A Cheap, Distributed Zero-Day Defense? 116
coondoggie writes "Shutting down zero-day computer attacks could be carried out inexpensively by peer-to-peer software that shares information about anomalous behavior, say researchers at the University of California at Davis.The software would interact with existing personal firewalls and intrusion detection systems to gather data about anomalous behavior, says Senthil Cheetancheri, the lead researcher on the project he undertook as a grad student at UC Davis from 2004 to 2007. He now works for SonicWall."
Wow... (Score:5, Insightful)
If you could break into that process, you could rule the world.
My first thought too (Score:5, Insightful)
Who watches the watchers?
Any system like this would be a premium cracker target. All it would take is one false positive or false negative before no one would trust it again.
Six months later, some other researcher would make a new proposal for a p2p system to guard the broken p2p system.
Re: (Score:2)
Obviously the entire point of doing it p2p is to speed up distribution, but that doesn't mean the fixes couldn't go through some kind of verification process before being flagged as safe and useful fixes.
Seems to work out pretty well for Blizzard updates.
Re: (Score:2)
Yes, theoretically, it could. In practice, the argument only holds against Windows and MS Office update (maybe also Firefox), since the others have a very high diversity.
Re: (Score:1)
Yes, theoretically, it could. In practice, the argument only holds against Windows and MS Office update (maybe also Firefox), since the others have a very high diversity.
What the hell??... This has nothing to do with Office or Firefox update they are not peer-to-peer applications.
Re: (Score:2)
Re: (Score:1)
You only get your updates from one place, the original source. (Or in the case of linux distro's you get the validation/CRC check from one place)
The article is about an automated distributed response, hence you have to trust much more than the person you're getting it from. You have to trust the entire chain.
The Blizzard example is a bet
Re: (Score:2)
"All it would take is one false positive or false negative before no one would trust it again."
would you be able to tell me which of the currently used security products are trusted, due to never throwing a false positive or negative?
Re: (Score:2)
"All it would take is one false positive or false negative before no one would trust it again."
would you be able to tell me which of the currently used security products are trusted, due to never throwing a false positive or negative?
Irrelevant. They aren't automated. People are allowed to make mistakes and presumably learn from them; it takes many repeated mistakes to become unreliable.
An automated system doesn't have that luxury. When there is no one to accept blame and make corrections, people won't trust it.
Re: (Score:2)
Make it an encrypted VPN like OpenVPN and use physical security
like they do at military installations when dealing with
Compartmentalized Top Secret information.
Have Supernodes that are the trusted servers, and the clients can
just offer data to their Supernode.
Have the reporting software add in PC system metrics like the
MAC and CPU ID#'s so that if ppl are trying to affect the
system maliciously it fingerprints them.
Re: (Score:2)
Yah, that'll work well.
MACs can be configured at will.
CPU ID#, now that's a new one. Still, it takes software to report it, so it too can be forged.
What exactly are you proposing anywho? I wonder if you have any clues about "miltary installations" other than what Hollywood tells you.
Re: (Score:1)
That was the first thought that crossed my mind, too..
Re: (Score:3, Interesting)
Re: (Score:2)
Presumably the monitor itself would need to be tricked into thinking the harmless operation was evil, so it would submit it to peer review on the p2p network.
Then you'd need to trick some other subscribers into agreeing it was evil, and somehow arrange for them to be selected by the system as peers. Then and only then could you get the system to DoS it's users.
--dave
Re: (Score:2)
This is the first thing I thought as well. Find a way to compromise systems and rather than do your usual dirty work, just get them all to report that the legitimate, "Secure" devices are the ones causing all the trouble. There you go, you've DDOS'd the secure computers without ever having to touch them yourself.
Cheap Defense? (Score:5, Insightful)
Re: (Score:2)
A Cheap, Distributed Zero-Day Defense?
Just before buying a computer, deciding not to?
Massive overkill (Score:2)
Re: (Score:2)
Not so fast... (Score:5, Insightful)
On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.
Re:Not so fast... (Score:5, Insightful)
On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.
You forget that the system is also leaking information about the traffic it is sending/receiving at the same time, and possibly internal state information (such as what applications are loaded, plugins, etc). That data in and of itself is valuable to an attacker, nevermind whether the vector can be protected or not... It opens up the possibility of discovering new vectors in ways maybe not possible remotely.
Re: (Score:2)
Heck, the data is valuable to anyone with an interest in what people are doing online and how they are using the internet. I don't see any way the information sent out could be limited to the actions of malware, so the database could end up a nice target for commercial(marketing and whatnot) datamining.
Sending out information which I don't control defeats half of the purpose behind why I run software firewalls.
