Web Application Worms: Myth or Reality?

A paper which explores a once hypothetical scenario, application worms. These aren't entrely the stuff of fiction, as Santy, a worm that used Google to detect vulnerable sites, and Anti-Santy, another worm which used Google to detect its targets, have both been seen in the wild. Were they faster than Code Red or Slammer? Not really, although that's possibly not the fault of the method. They were, however, easy to detect and stop.

This paper discusses the possibility of automated, self-propagating attacks on custom Web application code. It will show that such attacks are not only feasible but that their theoretical success rate is far greater than worms targeting commercial infrastructure (e.g., Slammer, Code Red, Blaster, Nachi, etc.).

It is the intent of this paper to raise awareness of the threat posed by automated attacks on vulnerabilities that exist in every organization's Web infrastructure. Threats of this type that cannot be avoided by counting on current IPS technologies and the law of large numbers.

Source: Web Application Worms: Myth or Reality?, by Amichai Shulman.