Slashdot Log In
'Friendly' Worms Could Spread Software Fixes
Posted by
Zonk
on Thu Feb 14, 2008 03:54 PM
from the perfect-way-to-make-a-rogue-ai dept.
from the perfect-way-to-make-a-rogue-ai dept.
An anonymous reader writes "Microsoft researchers are working out the perfect strategies for worms to spread through networks. Their goal is to distribute software patches and other friendly information via virus, reducing load on servers. This raises the prospect of worm races — deploying a whitehat worm to spread a fix faster than a new attacking worm can reach vulnerable machines."
Related Stories
Submission: MS researchers designing the "perfect worm" by Anonymous Coward
[+]
Why Old SQL Worms Won't Die 64 comments
narramissic writes "In a recent ITworld article, Security researcher Brent Huston ponders how it is that versions of SQL worms dating back to 2002 represent nearly 70% of all malicious traffic on the Internet today. 'I have made a few attempts to backtrack hosts that perform the scans and at first blush many show the signs of common botnet infections. Most are not running exposed SQL themselves, so that means that the code has likely been implemented into many bot-net exploitation frameworks. Perhaps the bot masters have the idea that when they infiltrate a commercial network, the SQL exploits will be available and useful to them? My assessment team says this is pretty true. Even today, they find blank "sa" passwords and other age-old SQL issues inside major corporate clients. So perhaps, that is why these old exploits continue to thrive."
[+]
Kraken Infiltration Revives "Friendly Worm" Debate 240 comments
Anonymous Stallion writes "Two security researchers from TippingPoint (sponsor of the recent CanSecWest hacking contest) were able to infiltrate the Kraken botnet, which surpasses its predecessors in size. The researchers have published a pair of blog entries: Owning Kraken Zombies and Kraken Botnet Infiltration. They dissect the botnet and go so far as to suggest that they could cleanse it by sending an update to infected hosts. However, they stopped short of doing so. This raises the old moral dilemma about a hypothetical 'friendly worm' that issues software fixes (except that the researchers' vector is a server that can be turned off, not an autonomous worm that can't be recalled once released). What do you think — is it better to allow the botnet to continue unabated, or perhaps to risk crashing a computer controlling a heart monitor somewhere?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Prior Art (Score:5, Informative)
Re:Prior Art (Score:5, Insightful)
Parent
Re:Prior Art (Score:5, Informative)
And still being used occasionally. The most recent one I recall is Welchia [wikipedia.org] which used the same RPC exploit as Blaster but tried to help the user by installing patches to prevent further use of the exploit.
It's an interesting idea, but still causes some of the big collateral problems that worms cause. Welchia brought university and corporate networks to their knees because of high traffic just as well as Blaster did - perhaps even moreso since it was also doing a lot of HTTP requests to Microsoft's servers. I think a better solution would be a more surefire way to make sure users get patched when such a critical vulnerability is found. That's the ironic part of the Blaster/Welchia RPC exploit, there was a patch available for months before the worm was released.
Parent
Re:Prior Art (Score:5, Interesting)
You could program the worm to spread based on a random calculation, and assign it a threshold so the traffic isn't excessive. This would give the worm a very low probability to survive.
However, a better approach IMO would be to get rid of all the Genuine Advantage and activation crack, and allow boxes using old and famous activation keys (such as the "devil's own") to get updated with Windows Update.
Parent
Re:Prior Art (Score:4, Funny)
Parent
Re:Prior Art (Score:5, Funny)
DUH. That's why my Norton Antivirus lights up when I click on those helpful "GET RID OF SPYWARE" ads?
Parent
Bad idea (Score:3, Insightful)
Re: (Score:3, Interesting)
Unfortunately, without the infrastructure in place, it's going to be much harder to ensure that nothing goes wrong.
Re: (Score:3, Funny)
Re:Prior Art (Score:5, Funny)
We can survive salt water, high EMP fields, and power outages. A computer can't handle carpet.
My money's always going to be on the meatbags.
Parent
Re:Prior Art (Score:5, Funny)
- Chapek 9 robot general
Parent
This one is different. (Score:5, Insightful)
Parent
Re:This one is different. (Score:5, Funny)
Or, even better, a way to send requests to the same domain name to physically different servers...
I think I may be on to something here.
Parent
Re: (Score:3, Funny)
Then again, it'll never catch on. Who's ever gonna download more than 2mb anyway? The tubes would get clogged!
It's OK, Comcast will block it.
Re:This one is different. (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Did you pay any attention to the last 30 years or so of cryptography [wikipedia.org]? Any peer-to-peer patch distribution system would use digital signatures that are difficult to fake. The corresponding public keys would be distributed with the OS install or through some other secure mechanism (SSL from the main update site or similar). Any attacker that can install their own key could install a worm through that route anyway.
P2P is quite good at solving intermittent high demand distribution problems, and is quite we
Re: (Score:3, Informative)
Modern p2p protocols use cryptography (usually secure hashes, but cryptographically signed data also works) to verify that what you downloaded is authentic.
In the case of secure hashes, you only have to trust that you got the hash value from a trusted source. In other words, you have to trust the original distributor as well as any intermediate distibutor that provides the hash.
With signed data you don't even have to trust any intermediate distributor. The data
Honestly! (Score:2)
The thing is, now we can "Let" access come from a good worm, and deny access from a good worm. Also, we now have the tech to have the good worm live a lifespan, for instance, terminating itself on a timer or home connection count, etc such as to reduce the potential hole it leaves open. Or it could be a "signed" worm.
