Slashdot Log In
A Cheap, Distributed Zero-Day Defense?
Posted by
CmdrTaco
on Wed Jan 14, 2009 01:14 PM
from the yeah-that-won't-get-gamed dept.
from the yeah-that-won't-get-gamed dept.
coondoggie writes "Shutting down zero-day computer attacks could be carried out inexpensively by peer-to-peer software that shares information about anomalous behavior, say researchers at the University of California at Davis.The software would interact with existing personal firewalls and intrusion detection systems to gather data about anomalous behavior, says Senthil Cheetancheri, the lead researcher on the project he undertook as a grad student at UC Davis from 2004 to 2007. He now works for SonicWall."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Wow... (Score:5, Insightful)
If you could break into that process, you could rule the world.
My first thought too (Score:5, Insightful)
Who watches the watchers?
Any system like this would be a premium cracker target. All it would take is one false positive or false negative before no one would trust it again.
Six months later, some other researcher would make a new proposal for a p2p system to guard the broken p2p system.
Parent
Re: (Score:2)
Obviously the entire point of doing it p2p is to speed up distribution, but that doesn't mean the fixes couldn't go through some kind of verification process before being flagged as safe and useful fixes.
Seems to work out pretty well for Blizzard updates.
Re: (Score:2)
Yes, theoretically, it could. In practice, the argument only holds against Windows and MS Office update (maybe also Firefox), since the others have a very high diversity.
Re: (Score:3, Interesting)
Re: (Score:2)
This is the first thing I thought as well. Find a way to compromise systems and rather than do your usual dirty work, just get them all to report that the legitimate, "Secure" devices are the ones causing all the trouble. There you go, you've DDOS'd the secure computers without ever having to touch them yourself.
Cheap Defense? (Score:5, Insightful)
Re: (Score:2)
A Cheap, Distributed Zero-Day Defense?
Just before buying a computer, deciding not to?
Not so fast... (Score:5, Insightful)
On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.
Re:Not so fast... (Score:5, Insightful)
On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.
You forget that the system is also leaking information about the traffic it is sending/receiving at the same time, and possibly internal state information (such as what applications are loaded, plugins, etc). That data in and of itself is valuable to an attacker, nevermind whether the vector can be protected or not... It opens up the possibility of discovering new vectors in ways maybe not possible remotely.
Parent
Re: (Score:2)
Heck, the data is valuable to anyone with an interest in what people are doing online and how they are using the internet. I don't see any way the information sent out could be limited to the actions of malware, so the database could end up a nice target for commercial(marketing and whatnot) datamining.
Sending out information which I don't control defeats half of the purpose behind why I run software firewalls.
Re:Not so fast... (Score:5, Insightful)
The obvious problem with such a system is the consequences of it being compromised.
The non-obvious problems:
1) People that don't keep automatic updates on aren't going to use this, so the same people that get infected today will continue to get infected.
2) P2P systems like this are notoriously hard to keep poison data out of.
Parent
Re: (Score:2, Funny)
You make it sound suspiciously like "Windows Update," which doesn't have these problems...oh wait....nevermind.
Re: (Score:2)
Maybe use a similar sort of system as a massively distributed active intrusion detection system. In "real life" (yeah, the outdoor thing), oak trees have chemicals in their leaves which sublime under normal atmospheric conditions. If the leaves are attacked by insects, the chemicals are released into the air and are picked up by nearby oaks. These respond by adding extra tannin in their own leaves. The practical upshot is that the heavier the insect attack, the more heavily protected the trees become, makin
Re: (Score:2)
Which lends itself well to a self created DDOS attack. You get a system like that to respond to a normal packet from the net and all of a sudden the amount of processing power expended to analyze the packets increases in response, which leads to greater susceptibility to flooding the system with crap.
Re: (Score:2)
It also wouldn't help against distributed C&C bot nets as those by definition don't have any one point of contact, but rather a great deal of contact among all the nodes. Without some sort of deeper inspection at both the data layer, and the application layer although this might catch s
Sooo... (Score:5, Insightful)
Re: (Score:2)
What to tell your boss (Score:4, Funny)
"I'm not pirating movies... I'm protecting the network!"