Comment removed (Score:5, Insightful)
Re: (Score:2, Funny)
You make it sound suspiciously like "Windows Update," which doesn't have these problems...oh wait....nevermind.
Re: (Score:2)
Maybe use a similar sort of system as a massively distributed active intrusion detection system. In "real life" (yeah, the outdoor thing), oak trees have chemicals in their leaves which sublime under normal atmospheric conditions. If the leaves are attacked by insects, the chemicals are released into the air and are picked up by nearby oaks. These respond by adding extra tannin in their own leaves. The practical upshot is that the heavier the insect attack, the more heavily protected the trees become, makin
Re: (Score:2)
Which lends itself well to a self created DDOS attack. You get a system like that to respond to a normal packet from the net and all of a sudden the amount of processing power expended to analyze the packets increases in response, which leads to greater susceptibility to flooding the system with crap.
Re: (Score:2)
I can see that. You'd need very good thresholds to avoid trivially establishing a self-inflicted DDoS. According to the Byzantine General's Problem, in a system with N nodes, (N+1)/2) of those nodes -must- be trustable in order to detect a node that is not. Thus, it would be necessary to establish in advance that the sum total of all compromised nodes PLUS all nodes run with malicious intent PLUS all misconfigured nodes fell below the ((N-1)/2)-M threshold, where M is the number of nodes you expect to be fr
Re: (Score:2)
Nonsense. I started constructing castle walls at the basement door with my peanut butter and jelly crusts last summer, and haven't been attacked even once!
Re: (Score:2)
Is that why you've been thrown into the closet by the marauding army ants?
Re: (Score:1)
Re: (Score:2)
It also wouldn't help against distributed C&C bot nets as those by definition don't have any one point of contact, but rather a great deal of contact among all the nodes. Without some sort of deeper inspection at both the data layer, and the application layer although this might catch s
Re: (Score:1)
Re: (Score:2)
Has Windows Update ever been compromised? It's a tortuously slow system in a similar vein, but I can't recall ever reading about malware being distributed via Windows Update (unless you count WGA ^.~ )
Sooo... (Score:5, Insightful)
Re: (Score:1)
It's not needed, because the zero-day defense software will be perfect - duh.
You're obviously right on point. This is only a good idea, if the software was perfect. But we wouldn't need this "perfect" software, if software was perfect....and around and around we go.
Re: (Score:2)
What to tell your boss (Score:4, Funny)
"I'm not pirating movies... I'm protecting the network!"
Re: (Score:1)
"I'm not pirating movies... I'm protecting the network!"
Baws: "Yea, but who's paying for it?" Welcome to capitalism.
Cheap defense? (Score:2, Interesting)
How about "disconnect it from the network."? That's the cheapest one I can think of.
Re: (Score:2)
How about "disconnect it from the network."? That's the cheapest one I can think of.
Now, do you have any solutions to network security that, you know, actually let me use the network?
You seem like the type that would propose shooting someone in the face is a good inexpensive way to ensure someone with cancer doesn't die of cancer, with the added benefit that they won't have to worry about their heart condition any more either.
I sincerely hope you aren't a doctor.
Re: (Score:2)
Nice strawman. BTW, I am a doctor. Some people just don't know a joke when they see one.
Re: (Score:1)
Nice strawman
Thanks.
Some people just don't know a joke when they see one.
Look in the mirror. ;)
Re: (Score:2)
touché
Flimsy (Score:3, Insightful)
"It depends on the number of events and the number of computers polled, but if there is a sufficient number of such samples, you can say with some degree of certainty that it is a worm,â Cheetancheri says. For that decision, the software uses a well-established statistical technique called sequential hypothesis testing, he says"
I'm also skeptical that you could rely on a vast network of machines that have presumably fallen prey to an attack to share information between each other fast enough to correctly diagnose an attack with the kind of results the researcher seems hopeful of.
Given that no method for correctly identifying "malicious" code 100% of the time currently exists, I don't think it's wise to allow a software program to run with the decision of shutting a machine down on notice of a perceived threat.
The concept seems like an interesting idea, but I doubt It could be terribly effective in practice.
Re: (Score:2)
So, it'll go something like this: The CEO/VP/Regional Manager is working on a contract bid that absol
Re: (Score:2)
If you were found to still be infected (usually because you lied about actually doing a virus check), you couldn't get back on without an IT rep checking your computer (usually within a few hours if you needed them to come to you; pretty good for a public school I thought
Re: (Score:2)
Tell that to the guy in the next cube. I believe he's running an internet business from there. (Honestly. I keep hearing him on the phone
Oh, yeah. It is going to work. (Score:2)
Will never happen. (Score:5, Interesting)
Detecting anomalies requires a baseline of what "normal" is. That means surrendering information about the type and nature of traffic being received by your computer (and possibly sent as well). It's a privacy problem that not many people will commit to. And businesses will be even more reluctant to surrender such information. That said, an aggregate of several hundred thousand firewall logs would be an asset to many organizations and individuals. For this reason, it will never be free... The moment someone realizes there is a monentary value in what they're doing, they will attempt to capitalize on it. So, effectually, what this project is asking you to do is give them your private, personal data, so they can turn a buck under the pretense of fighting those big bad evil hackers. Isn't the market already pretty crowded with the fear-mongers, anti-virus, anti-malware, anti-anti-anti businesses?
