IBM's Billy Goat Squashes Worms

Goat? by Anonymous Coward · 2003-09-01 01:03 · Score: 0, Funny

Oh my god. This has got to be a joke. Bring on the screenshots

Billy Goat by shird · 2003-09-01 01:06 · Score: 5, Funny

This is a play on the name "Bill Gates", surely? Why else would they call it that. Interesting concept nonetheless.

--
I.O.U One Sig.

Re:Billy Goat by bubbasatan · 2003-09-01 01:21 · Score: 3, Insightful

An amusing interpretation, but how about calling it a billy goat because it will eat anything?

--
Windows is going the way of phlogiston...
Re:Billy Goat by HeroicHorst · 2003-09-01 01:35 · Score: 1

But the play on the name is not really funny...
Re:Billy Goat by Anonymous Coward · 2003-09-01 01:43 · Score: 2, Informative

Actually, it's probably more likely they are referencing the folk tale of the Three Billy Goats Gruff.
Re:Billy Goat by KoolDude · 2003-09-01 01:53 · Score: 4, Funny

In giving out the details, the researchers mentioned that the full name is Williamy Henry Goat III. They also announced that a helper software code-named Steward "Monkey" Bawlmer will be released soon.

--
getSexySig(); /* returns sexy signature */
Re:Billy Goat by cockroach2 · 2003-09-01 02:27 · Score: 2, Interesting

funny thing is, in some swiss dialects, "geiss" (swiss-german for goat) is pronounced exactly like "gates" without the t, sort of like "gayss"...
Re:Billy Goat by Anonymous Coward · 2003-09-01 02:28 · Score: 0

Perhaps it's a derivative of the term "sacrificial goat", which is another way of saying "honeypot".
Re:Billy Goat by Brent+Nordquist · 2003-09-01 04:41 · Score: 1

Billy Goat why do you make this possible? Take our money and fix our software!!

--
Brent J. Nordquist N0BJN
Re:Billy Goat by njchick · 2003-09-01 09:17 · Score: 1

Google image search confirms it.
Re:Billy Goat by Anonymous Coward · 2003-09-01 09:35 · Score: 0

Uh, yeah... that's really fucking funny. NOT.

So you're saing the word sounds like Gates, but it doesn't? How is that funny?
Re:Billy Goat by Anonymous Coward · 2003-09-01 09:46 · Score: 0

Ulp. This bodes not well for the trolls among us.

inapproporiate title? by lingqi · 2003-09-01 01:06 · Score: 3, Interesting

squashes worms?

it is a detection system. and an imperfect one at that: heck even the designer for the software itself says this...

besides, if it's an outlook mail worm, then every address it goes to is targeted correctly, and Billy Goat will go on munching it's grass and not have a clue while the network slows to a crawl.

I mean, of course it can look for surge traffic, but how do you distinguish that vs. a simple slashdotting?

--

My life in the land of the rising sun.

Re:inapproporiate title? by farnz · 2003-09-01 01:15 · Score: 5, Informative

Something like Blaster scans the network for vunerable machines; some of these IPs are unassigned. Billy Goat detects the attempts to access unassigned IPs, and alerts admins/firewalls your box off/generally makes noise.
The result is that something like Blaster gets caught before your whole network is infested; Billy Goat ignores a slashdotting, since all the traffic goes to assigned IPs.

--
I appear to have a blog. Odd.
Re:inapproporiate title? by Anonymous Coward · 2003-09-01 03:17 · Score: 4, Interesting

So then we're in a situation of either

a) The admins take 5 mins to work out what out whats wrong and block the traffic (on a good day)

or

b) The firewall gets its rules automatically updated by billy goat (with an addon?) and successfully blocks the traffic. ...Leading to the attacker having an easy way to do a DOS attack on the entire network (by scanning every possible port on an unused ip address)
Re:inapproporiate title? by Overly+Critical+Guy · 2003-09-01 03:34 · Score: 2, Insightful

The result is that something like Blaster gets caught before your whole network is infested.

Instead of buying something called "Billy Goat," you could also just download the free patch that fixed it a month before...

--
"Sufferin' succotash."
Re:inapproporiate title? by Anonymous Coward · 2003-09-01 03:53 · Score: 0

So basically it's like the code-red tarpits.
Re:inapproporiate title? by farnz · 2003-09-01 04:05 · Score: 1

I don't see the DoS attack here; as far as I can glean from the article, an attacker scanning every possible port on an unused IP address is blocked. No-one other than the attacker is blocked, so there's no DoS.

--
I appear to have a blog. Odd.
Re:inapproporiate title? by mcc · 2003-09-01 06:13 · Score: 4, Insightful

you could also just download the free patch that fixed it a month before...

I think the idea is that the product is going to be targetted at ISPs and people in similar situations.. you know, where the people controlling the network don't necessarily have control of the computers actually running on the network. What good is a patch if you can't get your users to install it cuz they're dumb?

--
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
Re:inapproporiate title? by Felinoid · 2003-09-01 07:50 · Score: 1

So all you need is a bunch of unique IP addresses doing the attack...

Like a worm...

--
I don't actually exist.
Re:inapproporiate title? by Anonymous Coward · 2003-09-01 09:48 · Score: 0

You seem to assume that a slashdotting wouldn't be worth stopping like any other network attack. ;)
Re:inapproporiate title? by vurtigo · 2003-09-01 10:14 · Score: 1

besides, if it's an outlook mail worm, then every address it goes to is targeted correctly, and Billy Goat will go on munching it's grass and not have a clue while the network slows to a crawl.

Errrr.... so you don't want an immune system because it doesn't stop bullets?
Re:inapproporiate title? by Olathe · 2003-09-01 18:08 · Score: 1

That's why they'd likely build in an exception list to the addon, so that certain ports aren't closed with certain IPs.

"earlier this month" by mirko · 2003-09-01 01:06 · Score: 5, Funny

I do not want to look anal but I think the submitter meant "last month" :-)

--
Trolling using another account since 2005.

Re:"earlier this month" by barzok · 2003-09-01 01:26 · Score: 1

He probably submitted it while it was still August.
Re:"earlier this month" by F452 · 2003-09-01 01:36 · Score: 5, Funny

I do not want to look anal but I think the submitter meant "last month" :-)
Eeyu! Look anal? I can see being anal, or sounding anal, but I'd hate to look anal!
Re:"earlier this month" by Ambush · 2003-09-01 01:38 · Score: 1

I do not want to look anal but I think the submitter meant "last month"
You obviously haven't noticed how long the editors take to accept a story, have you? ;-)

--
There are 10 kinds of people; those who know ternary, those who don't, and those now hunting for a dictionary.
Re:"earlier this month" by Anonymous Coward · 2003-09-01 01:44 · Score: 0

So you think the submitter meant "last year"?
Re:"earlier this month" by G-funk · 2003-09-01 02:07 · Score: 0, Offtopic

Eeyu! Look anal? I can see being anal, or sounding anal, but I'd hate to look anal!

[ insert ontopic goatse link ]

--
Send lawyers, guns, and money!
Re:"earlier this month" by b!arg · 2003-09-01 04:16 · Score: 1

No...only how quickly they reject mine...

