Slashdot Mirror

http://blanu.net/curious_yellow.html

Curious Yellow was suggested by Brandon Wiley back in 2002.

It includes features like a distributed p2p network, encrypted communication, obfuscated and morphed code, updates through background traffic to avoid timing correlations. And finally, a Curious Blue antidote by the "good guys".

Curious Yellow was bound to happen sooner or later. I was wondering what was taking botnet authors so long, and why they were relying on a centralized system like DNS for coordinating their bots.

I'm sure we'll reach Curious Yellow at some point, just not yet.

It's been discussed since 2002, with the curious yellow whitepaper. As discussed there it can actually be more efficent in some ways than a centralized worm.

Curious Yellow here we come...

http://blanu.net/curious_yellow.html/

Brandon Wiley proposed a scenario in which a future internet would be consumed by the warfare between several (black or white) worms that feature node-coordinated efforts to prevent detection and removal. For those too lazy to read the link, "Curious Yellow" is basically a modular worm in which zero-day exploits can be added as they are discovered allowing for unchecked growth across the 'net. The worm can then work with other nodes to attack targets by dropping all their traffic, or by subtly modified whatever they receive. The best way to fight such a worm is with fire, a similarly designed "white" worm that goes around patching hosts as quickly as it can.

IMO, remote exploits are rare enough that I don't see this ever happening. On the other hand, with enough infected bot nodes to work with the data mining potentials of some of the more sophisticated extant work networks does worry me...

This is all converging towards the worm described in the Curious Yellow whitepaper from back in 2004. I'm frankly surprised it took this long.

I say we rename them.
One should be "Curious Yellow"
the other "Curious Blue"

http://blanu.net/curious_yellow.html

http://blanu.net/curious_yellow.html This has been predicted for while now. I think I first read about Curious Yellow (above) 4 years ago. Still relevant today.

(See here)

As always in situations like this, I give a link to Curious Yellow!

hey I just had an idea, what if you deliberately virtualised your machine in a hidden manner, so a vm rootkit trying to virtualise your os would actually be virtualising between the good VM and the OS, and the godd VM could detect and report on the bad VM :) (long way to go about it).

Maybe this was the real reason for Sony's rootkit -- backdoor into computers, then zombie out through them. Then the Sober worm could counteract it... we're getting closer and closer to blanu's Curious Yellow scenario every day...

Reading all of this, and especially the parents comments, remind me of this http://blanu.net/curious_yellow.html paper that was published a few years ago. I enjoy reading it, anyways.

I read a very interesting paper on this tactic/subject not too long ago. Rather than rehash the whole work, here is a link:

http://blanu.net/curious_yellow.html

Besides it was a major virus/etc security risk to people using it really... check out the last paragraph here.

What I'm waiting for is a virus that replicates the front end of major scanners. Everything looks fine, no viruses found, etc.

Or an implementation of the Curious Yellow whitepaper.

This paper is also quite interesting. Distributed computing meets the worm.

We know what problems they've caused and how the media's gone nuts over each virus, making things seem bigger and bigger. But some old viruses were much nastier, and I sure don't hear about those types of infections anymore.

Well, in the past several years the focus for worms and viruses has been on how quickly and efficiently they can spread rather than how much damage they can do. I guess you could sy virus writers have gotten a little more mature, and aren't out to do as much damage as possible.

On the subject of efficiently spreading viruses and worms though, here's an interesting concept for one. It is all a bit overstated and massively exaggerates the risk, but I think some sort of semi coordinated worm will come out soon rather than the blind pounding attacks that we usually get. It will be interesting to see how things go once that is the standard for worms.

Jedidiah.

What if everybody used IPv6?
What if you had to prove your id to send mail?
What if a Curious Yellow -like worm were realeased?
What if.... well you get my point.

This seems like a reasonably creative effort, but then again someone could try coding up something like this I think they overrate the real effectiveness of such a system in the description, but it certainly would be nasty if it actually coordinated its spread as effectively as they claim is possible.

Jedidiah

Worms today all have limited vision in what they can do and a greedy philosophy which results in limiting their possible damage.

I'm one of the good guys, but I can certainly see the potential that an evil genius can do. Please read these two papers and get a idea of what is possibly coming.

Warhol Worms

Curious Yellow

Case in point: I was not affected at all by Sobig.F directly, however I did see my mail gateways come under incredible load, my IDS's fill DB's with Sobig warnings, my users encounter endless confusion at bouncebacks from dumb virus scanners that claim we are infected since Sobig is a SMTP forger. Sobig wasted a lot of my resources and time even though it didn't infect a single one of my 1700+ users. It was rather benign though, I'm afraid of what comes next.

Give credit where credit is due. Check the description of the Curious Yellow worm.

BTW, it should be more like Kazaa/Altnet than Freenet if it wants to get anything done.

You've specified some details that Brandon Wiley left out, but really, they're all minor improvements. It's a very powerful concept that could be the end of the internet as we know it. Or not. But there you are.

I am surprised that I did not see people talking about this right off the bat. Superworms were a concept where worms/viruses would use a P2P type of organization to enhance their infections, remain undetected, and update themselves. In the original paper I read (linked from this Slasdot story), the author postulated that the eventual outcome would be to have two or maybe multiple competing worm distributors battling for control over the entire Internet. Sounds like something from James Bond.

Are we seeing the dawn of Superworms that update our computers and themselves without our knowledge or permission?

In the case of Windoze, I do not mind. Windoze users gave up their freedom when they paid Big Brother Bill to lobby Washington to take away their freedom. But a few or even one individual controlling the entire Internet and, by extrapolation, most if not all world communication: That is frightening.

Especially Freenet.

Yup. Untraceable, but probably useless if you want to use machines behind nat/firewall.

Maybe the worms could even try to keep track of each other, forming their own network, in a very low-key, low bandwidth, gnutella kind of way.

This was the idea behind the Curious Yellow concept. It was featured on Slashdot a while ago.

Here's a few links to the next level of annoyances:

• http://www.cs.berkeley.edu/~nweaver/cdc.web/
• http://blanu.net/curious_yellow.html
• http://www.cs.berkeley.edu/~nweaver/warhol.html

Sniff for packets containing the SHA1 hash of known infected nodes. Follow the links to eradicate the whole damn nest of the bastards.

alternatively release a fake "wormcode patch" which poisons nodes after they pass it on. Such an anti-virus-virus would take the network down in less than 15 seconds.

To be more robust, this worm has to start thinking smarter: it has to organise itself into a network of cells which are networks, rather than one big flat network. That way, only one node in each cell knows about only one node in an adjacent cell. If node A in cell 1 knows about node A' in cell 2, then when it gets compromised, it cannot betray nodes B', C' or D'.

Get the worm to spread until it knows about x number of nodes, and then tell each node that they are suddenly the only node in a new cell, and that all their old cell buddies are just their external contacts to other cells. repeat the process until you have global domination.

That way you can still issue orders, if you have access to the original cell, but if that cell dies, then the worm turns into many rogue cells which act on their standing orders... and any anti-virus-virus "patch" would have to start from the original cell....

This superworm for Linux is just a first attempt at an entire genre of zero-day exploit worms which create ad-hoc peer-to-peer networks as they spread.

I doubt that'll happen to Brandon; if it does, I'll invite him over for a long weekend and brainwash him.