Computer Worm

A computer worm is a malicious program that replicates itself and in doing so jumps from one device to the next. It requires no human trigger, such as a double-click. The worm independently searches for reachable devices, infects them, and continues searching from there. This is what distinguishes it from a virus: a virus attaches itself to an existing file; a worm is a standalone file that sends itself onward. Its sole purpose can be mere propagation — or it can carry additional malware along with it.

Why worms are particularly dangerous

The danger lies in exponential growth. A worm infects one device, then ten from there, then a thousand from those — all within minutes. In 2003, the worm SQL Slammer brought down hundreds of thousands of servers worldwide in under ten minutes. Banks, airlines, and emergency call systems went down.

Even a worm with no actual payload causes damage. It consumes bandwidth — meaning the transmission capacity of networks — and processing power on every infected device. When millions of devices simultaneously ping each other, the entire network collapses under the load. That is not a side effect — it was precisely the outcome in the case of SQL Slammer.

When a payload is added to the worm, things become more serious. Payload refers to the part of the program that causes the actual damage: encrypting files, stealing passwords, enlisting the device into a botnet. A botnet is a network of externally controlled devices that can be used for further attacks.

How a worm spreads

A worm exploits security vulnerabilities in operating systems or network services. A security vulnerability is a programming flaw that allows an attacker to execute code on a foreign device. The worm sends a specially crafted data packet to a vulnerable device. The device processes the packet, unintentionally executing the worm code in the process — and becomes infected.

Other distribution channels include email attachments and USB drives. Here the worm does require a human step after all, such as opening an attachment. But that is only the initial infection route: once it is on the device, it independently searches for further victims on the network, without requiring the user to act again.

The best-known protection is simple: install software updates as soon as they become available. Most updates close exactly the security vulnerabilities that worms exploit. WannaCry, a worm attack from 2017, affected almost exclusively systems that were missing an already available Windows update. Over 200,000 devices in 150 countries were infected within a few days.

Worms in the news and in products

Worms mainly make headlines when they hit critical infrastructure. WannaCry in 2017 encrypted data in hospitals within the British healthcare system, forcing operations to be postponed. Stuxnet, discovered in 2010, was a worm that specifically sabotaged control systems in Iranian uranium enrichment facilities — a state-developed worm used as a cyberweapon.

In security products such as antivirus software or firewalls, protection against worms is a basic function. A firewall monitors a device’s network traffic and blocks connections that are not explicitly permitted. This makes it harder for a worm to reach new devices on the network.

In everyday life, the term also comes up in IT security training. Anyone working at a company will sooner or later receive mandatory training on phishing and malware. Worms are a standard example there, because they show why a single careless click — or a missing update — can endanger an entire corporate network.