View source for Bagle (computer worm)

{{Short description|Computer worm}}
{{Multiple issues|
{{update|date=October 2016}}
{{more citations needed|date=October 2016}}
}}{{Infobox computer virus|fullname=Bagle|aliases=Beagle, Bagle.A, Bagle.B, Bagle.C, Bagle.D, Bagle.J, Bagle.Z|type=[[Computer worm]]|subtype=Trojan|isolation_date=January 18, 2004|filesize=''Varies upon type''}}
'''Bagle''' (also known as Beagle) was a mass-mailing [[computer worm]] affecting [[Microsoft Windows]]. The first strain, '''Bagle.A''', did not propagate widely. A second variant, '''Bagle.B''', was considerably more virulent.

== Overview ==
Bagle used its own [[Smtp|SMTP engine]] to [[Bulk e-mail software|mass-mail]] itself as an attachment to recipients gathered from the infected computer by combing through all of the computer's .htm, .html, .txt, and .wab files for any email addresses.<ref name=":0">{{Cite news|last=Munro|first=Jay|date=2021-01-26|title=How to Stop the Spread of Bagel Virus|work=[[ABC News (United States)|ABC News]]|url=https://abcnews.go.com/Technology/ZDM/story?id=97398&page=1|url-status=live|access-date=2021-04-13|archive-url=https://web.archive.org/web/20210126125341/https://abcnews.go.com/Technology/ZDM/story?id=97398&page=1|archive-date=2021-01-26}}</ref> It does not mail itself to addresses containing certain strings such as "@hotmail.com", "@msn.com", "@microsoft", "@avp", or “.r1”.<ref>{{Cite web|title=Email-Worm:W32/Bagle|url=https://www.f-secure.com/v-descs/bagle.shtml|url-status=live|archive-url=https://web.archive.org/web/20210126030855/https://www.f-secure.com/v-descs/bagle.shtml|archive-date=2021-01-26|access-date=2021-04-13|website=[[F-Secure]]}}</ref> Bagle pretends to be a different file type (a 15,872 byte Windows Calculator for Bagle.A and an 11,264 byte audio file for Bagle.B), with a randomized name, and it will then open that file type as a cover for opening its own [[.exe|.exe file]].<ref>{{Cite web|title=Virus Profile: W32/Bagle@MM|url=http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100965|url-status=dead|archive-url=https://web.archive.org/web/20080127150353/http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100965|archive-date=2008-01-27|access-date=2021-04-13|website=[[McAfee]]}}</ref><ref name=":1">{{Cite journal|date=March 2004|title=February|url=https://linkinghub.elsevier.com/retrieve/pii/S1353485804000492|journal=Network Security|language=en|volume=2004|issue=3|pages=5–7|doi=10.1016/S1353-4858(04)00049-2|url-access=subscription}}</ref><ref name=":0" /> It copies itself to the Windows system directory (Bagle.A as {{mono|bbeagle.exe}}, Bagle.B as {{mono|au.exe}}), adds [[HKCU|HKCU run keys]] to the registry, and opens a [[Backdoor (computing)|backdoor]] on a TCP port (6777 for Bagle.A and 8866 for Bagle.B).<ref name=":1" /><ref name=":0" /> Using an [[HTTP GET]] request, Bagle.B also informs the virus's programmer that the machine has been successfully infected.<ref name=":1" /><ref name=":2">{{Cite news|last=Fisher|first=Dennis|date=2004-02-17|title=New Bagle Virus Gaining Momentum|work=[[eWeek]]|url=https://www.eweek.com/security/new-bagle-virus-gaining-momentum/|access-date=2021-04-13}}{{Dead link|date=June 2022 |bot=InternetArchiveBot |fix-attempted=yes }}</ref> Bagle variants, including Bagle.A and Bagle.B, generally have a date at which they stop spreading included in their programming.<ref name="securelist" /> Computers infected with older versions of Bagle are updated when newer ones are released.<ref>{{Cite news|last=Hines|first=Matt|date=2006-04-17|title=Spam Attack Keeps Bagle Boiling|work=[[eWeek]]|url=https://www.eweek.com/security/spam-attack-keeps-bagle-boiling|access-date=2021-04-13}}</ref>