Cheap defense? (Score:2, Interesting)
How about "disconnect it from the network."? That's the cheapest one I can think of.
Re: (Score:2)
How about "disconnect it from the network."? That's the cheapest one I can think of.
Now, do you have any solutions to network security that, you know, actually let me use the network?
You seem like the type that would propose shooting someone in the face is a good inexpensive way to ensure someone with cancer doesn't die of cancer, with the added benefit that they won't have to worry about their heart condition any more either.
I sincerely hope you aren't a doctor.
Re: (Score:2)
Nice strawman. BTW, I am a doctor. Some people just don't know a joke when they see one.
Flimsy (Score:3, Insightful)
"It depends on the number of events and the number of computers polled, but if there is a sufficient number of such samples, you can say with some degree of certainty that it is a worm,â Cheetancheri says. For that decision, the software uses a well-established statistical technique called sequential hypothesis testing, he says"
I'm also skeptical that you could rely on a vast network of machines that have presumably fallen prey to an attack to share information between each other fast enough to correctly diagnose an attack with the kind of results the researcher seems hopeful of.
Given that no method for correctly identifying "malicious" code 100% of the time currently exists, I don't think it's wise to allow a software program to run with the decision of shutting a machine down on notice of a perceived threat.
The concept seems like an interesting idea, but I doubt It could be terribly effective in practice.
Re: (Score:2)
So, it'll go something like this: The CEO/VP/Regional Manager is working on a contract bid that absol
Re: (Score:2)
If you were found to still be infected (usually because you lied about actually doing a virus check), you couldn't get back on without an IT rep checking your computer (usually within a few hours if you needed them to come to you; pretty good for a public school I thought
Oh, yeah. It is going to work. (Score:2)
Will never happen. (Score:5, Interesting)
Detecting anomalies requires a baseline of what "normal" is. That means surrendering information about the type and nature of traffic being received by your computer (and possibly sent as well). It's a privacy problem that not many people will commit to. And businesses will be even more reluctant to surrender such information. That said, an aggregate of several hundred thousand firewall logs would be an asset to many organizations and individuals. For this reason, it will never be free... The moment someone realizes there is a monentary value in what they're doing, they will attempt to capitalize on it. So, effectually, what this project is asking you to do is give them your private, personal data, so they can turn a buck under the pretense of fighting those big bad evil hackers. Isn't the market already pretty crowded with the fear-mongers, anti-virus, anti-malware, anti-anti-anti businesses?
Also, this is not a defensive product. A defense requires the ability to resist or avoid an attack. Nothing about this scheme suggests it would provide that to the end-user. It is more of a "zero day surveillance" system than anything. It's a digital cow bell. Moo, ding ding, moo. The only problem is the cow moves at the speed of light and can replicate a few thousand times a second (conservatively). Don't ask about the milk. x_x
Nice try, but... (Score:2)
Your typical problems with security programs are
1) Blocking behavior which should be permitted and
2) Not blocking behavior which should be forbidden.
This adds the potential for
3) Enabling behavior which should be forbidden.
Is there one of those snarky standard forms for this?
The end of the web in 3.. 2.. 1.. (Score:2)
Could work on large corporate-type networks (Score:4, Informative)
The summary is misleading in that this isn't proposed as a defense. This is an early-warning system for detecting compromised machines on a network.
This isn't going to run on every computer in the world. Think of a corporate network with thousands of machines with fairly homogeneous usage. This could alert the sysadmin to a worm infection when the number of machines is numbered in the tens.
And since all it's doing is monitoring it shouldn't present a security risk (if well designed) greater than any P2P client.
This already exists (Score:5, Informative)
Re: (Score:2)
It's called dshield: http://isc.sans.org/howto.html [sans.org]
That was my first thought, although that may not be entirely accurate. As for dshield, noticed the other day there's what appears to be a new link on the Spamhaus [spamhaus.org] page that reads
Consumer Alerts
Is your PC infected or part of a "botnet"?
Check it Here
Humorous aspects aside, it links to some sort of dshield copy-cat setup run by mynetwachman.com. Never heard of them personally, but the more the merrier. A community-based effort to solve a community-wide pro
A Cheap, Distributed Zero-Day Defense? (Score:5, Insightful)
User education.
