Slashdot Mirror
Worms Going Further, Faster
Major Byte writes "Rob Kolstad's MOTD (pdf) column in Usenix login; passes along a few distilled factiods from a CAIDA analysis of the 'Sappire/Slammer' Worm. When it was at full blast it was scanning over 3 billion systems per hour--a speed that 'a "better" vulnerability would have enabled infection of the entire internet in 15 minutes, a "flash worm" or a "Warhol Worm."' I think 'better' to mean 'able to infect across a lot of platforms.'"
There's a lot that can't be done about these things because at the very bottom of every system is a human being who will forget to patch the system or stupidly open an executable.
There is no patch for human carelessness.
I have been pwned because my
I'm wonderfully happy to live in a world where the only large-scale communication network is prone to mass disruption and/or destruction at the drop of a pin. Great.
Fast moving worms are harder for those pesky birds to get at.
I thought this article was about Worms 2 being released for linux :(
It was terrible. I had to take lots of drugs.
Cut off their arms?
There is no god
obligatory dumb and dumber:
LLOYD
(smiling)
I got worms.
MARY
I beg your pardon?
LLOYD
That's what we're gonna call it: I
Got Worms. We're gonna specialize in
selling worm farms â" you know, like
ant farms. A lot of people don't
realize that worms make much better
pets than ants. They're quiet,
affectionate, they don't bite, and
they're super with the kids.
MARY
Aren't ants quiet, too?
Where it is the point in this matter nowadays? It really took talent to write malware in the old days, what with having to be able to get the virus in the executables and boot sectors of floppy disks, but now everything looks like a work of the VBScript cut-and-paste. Why is it so hard to find the author of these programs?
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
A good set of vulnerabilities across multiple hardware configurations and OSes is a great start. An interesting idea would be to sync the worms up based upon a reading from a certain timezone on time.gov. Make them start scanning all IPs for vulnerable, uninfected machines at the same time. So not only do you get the chance to infect, but you DDoS. Fun stuff. Also, you could make it infect unprotected routers and give the virus 'priority' in transmissions, etc, etc.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
The nice part about Slammer is that it could just spew data - if it hit you, and you were vulnerable, you were infected. It didn't require any complicated TCP sessions, was MUCH nicer on host resources, and the entire hack fit inside a single packet. Hard to improve on this really, perhaps using LZIP to shrink the size of the payload.
I want to delete my account but Slashdot doesn't allow it.
I'm still waiting for a Cisco IOS bug to be discovered that is present in all 12.x series code. I can't wait to see the worm for that one :D
http://www.cgisecurity.com/articles/worms.shtml
Thank God I've got a Mac! It's hard enough to get regular software ported, I doubt that many people would invest time to port a worm, except "Worms Blast" =D
Taking guns away from the 99% gives the 1% 100% of the power.
Comment removed based on user account deletion
Some day, we will all curse like sailors and have to reboot every god damned machine we have - maybe even revert to latest backup. Some day, the apocalypse will hit us, and Internet will cough for a day like it had the SARS. And then you hope your mother wasn't in hearing range.
Future proofing?
It's not even just that now. The latest rendition of Bugbear would send out an infected file named after a file on the computer it was sending from. I imagine the next generation mailers will check send records, or even incorporate spyware code, and mail themselves out using names of files the user sent recently, or selectively infect shared files to get loose on the network. For computers to be useful you have to have some level of trust, and as worms become smarter they can more easily exploit that fact.
We need to stop stressing prevention quite so much and start dealing with what happens when a virus does get through.
For a world-wide problem with worms, cross-platform worms are not required - just a simultaneous release of single platform worms. The spreading algo would be common, the payload and infection mechanism platform specific.
One for windows, one for linux, one for routers/switches...
Imagine the impact. Would the internet survive?
The only things preventing this might be the fact that no single person has the required experience in all the platforms, and vulnerabilities in non-windows OS's are typically more difficult to exploit.
All bow to his Noodliness!! His Noodle Appendage has touched me!
We need to stop stressing prevention quite so much and start dealing with what happens when a virus does get through.
Harsher punishments for virus writers?
Better system recovery process?
I have been pwned because my
What kind of a statistic is that? How can it fully complete a 3 billion system per hour cycle if there are not 3 billion systems to infect (I'm guessing that there aren't). So it's true rate is how ever many systems it actually did infect, which is likely a lot less than 3 billion. You can't just calculate the speed over 2 minutes and multiply it by 30. That'd be like a starship that was able to travel at 15 billion light years per hour. Really? Where would it go?
Are we illiterate or what? I think 'better' to mean 'able to infect across a lot of platforms.'? How about some kind of voluntary proofreading layer here?
One problem with saying that Slammer or any "flash worm" is that bandwidth and current infastructure isn't taken into account. Any worm taking on activity levels (as seen by how the whole Internet seemed to slow down) of this magnitude tend to self contain themselves at local router or node bottlenecks. As links go to fiber this won't hold, but atleast for now it does.
in THE Doomsday, those who don't believe will be wiped out.
so if we have this fast-spreading virus, wouldn't it just wipe out those who don't patch and maintain their servers properly?
and what's left are those nicely patched servers which serve the internet better and everyone's happy ever after.
"Worms Going Further, Faster"
Former East German sports coaches now working on worm farms?
