User:ACSlaughter/sandbox
Bagle (also known as Beagle) was a mass-mailing computer worm affecting Microsoft Windows. The first strain, Bagle.A, did not propagate widely. A second variant, Bagle.B, was considerably more virulent.
Overview
[edit]Bagle uses its own SMTP engine to mass-mail itself as an attachment to recipients gathered from the infected computer by combing through all of the computer’s .htm, .html, .txt, and .wab files for any email addresses.[1] It does not mail itself to addresses containing certain strings such as "@hotmail.com", "@msn.com", "@microsoft", "@avp", or “.r1”.[2] Bagle pretends to be a different file type (a 15,872 byte Windows Calculator for Bagle.A and an 11,264 byte audio file for Bagle.B), with a randomized name, and it will then open that file type as a cover for opening its own .exe file.[3][4][1] It copies itself to the Windows system directory (Bagle.A as bbeagle.exe, Bagle.B as au.exe), adds HKCU run keys to the registry, and opens a backdoor on a TCP port (6777 for Bagle.A and 8866 for Bagle.B).[4][1] Using an HTTP GET request, Bagle.B also informs the virus’s programmer that the machine has been successfully infected.[4][5] Bagel variants, including Bagle.A and Bagle.B, generally have a date at which they stop spreading including in their programming.[6] Computers infected with older versions of Bagle are updated when newer ones are released.[7]
History
[edit]The initial strain, Bagle.A, was first sighted on January 18, 2004, seemingly originating in Australia.[1] The original file name for the Bagle virus was beagle, but computer scientists decided to call it bagle instead as a way to spite Bagle’s programmer.[8] Although it started strong with more than 120,000 infected computers, it quickly dwindled in efficacy.[9] Sometimes accompanied by Trojan.Mitglieder.C, it stopped spreading after January 28, 2004, as designed.[9][1]
The second strain, Bagle.B, was first sighted on February 17, 2004.[5] It was much more widespread and appeared in large numbers; Network Associates rated it a "medium" threat. It was designed to stop spreading after February 25, 2004.
At one point in 2004, the Bagle and Netsky viruses exchanged insults and harsh words with each other in their codes, beginning with Bagle.I on March 3, 2004.[6] For example, Bagle.J contained the message “Hey, NetSky, fuck off you bitch, don't ruine our bussiness, wanna start a war?”, and Netsky-R included, "Yes, true, you have understand it. Bagle is a shitty guy, he opens a backdoor and he makes a lot of money. Netsky not, Netsky is Skynet, a good software, Good guys behind it. Believe me, or not. We will release thousands of our Skynet versions, as long as bagle is there ...".[10][11] Additionally, Bagle and Netsky both tried to remove each other from an infected system.[12]
Subsequent variants have later been discovered. By July 26, 2004, there were 35 variants of Bagle, and by April 22, 2005, that number had increased to over 100.[13][6] Although they have not all been successful, a number remain notable threats. Additionally, on July 3 and 4, 2004, Bagle.AD and Bagle.AE were released, with the source code for the virus, written in Assembly, visibly appearing in both of them.[14]
 | This is a user sandbox of ACSlaughter. You can use it for testing or practicing edits. This is not the place where you work on your assigned article for a dashboard.wikiedu.org course. Visit your Dashboard course page and follow the links for your assigned article in the My Articles section. |
References
[edit]- ^ a b c d e Munro, Jary (January 7, 2006). "How to Stop the Spread of Bagel Virus". ABC News. Archived from the original on January 26, 2021. Retrieved April 13, 2021.
- ^ "Email-Worm:W32/Bagle". F-Secure. Archived from the original on January 26, 2021. Retrieved April 13, 2021.
- ^ "Virus Profile: W32/Bagle@MM". McAfee. Archived from the original on January 27, 2008. Retrieved April 13, 2004.
- ^ a b c "February: Eventful horizon". Network Security. 2004 (3): 5–7. 2004-03-01. doi:10.1016/S1353-4858(04)00049-2. ISSN 1353-4858.
- ^ a b Fisher, Dennis (February 17, 2004). "New Bagle Virus Gaining Momentum". eWeek. Retrieved April 13, 2021.
- ^ a b c Mashevsky, Yury (April 22, 2005). "The Bagle botnet". SecureList. Archived from the original on January 19, 2021. Retrieved April 13, 2021.
- ^ Hines, Matt (April 17, 2006). "Spam Attack Keeps Bagle Boiling". eWeek. Retrieved April 13, 2021.
{{cite web}}: CS1 maint: url-status (link) - ^ Husted, Bill (January 21, 2004). "Latest Computer Worm Wreaks Less Havoc in U.S. Than Overseas". Atlanta Journal-Constitution.
- ^ a b Seltzer, Larry (2004-01-21). "Bagle Infection Rate Rolling Down". eWeek. Retrieved 2021-04-13.
- ^ "Virus writers start war of words". Internet Magazine. 118: 10. June 2004 – via Gale.
- ^ "Netsky--R latest in barrage of warring worms". Software World. 35 (3). A.P. Publications Ltd. 2004 – via Gale.
- ^ "Bagle-Netsky Battle Continues with New Players". Computergram International. MarketLine. March 17, 2004 – via Gale.
- ^ Fisher, Dennis (2004-07-26). "Success of Bagle Virus Puzzles Researchers". eWeek. Retrieved 2021-04-13.
- ^ "Would you like source with your Bagle?". Infosecurity Today. 1 (4): 46. 2004-07-01. doi:10.1016/S1742-6847(04)00095-3. ISSN 1742-6847.