--

Everybody dies frustrated and sad and that is beautiful
Re:"earlier this month" by billimad · 2003-09-01 05:59 · Score: 1

We used to have a saying when I was younger - "My face, your bum". No I mean, "Your bum, my face". Goddammit never could get the hang of that one. Ah "Your bum, my face". That was it.
Re:"earlier this month" by pipingguy · 2003-09-01 07:40 · Score: 1

Eeyu! Look anal? I can see being anal, or sounding anal, but I'd hate to look anal!

Maybe the owner of the original statement has two rosy cheeks and one brown eye.
Re:"earlier this month" by megabulk3000 · 2003-09-01 08:00 · Score: 1

I believe this is most appropriate in response to the question "Got a match?"
Re:"earlier this month" by dipipanone · 2003-09-01 10:32 · Score: 1

But the appropriate response depended on the gender and relative attractiveness of the questioner. If the question was asked by a male, the answer was 'Your face, my arse'. However, if it was asked by a hot female, that could be reversed to 'Your arse, my face.'
Re:"earlier this month" by Rellik66 · 2003-09-01 12:14 · Score: 1

Eeyu! Look anal? I can see being anal, or sounding anal, but I'd hate to look anal!

Obviously you have never been traumatized by the Goatse guy.

--
Too many zeros, not enough ones
Re:"earlier this month" by Edward_M · 2003-09-01 16:36 · Score: 1

or, "I like your ass, can I wear it as a hat?" or something like that :)
Re:"earlier this month" by mirko · 2003-09-01 16:56 · Score: 1

I actually thought the story was supposed to be bug-proofed by subscribers... ;)

--
Trolling using another account since 2005.

What's the point? by mOoZik · 2003-09-01 01:07 · Score: 5, Insightful

Detecting potential attacks is one thing and preventing damage and slow-down of the internet is another. Even now we can somewhat predict them before they begin to slow the entire net down. But seeing how something akin to these last two worms will slip right by even with our knowledge, this technology becomes rather redundant. Eventually, educating the end-user will be a greater force than some goat.

P.S. any coincidence it is named "Billy"?

--
A blog like any other.

Re:What's the point? by KrispyKringle · 2003-09-01 01:58 · Score: 4, Interesting

I'm not sure I follow you on educating the end user. It's definitely a good idea, to be sure, but it does little against worms that require no user interaction to infect the PC, like Blaster. Granted, if the machine were patched, it would help, but not that much. Many users are on slow connections, windowsupdate was unreliable, and the time it takes users to patch--a few hours, a few days--is easily enough time to become infected (I have a friend who connected a new XP machine to the 'Net to run windowsupdate and was infected in minutes).
On the other hand, security professionals can usually whip up IDS signatures in a pretty short amount of time--Blaster, CodeRed, what-have-you all have pretty easy-to-detect signatures--which could easily be implemented on a system plugged into the routers of ISPs. Detect a worm infected machine and lock it out. Simple. The same could be done with managed switches at corporate LANs.
This was actually suggested in a previous story; it's not that big a deal and probably in use various places already. Seems like IBM's only innovation is in detecting a pattern of behaviour rather than just the attack signature itself, in the hope that it will work, without updated signatures, to detect as-yet unknown worms. And even that's not that big a leap.
Re:What's the point? by mOoZik · 2003-09-01 02:12 · Score: 3, Insightful

All good points, but I was actually referring to the many worms which dwell in os holes. If users were educated enough to know why a patch is useful, then the effects of the last two (or three?) worms, for example, would be nulled. The warning and patch predated the swarm by 3 weeks. Even for someone on 56K and even with assumed problems with the windows update site, 3 weeks is plenty of time to avoid such a mess. Granted, it wouldn't solve all the problems, and a heavy fist on the side of the ISP's would alleviate the problems, but something like billy goat just doesn't solve them.

--
A blog like any other.
Re:What's the point? by KrispyKringle · 2003-09-01 04:26 · Score: 3, Insightful

I suppose there are multiple avenues to success. And while educating the end-user may be ideal, I just don't think its reasonable to expect that it will happen any time soon. Heavy-handed ISP's, as you put it, are a good alternative.
End-users often don't see why they should secure their PC's. They figure they don't have anything important on them, so what's the big deal? Then they are used as launching points for DoS attacks, they spread worms, and so forth. But end users don't have the time or inclination to be security professionals.
ISPs could implement stronger router controls to block DoS attacks from zombied machines. They could implement automatic IDS-based router controls to block the spread of worms. And--egads--perhaps software companies could start focusing on security a bit more (with some added incentive from the legal liability they ought to have, in my opinion). In other words, end users should be taken as end users. We cannot expect that all or most will secure their machines to the extent that you or I may. So we find work arounds.
Re:What's the point? by kdsolutions · 2003-09-01 05:12 · Score: 0

but it does little against worms that require no user interaction to infect the PC, like Blaster.

Actually, blaster (and other worms) required exactly the opposite... a LACK of user interaction... the LACK of willingness of the user to educate themselves and keep up a firewall, turn off unnecesary services, to learn exactly what a worm or virus is, and even to learn to turn the damn thing off and on properly (yes, my girlfriend's mother uses a computer, but someone else has to turn it on and off for her... she's afraid to do it herself in case she does it wrong)! the LACK of proper use and updating of antivirus software... the LACK of proper use and application of patches... the LACK of actually watching the news (or reading... the information usually get out a whole day or two faster on the 'net) to find out if there are any new worms or vir(ii/uses) and what to do to protect themselves or get rid of the virus if they already have it...

You are very much right... not every virus or worm requires user interaction... but almost all of them thrive on LACK OF IT.

--
Error 666 - Satanic SCO code found in your Linux kernel.
Re:What's the point? by moncyb · 2003-09-01 09:39 · Score: 1

What you say is true, but it doesn't mean something like Billy Goat isn't necessary. What if there isn't a patch for the security hole? What if the worm uses a 0 day exploit? Adding more defenses is not redundant. Luckily most worm / virus writers are stupid. Luckily they try to use already known and patched exploits. Luckily they don't know how (or aren't willing) to write really nasty worms.
What if someone develops a really nasty worm. One which uses one or multiple 0 day exploits. There is no patch and the vendor has to scramble to fix the problem(s). One which really digs deep into all system and program files, so the only way to fix it is reinstall the OS. One which also tries to imbed itself into the boot sector, then encrypt all the data on your hard drive so you lose all your data if you try to remove the worm--only the worm knows how to read your hard drive. One which trys to infect itself in the BIOS and won't let you burn back in the original, so the only way to clean it is remove the chip from your motherboard and reprogram it with an eprom burner (or whatever they use nowadays). One which uses an efficient infection algorithm with no bugs (they actually tested it), so it infects all vulnerable machines on the internet within hours or minutes.
This type of worm is theoretically possible. It hasn't happened because the people who write worms which are intended to infect the whole internet are mostly just stupid script kiddies trying to prove something. I'd worry more about worms which are specifically targeted at your company's lan. Those are going to be the people who know what they're doing, and intend to do things like steal your customer credit card database, destroy your network (maybe they are a competitor or a pissed off customer or some whacko "activist"), or some other really nasty thing which will screw you like there's no tomorrow. Billy Goat will probably help stop those too.