216.31.149.142 - - [04/Jun/2003:17:15:29 -0600] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 392 "-" "-" /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 392 "-" "-" /sumthin HTTP/1.0" 404 388 "-" "-" /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 392 "-" "-"
216.31.149.142 - - [04/Jun/2003:17:17:06 -0600] "GET
172.182.46.212 - - [04/Jun/2003:17:46:09 -0600] "GET / HTTP/1.0" 200 7029 "-" "-"
217.230.180.171 - - [04/Jun/2003:22:05:36 -0600] "OPTIONS * HTTP/1.0" 200 0 "-" "-"
210.179.95.123 - - [07/Jun/2003:11:16:01 -0600] "GET
216.60.56.84 - - [07/Jun/2003:19:38:47 -0600] "GET
Comment removed based on user account deletion
nature has evolved to fight biological infection by various means: genetic diversity, adaptive defensives. we could take a lesson from this.
If people would stop and think, "hey, I never e-mailed them to begin with" then we'd have less problems. Obviously people will fall through the cracks, and then there are of course those that did e-mail Microsoft, but the body of those e-mails were patheticly obvious. "Here's the file" or some such idiocy. Who runs those?... oh sh... I didn't e-mail them did I?
The ladder people obviously then fall into your basket.
Harsher spankings for the people that still haven't grasped the concept of NOT clicking that email attachment with a .vbs extension. :P
-blink-blink-
Connecting to AOL...
-blink-
You've got mail!
-blink-blink
"ooh, an attachment..."
-- There is no patch for human carelessness.
The user isn't always to blame. What about the software developers who don't take even minimal efforts to protect their scripting systems?
Yes, there will always be someone who will open attachments no matter how often you tell them not to.
But perhaps the root issue isn't the fellow who can't stop clicking on Fireworks.exe files but the OS and application developers who enable and then don't patch systems that allow those users to be so easily exploited.
I was just listening to a radio show. The host had an email from "an insider" we'll say, who related that just lately (ongoing) there is supposedly some big "attack" going on that is targeting some government database,allegedly the largest in the world, but no name-redacted of course- and also banks of all things. I emailed him with the latest bug bear exploit details, because it sounded like it. He mentioned my email after a station break, and was adamant that his source was saying it was NOT the latest bugbear variant, but something much larger and they think it's a state sponsored cyber warfare attack.
Anyone hear of anything like this going on? I checked the usual security sites, I see nothing mentioned.
My apologies for the sidetracking, just the timing and this thread gave me an opportunity to ask here.
There's a lot to be said for having diversity in a population to prevent a 100% infection rate.
Why doesn't someone just make a worm that goes around and downloads Windows and SQL server updates to patch against all these worms? I realize Microsoft doesn't have the best track record even with their updates, but it would still probably solve some problems. And yes, I realize there's something wrong with forcing people to install updates, but consider the alternative of reading these articles every week here.
a speed that 'a "better" vulnerability would have enabled infection of the entire internet in 15 minutes, a "flash worm" or a "Warhol Worm."'
A "Warhol" worm wouldn't infect the Internet in 15 minutes, it would infect it for only 15 minutes.
I think the root issue is the assholes who write the viruses in the first place, slack OS's and users just make their life easier.
sig's not here
I agree that it's not safe to rely on humans to keep systems patched. But, for one, if most systems are kept patched, a worm like SLAMMER would be useless. This is an obvious point you neglect, but not an interesting one.
More interesting, I think, is the debate over whether there is such a thing theoretically possible as a secure architecture. This is, of course, the idea behind "secure" systems designed to be so from the ground up, such as Palladium. Ethernet, TCP/IP, ARP, and most of the other protocols which make up the 'Net were not designed with security in mind from the bottom up, but rather designed for effectiveness, ease of implementation, and the like. For example, why do Ethernet cards allow promiscuous mode? It makes diagnosing certain problems easier, but it also represents a very big opportunity for all sorts of security vulnerabilities. Or why can MAC addresses be changed so easily? This represents an easy opportunity for mischeif.
But had the entire architecture of the 'Net been designed for security and accountability rather than ease of access and openness from the start (granted, two often-conflicting ideals), would absolute security be possible?
Many say that security is never truly possible without unplugging the computer from the 'Net, turning it off, and embedding it in concrete. This may be exaggeration, but of course it is quite difficult to prove something secure; RSA has not be proven secure, public-key cryptography has not been proven secure, and I don't really see how you could prove any other system secure, either.
This may not be necessary, however. We may not know for certain that RSA is secure, but we assume that the NSA does not know how to factor such large numbers any better than the rest of us, and we assume it to be secure (and such an assumption does appear valid). If enough evidence exists to assume a system to be "practically secure," that is enough for implementaiton.
I have no answers to these questions. But I think to assume such a problem is unanswerable is silly and is itself merely a non-answer. Security may not be an easy goal, but it may be acheivable. At least in some forms, this is clearly the case; it would quite evidently be possible to stop some sorts of attacks, like SLAMMER, in the future, even if theoretical, absolute, security remains un-obtainable.
If we're talking about ultra-fast worms in particular, only the first problem matters. A piece of malware that depends on users getting to their email is going to talke longer than 15 minutes to spread.
We could still be vulnerable even if everyone patched their systems, if someone writes the exploit before the patch comes out.
Scary stuff.
How to 0wn the Internet in Your Spare Time
Interesting topics: "Better" worms techniques
"A combination of hit-list and permutation scanning can create what we term a Warhol worm, capable of attacking most vulnerable targets in well under an hour, possibly less than 15 minutes. "
Brain is my second favorite organ.
i would vote for a slowing down the release cycle of software products. with the idea of 'new versions' every 18 months becoming common, it seems that there is more writing of code than debugging/optimizing.
and i've said this before, certain software companies have not been very good about training administrators about patching, etc.
eric
A really nice way to make an extremely destructive worm would be to ensure that the great majority of computers connected to the internet are running the exact same operating software. This would guarantee that a vulnerability can reliably be exploited in pretty much any neighbor.
