Back in 2003, I can still remember my first experience with peer-to-peer file sharing.

I had downloaded and installed a program called LimeWire on my blue Dell Inspiron 1100.

Suddenly, it felt like a whole world was at my fingertips.

All the CDs I owned, and way more, were now in digital format just waiting to be downloaded.

Of course, back then, downloading a single song could take an hour or more,

but still, there was something magical about it.

One thing that sticks out is how I noticed some song files were way smaller than others.

A typical song back then was around 2-3 megabytes,

but I'd see some files that were just 300 bytes, only a fraction of the size they should have been.

I wondered to myself how that was even possible.

Computers were still relatively new to me at the time, so I figured, why not?

I downloaded one of the smaller files, thinking it'd finish faster, and it did.

Way quicker. I double-clicked to play it, but instead of hearing music, a black window flashed

on my screen, and then... nothing. My stomach dropped. I didn't know exactly what just happened,

but I knew it wasn't good. I took a closer look at the file, and that's when I saw it.

The extension was .exe. Not a song file at all. It wasn't until I came across the Fizzer Worm from

2003 that things started to make a bit more sense. From peer-to-peer file sharing,

to key loggers and back doors, on this episode of In The Shell.

Thank you.

.

has caused this outage.

That it takes you longer to do something

by putting it into a computer and calling it up again

than if you just kept simple records yourself in the house.

Fizzer was first discovered on May 8, 2003

by a company named F-Secure.

They're a global security and privacy company

based out of Helsinki, Finland.

Within a few days, it had also been spotted

by Trend Microsystems and Symantec.

They all classified it as one of those

new hybrid viruses,

and no, I don't mean hybrid like the car.

This worm was pretty advanced for its time.

It had its own emailer,

could randomly create IRC and AOL Instant Messenger bot accounts,

and even had the ability to update itself

by connecting to a GeoCities website.

So if the person behind it needed to fix a bug

or add a new feature,

they could easily push those changes

and all the infected machines would download the updates.

In previous episodes,

I've talked about some other worms.

like Code Red and Sequel Slammer. When those were released, they were pretty static, meaning once

an antivirus rule was created to catch them, that was pretty much the end of the story. They'd be

stopped in their tracks. But with Fizzer, the game changed. The person behind it could actually

update the worm. So once antivirus companies released rules to detect it, the malicious actor

could tweak the worm's signature and push out an update, hoping to stay ahead of the infected

user's computers before they even knew what was happening. Speaking of antivirus, Fizzer also had

another trick up its sleeve. It disabled local antivirus software. So even if you had protection

and the latest rules in place, it didn't matter if your antivirus software was turned off.

And to make matters worse, it installed a keylogger. Now a keylogger records every keystroke you type on

your keyboard. Depending on how long you've been online, you might remember some banking or government

websites.

Fizzer, Fizzer, Fizzer, Fizzer, Fizzer, Fizzer, Fizzer, Fizzer. For the first time, you can see it.

Thank you.

making you use an on-screen software keyboard where you'd click to enter your username and

password. That was an attempt to protect users from keyloggers by avoiding physical keyboards.

It was mostly ineffective, which is why you don't see it around much anymore.

But back to Fizzer's keylogger. It saved all the keystrokes to a file called

iservc.klg inside the Windows folder. Later on, the malicious actor would retrieve that file

and run filters on the data, searching for patterns like username and password combinations,

along with credit card numbers. Compared to worms that came before it,

Fizzer was operating on a whole different level.

Let's dive into some of these specifics. When F-Secure first discovered Fizzer on May 8th,

it was spreading through the Kaza file-sharing network in Asia.

And this is what fascinates me about the worm. It found such a clever way to spread.

Peer-to-peer file sharing is pretty much exactly what it sounds like.

You, as a peer, use software to share files and other peers, whether it's me or someone else or

even the NSA, can download those files. So one person shares a file and other people can download

it. Once they download it, those people also become a source for the file. Instead of just

one peer having the file, now 10 different people might have it. It spreads the load and the bandwidth

so that no one person is bogged down. It's a brilliant, legitimate way to share and spread

information quickly. If you've ever downloaded a torrent, it works on a similar concept.

So what Fizzer did was locate the Kaza shared folder on an infected computer

and copy itself there, giving the file random names. Like I mentioned earlier, you might see

something like metallica-enterthesandman.mp3.exe. Anyone who downloaded that file and executed

it was now infected with a worm.

Many Americans use programs like Kaza to download music.

And you can imagine just how quickly that spread. It's like a spider web expanding,

with the file becoming available for download to anyone using Kaza.

And Fizzer wasn't just creating chaos in Asia, it went global.

People from the US to Europe were all getting infected.

Now keep in mind, back then, bandwidth was in pretty short supply.

Honestly, with my local ISP and their data caps, it feels like they want me to still believe it is.

But I digress.

At the time, limited bandwidth meant these malicious actors were essentially crowdsourcing bandwidth

from infected users, getting them to spread the worm for them.

I think that's just incredibly creative. Terrifying. But creative.

And it wasn't just Kaza. Fizzer also exploited Windows network shares.