Re: (Score:3, Funny)
I think you misread "Cheap, Distrubted Zero-Day Defense" as "expensive, ineffective, and slow defense."
More difficult than it sounds (Score:2)
what a useless article (Score:2)
So where is the paper/thesis/documentation of any type whatsoever that describes their p2p solution?
Collaborative p2p worm containment has been around for ever, what does Senthil Cheetancheri's proposal has to offer over previous work?
a small subset of prior work that does exactly what the clueless article sais they do.
http://gridsec.usc.edu/wormshield/ [usc.edu]
http://research.microsoft.com/apps/pubs/default.aspx?id=66830 [microsoft.com]
PS: I doubt Senthil's research reinvents the wheel but I would appreciate an actual link to his
Re: (Score:2)
And to answer my own question (hate doing it on /. but somebody has to set the record straight).
http://scholar.google.com/scholar?hl=en&q=Senthil%20Cheetancheri&um=1&ie=UTF-8&sa=N&tab=ws [google.com]
There is no published work on his so called groundbreaking research:
http://scholar.google.com/scholar?hl=en&lr=&q=Senthil%20Cheetancheri&um=1&ie=UTF-8&sa=N&tab=ws [google.com]
I would expect much higher story verification standards by Cmdr Taco and NetworkWorld
Another related actually high profi
Re: (Score:2, Insightful)
Operator Law (Score:2)
Ken's OPERATOR Law
There inany given population, in an effort to corrdinate, will have a given number of contrarians that for no purpose other then to avoiding conforming to the norm, will intentionally provide and contribute false information to the collective. This can be exhibited in the childrens game 'operator' starting with a message and retelling it down the line. While in small populations the deviation from the original message is minor. The larger the population, the larger the devation tends to ge
It is far too late for that (Score:2)
There is no defense against "zero day". The script kiddie misappropriation of warez d00d slang is now so embedded in the nomenclature that even legitimate security researchers are using it.
Re: (Score:2)
Now works for SonicWall, eh? (Score:2)
Knowing SonicWall, this will be a feature in next years product line - except it will only "work" between other SonicWall products. It won't actually do anything, but they'll claim that it does - yet they won't provide any technical details (let alone source code) on the inner workings.
Re: (Score:2)
Close... it will appear in the routers as an unlockable feature for an additional, annual license fee.
sonicwall blows.
Re: (Score:2)
And when you get your annual renewal feature key - you'll go to type it in and submit it but it won't be able to authenticate the license key. So, you'll have to call SonicWall for a 100-character manual license key and sit on hold for forever listening to that damned SonicWall hold music.
Now I've got it stuck in my head.
Ta ta ta ta... ta ta ta ta... doo doo dee dooo dee doooo dee dooo... ta ta ta ta... ta ta ta ta... doo doo dee dooo dee doooo dee dooo... ta ta ta ta... ta ta ta ta...
ACTNet (Score:2)
There are a number of products that already do this. ACTNet [gews.com], which is part of ActiveScout, does something very similar to this. And it's patented.
Attack information is uploaded to a central server from individual appliances. Appliances then check the central server for a list of "known attackers" and automatically blocks them if they attempt to access the protected network. The concept is similar to Realtime Blackhole lists for spammers.
Re: (Score:3, Insightful)
It's almost as funny as the people who use AOL because it is the "internet" even though they are just hooked into a router and cable modem like everyone else. - this used to be acceptable when people used AOL's dialup service (or shudder- continue to use it)
Re: (Score:2)
Though I'm sure the troll was just trying to be funny in saying that the computer needed a verizon CD and MS Word(uh, OO.o anybody?) to do schoolwork.
Re: (Score:2)
Though I'm sure the troll was just trying to be funny in saying that the computer needed a verizon CD and MS Word(uh, OO.o anybody?) to do schoolwork.
Sadly, that's a real news story. Its funny, but all too true. I'm from Wisconsin, and I died a little inside when I read this story on another site.
Re: (Score:3, Interesting)
Then again, at my school the standard response would've been "there are plenty of cluster computers available all over campus, if yours won't run the necessary software."
Re: (Score:2, Insightful)