Unfortunately, such a scenario is but a dream. Modern operating systems are too secure!
This sounds like Ender's Worm. Very interesting read.
Your assumption is that true security is a theoretical impossibility. On what grounds?
Not to speak for the previous poster, but that's a pretty good assumption. No technological advance has ever succeeded in remaining secure for long.
(Example: plate armor probably seemed impregnable in practical terms, until the longbow came along. Yeah, okay, a stinking peasant could hamstring a warhorse and beat the knight to death with a rock while he lay helpless on the ground, but these possibilities were probably ignored with the same superstitious enthusiasm that sysadmins ignore the rarer kinds of attacks on their systems.)
I would think that the burden of proof falls on those who maintain that "true security" is attainable. And the minute you propose some system to guarantee that true security, some clever person will come along and propose a way to get around it.
Anyone designing a critical security system should probably start off with the assumption that security will eventually be breached, and make damn sure that when the breach occurs, catastrophe does not result.
It's not a description of an actual worm, it's not even a description of how to build a worm, it's a vague description of how a worm might be constructed:
1. Scan internet servers looking for vulnerable software
2. Infect said software.
Duh. The author writes, "I didn't write this paper to give people malicious ideas." -- It's okay! There's nothing in the paper that would assist people in doing anything useful!
Big Daddy, Johnny, Burp, Aunt Zelda, Scott, Slurp, Big Momma
Everyone knows that worms DO infect apples.
Actually, the new Bugbear does selectively infect shared files. On my network, two 98 boxes had their entire C drives shared, while someone else (a laptop) became infected with the new Bugbear. Those two computers had only a few infected files, including:
c:\program files\internet explorer\iexplore.exe
c:\program files\outlook express\msimn.exe
c:\program files\adobe\acrobat x.0\reader\acrord32.exe
So it looks like the new Bugbear already selectively infects shared files.
We need to stop stressing prevention quite so much and start dealing with what happens when a virus does get through.
We don't need to stop stressing prevention, but some shops certainly do need to react faster when something hits.
Actually, this is exactly where a portion of the security community is currently focusing. With a deep enough level of protocol understanding, it's often possible to write generalized algorithms that detect (and presumably block) novel attempts to exploit a known vulnerability. For example, in the case of SQL Slammer, the buffer overflow vulnerability disclosure came many months before the worm hit, and at least a couple intrusion detection vendors were able to positively identify the exploit attempt without requiring an update -- one of the keys to protection against such a rapidly propagating worm.
This is about that new AOL 8.0 software, right?
-1 Uncomfortable Truth
I'm no historian, but I bet plate armor was more for intimidation factor than anything else.
:)
I bet a hundred shiny enemy knights on horses really does a lot to demoralize your thousand foot soldiers.
I think a lot of modern security is the same way, deter most attacks with shiny armor, and minimize damage on the inevitable attacks that will get through.
Now the real problem these days is the companies selling cheap tin armor and telling people it's the strongest steel. Some things never change.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
>
> Kinda makes the phrase "The early bird catches the worm", redundant doesn't it.
Honeypots: The early bird may get the worm, but the second mouse gets the cheese.
*BOFH-like evil grin*
For computers to be useful you have to have some level of trust,
I have never run any executable code I received in an email. What exactly have your friends been sending you?
Does that mean they're going to start using Java?
- Joe
A multi-headed worm that can penetrate seven different networks at once, and steal 4 billion dollars from the Swordfish slush fund, all within ten seconds?
N4st0r, trixx0r h0bb1tz0rz! Th3y st0l3 0ur pr3c10uzz!
There are these things called, uh, let me think, they're often connected to wires in the wall, umm, sometimes people forget to turn them off in movie theaters, err, they make noise when someone wants to talk to you, uh, damnit I forget. But they were the big thing a few years ago. I think I can even remember using them for Internet access, but maybe that was just a bad dream.
Gates' Law: Every 18 months, the speed of software halves.
Sure it's the developers' fault...
It's big business' fault...
It's the sysadmin's fault...
why not blame canada?
Remember how long it took for the good guy virus, in the movie 'Independance Day', to crawl into the alien systems and do bad?
Seemed like minutes to me... too bad they didn't have the expertise of the Slammer writer to put to use then, eh? Those filthy off-world slime would have been heading for the exists much sooner me thinks....
Name a security measure that is mere intimidation. Name a measure that has no added value and is just shiny armor. (This does, admittedly, apply to local security measures using biometrics; thumbprint scanners are less secure, at least on the consumer-grade, and just cooler looking, but I don't think it applies quite the same way to real network security measures.)
Your point is well-taken, that companies have no incentive to sell something that works above and beyond selling what sells, but it neglects that the two generally do go together and the leaders in the field tend to have true committment to security.
I suppose the drive to release the worm while there is still a sizable pool of vulnerable hosts is one justification for the distinct lack of QA by worm developers.
Specifically, I would have done more testing on the PRNG (run in a sandbox, check IP target coverage), added code to selectively target "nearby" hosts (bypass randomization of the first, second and sometimes third byte), and perhaps looked into spoofing the source port (lots of badly written firewalls allow inbound packets that show a source port of 53, etc).
And to get really nasty, every few packets, set the fourth and sometimes third octet of the IP to .255/.127/.63, to get that whole smurf effect going in your favor.
Nonesuch@Chicago
"The happiest day of my life was when the doctor said I didn't have worms anymore"
> Cut off their arms?
Cut off their access.