Also, this is not a defensive product. A defense requires the ability to resist or avoid an attack. Nothing about this scheme suggests it would provide that to the end-user. It is more of a "zero day surveillance" system than anything. It's a digital cow bell. Moo, ding ding, moo. The only problem is the cow moves at the speed of light and can replicate a few thousand times a second (conservatively). Don't ask about the milk. x_x
Re: (Score:1, Offtopic)
Re: (Score:1)
Nice try, but... (Score:2)
Your typical problems with security programs are
1) Blocking behavior which should be permitted and
2) Not blocking behavior which should be forbidden.
This adds the potential for
3) Enabling behavior which should be forbidden.
Is there one of those snarky standard forms for this?
Re: (Score:1)
4) Profit !!!
Patents! (Score:1)
I'm pretty sure we can modify some existing patents to apply to distributed firewalls.
US Patent Application 20080250497 [freepatentsonline.com]: Statistical method and system for network anomaly detection
"Whatever concept a person can think of, there will be a patent either active, being applied, or being prepared to include new concept." -- Troll
---
There's also some other related studies.
Modular Strategies for Internetwork Monitoring [umich.edu], which "addresses the longstanding and difficult problem of detecting and classifying spatially
Re: (Score:2)
Actually...
I did a provisional patent for a application I wrote in 2001 that, as best as i can tell from the article, was nearly the same.
NACM. Network Active Countermeasures.
I buried it, because it would have been too easy to use it as a censorship tool.
If it is the same, I guess that would constitute prior art.
The end of the web in 3.. 2.. 1.. (Score:2)
Re: (Score:1)
Not only is this troll-nonsense, it is a Slashdot-only troll-nonsense!
ninnle linux -slashdot [google.com] is a "Google Whack"! (if you stretch the rules a bit)
Could work on large corporate-type networks (Score:4, Informative)
The summary is misleading in that this isn't proposed as a defense. This is an early-warning system for detecting compromised machines on a network.
This isn't going to run on every computer in the world. Think of a corporate network with thousands of machines with fairly homogeneous usage. This could alert the sysadmin to a worm infection when the number of machines is numbered in the tens.
And since all it's doing is monitoring it shouldn't present a security risk (if well designed) greater than any P2P client.
This already exists (Score:5, Informative)
Re: (Score:2)
It's called dshield: http://isc.sans.org/howto.html [sans.org]
That was my first thought, although that may not be entirely accurate. As for dshield, noticed the other day there's what appears to be a new link on the Spamhaus [spamhaus.org] page that reads
Consumer Alerts
Is your PC infected or part of a "botnet"?
Check it Here
Humorous aspects aside, it links to some sort of dshield copy-cat setup run by mynetwachman.com. Never heard of them personally, but the more the merrier. A community-based effort to solve a community-wide pro
Re: (Score:1)
A Cheap, Distributed Zero-Day Defense? (Score:5, Insightful)
User education.
Re: (Score:3, Funny)
I think you misread "Cheap, Distrubted Zero-Day Defense" as "expensive, ineffective, and slow defense."
More difficult than it sounds (Score:2)
Easier than it sounds, actually (Score:2)
One part of this is just the "it was in yesterday's activity log" test. If you have data from a period leading up to a problem, set-subtract the previous activity from the activity on the day of the crash to get just the new, unexpected activity. That's the material you should be looking at.
For syslog, this can be implemented with an awk script: there's an example in "Sherlock Holmes on Log Files", at http://datacenterworks.com/stories/antilog.html [datacenterworks.com]
--dave
what a useless article (Score:2)
So where is the paper/thesis/documentation of any type whatsoever that describes their p2p solution?
