Slashdot Mirror
IBM's Billy Goat Squashes Worms
fr0z writes "InformationWeek is running a story on "Billy Goat", a novel worm-squashing software developed by researchers in Zurich, Switzerland. IBM says it wants to turn Billy Goat into a product to help guard against computer-network attacks such as those that slowed Internet traffic earlier this month."
This is a play on the name "Bill Gates", surely? Why else would they call it that. Interesting concept nonetheless.
I.O.U One Sig.
squashes worms?
it is a detection system. and an imperfect one at that: heck even the designer for the software itself says this...
besides, if it's an outlook mail worm, then every address it goes to is targeted correctly, and Billy Goat will go on munching it's grass and not have a clue while the network slows to a crawl.
I mean, of course it can look for surge traffic, but how do you distinguish that vs. a simple slashdotting?
My life in the land of the rising sun.
I do not want to look anal but I think the submitter meant "last month" :-)
Trolling using another account since 2005.
Detecting potential attacks is one thing and preventing damage and slow-down of the internet is another. Even now we can somewhat predict them before they begin to slow the entire net down. But seeing how something akin to these last two worms will slip right by even with our knowledge, this technology becomes rather redundant. Eventually, educating the end-user will be a greater force than some goat.
P.S. any coincidence it is named "Billy"?
A blog like any other.
So you're turning on a computer system thats intended to be intelligent enough to seek out and erradicate computer worms?
Did you NOT see Terminator 3?
- Those that do not learn from history are doomed to repeat it.
Or, in this case, those that don't learn from crappy movies. =P
It sounds like a nice extension of egress filtering; you know which of your IPs are unassigned, and so you assume that boxes trying to access unused IPs are up to no good, and act accordingly (firewall the affected box off, and investigate). Slows worm propagation, and discourages people from scanning your entire address space unnecessarily.
I appear to have a blog. Odd.
You can always depend on IBM. They contribute to Linux... help Windows users... make awesome products, even if they do cost too much... But, hey, IBM is great.
Will it butt trolls off the net too?
Sheesh, evil *and* a jerk. -- Jade
IBM says its prototype combines the strength of analyzing traffic directed at IP addresses assigned to computers on a network with the ability to look at the unassigned addresses worms also target.
What good would this do (checking unassigned addresses) as most worms (at least polymorphic ones) replicate and spread to other users it (the worm) finds on the machine. Hrmm sounds odd typing because I'm tired. Ok, for instance most MS based worms such as Blaster, Sobig, etc., tend to rip a list of address from programs on the infected machine. Blaster and Sobig sent out spoofed emails which differed from the normal worm a bit. Anyway, if a machine is sending info (while infected) to an unassigned IP address, what difference would it make since it somehow obtained the information locally.
Now, I understand that some virii writers often leave some 'h3ll0 i j4m l33t' message, but this is a rarity, so I find it obsolete.
It also can sniff out the signatures of known attacks. By testing the software at a large ISP, IBM can collect more data on worm traffic and help decide how to bring Billy Goat to market, says Adrian Schlund, a manager at IBM Global Services.
This is a bold statement for IBM to make considering they are now claiming to sniff out attacks. Considering attacks change, all they could do is update their rules, which means you could get by without this product if you have an experienced network engineer who has network anamoly detection experience. Hell if you've read enough RFC's and Cisco books, anyone would be able to detect and halt attacks using freeware such as snort.
Oh well it sounded good for a minute, it's a shame they didn't included any screenshots or specs in the article.
MoFscker
TFA isn't very clear, but it sounds like the only thing unique about Billy Goat is that it detects port scans. I can't believe it would take a bunch of PhD computer scientists to figure out how to do that. Anyone else know what makes this thing special?
Not Found
The requested URL
Never click on a link with the word "goat" in it.
If you built a software package that catches worms...why wouldn't you call it "Early Bird"?
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
Comment removed based on user account deletion
Is that a hint that Bill Gates is into Goatse? I'm a nice troll, gimme a cookie.
if(>X packets received from ip
&& !reverse dns for ip)
block ip
Do I win $10?