Ã
You want to know where slammer went wrong and the next one is gona hit? If you really wana cause internet hell, do not infect the machine, do not even get to it. ONLY infect the switches and routers. Not the ones that joe shmoe has at home, no, the ones that are on the fiber, the ones on the backbone. Make them send random junk data to each other at the 'spec limits that the OEM put on the hardware. Then the hardware the net is based on will kill itself - latency hell. The only way to fix it would be to reset each one by hand. It WILL happen, only a matter of time till some moron will think of this and feel inclined to do it. Just the right code in an ICMP packet and we are down for the count and shipped away in the ambulance.
It figures. The BOFH not only has a /. account, but is reading it during 'work'.
The problem with Ender's worm is that by design it is self-defeating. The idea of a "worm farm" of different units targetting different systems is effective, but with a common communications protocol, it negates the worms' ability to evolve and thwart detection. The writer of the paper talks about the worms' needs to change signatures to avoid AV detection, yet communicate with other units by a common question-and-response session, which would make it incredibly easy for any infected unit on the network to be easily identified.
To date, what gives away worm activity is the incessant talking they perpetrate, which is necessary to their propagation. So the key to any "super worm" isn't necessarily the speed at which it can infect nodes, but how quietly this can be done. I would argue that a slow, methodical infection, at a pace which makes the activity unsuspicious, has the potential to be much more dangerous.
Maybe this would be the ultimate worm.. two modes.. the first one slowly propagates and avoids detection, then a second phase which triggers a more aggressive frontal assault.
Lyrics include:
enjoy!Yeah, I know that's what you said. My way is cuter.
A key point of this article is patch-based security won't work, and signature-based virus scanning won't work, against a competent attacker. If someone discovers a new exploit and crafts a fast-spreading attack based on it, the attack can take over a vast number of hosts long before there's any response.
This issue is a bit more complicated than you think.
Whoops. So much for 'release early, release often.'
I guess that does it. No more Open Source projects freely released and enthusiastically and continually updated.
Hey, when is someone going to be nice enough to the world to make a purty li'l worm that actually shuts off all the security features that are exploited in Outlook...
I am sure there are plenty of reasons not to do this, but if you asked the person politely like.
"Hello, this is your friendly internet virus fighter coming to say hello and give you a hand! Would you like to turn off the features now that allowed me to hack into your computer?
| Yes | No |"
*click*
"Thank you and have a nice day! If I come back again that means a new hole/exploit was found in Outlook and I can give you another helping hand!"
Security that works (err, was supposed to work?) through intimidation: The Windows 9x login prompt. I don't know how many end users I talked through hitting escape there during my days on a helpdesk.
The key to the enjoyment of pop music is to replace any instance of "love" with "C.H.U.D."
Comment removed based on user account deletion
Comment removed based on user account deletion
"on the network. For computers to be useful you have to have some level of trust"
This is what Palladium is all about. Executable code is signed, and it can only run if you choose to trust the publisher. Viruses are less of a problem because an infected file will fail signiture verification.
Microsoft may be misguided with Palladium and the DRM goodies that it includes, but the underlying concept of trusted and untrusted code is a good one.
Might I add, however, that the same thing can be done without the complete hardware implementation of Microsoft's product. A simple signed executable system would do the trick. Microsoft already uses this for ActiveX controls.
That's the price you pay for supporting a monoculture. I run a Linux and Macintosh network here, and we were entirely -- let me repeat that, *entirely* -- untouched by this toy virus. Even our two Windows users were untouched because I tell Postfix to strip scripts from their mail.
So the Wintel world got hit with a script virus du jour. Tell me -- what's the problem? Sympathy: zero.
In all the places that stress not opening unsolicited attachments, there is usually a note about sharing the entire C Drive.
Good networking practice says only share what you want people to access.
liqbase
"""
This is what Palladium is all about. Executable code is signed, and it can only run if you choose to trust the publisher.
"""
How do you know if you trust them or not?
THL
Keeping
Until someone configures their linux system to recognise .exe's in mail, and automatically launch Wine for them.
Don't laugh, it _will_ happen.
THL
Keeping
What kind of a monkey?
Fatuous argument. Nuke the server. No machine can survive a direct nuking therefore no software can be secure.
You've got to specify your threat modal before you judge security. You can't just bring in arbitrary threats post-facto.
Phil
Keeping
Technically, yes. However, the issue isn't really the worm du jour but the potential of break-ins. What freaks people out is that they are sitting ducks for data-thieves and vandals. The possible (not necessarily real) existence of an attacker is enough. Slack OS's and users are responsible for that problem.
Remotely exploitable vulnerability found in IIS!
"Hmpf! Grrr! Must... install... patch!"
-Clickity click click-
"Raaaah! Damn nose! I didn't want to donate $20 to the RIAA!"
-Clicky clicky click-
"Nooo! Now I have deleted all my files! Why must my nose be so flat?!"
... well, anyway, one somewhat movtivated gang of authors. The hardest part is probably finding somebody with Cisco hacking experience. At least the last couple of worms weren't that malicious - they got their 15 minutes of fame, but didn't wipe the disk drives of the machines they'd infected.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I think it's a good thing that even so many NICs allow promiscuous mode and changing MAC address. If they didn't some lame-ass designer would think those are security features and rely on them while designing a new security model. Have you noticed how some very old protocols rely on IP numbers for "authentication" or "security". Perhaps when those protocols were designed the IP numbers were fixed and couldn't be changed easily? Or perhaps the security wasn't an issue back then when everybody had to trust everybody in the net to make it work, or something. Compare fixed MAC or IP to public key security and you'll immediately notice that those two are from totally different ballparks when it comes to the security. For example, the RSA is even in theory hard to crack to the best of our knowledge -- fixed MAC or IP is "hard" to crack because the "hardware doesn't allow you to change it". In cases like these, it's always the blackhats who have have the hardware that allows those "impossible changes" and whitehats just think they're safe.
