3

I've been researching LAN recently, and I came across a post talking about viruses spreading over LAN, and I was wondering, how is this possible? Would it not be a huge security issue to allow files to automatically be installed over LAN?

1
3

Here are some ways using which computer worms can spread over a LAN:

  • Exploiting vulnerabilities: The number one method is exploiting a vulnerability in the operating system or an installed software. The worm starts launching exploits from patient zero in your network against other computers hoping that they don't have the latest patches/updates installed. Using those exploits, the worm can execute shellcode on the target machine and get it to download and execute a version of the worm itself.

  • Weak passwords: The worm will usually try to launch dictionary attacks on other machines on the network in order to find the correct credentials and use them to certain commands on a, albeit patched, the target machine. On Windows, this is possible using the admin shares.

  • Insecure configurations: One prominent example is using openly-shared folders. The worm can simply copy itself into the shared folder on another machine using some attractive name/icon like CounterStrike-Source_Installer.exe on computers connected at a LAN party.

  • Email: As the other methods, this method isn't specific to LANs and it is actively used to infect corporate networks. The worm will read the address book on the infected machine and starts sending carefully-written emails trying to convince as many people to click on a link and install a software (Example: Impersonating the IT department and asking the employees to install a custom Flash Player update, which is in fact a version of the worm itself), or to download and execute some attachment, etc.

1

There is a difference between a Worm and a Virus. The latter is more of an opportunistic piece of code that copies itself, but it usually requires that a user does something to help or aid the process. A Worm, on the other hand is much more pro-active. It is an independent programme, that will attempt to spread and run itself on other machines. It normally does so by exploiting some sort of vulnerability, in a sense it's an 'automated hacker' who breaks into another machine copies the algorithm there and runs it.

This line of course is rather abstract, since e-mail viruses are for all practical purposes really worms, since they will initiate their spread themselves, and only require the small 'help' from the user who runs the attachment.

As to how Worms do that, will depend on which particular worm you are talking about. If you want a general overview without details read 'Computer worm' article on Wikipedia.

Not the answer you're looking for? Browse other questions tagged or ask your own question.