal then view the source. That's how we found the virus that attacked us.

Hope this can clear up any confusion.

~Camo