You cannot trust on obscure hardware if you want security - it just quarantees that every issue is much harder to notice in advance, not that those issues didn't exist. (See also: DeCCS)
_________________________
Spelling and grammar mistakes left as an exercise for the reader.
You have stated a truth. I am pointing this out to bring this reality to the masses. Yes, I am willing to spend a few Kharma points to propagate this and point out a fact to the Slashdot community.
Many eggheads will debate the truth of my action.
I stand by it.
Matrix2110
Although Palladium may help with some worms, since Outlook Express is a "trusted application" (at least by Palladium...), those .vbs scripts will be run as trusted apps; this will allow better than half of the viruses currently circulating to continue to do so.
It's almost amusing to read my mail in kmail with HTML rendering turned off, and look over the attached scripts that arrive in my mailbox now and then. It makes me feel like an entomologist looking though a magnifying glass at a venomous spider pinned to a corkboard.
"Can't you see that everyone is buying station wagons?"
I quote:
:)
a speed that 'a "better" vulnerability would have enabled infection of the entire internet in 15 minutes, a "flash worm" or a "Warhol Worm."' I think 'better' to mean 'able to infect across a lot of platforms.'"
I love the way, after creating a chaotic sentence by leading into a quote the wrong way, he then tries to fix it up by writing another sentence that also contains an error. He didn't press the left arrow key a few times to go back and fix the first sentence, he just kept writing
Whence? Hence. Whither? Thither.
Sophisticated methods of dealing with intrusions abound here. We're way behind you. My Big Boss issued an edict last week asking that we "log in at 8:00Am, not 8:05Am" Well, no one unlocks the door until 8:00Am, so they Cannot get logged in until say, 8:05Am. If that is the current state of IT/Management directives here, then how in the hell are we to even begin to run with the big boys on /.?
> You can bet your ass that if
I'm not really interested in WHY there are no worms that try to infect my Mac.
Actually the fact THAT there are no worms capable of infecting my Mac is absolutely sufficient to make me a happy customer.
And - by the way - since the SystemUpdate on MacOSX works close to absolute flawlessly*, I doubt that there is a significant percentage of unpatched Macs out there.
Compared to the heaps of unpatched Windows-PCs AND Linux-Boxen I know of. (But am not responsible for.)
k2r
* Of course the no-login-button bug in the last update was funny, but since most people use the return-key to finish entering their password, it didn't matter.
No offense, but you seem to have gotten your "facts" from Hollywood, instead of from actual history.
1) The longbow did not make plate armour obsolete, it was one of the factors which made it _necessary_. I.e., quite the exact opposite. What longbows, crossbows and impact weapons did make obsolete was chain armour.
What eventually made plate obsolete was the constant evolution of firearms. When it got to the point that an armour thick enough to stop a bullet was too heavy to run around with, armour was discarded.
2) About the knight laying helpless on the ground, that's utter and total BS. It originated in Mark Twain's wild imagination, and is not supported by any historical or achaeological data.
A full suit of combat plate weighed about 60 pounds. Even if you're a total geek, you don't collapse helplessly under 60 pounds. Knights in full armour could and did fight on foot when needed.
What helped make this stupidity seem believable, were two things:
A) Tournament armour. Unlike real combat, a tournament was a sport with rules. Thus the equipment for it didn't have to be the same as actual combat equipment. (The US Marines do not wear the same gear as a US football team, either.)
Tournament armour was considerably thicker on likely points of impact, i.e., on the front, but thinner to the point of offering almost no protection on the back and sides. Still, on the whole it was heavier than regular combat armour.
B) Firearms era breastplates. As firearms became more and more powerful, the first counter-step was to concentrate all those 60 pounds into just a super-thick breastplate and helmet.
_But_ at that point that was _all_ that the soldier would wear. Those super-thick breastplates did _not_ have a matching back plate, nor leg or arm protection.
I.e., taking one of those breastplates and extrapolating its weight to a full suit that thick is just pointless. Such a suit never existed. Ever.
3) The comparison to computer security is pointless anyway. Armour (plate or otherwise) was _never_ supposed to make one 100% bullet (or sword) proof. At that point you'd also be too immobile to actually fight well.
So in fact what happened there is simply trying to give those troops enough of an edge. If your knight in a plate suit was more survivable than one without armour, then you paid for a plate suit. When, on the other hand, armour became a liability (too heavy and still didn't stop a bullet), they just discarded it.
Again, the purpose _never_ was to make the wearer invulnerable.
A polar bear is a cartesian bear after a coordinate transform.
The problem is, the original poster made a very strong and unfounded statement. If you say something is theoretically impossible, you are saying that is can never be done no matter what, not just that it cannot currently be done.
For example, by your argument it is theoretically impossible to put a man on Mars, because no technological advance has so far enabled us to do it.
See the parallel here???
Some fairly simple patches would go a long wayMaybe some more lines to make each person's backups readable by that user and only that user.
Scenario:
This code has not been signed (or is signed by an unknown publisher) Click OK in this box could transmit a virus, destroy your hard drive, subvert your nations economy, summon flesh eating aliens and damn us all to eternal hell.
