Nicholas Weaver and Vern Paxson, International Computer Science Institute, nweaver@icsi.berkeley.edu vern@icir.org

May 5, 2004

Abstract

Worms represent a substantial economic threat to the U.S.
computing infrastructure. An important question is how
much damage might be caused, as this figure can serve
as a guide to evaluating how much to spend on defenses.
We construct a parameterized worst-case analysis based
on a simple damage model, combined with our understanding
of what an attack could accomplish. Although
our estimates are at best approximations, we speculate
that a plausible worst-case worm could cause $50 billion
or more in direct economic damage by attacking widelyused
services in Microsoft Windows and carrying a highly
destructive payload.

[CLB] Recall the Warhol worm, and all the study done on zero day worms? This paper does not diverge in the basics, merely in quantitive initial assumptions, such as having a small nation state at your disposal. Still, the cost due to worm outbreaks of even a small perentage desicrbed in the paper add up quickly.