== History ==
The initial strain, Bagle.A, was first sighted on January 18, 2004, seemingly originating in Australia.<ref name=":0" /> The original file name for the Bagle virus was Beagle, but computer scientists decided to call it Bagle instead as a way to spite Bagle's programmer.<ref>{{Cite news|last=Husted|first=Bill|date=2004-01-21|title=Latest Computer Worm Wreaks Less Havoc in U.S. Than Overseas|work=[[Atlanta Journal-Constitution]]}}</ref> Although it started strong with more than 120,000 infected computers, it quickly dwindled in efficacy.<ref name=":3">{{Cite news|last=Seltzer|first=Larry|date=2004-01-21|title=Bagle Infection Rate Rolling Down|work=[[eWeek]]|url=https://www.eweek.com/security/bagle-infection-rate-rolling-down/|access-date=2021-04-13}}</ref> Sometimes accompanied by Trojan.Mitglieder.C, it stopped spreading after January 28, 2004, as designed.<ref name=":3" /><ref name=":0" />

The second strain, Bagle.B, was first sighted on February 17, 2004.<ref name=":2" /> It was much more widespread and appeared in large numbers; [[Network Associates]] rated it a "medium" threat. It was designed to stop spreading after February 25, 2004.

At one point in 2004, the Bagle and [[Netsky (computer worm)|Netsky]] viruses exchanged insults and harsh words with each other in their codes, beginning with Bagle.I on March 3, 2004.<ref name="securelist" /> Notably, Bagle.J contained the message “Hey, NetSky, fuck off you bitch, don't ruine our bussiness, wanna start a war?”, and Netsky-R included, "Yes, true, you have understand it. Bagle is a shitty guy, he opens a backdoor and he makes a lot of money. Netsky not, Netsky is Skynet, a good software, Good guys behind it. Believe me, or not. We will release thousands of our Skynet versions, as long as bagle is there ...".<ref>{{Cite journal|date=2004|title=Virus writers start war of words|journal=[[Internet Magazine]]|volume=118|pages=10|via=Gale}}</ref><ref>{{Cite journal|date=2004|title=Netsky--R latest in barrage of warring worms|journal=[[Software World]]|volume=35|issue=3|via=Gale}}</ref> Additionally, Bagle and Netsky both tried to remove each other from an infected system.<ref>{{Cite journal|date=2004-03-17|title=Bagle-Netsky Battle Continues with New Players|journal=[[Computergram International]]|publisher=[[MarketLine]]|via=Gale}}</ref>

Subsequent variants have later been discovered.  By July 26, 2004, there were 35 variants of Bagle, and by April 22, 2005, that number had increased to over 100.<ref>{{Cite news|last=Fisher|first=Dennis|date=2004-07-26|title=Success of Bagle Virus Puzzles Researchers|work=[[eWeek]]|url=https://www.eweek.com/security/success-of-bagle-virus-puzzles-researchers/|access-date=2021-04-13}}</ref><ref name="securelist" /> Although they have not all been successful, a number remain notable threats. Additionally, on July 3 and 4, 2004, Bagle.AD and Bagle.AE were released, with the source code for the virus, written in [[Assembly language|Assembly]], visibly appearing in both of them.<ref>{{Cite journal|date=2004-07-01|title=Would you like source with your Bagle?|url=https://www.sciencedirect.com/science/article/abs/pii/S1742684704000953|journal=Infosecurity Today|language=en|volume=1|issue=4|pages=46|doi=10.1016/S1742-6847(04)00095-3|issn=1742-6847|url-access=subscription}}</ref>

Some of these variants contain the following text: 
     "Greetz to antivirus companies
      In a difficult world, 
      In a nameless time, 
      I want to survive, 
      So, you will be mine!! 
      -- Bagle Author, 29.04.04, Germany."
This has led some to believe that the worm originated in Germany.

Since 2004, the threat risk from these variants has been changed to "low" due to decreased prevalence. However, Windows users are warned to watch out for it.