Yes, checking signatures on code you execute is a good thing, but there are specifics to be concerned about in an implementation. How to you guarantee the signature? Obviously, some sort of authentication, and method of checking the signiture against, perhaps, a public key is needed. And to handle that you need a web of trust that's workable. But none of that matters a whit if users aren't careful about the trust, and don't investigate. Nor is it worth a darn if they ignore warnings. These problems (aka user education, and poorly designed secure systems) have to be taken care of before any of this will be useful.
"No nation could preserve its freedom in the midst of continual warfare."
--James Madison
I can't say that I don't give a fuck. I've just run out of fuck to give.
That's an excellent idea.
If new releases came out less frequently, there would be more time for the developers to test their code in the different configurations, to throw it to Aunt Tillie the sysadmin and to see how it might hose their internal corporate network.
"Provided by the management for your protection."
There is no patch for human carelessness.
Full Scale Nuclear Destruction is a good patch for the folly of humans.
OK, first up, the longbow predates the use of plate armor by quite a bit. And there were composite bows (horn/bone/wood/sinew laminates, don't confuse composite with compound aka pulley-type bows) in military use that were capable of penetrating plate long before the English/Welsh longbow became the terror of Crecy and Agincourt. The Parthian horse-archers used composite bows against the armies of the Greek city-states in ancient times!
Second, the knightly class certainly did not ignore the possibility of being brought down by the peasantry. Feudal European military castes preferred to capture their opponents alive whenever possible, because of the practice of ransoming captured enemies for enormous sums. The knighthood would claim that they only wanted to fight their equals for reasons of honor, but more practically they stood a better chance of surviving a defeat by a "gentle-man" than by a peasant levy armed with a hammer or spear (who would be unlikely to gain any significant fraction of a ransom). It's a classic risk/benefit analysis: don't start bar-fights with little guys, you have little to gain and much to lose!
Note: I don't disagree with your point, but rather with the example you used to illustrate it. Defense in depth is better than Maginot lines, combined arms are better than reliance on a single weapon, and the history of conflict is an infinite loop of thesis/counter-thesis/synthesis.
DOC, XLS, MDB, BAT, ZIP, TAR.*...
Ok, so those aren't obvious carriers in the same way that you classified the filetypes that you listed. However, they are all potentially capable of carrying and delivering malicious code and, at the same time, all potentially valid attachment types.
The problem with blocking attachments is that certain filetypes are often used for virus distribution but also for valid email. Something like PIF can be blocked because no one sends PIF files as attachments. Blocking an EXE or a DOC file may have unforseen consequences, however. The solution isn't to block every suspicious filetype that comes through. Running those files through a virus scanner on the server side would probably be a good idea, though. Of course, that'd use more CPU time than just delivering the message, so messages might end up being delayed a few seconds, but it's a small price to pay.
Look, we white hats are legit because we have houses, and kids, and real lives outside of computing.
The black hats rarely have more than one of the above...
We don't write worms and viruses because of the legal liabilities involved. Take Slammer, (probably written by a grey hat because the average SQL admin is apparently so incompetent they were putting the whole infrastructure at risk by never patching) for instance; do you think a big bank would care that your motives were pure when you brought down their ATM network as a side effect of your "good" worm's propagation?
Releasing good exploit code is very dangerous, and white hats are very careful how they do it. Black hats don't care, the code is the point for them and destructiveness provides an easy measure for code effectiveness. Grey hats dance on a taut line... and get reviled whenever they fall off it (see recent slashdot interview with Fyodor for an example).
Well, but it is the fault of the criminals. It's very sad that most of us live in societies where your point seems to implicitly make some sort of sense, but no one should lose sight of the fact that there is really no one to blame for this but the instigator. Because another parallel that works, unfortunately, is:
"You got raped because you were showing a little leg and walking down a dark street?"
You can dress more conservatively and only walk down lit streets, but by refusing to address the root issue, you give up some of your freedoms. Same thing here; there are a lot of neat, open things that we should be able to do with computers to make our lives easier without having to give in to the criminals who write these things. The parent post you are replying to has a good point--we shouldn't be putting more effort into locking ourselves down than we are in to finding and dealing with the offenders.
No relation to Happy Monkey
It will be 1000 times more destructive to slowly corrupt say, 2% of the database every week, then wipe them out after a year. That way, by that time, probably all backups they kept are corrupted, and even if they keep year old tapes, it is horribly out of date.
Oliver.
It is.
No-one forces criminals to steal someone else's property just because it doesn't happen to be locked up, tied down, or otherwise secured. Theft is a choice.
I'm old enough to remember when discussions on Slashdot were well informed.
I would disagree there. Computer worms actively seek out computers to infect, compared with viruses that only spread by contagion.
With human diseases, if most potential hosts are immune, then an epidemic cannot develop. The minimum immunisation level is generally considered to be about 95%. At that level, the chance that an infections person will meet and infect a non immune person in the week or so that they are infections but not obviously sick is low. The situation is similar with old style (boot sector) viruses.
On the other hand, modern worms, are designed to seek out susceptible hosts, so even if only 1% of computers are susceptible, then they will all become infected, quite quickly.
The rest of us, who have patched our systems, now have to put up with constant probing from the infected systems out there. What we need to do, is to find a way to quarantine infected hosts as close to source as possible so that they are less of an hazard to the rest of us.
And harsh spankings for MS for making 'hide file extensions' the default. Seriously, this is one of the biggest reasons stuff gets clicked on. Everyone says '.jpg files are safe' and so something comes in .jpg.vbs which MS shows as .jpg, since it hides the file extension, and even somebody who's folloing the instructions regarding .vbs files doesn't realize they're getting duped by the UI.
