Slashdot Log In
'Friendly' Worms Could Spread Software Fixes
Posted by
Zonk
on Thu Feb 14, 2008 04:54 PM
from the perfect-way-to-make-a-rogue-ai dept.
from the perfect-way-to-make-a-rogue-ai dept.
An anonymous reader writes "Microsoft researchers are working out the perfect strategies for worms to spread through networks. Their goal is to distribute software patches and other friendly information via virus, reducing load on servers. This raises the prospect of worm races — deploying a whitehat worm to spread a fix faster than a new attacking worm can reach vulnerable machines."
Related Stories
Firehose:MS researchers designing the "perfect worm" by Anonymous Coward
[+]
Why Old SQL Worms Won't Die 64 comments
narramissic writes "In a recent ITworld article, Security researcher Brent Huston ponders how it is that versions of SQL worms dating back to 2002 represent nearly 70% of all malicious traffic on the Internet today. 'I have made a few attempts to backtrack hosts that perform the scans and at first blush many show the signs of common botnet infections. Most are not running exposed SQL themselves, so that means that the code has likely been implemented into many bot-net exploitation frameworks. Perhaps the bot masters have the idea that when they infiltrate a commercial network, the SQL exploits will be available and useful to them? My assessment team says this is pretty true. Even today, they find blank "sa" passwords and other age-old SQL issues inside major corporate clients. So perhaps, that is why these old exploits continue to thrive."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Prior Art (Score:5, Informative)
Re:Prior Art (Score:5, Insightful)
Parent
Re:Prior Art (Score:5, Informative)
And still being used occasionally. The most recent one I recall is Welchia [wikipedia.org] which used the same RPC exploit as Blaster but tried to help the user by installing patches to prevent further use of the exploit.
It's an interesting idea, but still causes some of the big collateral problems that worms cause. Welchia brought university and corporate networks to their knees because of high traffic just as well as Blaster did - perhaps even moreso since it was also doing a lot of HTTP requests to Microsoft's servers. I think a better solution would be a more surefire way to make sure users get patched when such a critical vulnerability is found. That's the ironic part of the Blaster/Welchia RPC exploit, there was a patch available for months before the worm was released.
Parent
Re:Prior Art (Score:5, Interesting)
You could program the worm to spread based on a random calculation, and assign it a threshold so the traffic isn't excessive. This would give the worm a very low probability to survive.
However, a better approach IMO would be to get rid of all the Genuine Advantage and activation crack, and allow boxes using old and famous activation keys (such as the "devil's own") to get updated with Windows Update.
Parent
Re:Prior Art (Score:5, Funny)
DUH. That's why my Norton Antivirus lights up when I click on those helpful "GET RID OF SPYWARE" ads?
Parent
This one is different. (Score:5, Insightful)
Parent
Re:This one is different. (Score:5, Funny)
Or, even better, a way to send requests to the same domain name to physically different servers...
I think I may be on to something here.
Parent
Re:This one is different. (Score:4, Insightful)
Parent
Re:Prior Art (Score:5, Funny)
We can survive salt water, high EMP fields, and power outages. A computer can't handle carpet.
My money's always going to be on the meatbags.
Parent
Re:Prior Art (Score:5, Funny)
- Chapek 9 robot general
Parent
A viral implementation of Windows Update? (Score:5, Funny)
Re:A viral implementation of Windows Update? (Score:4, Insightful)
Parent
Annnndddd... (Score:5, Insightful)
Re:Annnndddd... Well, these worm (Score:5, Funny)
Parent
Re:Annnndddd... (Score:5, Insightful)
That's right, none. There's your clue.
Parent
This is an old idea (Score:5, Insightful)
If you use a tool like this on your own network, fine, but if I find it on my own you had better cover your tracks because I'll go ballistic.
not exactly (Score:5, Insightful)
If I'm not mistaken according to Micro Soft's EULA you don't actually own the software they do. They are just giving you permission to use it. Though you do own the hardware the worm in question would only affect or change the Soft Ware. In addition you neither own your network connection or most likely the building you live in ( dorm, apartment, mortgaged home etc) so from a purly legal stand point you have no leg to stand on. Though I do completely understand and support the meaning behind yrou rant
Parent
Caused Issues the last time someone tried it.. (Score:5, Insightful)
I guess this goes with all of the tags we've seen today on articles of "whatcouldpossiblygowrong?".
I can hear it already... (Score:5, Funny)
Tier1 Customer Support: Ok sir, I'd be happy to help you with that. Firstly, do you have the latest Microsoft Virus(tm) installed?
Customer: Yes.
Tier1 Customer Support: OK, do you have an Antivirus installed?
Customer: Yes.
Tier1 Customer Support: Ah, that's the problem. You'll need to remove the Antivirus in order for the Virus to function correctly. It's not safe these days to be running without the latest Virii!
Stupid Idea (Score:4, Interesting)
The temptation if this became a strategy, i.e. the system can run Microsoft Worms only, would in a very short time, run Microsoft like worms.
This seems more like and admission that their systems can't be secured.
Or "Who's finger is in the dike? Dammit, thats not my dike!"
At one point, I liked this idea.... (Score:4, Interesting)
nothing to see here... (Score:4, Informative)
Brandon Wiley proposed a scenario in which a future internet would be consumed by the warfare between several (black or white) worms that feature node-coordinated efforts to prevent detection and removal. For those too lazy to read the link, "Curious Yellow" is basically a modular worm in which zero-day exploits can be added as they are discovered allowing for unchecked growth across the 'net. The worm can then work with other nodes to attack targets by dropping all their traffic, or by subtly modified whatever they receive. The best way to fight such a worm is with fire, a similarly designed "white" worm that goes around patching hosts as quickly as it can.
IMO, remote exploits are rare enough that I don't see this ever happening. On the other hand, with enough infected bot nodes to work with the data mining potentials of some of the more sophisticated extant work networks does worry me...
Oh yah, that'll work. (Score:4, Insightful)
http://blogs.msdn.com/ie/archive/2007/12/18/post-install-issues-with-ms07-069-ie6-on-xpsp2.aspx [msdn.com]
(Among others) That they'll be a perfect candidate to create this type.
For that matter, I'd really like to know how someone/people who might do this, would get around that whole illegal thing.
This BS creeps up time and again.... (Score:4, Insightful)
Anybody proposing this nonsense just shows they do not even have elementary security knowledge and did not research the topic at all. Incompetents.
I can't wait... (Score:5, Funny)
Yay Microsoft! They have such good instincts when it comes to security!