A computer system to seek out worms? by zippity8 · 2003-09-01 01:07 · Score: 5, Funny

So you're turning on a computer system thats intended to be intelligent enough to seek out and erradicate computer worms?

Did you NOT see Terminator 3?

- Those that do not learn from history are doomed to repeat it.

Or, in this case, those that don't learn from crappy movies. =P

Re:A computer system to seek out worms? by Psiren · 2003-09-01 01:24 · Score: 3, Funny

There was a story a while back (not sure if it was on /.) about a whole load of traffic on the net that no-one could account for or trace. Makes you think...

I believe Skynet went online August 29th 1997, but software is always late, no? ;)
Re:A computer system to seek out worms? by Anonymous Coward · 2003-09-01 02:20 · Score: 0

T3? Crappy movie? Talk to the hand!!
Re:A computer system to seek out worms? by Anonymous Coward · 2003-09-01 02:34 · Score: 0

Skynet has stolen SCO's IP.
hence the time travel and general bad attitude.
Re:A computer system to seek out worms? by Skater · 2003-09-01 02:53 · Score: 1

Didn't you see T3? Judgement Day is inevitable. :)

--RJ
Re:A computer system to seek out worms? by Anonymous Coward · 2003-09-01 04:20 · Score: 0

Talk to the dick!

Interesting technique by farnz · 2003-09-01 01:08 · Score: 5, Insightful

It sounds like a nice extension of egress filtering; you know which of your IPs are unassigned, and so you assume that boxes trying to access unused IPs are up to no good, and act accordingly (firewall the affected box off, and investigate). Slows worm propagation, and discourages people from scanning your entire address space unnecessarily.

--
I appear to have a blog. Odd.

Re:Interesting technique by hey · 2003-09-01 04:28 · Score: 1

Egress is exiting so don't you mean ingress (entering)?
Re:Interesting technique by Hubert_Shrump · 2003-09-01 04:28 · Score: 1

just turn on labrea and put a tail on the logs.

this slowed a kazaa box from scanning my internal network endlessly. little bastard. next step: boot it off Knoppix, shred /dev/hd*

--
Keep your packets off my GNU/Girlfriend!

pure genius... by DrStrangeLoop · 2003-09-01 01:09 · Score: 0, Redundant

...with connotations of both the young William Gates and the goatse.cx dude, i predict this meme to become quite popular here at /. and in IT at large.

strangeloop.

Re:pure genius... by The+Cydonian · 2003-09-01 01:11 · Score: 0, Redundant

Yes. I, for one, welcome our new goat overlords!

--
More than mere navel gazing.
Re:pure genius... by dipipanone · 2003-09-01 10:35 · Score: 1

In Soviet Russia, Goatse Man defects to the West

Well... by Kai_MH · 2003-09-01 01:12 · Score: 2, Insightful

You can always depend on IBM. They contribute to Linux... help Windows users... make awesome products, even if they do cost too much... But, hey, IBM is great.

Re:Well... by theTerribleRobbo · 2003-09-01 02:32 · Score: 0

Until they turn on us. :-)
Re:Well... by Anonymous Coward · 2003-09-01 03:35 · Score: 0

"Pointless" or "Mumbling to self" I could see, but "Troll"?

I think the poster just didn't have a point to make and wanted to post for the sake of posting...

hey, kinda like me!
Re:Well... by alangmead · 2003-09-01 04:10 · Score: 2, Insightful

I'm sorry. I remember too much of the antitrust suit against IBM to fully trust them. I'll thank them for each thing they do to help advance free software, and the computer industry as a whole, but I reserve the right to examine each decision individually.

As in "Billy Goat Gruff"? by Black+Parrot · 2003-09-01 01:12 · Score: 5, Funny

Will it butt trolls off the net too?

--
Sheesh, evil *and* a jerk. -- Jade

issues with this by segment · 2003-09-01 01:13 · Score: 4, Interesting

IBM says its prototype combines the strength of analyzing traffic directed at IP addresses assigned to computers on a network with the ability to look at the unassigned addresses worms also target.

What good would this do (checking unassigned addresses) as most worms (at least polymorphic ones) replicate and spread to other users it (the worm) finds on the machine. Hrmm sounds odd typing because I'm tired. Ok, for instance most MS based worms such as Blaster, Sobig, etc., tend to rip a list of address from programs on the infected machine. Blaster and Sobig sent out spoofed emails which differed from the normal worm a bit. Anyway, if a machine is sending info (while infected) to an unassigned IP address, what difference would it make since it somehow obtained the information locally.

Now, I understand that some virii writers often leave some 'h3ll0 i j4m l33t' message, but this is a rarity, so I find it obsolete.

It also can sniff out the signatures of known attacks. By testing the software at a large ISP, IBM can collect more data on worm traffic and help decide how to bring Billy Goat to market, says Adrian Schlund, a manager at IBM Global Services.

This is a bold statement for IBM to make considering they are now claiming to sniff out attacks. Considering attacks change, all they could do is update their rules, which means you could get by without this product if you have an experienced network engineer who has network anamoly detection experience. Hell if you've read enough RFC's and Cisco books, anyone would be able to detect and halt attacks using freeware such as snort.

Oh well it sounded good for a minute, it's a shame they didn't included any screenshots or specs in the article.

--
MoFscker

Re:issues with this by mOoZik · 2003-09-01 01:21 · Score: 3, Informative

Actually, some of the worst worms have used random IP's. The worms you mentioned only use the emails from the address books, as there is no way to get IP information from it. Therefore monitoring which IP's are fake will provide a method of early warning. Though that's all it'll do.

--
A blog like any other.
Re:issues with this by tesmako · 2003-09-01 02:47 · Score: 2, Informative

Repeat after me: Sobig is *NOT* a worm, it requires the user to execute the attachment. It relies on somewhat crude social engineering, absolutely not a self-replicating worm.
Re:issues with this by Seabass55 · 2003-09-01 04:22 · Score: 1

Since when did Blaster send out emails?
Re:issues with this by dago · 2003-09-01 04:50 · Score: 1

sobig != blaster != nachi

they share in common the vulnerabilities used

--
#include "coucou.h"
Re:issues with this by arkane1234 · 2003-09-01 04:58 · Score: 1

Now, I understand that some virii writers often leave some 'h3ll0 i j4m l33t' message, but this is a rarity, so I find it obsolete

Queue up the people arguing over virii versus viruseseses.

--
-- This space for lease, low setup fee, inquire within!
Re:issues with this by Anonymous Coward · 2003-09-01 08:40 · Score: 0

might as well be viruses because in Latin, 'virus', meaning 'poisonous stuff', appears to have been invariant, since there's not a single example in the surviving classical latin literature showing it used in the plural. It's just like you wouldn't talk about softwares.