.doc and .ppt and .jpg extensions! People think extensions are confusing!' Which is true. A lot of casual users don't like file extensions. But the answer is not to hide them. If they're bad, they should be replaced with a less confusing system. Whenever I get on a coworker's machine where they're hidden, I usually just quietly unhide them and the say 'make all folders like this one'. Admittedly I'd hate it if somebody changed my UI settings without asking me, but no one has complained, so they probably just hadn't realized they could do it. And since we all use Solaris machines as well, they're all more than capable of coping with a few file extensions.
I know that MS is thinking, 'People don't like to see all those
if ($it != $onething) {$it = $another;}
I would hope that the grandparent, when talking about longer release cycles, was referring to major version release cycles.
The open source model of release early, release often is great, when people don't inflate version numbers. =P
You'll note that even the Linux kernel has a very long major version release cycle, and a respectably long MINOR release cycle. The revision/patches keep flowing, but basic kernel functions (mostly) dont' get revved in 18mo or less unless they're severely and completely broken.
Commercial/Cathedral-style software might be better served by lengthening severely the amount of time between 1.x and 2.x, instead of releasing a new one every 18 months or so (Microsoft Office).
Especially since most Office users would be happy with Office 97 (and many are!)...what are they adding that makes it slower every year?
"America has done some terrible things. But I know that Americans don't cheer when innocents die." -Dave Barry
I'd say get rid of all the youngsters that are too busy bitheading about all the latest languages and "technology" constantly flooding our industry, and put the old time quality coders back to work. Then we can focus on quality of things which include security. 23 years software and I'm doing bike mechanics to pay the bills. Thanks Seattle.
I appreciate the correction.
Ultimately you are just adding another layer that must be circumvented.
If your computer only runs trusted code, you need to figure out how to fake trust.
It will get harder, but unless the computer becomes an appliance that can only run what's built in at the factory can virus prevention even be possible. And then that assumes the software still can't be exploited. And when has Microsoft (or anyone else) ever written flawless software.
Moving protection into hardware will made it harder, sure, but just like DRM, you can never eliminate the problem 100%.
You are in a maze of twisty little passages, all alike.
[...] (or anyone else) ever written flawless software.
I'm pretty sure that Pong was flawless... It might not be the best game anymore, but when was the last time you saw it get infected?
(\(\
(=_=) Bani!
(")")
It's easy to imagine... could dwarf the depression of 1929.
And the next one begins
Let's take a rational....
I am in favor of the latter, but I think Rob's gone a little over the top on this subject.
Which is more likely:
I think the latter, and banking already has existing infrastructure to deal with that.
As far as food deliveries held up for a week (or a month) in large areas, floods and earthquakes do that more effectively than an internet loss would and we cope. When it happens, it's not even usually a week's worth of CNN-level coverage when it happens. Why? Because we have existing infrastructure for that too.
Is Cyberterrorism a potential issue? Yes. But at a level (yet) where even a very, very clever terrorist could cause national-level difficulties? This AC doesn't think so, because in most cases we do actually have existing infrastructure to recover
Running those files through a virus scanner on the server side would probably be a good idea, though. Of course, that'd use more CPU time than just delivering the message, so messages might end up being delayed a few seconds, but it's a small price to pay.
Speak for yourself, it really depends on the amount of mail your server processes.
New things are always on the horizon
Office 2000 is fast enough to still be usable on my 486DX-100 laptop. The 'slower every year' meme is often exaggerated. Granted, if that laptop were my only machine I wouldn't be very happy running Office on it. And it's installed without all the croft they dump in.
Conceded...however, it was my experience that
Office 95 = much faster than Office 97, but Office 95 = teh suckz.
Office 97 = marginally faster than Office 2k.
Office 2k = arguably best of them, much faster than Office XP
Office XP = dog slow, but not as slow as Office 2k3.
This is based on personal experience with the machines at work, where we have licenses to all of the above (The horror!)
"America has done some terrible things. But I know that Americans don't cheer when innocents die." -Dave Barry
SQLSlammer was a work of professional virus design, but it was not a flash or Warhol worm.
These terms describe particular exact techniques which it is projected will infect all or most infectable machines on the 'net within 3, or 15 minutes, fusions of using a prescanned "supernode" structure to get fast machines first, and intelligently split IP scanning horizons to distribute the load (which is much more efficient than random scanning - if you don't understand why, do you understand why quicksort is "quick"?).
SQLSlammer was a conventional actively infectious internet worm, and possibly at or near the very pinnacle of it's class of worm in terms of rate of infections. A work of art.
A vulnerability which runs arbitary code immediately on receiving one single IP packet (UDP).
This is important. No unusual backwards communication whatsoever - no TCP handshakes, no "it went okay, I'm infected" messages. Literally fire and forget - if it's infectable, it's probably infected (if the packet got through) - doesn't matter, onto the next host. Worm doesn't need to know.
A worm small enough to easily fit into the overflow payload - which means being smart about what you have to lose for extreme small code size.
Prescanned tables are right out. Split horizons are right out. Most smart stuff is right out. Jettison all forms of stealth, polymorphism, multipartitism - even reset recovery! No smart injoke messages or badly spelled CVs for this worm. No remote control or update, no botnets and absolutely no smegging peer-to-peer encrypted proxy networks. It disdained modern principles of virus design (big and bloated) for the KISS approach. Check the RNG. Simple, classic, very small, no very obvious patterns that cause the traffic to clump - predictable but quasi-random enough to work and above all, small and fast.
