Patent Application
20080091817
These and other features and advantages will be better and more completely understood by reference to the following detailed description of exemplary illustrative embodiments in conjunction with the drawings, of which:
Referring now more particularly to the drawings in which like reference numerals indicate like parts throughout the several views,
More particularly, the worms may be intentionally implanted on servers by cooperating media groups. For example, a media group that is cooperative that typically receives messages from terrorist groups may allow the worms to be implanted on its server(s). However, worms may be surreptitiously implanted on the server(s) of media groups that are not cooperative. The worms may be small in size and difficult to detect, thus reducing the ease with which the media group and/or the terrorist group could detect the worm residing on a server or as being transmitted to the client device.
The worms need not be stored on every server. Indeed, it probably would be impossible to transmit the worm to every server with an Internet connection. Rather, known facilitators and attractive media channels make good candidates for worm implantation. Furthermore, it may even be possible to develop a site that is particularly attractive to terrorists seeking to transmit a message. Opening up channels that are particularly attractive to unscrupulous sources has been known to work, for example, in identifying, tracking, and stopping mail-bombers, spammers, etc. These techniques thus could be extended to make certain new or existing sites attractive to terrorist groups and to facilitate the transmission of worms by, for example, making it appear that there no username/password combination is required, usage logs are not kept, etc.
In certain example embodiments, the worms may be transmitted to all devices connecting to a server device having a worm. Alternatively, in certain other example embodiments, the worms may be transmitted to only those devices that meet a certain profile. For example, such worms need not be transmitted to the casual reader of CNN.com. Similarly, they may be targeted to IP addresses that originate and/or pass through a known gateway (e.g. a gateway in Iraq, a known portal for terrorist communiques, etc.).
The worm may be transmitted to the client device in a number of different ways. The following list of vulnerabilities should be taken by way of example and without limitation. It will be appreciated that other techniques may be used in place of, in addition to, the following list as new vulnerabilities are discovered and new patches are made available. Also, it may be advantageous to use more than one technique, as different systems will have vulnerabilities by virtue of, for example, the hardware, software, updates, etc. As one example, then, the worm may exploit one or more known vulnerabilities of a system and/or the software running thereon. On Unix and Linux machines, for example, vulnerabilities may exist in print and email server components of the kernel. On Windows machines, it may be possible to cause buffer overflows, cause email messages and/or ActiveX controls to be automatically received and executed, etc. In another example, the worm may be transmitted as one or more additional packets, or as parts of multiple packets transmitted to the client device 112.
In certain other example embodiments, one or more programs may be distributed such that they make the system amenable to the worms by functioning, for example, as backdoors, Trojans, or the like. Such functionality may be embedded, for example, in emailing programs, web browsers, ftp clients, etc. Widely distributed operating systems also may be modified to make the system amenable to attack.
Once a worm 200 is transmitted to a client device 112, it may cause an identification and/or location signal to be emitted from the client device 112. If the client device 112 is equipped with a GPS device, the exact coordinates may be transmitted via a web, email connection, or other suitable connection. Other information may include, for example, information identifying the computer with a predetermined degree of specificity (e.g. processor serial number, embedded ID numbers, particular components, etc.), the IP address of the connection, the route through which the transmissions are passing, etc.
In certain example embodiments, if the client device is equipped with a wireless transmitter, a homing or identifying signal may be produced, indicating that the client device was used to transmit a message.
In certain example embodiments of this invention, the receivers 302 are located in monitored areas such as airports, train stations, bus stations, etc. because of the large number of people who pass through the same. Thus, when the monitoring receivers are located in such locations, it is possible to locate terrorists (or terrorist computers) which pass through such areas, even if the signal transmitted from the client device 112 is a low-powered signal which is not transmitted a great distance.
In certain example embodiments, the wireless transmitter 300 of the mobile device 112 may emit a homing signal that may be picked up irrespective of whether the mobile device 112 is within a predefined monitored area. Thus, the user of the client device 112 may be located (e.g. by tracing the signal to its source, triangulation, etc.) and apprehended.
The above-described signals may be transmitted at a certain frequency, bandwidth, channel, etc. to serve as unique identifiers. Alternatively, the signals may be processed along common and/or active channels to appear merely as background noise. Moreover, they may incorporate certain predefined information, as described above.
Although the example embodiments herein have been described as relating to a worm, the present invention is not so limited. In particular, the term “worm” should be construed broadly to cover any software program capable of reproducing itself that can spread from one computer to the next over a network connection, or any module that can take advantage of file sending and receiving features found on computers and computerized systems. As used herein, the worm may comprise a series of executable codes, either in compiled form or suitable for interpretation and/or execution without having to be compiled. Thus, the worm may be a stand-alone program or simply a series of codes configured to cause one or more other programs and/or system resources to behave in a particular fashion.
Furthermore, although certain example embodiments have been described as relating to Internet and/or web connections, the present invention is not so limited. The example embodiments may be implemented on computer systems communicating over any computer-mediated network protocol. Also, the example embodiments may apply to more than the uploading, emailing, etc. of media. For example, they may be applicable whenever a terrorist-related website, email server, etc. is accessed.
While the invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not to be limited to the disclosed embodiment, but on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.