It's definitely neuter, and there seem to be only four neuter nouns ending in -us: cetus (a whale), pelagus (the sea), virus (poisonous stuff), and vulgus (the crowd). Cetus and Pelagus come from Greek, keep their Greek endings and pluralise to cete and pelage. Vulgus is fourth declension and pluralises to vulgus (with a long U, vulg-oos from vulg-us). Vulgus and Pelagus were very, very rarely pluralised, and no-one ever seems to have pluralised virus. It *could* be second declension, the only neuter example ending in -us to have survived, in which case a good guess for a plural would be viri, but since that's also the plural of vir (a man), this seems a little unlikely.

If virus had a plural at all it was probably virus (long u, just like status (long u), the plural of status, but it probably didn't. Virii would, however, be the nominative plural not of virus but of virius, and there's not a single existing example of the word virius so it may well have never existed at all.

At the moment it seems to be a live battle for hegemony between viruses and virii, both of which are english words, neither of which is latin. I tend to use 'malware' (no plural) as, just like in the latin, there are so many of these buggers that after a while it all blurs into one great mass of poisonous stuff, or as the Romans would have put it, one great mass of 'virus'.

Incidentally, the plural of octopus is, IMHO, octopodes from the Greek, so ignore me :-)

Your Affectionate Cousin

AC
Re:issues with this by Anonymous Coward · 2003-09-01 09:44 · Score: 0

So you're saying it's a virus?
Re:issues with this by Anonymous Coward · 2003-09-01 11:13 · Score: 0

in which case a good guess for a plural would be viri, but since that's also the plural of vir (a man), this seems a little unlikely.

Unlikely perhaps, but also rather deliciously ironic. Especially if you happen to agree with the observation of a certain Smith. ;)

Detects port scans? by twelveinchbrain · 2003-09-01 01:13 · Score: 2, Interesting

TFA isn't very clear, but it sounds like the only thing unique about Billy Goat is that it detects port scans. I can't believe it would take a bunch of PhD computer scientists to figure out how to do that. Anyone else know what makes this thing special?

--
Not Found
The requested URL /signature.html was not found on this server.

Re:Detects port scans? by Anonymous Coward · 2003-09-01 06:29 · Score: 0

You might think that, but... did you think of using this for worm defense first? Or are you just belittling an idea that seems "obvious" after the fact? I, for one, thought there was a lot of interesting insight here. After all, most worms can't propagate without random scanning of unused IP addresses on a massive scale.

Which reminds me: how about IPv6 as a solution to worms? The address space is so big, it'll take too long for the worm to infect everyone. ;)

Slashdot Rule #1 by imadork · 2003-09-01 01:16 · Score: 5, Funny

Never click on a link with the word "goat" in it.

Re:Slashdot Rule #1 by Anonymous Coward · 2003-09-01 02:23 · Score: 0

Information on goats
Re:Slashdot Rule #1 by Anonymous Coward · 2003-09-01 15:38 · Score: 0

readers should also be wary of links containing the word "oats", as in: Hey, ma! I'm going out to sow my oatse!

In version 3 by Epeeist · 2003-09-01 01:17 · Score: 0

This will be in version 3, aka "Great Big Billy Goat Gruff".

Will _he_ sue IBM now? by geek2003 · 2003-09-01 01:20 · Score: 0, Troll

IBM can collect more data on worm traffic and help decide how to bring Billy Goat to market... Will Billy Gays ,er Gates, now sue IBM for illegally using his name to make money. After all TIBCO sued Apple on Friday for using the term Rendezvous!!

Re:Will _he_ sue IBM now? by FxChiP · 2003-09-01 03:20 · Score: 1

And Spike Lee sued TNN for trying to call themselves Spike TV! :P

Wow by AnonymousCowheart · 2003-09-01 01:22 · Score: 0

"...that slowed Internet traffic earlier this month."
Posted by Hemos on Monday September 01, @09:02AM
Wow, they're have already been worms this month???

Dumb Name by Kaz+Riprock · 2003-09-01 01:26 · Score: 5, Funny

If you built a software package that catches worms...why wouldn't you call it "Early Bird"?

--
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon

Re:Dumb Name by secolactico · 2003-09-01 02:27 · Score: 1

Somebody beat them to it.

Early Bird Intrusion Detection aims to catch the NIMDA worm.

--
No sig
Re:Dumb Name by OpenSourcerer · 2003-09-01 02:32 · Score: 1

May be it should be Darl the Early Bird!

--

Desi Noise, Live!
Re:Dumb Name by Paradise+Pete · 2003-09-01 03:56 · Score: 1

If you're a bird, be an early bird
and catch the worm for your breakfast plate.
If you're a bird, be an early, early bird...
but if you're a worm, sleep late.
Silverstein
Re:Dumb Name by wally@smug · 2003-09-01 15:04 · Score: 1

Many have! I'm working on a thesis at the moment that does just that, and others, such as GrIDS have coined the term "Early Bird" before.

Comment removed by account_deleted · 2003-09-01 01:33 · Score: 5, Interesting

Comment removed based on user account deletion

(M$) Bill Goatse? by VEGx · 2003-09-01 01:35 · Score: 4, Funny

Is that a hint that Bill Gates is into Goatse? I'm a nice troll, gimme a cookie.

Um, innovative? by Rogerborg · 2003-09-01 01:38 · Score: 4, Funny

if(>X packets received from ip
&& !reverse dns for ip)
block ip

Do I win $10?

--
If you were blocking sigs, you wouldn't have to read this.

Re:Um, innovative? by AArmadillo · 2003-09-01 03:06 · Score: 1

Do I win $10?
Unfortunately, you failed to come up with such a creative name as "Billy Goat" for your project. Who can resist software called "Billy Goat"? Perhaps you can call your project "She-Buffalo" and you'd have a chance!
Re:Um, innovative? by Rogerborg · 2003-09-01 04:43 · Score: 3, Funny

How about "ipchains"? That sounds kind of kinky, and I don't think it's been used before.

--
If you were blocking sigs, you wouldn't have to read this.

needs to be renamed by linuxislandsucks · 2003-09-01 01:40 · Score: 1

needs to be renamed to :

Billy we got Your Goat

--
Don't Tread on OpenSource

Re:needs to be renamed by MrHanky · 2003-09-01 03:45 · Score: 1

...or Billy, get your goat before you walk through that door.

Allright, I'm going back to bed now. Shouldn't post to Slashdot while having fever.

A better mousetrap, perhaps by Mostly+a+lurker · 2003-09-01 01:40 · Score: 3, Insightful

I have two immediate reactions. The first is that, on the face of it, there is nothing very revolutionary here. On the other hand, maybe all that is needed is a high quality implementation of techniques that are already known. I have read in several places recently that (excluding false alarms) rapid detection of attacks was not actually that difficult.

My second reaction is that the focus needs to be at the level of the ISPs. To expect all users to reliably protect themselves against attacks is just naive. Technology that could immediately detect attacks and prevent their propogation to individual users in the first place seems to me feasible and desirable.

Re:A better mousetrap, perhaps by Anonymous Coward · 2003-09-01 08:19 · Score: 0

I have read in several places recently that (excluding false alarms) rapid detection of attacks was not actually that difficult.