It all goes out for an assembly-language coded classic worm whose entire purpose is to reproduce as insanely quickly and proflificly as possible, with no regard to the survival of the host. It wasn't aiming for longevity, it was aiming for fame - for exactly this Slashdot article, and for the hysterical news reports about it despite the fact that, bluntly, it didn't do any actual damage that script kiddies don't already (just more so).
Slammer's goal was to go for one vector, all out greedy, and do it as quickly as possible - even to saturate the network completely with infectious packets, creating a huge red flag, possibly causing massive denial-of-service on networks with infected machines connected.
It was a case study of experimental peak potential infection times for a known patched hole. An upper limit if you will. One would note that the AV companies were the ones collecting the data in this experiment, and the professionalism and sheer to-the-point nature of the code points, in my view, towards one of them.
It was either a real-world research experiment and/or or it was the antivirus companies just blagging for massive PR, but it was not a bored little kid. Most bored little kids don't code that tight these days, and they really don't tend to design that well. And the bored little kids that do code worms that tight... well we just hope they grow up before they release their projects.
Slammer is chickenfeed next to a flash worm that uses all of the sneaky techniques above. Slammer is irritating, but it does serve a useful purpose - you know when you've got a machine vulnerable to that exploit on the network, because when you plug it into the network, the network stops. (Even today, note that it still only takes one packet, and one infected host on a cable modem could go through the whole net in a week. Fancy your chances?)
Get infected with something like the Curious Yellow paper describes (only smarter because that paper was frankly, a bit shite) and you have a very serious problem...
By the way, for any worm authors out there, now is the perfect time to strike. There is a known vulnerability in the super
Ever since explorezip (the worm before that I Love You thing) appeared and wiped out most of our office network, I have thought that the whole anti-virus industry was on the back foot.
At work we all have this little anti-virus icon in our task bars, updating virus libraries from a central server (and slowing down all our machines as well). But if a new Outlook worm came out and we all started opening it, the anti-virus software would just ignore it until the patch came out. Even if the gap between us getting the worm and the patch was a few seconds, the damage would be done.
So why are we paying thousands of bucks a year for anti-virus when we know it probably will do nothing? Sure, it catches the occasional tired Word macro and maybe an antique trojan on an old floppy, but is that worth it?
Hmm.
"And the meaning of words; when they cease to function; when will it start worrying you?"
Pong wasn't software... it was implemented in hardware.
The Pong machine had no CPU.
You are in a maze of twisty little passages, all alike.
Pong wasn't software... it was implemented in hardware.
The Pong machine had no CPU.
In all seriousness though, the idea "flawless software" only has meaning when we are talking about non-trivial software. Pong, or Tic-tac-toe, or Nim, etc are trivial.
Of course, in Microsoft's case, calling memcpy( ) must count as non-trivial software since they seem to screw it up so much.
(Sorry for the double post...)
You are in a maze of twisty little passages, all alike.
Well... blocking files like .zip and .tar and other archive files aren't quite the danger you make them out to be, themselves not being carriers... the worst that could happen opening up one of those files is to launch the archive program to check out what's inside, but merely opening those files won't infect you...
.exe files go however, those should be blocked. At the very least, you should have to confirm whether or not to allow that file to come through.
As far as
If one needs to send an exe file to someone else, it should be packaged in a zip or other archive if for no other reason than to prevent the program from running accidentally.
I'm not so suspicious of exe files sent to me inside archives. I can toss the archive around, open it and close it at will and not worry about an accidental infection before I can get around to scanning the contents for virii. An exe file, however, all it takes is a little keybounce on a mouse button at the wrong moment, and its too late.
BAT, VBS, EXE, COM files are all executables and should be treated with suspicion...
ZIP, ZOO, LHA, TAR, CAB, RAR files are all archive files and, by themselves, aren't dangerous... it is the files contained within that may or may not be dangerous, but you don't have to worry about them as much, since being within an archive, the risk of accidental execution just isn't there.
The differences are in how the files are treated... for example, a GIF, JPG, BMP, WAV or AVI file isn't dangerous... even if someone imbedded a virus code within those files, those types are never executed so any virus code within is inert. At most, the program reading those files will report an error in the file. The same goes with ZIP, LHA, ZOO, CAB and RAR files.
Cogito cogito, ergo cogito sum, cogito.
I think I'm going to cry, it's so lovely. Why don't people who can write this kind of stuff apply themselves to other things?
--- 11 meters/second, or 24 miles per hour - the airspeed velocity of an unladen European swallow. Really.
Did you mean to say "Fatuous argument:" (Note the colon.) I would have to say that a well-nuked server would be extremely secure. Certainly the data on that server would never be used for any malicious purpose.
No, this simply won't work.
1) You can still execute unsigned code, the system is then just going to "compromised mode" and some crypto stuff is turned off (like the encrypted parts of your hard drive where media is stored)
2) If you want to run code not signed by Micro$oft like the "evil" Kazaa-lite, as promised possible there will just be a box appearing like the "this word document might contain macro viruses - run anyways?"-box, that morons will click away with "yes" anyways.
While it sounds draconian, it's not even much of a problem. If someone needs to send executables, we already know in advance, and so we rename the ZIP to a ZAP or somesuch and it goes through just fine. For the bigger stuff, we just dump it on an FTP server somewhere and exchange it that way (bigger than a few hundred K doesn't belong in email anyway.)
When I first heard about it I thought it would be much more of a problem. It wasn't. It's actually quite nice, because I don't even see most of the crap worms, etc. I just wish they'd block more of the stuff from within DOC files, such as blocking any Office documents that have scripts or macros in them. (I've ony had one resume show up that had a macro virus, but it was old and my antivirus software patched it.)
John