programming-for-dummies

Stopping Malware 635
Worms
Similar to viruses are worms. Unlike a virus, a worm doesn’t need to infect a
file to propagate itself. Instead, a worm can duplicate and spread to other
computers all by itself. In the early days of computers, when computers
were isolated from one another, the only way files could spread from one
computer to another was by physically copying a file to a floppy disk and
inserting that floppy disk into another computer. That’s why viruses were so
popular in the early days of computers.
Nowadays, most computers are connected to the Internet, so there’s no
need to infect any files to spread. Instead, worms can spread on their own by
looking for connections to another computer and then copying themselves
over that connection, such as through a group of networked computers.
Here are two steps to protecting a computer against a worm. First, security
professionals must capture a worm and dissect it like a virus to see how the
worm works. After they capture a worm’s digital fingerprint, they can store
this information in an antivirus program’s database so it knows how to recognize
and remove that particular worm.
A second way to guard against worms is to block their access to other computers
over a network. The way computers connect to one another is through
virtual openings, or ports. Worms simply look for open ports on an infected
computer so they can travel out and infect another computer.
Book VII
Chapter 3
The simplest way to block ports on a computer is to use a special program
called a firewall. Firewalls can defeat worms in two ways. First, a firewall can
block a computer’s ports to keep a worm from infecting the computer in the
first place. If the worm has already infected the computer, a firewall can also
block its ports that could allow the worm to sneak out and infect another
computer.
Although you could write your own firewall in your favorite programming
language, it’s much easier just to use an existing firewall program and configure
it properly. Configuring a firewall means defining exactly what the firewall
allows and what the firewall blocks.
Computer Security
On the simplest level, you can tell a firewall to allow certain programs to connect
over the Internet; on a more complicated level, you can configure a firewall
to allow only certain types of data to pass in and out. Allowing certain data to
pass through a firewall, rather than just allowing certain programs, can defeat
both Trojan horses and spyware.