No kidding. The problem is the false alarms, which (with most Intrusion or Attack detection) runs upward of 90% of the alerts. You have to minimize Type 1 and Type 2 error to have a useful system.

Honey, I'm home by Alejo · 2003-09-01 01:51 · Score: 2, Interesting

The system uses a unique approach to detecting malicious software by looking at traffic flowing to Internet addresses that aren't assigned to specific computers, trying to isolate computers on a network that attempt to infect others.

and then

IBM says its prototype combines the strength of analyzing traffic directed at IP addresses assigned to computers on a network with the ability to look at the unassigned addresses worms also target.

Doesn't this sound like honeyd?

Re:Honey, I'm home by Anonymous Coward · 2003-09-01 04:17 · Score: 0

Well, there are many similar ideas floating around.
The Honeyd people just added a section on how to automatically disable the blaster worm. It seems that open source is ahead again of industry. You would just wish that more people were running such a setup.

LaBrea by MoogMan · 2003-09-01 01:58 · Score: 5, Informative

LaBrea - the "Sticky Tarpit". Seems like the same concept, and has a working, free implementation at http://labrea.sourceforge.net/

Re:LaBrea by Uberdog · 2003-09-01 04:11 · Score: 1

Actually LaBrea is a honeypot that refuses to release connections once they're open. So, it's not really the same at all, but it might slow down some worms if they were poorly coded.

Network Management Software by Dionysus · 2003-09-01 02:02 · Score: 3, Interesting

Doesn't network management software like NNM and whatever CA's stuff is called, work by doing ping sweeps and other stuff to detect new systems on the network?

Won't it break those systems?

--
Je ne parle pas francais.

Re:Network Management Software by Anonymous Coward · 2003-09-01 03:33 · Score: 0

"Francais" should be "francais" (lowercase and with a cedille)
Re:Network Management Software by arkane1234 · 2003-09-01 05:07 · Score: 1

Or more precisely, "ces gens qui gardent pour etre envahies".

--
-- This space for lease, low setup fee, inquire within!
Re:Network Management Software by Anonymous Coward · 2003-09-01 10:04 · Score: 0

No it won't, you just configure an exception for those sweeps.

How long before it's turned against file sharers by ralatalo · 2003-09-01 02:03 · Score: 3, Interesting

Seems to me that it it's aimed towards detecting sources that aren't published, that somewhere there needs to be a list of 'published sites'. If you're web, ftp, mail, cvs, filesharing software isn't on the list then it will flag everyone who connects to it for futher study.

How? With a bit of the old ultra-violence??? by Mjlner · 2003-09-01 02:13 · Score: 1

I'm wondering, oh my brothers, if "Billy Goat" is a really horrorshow name for this software. If I remember correctly, it was your humble narrator who gave most of the tolchocks, while Billy Boy was mostly on the receiving end. You might not remember the happenings all horrorshow like, oh my brothers, so let me refresh your memory...

"Well well well, if it isn't fat stinking Billy Goat Billy Boy in poison. How art thou, thou globby bottle of cheap stinking chip oil? Come and get one in the yarbles, if you have any yarbles, you eunuch jelly thou!"

All that is needed is worm called "Alex"...

--
Lemon curry???

Re:Billy Goat? by WindBourne · 2003-09-01 02:14 · Score: 1

Actually, he is probably thankful. This is exactly what MS needs to overcome their deficencies until they can get LongHorn designed and developed.

--
I prefer the "u" in honour as it seems to be missing these days.

A minor variation on this... by zen+parse · 2003-09-01 02:17 · Score: 3, Interesting

Here's an idea I had a while ago, (probably around slammer time) but never got around to doing anything about (because I don't admin any networks).

A module for your IDS which, if it detects a machine on your network is infected with something, automatically set your router to NAT that machine so it points to some server which will inform the user they are infected, and gives details on how to disinfect themself, or to contact the helpdesk, or whatever.

In addition to the NATing, the next DHCP request they perform could take them off the local network address space (except for the disinfection message machine) so they won't be spreading their infections locally.

The infoming machine would not just be HTTP, which could return the webpage, but also have SMTP, POP3, IMAP servers, whatever else they could be running, which return an error, which (hopefully) will be displayed by the users application, telling the user what is happening.

Even if the user doesn't receive the error messages, they would most likely notice something is wrong when they can't connect to anything, and even if they don't they are isolated from the internet, and after their dhcp lease expires (assuming it has a reasonable length) they would also be isolated from the internal network.

It sounds similar to the 'Billy goat' idea... I hope it's not too similar, or it might be covered by restrictive software patents. ;/

squashes worms?? by di0s · 2003-09-01 02:17 · Score: 2, Funny

I'm reporting you to PETA!! Oh wait, you mean computer worms...

Re:squashes worms?? by Anonymous Coward · 2003-09-01 04:06 · Score: 0

I'm reporting you to PETA!! Oh wait, you mean computer worms...
There's still time left, but I'm going to flip over all the cards and declare you the winner of the 2003 Least Funny Attempt at Humor award.

Traffic Analysis and Holistic Medicine by eer · 2003-09-01 02:27 · Score: 1

For years the common wisdom has been that traffic analysis attacks were too hard to master to worry about. It's interesting that the technique is now being turned on the attackers themselves as a means of detecting infections. Makes sense in the context of IBM's auto-immune system approach to system health.

But, note - in computer security, as in human health - there are two fundamental approaches:

once well, don't get sick
and

once sick, get well fast

A hospice volunteer I talked to last week pointed out that holistic eastern philosophies of medicine offer an interesting alternative perspective on how to approach "wellness". I wonder if there's something like accupuncture we should be exploring for intrusion detection systems and anti-virus/spam filters?

Re:Traffic Analysis and Holistic Medicine by vurtigo · 2003-09-01 10:08 · Score: 1

Interesting comment; I suppose in some sense it is a matter of scale. Given a sufficiently large system, it is always at least a little bit sick. The Billy Goat is fairly western in the sense that the whole point is targeted to address a particular and well defined problem well (network worms). At the same time, it fits into the category of once sick, get well fast.

Comment removed by account_deleted · 2003-09-01 02:29 · Score: 1

Comment removed based on user account deletion

Billy Goat.... by Anonymous Coward · 2003-09-01 02:35 · Score: 0

Billy Goat, why did you let this happen? Stop making money and fix your software!

In case you don't get the names... by Vexar · 2003-09-01 02:41 · Score: 3, Insightful

short for anal-retentive, a 'clever' way of articulating someone has a detail-oriented obsession or obsessive-compulsive behavior. It describes the person as unable to relax, or constipated.

Sadly, people just know 'anal' these days. Gone are days of long ago when people said what they meant, and did not lean on the spindly crutch of catchphrases and colloquialisms.

I can now imagine that this sort of intrusion detection software will be known only as Billy Goat, just as so many use 'trojan' and 'virus' when such terms are far from inappropriate to describe a specific piece of software with destructive intent. Why, just this morning, an interview with the prosecutor of Blaster.B accused author Jeffrey Lee Parsons, yielded such terms as "cyber-hacker." Since when did "cyber" need to be prefixed? I'm waiting for someone in the legal profession to butcher that term, and vomit terms like Cyber-goat.