Collaborative p2p worm containment has been around for ever, what does Senthil Cheetancheri's proposal has to offer over previous work?
a small subset of prior work that does exactly what the clueless article sais they do.
http://gridsec.usc.edu/wormshield/ [usc.edu]
http://research.microsoft.com/apps/pubs/default.aspx?id=66830 [microsoft.com]
PS: I doubt Senthil's research reinvents the wheel but I would appreciate an actual link to his
Re: (Score:2)
And to answer my own question (hate doing it on /. but somebody has to set the record straight).
http://scholar.google.com/scholar?hl=en&q=Senthil%20Cheetancheri&um=1&ie=UTF-8&sa=N&tab=ws [google.com]
There is no published work on his so called groundbreaking research:
http://scholar.google.com/scholar?hl=en&lr=&q=Senthil%20Cheetancheri&um=1&ie=UTF-8&sa=N&tab=ws [google.com]
I would expect much higher story verification standards by Cmdr Taco and NetworkWorld
Another related actually high profi
Re: (Score:2, Insightful)
I know of better defense! (Score:1)
Operator Law (Score:2)
Ken's OPERATOR Law
There inany given population, in an effort to corrdinate, will have a given number of contrarians that for no purpose other then to avoiding conforming to the norm, will intentionally provide and contribute false information to the collective. This can be exhibited in the childrens game 'operator' starting with a message and retelling it down the line. While in small populations the deviation from the original message is minor. The larger the population, the larger the devation tends to ge
It is far too late for that (Score:2)
There is no defense against "zero day". The script kiddie misappropriation of warez d00d slang is now so embedded in the nomenclature that even legitimate security researchers are using it.
Re: (Score:2)
Re: (Score:2)
It originally meant having a crack available to the copy protection of piece of software on the day of its release (the zero day, being more impressive than the day after, or three weeks later). The script kiddies started using it to refer to any type of exploit because it sounded cool, so it has now been rationalized to refer to an exploit for which there is no patch available, regardless of how long the software has been out or how long the exploited flaw has been known.
Re: (Score:2)
It sounds to me like... (Score:1)
...this is a great way to cause the opposite effect of a technological singularity [wikipedia.org].
Now works for SonicWall, eh? (Score:2)
Knowing SonicWall, this will be a feature in next years product line - except it will only "work" between other SonicWall products. It won't actually do anything, but they'll claim that it does - yet they won't provide any technical details (let alone source code) on the inner workings.
Re: (Score:2)
Close... it will appear in the routers as an unlockable feature for an additional, annual license fee.
sonicwall blows.
Re: (Score:2)
And when you get your annual renewal feature key - you'll go to type it in and submit it but it won't be able to authenticate the license key. So, you'll have to call SonicWall for a 100-character manual license key and sit on hold for forever listening to that damned SonicWall hold music.
Now I've got it stuck in my head.
Ta ta ta ta... ta ta ta ta... doo doo dee dooo dee doooo dee dooo... ta ta ta ta... ta ta ta ta... doo doo dee dooo dee doooo dee dooo... ta ta ta ta... ta ta ta ta...
ACTNet (Score:2)
There are a number of products that already do this. ACTNet [gews.com], which is part of ActiveScout, does something very similar to this. And it's patented.
Attack information is uploaded to a central server from individual appliances. Appliances then check the central server for a list of "known attackers" and automatically blocks them if they attempt to access the protected network. The concept is similar to Realtime Blackhole lists for spammers.
Run foul of the law (Score:2)
Re: (Score:1)
CPAN has this already... (Score:2)
I wrote something almost identical years ago, but couldn't since I'm not part of the security community it never really took off. Blacklists were The Thing at the time still...
http://search.cpan.org/~adamk/ThreatNet-DATN2004-0.20/lib/ThreatNet/DATN2004.pm [cpan.org]
The test bots are still running in Freenode #threatnet
FW snort (Score:1)
Somehow, this fails to surprise. (Score:1)
http://www.networkworld.com/news/2009/011309-zero-day-worm.html?hpg1=bn [networkworld.com]
Reason for restriction: Forbidden Category "Adult Entertainment"
Way to go, Cheetancheri.
How to handle dad mouthing attacks? (Score:1)
Sending controversial informations (Score:1)
Re: (Score:3, Insightful)
It's almost as funny as the people who use AOL because it is the "internet" even though they are just hooked into a router and cable modem like everyone else. - this used to be acceptable when people used AOL's dialup service (or shudder- continue to use it)
Re: (Score:2)
Though I'm sure the troll was just trying to be funny in saying that the computer needed a verizon CD and MS Word(uh, OO.o anybody?) to do schoolwork.
Re: (Score:2)
Though I'm sure the troll was just trying to be funny in saying that the computer needed a verizon CD and MS Word(uh, OO.o anybody?) to do schoolwork.
Sadly, that's a real news story. Its funny, but all too true. I'm from Wisconsin, and I died a little inside when I read this story on another site.
Re: (Score:3, Interesting)
Then again, at my school the standard response would've been "there are plenty of cluster computers available all over campus, if yours won't run the necessary software."
Re: (Score:2, Insightful)