==Botnet==

The Bagle botnet (Initial discovery early 2004<ref name="securelist">{{cite web|last=Mashevsky|first=Yury|date=2005-04-22|title=The Bagle botnet|url=http://www.securelist.com/en/analysis/162656090/The_Bagle_botnet|url-status=live|archive-url=https://web.archive.org/web/20210119234042/https://securelist.com/the-bagle-botnet/36046/|archive-date=2021-01-19|access-date=2010-07-30|publisher=Securelist}}</ref><ref name="m86security">{{cite web|date=2009-06-04|title=A Little Spam With Your Bagle?|url=http://www.m86security.com/labs/i/A-Little-Spam-With-Your-Bagle-,trace.999~.asp|url-status=dead|archive-url=https://web.archive.org/web/20120312011339/http://www.m86security.com/labs/i/A-Little-Spam-With-Your-Bagle-,trace.999~.asp|archive-date=2012-03-12|access-date=2010-07-30|publisher=M86 Security}}</ref>), also known by its aliases '''Beagle''', '''Mitglieder''' and '''Lodeight''',<ref name="m86aliases">{{cite web|date=2009-06-17|title=Bagle|url=http://www.m86security.com/labs/spambotitem.asp?article=938|url-status=dead|archive-url=https://web.archive.org/web/20110101164932/http://www.m86security.com/labs/spambotitem.asp?article=938|archive-date=2011-01-01|access-date=2010-07-30|publisher=[[M86 Security]]}}</ref> is a [[botnet]] mostly involved in proxy-to-relay [[e-mail spam]].

The Bagle botnet consists of an estimated 150,000-230,000<ref name=messagelabs>http://www.messagelabs.com/mlireport/MLI_2010_04_Apr_FINAL_EN.pdf{{dead link|date=July 2017 |bot=InternetArchiveBot |fix-attempted=yes }}</ref> computers infected with the Bagle [[Computer worm]]. It was estimated that the botnet was responsible for about 10.39% of the worldwide spam volume on December 29, 2009, with a surge up to 14% on New Year's Day,<ref>{{cite web|author=Dan Raywood |url=http://www.scmagazineuk.com/new-botnet-threats-emerge-in-the-new-year-from-lethic-and-bagle/article/160999/ |title=New botnet threats emerge in the New Year from Lethic and Bagle |magazine=SC Magazine UK |access-date=2010-07-30}}</ref> though the actual percentage seems to rise and drop rapidly.<ref name="darkreading">{{cite web|last=Raywood|first=Dan|date=2010-01-11|title=New Spamming Botnet On The Rise|url=http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=221600694|url-status=dead|archive-url=https://web.archive.org/web/20160808014046/http://www.scmagazineuk.com/new-botnet-threats-emerge-in-the-new-year-from-lethic-and-bagle/article/160999/|archive-date=2016-08-08|access-date=2010-07-30|website=[[SC Magazine]]|publisher=DarkReading}}</ref> As of April 2010 it is estimated that the botnet sends roughly 5.7 billion spam messages a day, or about 4.3% of the global spam volume.<ref name=messagelabs/>

== See also ==
{{columns-list|colwidth=18em|
* [[Zombie (computer science)]]
* [[Netsky (computer worm)]]
* [[Botnet]]
* [[Malware]]
* [[E-mail spam]]
* [[Internet crime]]
* [[Internet security]]
* [[McColo]]
* [[Operation: Bot Roast]]
* [[Srizbi botnet]]
* [[Alureon]]
* [[Conficker]]
* [[Gameover ZeuS]]
* [[Storm botnet]]
* [[Rustock botnet]]
* [[ZeroAccess botnet]]
* [[Regin (malware)]]
* [[Zeus (malware)]]
}}

== References ==
{{reflist|2}}

{{Botnets}}
{{Hacking in the 2000s}}

[[Category:Distributed computing projects]]
[[Category:Spamming]]
[[Category:Botnets]]
[[Category:Email worms]]
[[Category:Hacking in the 2000s]]
[[Category:2004 in computing]]