IBM was foolish to announce this so early. I just know they will get targeted by the crackers out there for it (note, that's criminal-hacker, not ebonic-slang/slur for white peson), and then the crackers will roast the billy goat over IBM's own firewall!

For those who aren't well-educated on nursery rhymes, go read up on Three Billy Goats Gruff. You will find the proper origin of the software name there, trade-related double-entendre's notwithstanding.

Re:In case you don't get the names... by Bromrrrrr · 2003-09-01 07:42 · Score: 1

short for anal-retentive, a 'clever' way of articulating someone has a detail-oriented obsession or obsessive-compulsive behavior. It describes the person as unable to relax, or constipated.

Geeh, thanks. This and the rest of your post sure made things clear to me! :-)

--

What a rotten party, have we run out of beer or something?
Re:In case you don't get the names... by catbutt · 2003-09-01 09:00 · Score: 1

Gone are days of long ago when people said what they meant, and did not lean on the spindly crutch of catchphrases and colloquialisms.

...and when was those good old days? I imagine such shorthand ways of expressing things has been around just about as long as language itself -- and for good reason.

I think most reasonably-educated people know that the term anal refers to anal-rententiveness. I assume you also know this is a Freudian concept.

Incidentally, your complaint about the term "cyber-hacker" directly contradicts your complaint about people shortening expressions. There are hackers who are not computer hackers, the term has been around a long time. Most people would know what he meant if he just said "hacker", but maybe he was trying to make sure he was clear, so he wouldn't upset people like you who tend to be....um, anal.
Re:In case you don't get the names... by Anonymous Coward · 2003-09-01 09:59 · Score: 0

The term anal-retentive has nothing to do with constipation - it stems from Freud's nonsense theory of psychological development. An anal-retentive person is supposed to be essentially stuck at the toilet-training stage, where they're obsessed with cleanliness and the like (bear in mind that these theories are wholly discredited). "Retentive" in this context means confined or restrained, since the person is unable to progress to the last of Freud's three early childhood development stages (the order is oral, anal, genital). This is also where the idea of "oral fixation" comes from (there's no equivalent concept for the genital stage, since reaching there is your graduation, and you can move on to your Oedipal or Electra complex ;).

I'm sure you'll appreciate the irony in your getting this wrong nearly as much as I do. ;)
Re:In case you don't get the names... by Vexar · 2003-09-03 00:09 · Score: 1

Actually, I appreciate being corrected. I studied your message very carefully. I never took psychology classes (which appears to be where this might be learned), so I admit I concocted my own interpretation of the word. I suppose I could have looked it up, though. Freud doesn't sound like a good dinner party guest to me.
Re:In case you don't get the names... by Vexar · 2003-09-03 00:30 · Score: 1

No, I didn't know it was Freudian. I thought it was a fancy way of saying tight-ass, which, in my mind, has always conveyed a sense of constipation.
Cyber-hacker is hackneyed and perhaps intermediate to a final term yet undetermined, and I don't like the way it is going, it seems unplanned. Apart from golf or performing arts, would you give me an example of a 'hacker' that could not be better described by another term when it comes to crimes or criminals? I mean, if you get right down to it, anyone who writes a computer virus is not just a hacker. Hacking is sometimes considered intrusion without intent, it is writing software with a taste for haste, or encoding benign routines which have an inherent gee-whiz value. Cracking is intrusion into systems with criminal intent. Slopping "cyber" on the front at best offers disambiguation from the golf-hacker, or the piano-hacker. Were I a barrister, I would use the term criminal coder, and not mince words by inferring this is merely a hobbyist. The gang from Asia that wrote the first Blaster, shoot, they probably got paid to do it. Couldn't call those guys hobbyists or amateurs! Now, if only I could earn a living writing commentary, instead of just doing it as a hacker.

Re:Important announcement by Anonymous Coward · 2003-09-01 03:05 · Score: 0

Actually there is a damn good reason why they say "gain three inches in length" and make no mention of how many millimetres that is.

All nations that are signatories to the treaty that established SI have legislation requiring that measurements in SI units are required to be accurate to a certain standard. The measurement does not cover non-SI units. Which is why monitor manufacturers will quite happily give you 22mm. on the inch and marijuana dealers will quite happily give you 24g. on the ounce.

It would be illegal for them to say "gain 75mm." unless the stuff actually made you gain 75mm. But, they can say "gain 3 inches" and they are NOT making a claim, because non-SI measurements have no legal standing. This is how, BTW, you can often get around a school or workplace hair-length, heel-height or skirt-length dress code regulation ..... if it only says how long in inches, not in metres, then you can simply redefine an inch to be however many millimetres it would take to get you within code. {'These shoes would be acceptable if there were 40mm. in an inch; therefore, I claim that there are 45mm. in the inch and my shoes are now legal.'} Now it's just your word against theirs. The rule will at least have to be debated before it can be amended, and may be rejected {especially if you can influence enough voting members before the EGM}.
Ting! Next please.

attacks finished? by winkydink · 2003-09-01 03:13 · Score: 1

to help guard against computer-network attacks such as those that slowed Internet traffic earlier this month You mean the attacks are over? The 67000 icmp probes I received yesterday are legitimate tests?

--

"I'd rather be a lightning rod than a seismometer." -Ken Kesey

Re:Useful tool to have in an emergency by Anonymous Coward · 2003-09-01 03:26 · Score: 0

not a bad idea. although, patching would be a good step to throw in before going to the batbelt.

Bob Bloom sums it up... by hendridm · 2003-09-01 03:29 · Score: 1

"A powerful virus is running rampant through the world's computers throwing everything a-kilter, so the brass at the Pentagon is considering putting Skynet on line to combat the virus. Unlike the audience, they are unaware that Skynet itself is creating the virus."

Hehe by orbitalia · 2003-09-01 03:35 · Score: 2, Funny

It's not the only thing IBM are going to be squashing soon..

Let billygoat's platform of choice be Linux! by mwfolsom · 2003-09-01 03:38 · Score: 3, Insightful

Strikes me that it would be great if billgygoat was designed on top of a Linux kernel.

If it turned out to be a great product that would be a wonderful bit of irony. Linux working to say a messed up windows world.

Re:Let billygoat's platform of choice be Linux! by the_archivist · 2003-09-01 05:16 · Score: 1

It already is!
There was a report last week that MS DNS has been outsourced to company that runs Linux (to deal with the expected dos attack)

--
while(karma less_than enough_karma){karma++}

Comment removed by account_deleted · 2003-09-01 04:12 · Score: 1

Comment removed based on user account deletion

Missed it by THAT much! by The+Monster · 2003-09-01 04:14 · Score: 3, Insightful

block ip

So close. Instead of blocking the IP, tarpit it! Force the attacker to
s l o w . d o w n
while keeping the rest of the network moving right along while emailing the admin about it.

--

[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.

Re:Missed it by THAT much! by arkane1234 · 2003-09-01 05:01 · Score: 1

noooo! create a giant skynet network of computers, and reserve a large amount of bandwidth. When an offending IP comes along, open up all of the nodes onto it.