It's definately an old Idea, but one that we now have a way to make it P2P.
So, what... (Score:2)
Re: (Score:2)
I couldn't find a wikipedia link to cover this idea, but uncyclopedia [uncyclopedia.org] has one.
-mcgrew
A viral implementation of Windows Update? (Score:5, Funny)
Re:A viral implementation of Windows Update? (Score:4, Insightful)
Parent
Annnndddd... (Score:5, Insightful)
Re:Annnndddd... Well, these worm (Score:5, Funny)
Parent
Re:Annnndddd... (Score:5, Insightful)
That's right, none. There's your clue.
Parent
This is an old idea (Score:5, Insightful)
If you use a tool like this on your own network, fine, but if I find it on my own you had better cover your tracks because I'll go ballistic.
Re: (Score:2)
Re: (Score:2, Interesting)
What's more, it'll make one hell of a fun class action suit.
If they had any sense, MS would nip this one in the bud...but then, they're the ones who gave us Windows Me, so...
not exactly (Score:5, Insightful)
If I'm not mistaken according to Micro Soft's EULA you don't actually own the software they do. They are just giving you permission to use it. Though you do own the hardware the worm in question would only affect or change the Soft Ware. In addition you neither own your network connection or most likely the building you live in ( dorm, apartment, mortgaged home etc) so from a purly legal stand point you have no leg to stand on. Though I do completely understand and support the meaning behind yrou rant
Parent
Re: (Score:3, Insightful)
Now, I keep asking this question about EULAS: tell me, now. Mike buys a naked, no OS computer and a boxed set of Windows Vista Home, and asks me to install it for him. If I'm the one who agrees to the EULA, how is he legally held to that EULA? He didn't agree to anything, I did. And unless he's signed "power of attorney" to me, well?
What if his ten year old child (or neighbor kid) installs it?
What if it's already instal
Re:not exactly (Score:4, Informative)
3. RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in this EULA. The Software is protected by copyright and other intellectual property laws and treaties. Microsoft or its suppliers own the title, copyright, and other intellectual property rights in the Software. The Software is licensed, not sold.
http://www.microsoft.com/windowsxp/home/eula.mspx [microsoft.com]
Parent
My Tin foil hat part of my brain says... (Score:2, Redundant)
Just what we need... (Score:2, Insightful)
Caused Issues the last time someone tried it.. (Score:5, Insightful)
I guess this goes with all of the tags we've seen today on articles of "whatcouldpossiblygowrong?".
3-2-1 tagged "whatcouldpossiblygowrong" (Score:3, Insightful)
I can hear it already... (Score:5, Funny)
Tier1 Customer Support: Ok sir, I'd be happy to help you with that. Firstly, do you have the latest Microsoft Virus(tm) installed?
Customer: Yes.
Tier1 Customer Support: OK, do you have an Antivirus installed?
Customer: Yes.
Tier1 Customer Support: Ah, that's the problem. You'll need to remove the Antivirus in order for the Virus to function correctly. It's not safe these days to be running without the latest Virii!
NO shortage of worms (Score:2)
Stupid Idea (Score:4, Interesting)
The temptation if this became a strategy, i.e. the system can run Microsoft Worms only, would in a very short time, run Microsoft like worms.
This seems more like and admission that their systems can't be secured.
Or "Who's finger is in the dike? Dammit, thats not my dike!"
But Just hope.... (Score:2)
Thought of doing this once (Score:2)
Funny (Score:2)
Planned it All Along (Score:2)
Legality (Score:2)
IANAL but it's interesting that they are conducting this research in England, at the very least this would require a change in the EULA that MSFT could be deemed an "authorised user" of the computer, from the Computer Misuse Act 1990 [hmso.gov.uk]:
Worm Wars! (Score:2)
At one point, I liked this idea.... (Score:4, Interesting)
Extremely bad idea (Score:3, Insightful)
What about all the security admins who filter traffic based on pattern matches and ports? So now when we see a spike in traffic from thousands of machines going to 1433 on successive IP's we're supposed to somehow make a diagnosis on whether it's good or bad traffic? It's unnecessary overhead on the network. Whatever it's intention, auto fixing of problems and specifically designed auto replicating extra internet traffic is a bad idea.
nothing to see here... (Score:4, Informative)
Brandon Wiley proposed a scenario in which a future internet would be consumed by the warfare between several (black or white) worms that feature node-coordinated efforts to prevent detection and removal. For those too lazy to read the link, "Curious Yellow" is basically a modular worm in which zero-day exploits can be added as they are discovered allowing for unchecked growth across the 'net. The worm can then work with other nodes to attack targets by dropping all their traffic, or by subtly modified whatever they receive. The best way to fight such a worm is with fire, a similarly designed "white" worm that goes around patching hosts as quickly as it can.
IMO, remote exploits are rare enough that I don't see this ever happening. On the other hand, with enough infected bot nodes to work with the data mining potentials of some of the more sophisticated extant work networks does worry me...
Oh yah, that'll work. (Score:4, Insightful)
http://blogs.msdn.com/ie/archive/2007/12/18/post-install-issues-with-ms07-069-ie6-on-xpsp2.aspx [msdn.com]
(Among others) That they'll be a perfect candidate to create this type.
For that matter, I'd really like to know how someone/people who might do this, would get around that whole illegal thing.
This BS creeps up time and again.... (Score:4, Insightful)
Anybody proposing this nonsense just shows they do not even have elementary security knowledge and did not research the topic at all. Incompetents.
I can't wait... (Score:5, Funny)
Yay Microsoft! They have such good instincts when it comes to security!