You know, those shared folders in corporate environments that had pretty terrible security

back then. And let's be honest.

they often still do. If a machine was infected and it had access to a shared folder on your network,

Fizzer could spread through that too. It didn't care who you were, whether you were a home user

downloading songs or a corporate employee, Fizzer was coming for you. Once you were infected, it

didn't stop there. Besides spreading itself through your Kaza shared folder, Fizzer would also email

itself to everyone in your Outlook address book. Sound familiar to anyone? And it didn't just use

your name as the sender, it spoofed the sender name, picking from a list of 200 different names

the worm had built in. The actual email address it used was generated randomly and often came from

domains like hotmail.com, AOL, and a few others. Fizzer also got a little crafty with the email

subjects to entice people to click. While the body of the email was always in English,

the subject line appeared in three languages, English, French,

and German. Here are a few of the subjects I found particularly interesting.

Damn it feels good to be a gangsta. Yo what's up B. Please discard if you don't like or agree

with our present leadership. See you tomorrow. I wonder what can be so bad that it makes you

want to die. Check this out dot dot dot he he he. You need to lose weight. That last one

is particularly straightforward. As far as social engineering goes some of the email subjects

Fizzer used were pretty awful but others they were actually pretty catchy and I can see how people

would have been tempted to click them. Similar to the sender name the body was also picked from a

predefined list the worm had. Some examples are watching the game having a bud. There is only one

good knowledge and one evil ignorance.

you don't have to if you don't want to. So now that your infected machine has sent the worm to

all your friends, family, and co-workers, let's talk about what happens next. First off, that

keylogger I mentioned earlier is now actively monitoring everything you type. Fizzer also

creates a backdoor for AOL Instant Messenger, also known as AIM. The worm connects to an AIM

server with a random username creating a bot. The person controlling the worm could then establish

a connection to that bot and start controlling your machine remotely by sending commands through

the chat. And just in case the AIM backdoor wasn't working, Fizzer had a backup plan. It also created

an IRC backdoor. IRC, which stands for Internet Relay Chat, is kind of like AIM in that it lets

people chat. But IRC is decentralized and has actually been around a lot longer,

about a decade before AIM even existed. And while AIM is long gone,

IRC is still around. And as if that wasn't enough, Fizzer also listened on four additional ports.

Port 2018, the command port, was used for sending and receiving commands. 2019, file port, was used

for sending and receiving files. 2020, console port, allowed remote control of the system.

And port 2021, video port, was used for capturing video and sending it out.

And to top it all off, Fizzer could even start an HTTP web server on port 81,

giving the attacker even more access to your infected computer.

Now I know we're talking about a worm, something malicious that caused damage and infected users,

but you've got to admit, that's a pretty robust piece of software. I've worked at quite a few

tech companies over the years, and let me tell you, a lot of modern day applications don't even

come close to that level of redundancy.

Thank you.

At this point, Fizzer has sunk its claws deep into your system.

You are at its mercy.

And while it's in there, it kills off a list of processes associated with antivirus programs.

So that fancy software you bought and paid for?

Yeah, completely useless now.

But Fizzer didn't just stop at disabling your antivirus.

Parts of the Worms code were actually encrypted,

which made it even harder for antivirus programs to detect it in the first place.

It was like trying to find a needle in a haystack.

Except the needle was hiding behind a locking key.

But now that I think about it,

a needle in a haystack with a lock would actually be a lot easier to find.

So maybe this isn't the best analogy.

So instead, it would be like trying to find half a needle in a haystack.

So now the Worm is fully in.

It's installed.

It's persistent.

It's always running.

The malicious actor has guaranteed access.

Your antivirus is down for the count.

And if there's any issues with the Worm itself, no worries.

It can auto-

update in the background to make sure it's always running the latest version. Remember how I

mentioned earlier that these updates were downloaded from a GeoCities website? For those who don't

recall, GeoCities was one of those old school web hosting services back in the day. It was like the

MySpace of websites, everyone had one. So the malicious actor would just upload the update to

a GeoCities webpage, and all the infected machines would check in and grab the latest version.

Now despite all this, the actual damage caused by Fizzer was never fully quantified in terms of

dollars. While the worm had the ability to launch DDoS attacks, I couldn't find any references to

any actual documented attacks. It seems the main damage was financial, with people's credentials

and personal information being easily stolen. Fizzer was definitely in a league of its own,

and the methods it used for persistence are still widely used in malware today.

And although the creator of Fizzer is still a mystery, there were

definitely efforts to track them down. Law enforcement agencies and cybersecurity companies

were racing to figure out who was behind it. But it was a different time, and tracking down

malware authors wasn't nearly as advanced as it is today. Though, even now, many still remain a

mystery. The moral of the story? Always check the extension of those music files you download.

Make sure it's mp3 and not exe.

In the Shell is written, researched, and recorded by me, the Sniffer of Packets. If you made it this

far, you either couldn't find the pause button, or you enjoyed the episode. If it's the latter,

then I have a small request. Please click the share button wherever you're listening,

and send this episode to someone you think would enjoy it. I would truly appreciate it.

That's it. Take care, and I'll see you next time.