--
-- This space for lease, low setup fee, inquire within!

Billy Goat insightful naming? by polyp2000 · 2003-09-01 04:24 · Score: 0

Anyone else notice that there are only 2 different characters that set Billy Goat and Bill Gates apart.

Me thinks there is more to this name than meets the eye ...

--
Electronic Music Made Using Linux http://soundcloud.com/polyp

LaBrea by pantherace · 2003-09-01 04:24 · Score: 1

I found it a couple of days ago, and it looks very interesting.

It is a program to 'tar-pit' worms. When something (Code Red was the initial reason) scans an ip address that isn't there, it sends an ack back spoofed to be from that machine, thus causing the worm to have to time out before it goes on, and it can knock the connection into persistant mode, thus locking up the thread on the attacking machine until the thread is killed.

Looks nasty, and there is a debian package. If it works as well as hoped, Linux users could save the networks some trouble.

Re: end user patching by King_TJ · 2003-09-01 04:25 · Score: 3, Informative

I'd really be interested to see how many of these recent worm infections happened on company systems, as opposed to people's home computers.

I agree that a big problem is educating the average home user to apply update patches as they become available, but this isn't usually an option at the corporate level.

I've seen corporate environments where even the I.T. staff in charge of the desktop systems has to fight and fight to get the approval to apply a security patch. (The team lead or I.T. manager may scratch the plan, arguing they haven't had sufficient time to make sure the patch doesn't break a "mission critical" application they run, or they may decide the patch can wait until another update it rolled out, so they can get 2 birds killed with one stone.) Letting the end users apply their own patches isn't typically allowed on corporate machines.

Cheezborger, cheezborger, cheezborger! by WCityMike · 2003-09-01 04:33 · Score: 0, Offtopic

Cheezborger, cheezborger, cheezborger. No Pepsi, Coke. No fries, cheeps.

[Sorry, but as a Chicagoan, I had to add that to this thread. I was obligated to. :-)]

Re:Cheezborger, cheezborger, cheezborger! by Anonymous Coward · 2003-09-01 23:25 · Score: 0

Um that should be no coke, pepsi...
Re:Cheezborger, cheezborger, cheezborger! by WCityMike · 2003-09-02 01:00 · Score: 1

Eeek ... as a Chicagoan, I now stand shamed ... :)

Not like this. by 21mhz · 2003-09-01 04:59 · Score: 4, Funny

So, the thing that will put an end to the humanity is called Billy Goat? This is just... wrong.

--
My exception safety is -fno-exceptions.

Encrypted Version by Anonymous Coward · 2003-09-01 05:02 · Score: 0

3BGG

Three Billy Goats Gruff

Interesting tool in a good toolset by __aagmrb7289 · 2003-09-01 05:05 · Score: 1

The Billy Goat tool is not very well described in the article, I'm assuming, since the implementation details are quite vague. However, some things are clear:

1) It looks for computers that are trying to hit unassigned IP address (assuming these are local ones, btw).
2) When it finds a computer trying to hit unassigned IPs (unknown on the required frequencies), it acts to isolate the computer from the rest of the network.

Now, this could be a nice tool. #2 is problematical - if it automatically isolates a computer, this could be bad, but then, hopefully it would be rare, and for some users, they wouldn't even notice. If an administrator is notified that there is some sort of issue going on, here, here, and here, that gives them a heads up to take some action. It wouldn't stop the initial infection, nor would it stop the entire network from being infected, but it might slow down the problem, maybe even enough for us, the slow and stupid human administrators, to get things under control.

Overall, based on what I can see here, a potentially useful tool in a big toolbox.

Bill Gates? What about trolls? by Cappy+Red · 2003-09-01 05:30 · Score: 1

Billy goats... wasn't there enough troll food already?

*honkenpossiblyobscure*

--
This is my sig. It's prescription, I swear. I need it for reading things... on the other side of things

SCO? by Ripplet · 2003-09-01 05:49 · Score: 1

Oh, I thought this was going to be an SCO story. I'm sure we're going to see one soon with a similar title!

--

Skiing? Check out The Independant Skiers Portal

He gets mad by Anonymous Coward · 2003-09-01 05:54 · Score: 0

He Gets Mad

Narrator: A goat can feel happy
A goat can feel sad
A goat can feel wonderful
A goat can feel mad

Goat: Feel mad! Feel mad! Feel mad!
It ain't bad to feel mad

N: If someone pulled the hair on his chin
Would a goat say nothing, stand there and grin?

Goat: NO! I get mad! I get mad! I get mad!
It ain't bad to get mad

N: And what if someone gave him a fright
Would a goat laugh, "Ha, ha, it's quite all right"?

Goat: NO! I get mad! I get mad! I get mad!
It ain't bad to get mad

N: And what if someone does something unkind
Would a goat pretend he doesn't mind?

Goat: NO! I get mad! I get mad! I get mad!
It ain't bad to get mad

N: And if a friend lets him down

Pig with ice cream cone: (snorting) Forgot to bring one for YOU.

N: Would a goat say, "No matter, don't worry, I couldn't care less"?

Goat: NO! I get mad! I get mad! I get mad!
It ain't bad to get mad

N: And in the end most folks are glad
To find out what makes him mad

All: He gets mad, he gets mad, he gets mad.
It ain't bad to get mad!

Goat: Yeah!

Re:Useful tool to have in an emergency by rhizome · 2003-09-01 06:01 · Score: 1

Next week we will be bringing an automated system online that will do the following:

- snort portscan preprocessor will look for port scanning (with a list of exceptions for data center servers)

- a perl script will have the alerts piped to it and know when a new scan has started

- the perl expect mod will be used to put a null route in the network (on a cisco device) for the host that is doing the scanning. No return packets will make it back to the infected box.

Portsentry on FreeBSD (or BSD in general, I guess) will do all of this for about 10 minutes of work. With Snort you'll be able to collate seemingly random portscans into patterns (sometimes a determined cracker will try to lurk in the background scanning only one port per minute/hour/day/etc), but portsentry will do all the "nullroute anybody who touches a magic port" stuff easily.

--
When I was a kid, we only had one Darth.

Re:Useful tool to have in an emergency by unixbugs · 2003-09-01 06:26 · Score: 2, Interesting

glad you came around. the use of snort and perl, especially in combination with iptables, etc. can make something pretty hard to break if its done right. the great thing about the combination of the three is the flexibility allowed; the different ways to accomplish the same effect on traffic are literally endless, so you see where a flooded job market is still starved for real talent.

one of the things i thought of, that nobody has even brought up that i could find on this post, is the fact that this "Billy Goat" only benefits microsoft in the long run. why should they change now when they can let big ass IBM fork out the funding for this kind of R&D?

after all, hasn't an entire industry spawned in the wake of microsofts neglegence? and to what avail? microsoft needs to either be held accountable or they need to release source code. these are the only 2 ways, and mark the words, one day it will come to that.

--
You are about to give someone a piece of your mind, something which you can ill afford...

Does it not sound similar to tarpits ? by Anonymous Coward · 2003-09-01 06:29 · Score: 0

I wonder how this is diffrent from a Tarpit with a program to report everyone who is visiting it. Related slashdot article

NetScreen IDP has had this two years ago... by Anonymous Coward · 2003-09-01 06:41 · Score: 2, Informative

NetScreen's IDP product had this technology almost 2 years ago - we called it a 'Network Honeypot'. All it does is respond to IP's that don't exist (or that do, but on ports the machine is not listening on) and then perform rules against that IP. The rules can be a simple as 'log' to aggressive as 'block the subnet of this IP for x hours', or anywhere in between.

But we didn't get press coverage, because:

a) We're not IBM
b) We don't come up with cool codenames
c) This is so obvious it doesn't deserve coverage.

-AC

Does it not sound similar to tarpits ? by ganhawk · 2003-09-01 06:47 · Score: 1

I wonder how this is diffrent from a Tarpit with a program to report everyone who is visiting it. Related slashdot article

--
Python script to convert photos into "artsy" portraits: http://p2pbridge.sf.net/pyPortrait/

Anomaly-based IDS sucks. by netherpunk · 2003-09-01 10:21 · Score: 0

What is an Anomaly based IDS and how does it differ from Signature based systems?

Signature based systems rely on static analysis of event.

Anomaly systems rely on creating a baseline of normal activity then flag any deviations.

How anomaly based systems work.

A baseline is normally gathered during a tuning phase. Gather all traffic, analyze it, store it.

Data mining process that does statistical analysis of data.

Theory behind them.

If its traffic that hasn't been seen before, its bad.

Attacks cause things the system has not seen before.

How to tear the Castle Down.

1.) More noise, less accuracy.

Single outside point to multiple inside machines.

Properly crafted packets will cause inside machines to appear as attackers.

2.) Covert channels.

Hiding the data in plain site.

How useful is this?

3.) Flooding.

Several outside sources to a single inside source. Not very effective, but useful for quick and dirty.

Flaws in the System

Attacks against the system itself.

Attacks against what feeds the system.

Summary:
It is very easy to use anomalies to sort good traffic from bad. But with everything, this sort of system can be used against itself as a distraction. Its very flaw is its design. Using software such as this to detect worms is a great idea. However, it won't work once someone writes code that dodges this type of detection, ie something that pretends to be normal traffic.

YOU STUPID ASSHAT MOTHERFUCKER MODERATORS!!! by Anonymous Coward · 2003-09-01 10:38 · Score: 0

I HATE YOU ASSES!!! How could thi spost have possibly been redundant when it specifically refered to Trolling4Dollars??!!! Did someone else make the same point that if Trolling4Dollars posted that he would have gotten modded as a troll?!! I DON'T THINK SO!!! God you folks are really fucking stupid!! I'd love to find the fucking nerd who modded T4D down and beat the living shit out of him. What T4D said was hilarious and should have been modded as +1 Funny. I can't believe how stupid you fucking moderators are. All you do is ruin the level of humor on Slashdot. You are a disgrace and need to be killed.

dumb and dummer. by twitter · 2003-09-01 17:11 · Score: 1

What good is a patch if you can't get your users to install it cuz they're dumb?

About as much good as a network poluted with MS transmitted diseases. The users are not dumb, they are doing what the "experts" tell them is right. It's the "experts" who either lack a clue or have an interest in M$ shit that are the problem. Fix one expert and you swing a few hundred users sooner or later. The more experts you fix the faster the users swing.

I'm now working in the trenches, a local computer retail shop. The cost of this latest wave of viruses is $40, $100 per disabled computer. This is on top of the "normal" windoze attrition that's part of the upgrade train now pushing windoze XP as a fix. Do you have any idea how much it would cost the end user to get all the fucking patches put on after reinstalling their crappy OEM M$ software? Doing the same for broken XP boxes is also expensive, but they seem to fix a little faster. The customers are not happy, yet they feel compelled to stay in windoze land due to Microshit's audio/video device driver lockin or a percieved M$ Word requirement. MSN and AOL subscriptions are another problem.

Still, I see a way to promote free software: use the right tool for the right job. Free software's networking is much better than Microsoft's poor stuff. A dual booting machine that uses free software for all email and other net functions is a practical solution to MS transmitted diseases.

--

Friends don't help friends install M$ junk.

So what you're saying is... by Eric+Damron · 2003-09-01 17:50 · Score: 1

That Billy Goat is going to clean up the mess left by Billy Gates?

ROFLMAO!

--
The race isn't always to the swift... but that's the way to bet!

Re: end user patching by Anonymous Coward · 2003-09-01 22:10 · Score: 0

Looking my firewall logs, I am seeing a definite periodicity of pings from the Nachi/Welchia et al.

I have not had time to analyse the logs for frequency vs the time zone of the senders IP address. But a cursory look there appears to be a greater traffic load during work hours.

Ultimate virus by geschild · 2003-09-02 01:59 · Score: 1

Yeah yeah, I will get modded troll for the word ' Ultimate' in the subject. See if I care.

A virus/worm I would write would:

Snort the network for arps and only contact addressess it sees on the wire.
Lend the OS detection and possibly more of the stealth features from nmap.
Be multi-os (windows, mac, linux) (not multi-platform, i386 will do nicely, thank you.)
Use a trick devised by another slashdotter to find follow-up code by doing a google search (possibly hidden in an existing HTTP connection)
Spite the system-administrator for his not patching known vulnerabilities
Leave the Linux/BSD admins off the hook (mostly because it's much more difficult to do real damage, oh, and because it's pointless to code for BSD vulnerabilities)
Kill the windows boxes (without refering to O/S. Don't want give O/S bad publicity now do we? */sarcasm*)
After a time-out based on the amount of times that we've hit an already infected box within the same sub-net
Using a decent IP-# generation trick.

It isn't so hard to create a really damaging virus/worm, you just have to put some effort in it ...
(To nay-sayers on the multi-o/s part: if your worm is able to find vulnerabilities, it can use them to install any binary you like. I would think you start out spreading the windows worm with the linux/mac/other payloads in it and making it so that, when installed on the target platform, contain the code to infect all other platforms.)

There's one little problem with this idea: the last time I did real coding, as opposed to scripting, was almost ten years back.

(Would 'they' come after me if a virus writer confesses to have used my ideas? ;-)

--
Karma? What's that again?

Billy Goat Tavern? by HiggsBison · 2003-09-02 06:59 · Score: 1

Maybe it's a reference to the Billy Goat Tavern in Chicago.

Chizborgha! Chizborgha! Chizborgha!

No, wait. I don't want to think about that in connection with squashing worms. Never mind.

--
My other car is a 1984 Nark Avenger.

No Pepsi! Coke! by HiggsBison · 2003-09-02 07:15 · Score: 1

There was an episode on Saturday Night Live where Coca-Cola came in an bribed them and immediately wheeled in new machines. And all the customers who were used to ordering Pepsi were told "No Pepsi. Coke."

--
My other car is a 1984 Nark Avenger.

Slashdot Mirror

IBM's Billy Goat Squashes Worms

170 comments