If you were blocking sigs, you wouldn't have to read this.
My second reaction is that the focus needs to be at the level of the ISPs. To expect all users to reliably protect themselves against attacks is just naive. Technology that could immediately detect attacks and prevent their propogation to individual users in the first place seems to me feasible and desirable.
and then
Doesn't this sound like honeyd?
LaBrea - the "Sticky Tarpit". Seems like the same concept, and has a working, free implementation at http://labrea.sourceforge.net/
Doesn't network management software like NNM and whatever CA's stuff is called, work by doing ping sweeps and other stuff to detect new systems on the network?
Won't it break those systems?
Je ne parle pas francais.
Seems to me that it it's aimed towards detecting sources that aren't published, that somewhere there needs to be a list of 'published sites'. If you're web, ftp, mail, cvs, filesharing software isn't on the list then it will flag everyone who connects to it for futher study.
Here's an idea I had a while ago, (probably around slammer time) but never got around to doing anything about (because I don't admin any networks).
;/
A module for your IDS which, if it detects a machine on your network is infected with something, automatically set your router to NAT that machine so it points to some server which will inform the user they are infected, and gives details on how to disinfect themself, or to contact the helpdesk, or whatever.
In addition to the NATing, the next DHCP request they perform could take them off the local network address space (except for the disinfection message machine) so they won't be spreading their infections locally.
The infoming machine would not just be HTTP, which could return the webpage, but also have SMTP, POP3, IMAP servers, whatever else they could be running, which return an error, which (hopefully) will be displayed by the users application, telling the user what is happening.
Even if the user doesn't receive the error messages, they would most likely notice something is wrong when they can't connect to anything, and even if they don't they are isolated from the internet, and after their dhcp lease expires (assuming it has a reasonable length) they would also be isolated from the internal network.
It sounds similar to the 'Billy goat' idea... I hope it's not too similar, or it might be covered by restrictive software patents.
I'm reporting you to PETA!! Oh wait, you mean computer worms...
Sadly, people just know 'anal' these days. Gone are days of long ago when people said what they meant, and did not lean on the spindly crutch of catchphrases and colloquialisms.
I can now imagine that this sort of intrusion detection software will be known only as Billy Goat, just as so many use 'trojan' and 'virus' when such terms are far from inappropriate to describe a specific piece of software with destructive intent. Why, just this morning, an interview with the prosecutor of Blaster.B accused author Jeffrey Lee Parsons, yielded such terms as "cyber-hacker." Since when did "cyber" need to be prefixed? I'm waiting for someone in the legal profession to butcher that term, and vomit terms like Cyber-goat.
IBM was foolish to announce this so early. I just know they will get targeted by the crackers out there for it (note, that's criminal-hacker, not ebonic-slang/slur for white peson), and then the crackers will roast the billy goat over IBM's own firewall!
For those who aren't well-educated on nursery rhymes, go read up on Three Billy Goats Gruff. You will find the proper origin of the software name there, trade-related double-entendre's notwithstanding.
It's not the only thing IBM are going to be squashing soon..
Strikes me that it would be great if billgygoat was designed on top of a Linux kernel.
If it turned out to be a great product that would be a wonderful bit of irony. Linux working to say a messed up windows world.
s l o w . d o w n
while keeping the rest of the network moving right along while emailing the admin about it.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
I'd really be interested to see how many of these recent worm infections happened on company systems, as opposed to people's home computers.
I agree that a big problem is educating the average home user to apply update patches as they become available, but this isn't usually an option at the corporate level.
I've seen corporate environments where even the I.T. staff in charge of the desktop systems has to fight and fight to get the approval to apply a security patch. (The team lead or I.T. manager may scratch the plan, arguing they haven't had sufficient time to make sure the patch doesn't break a "mission critical" application they run, or they may decide the patch can wait until another update it rolled out, so they can get 2 birds killed with one stone.) Letting the end users apply their own patches isn't typically allowed on corporate machines.
So, the thing that will put an end to the humanity is called Billy Goat? This is just... wrong.
My exception safety is -fno-exceptions.
glad you came around. the use of snort and perl, especially in combination with iptables, etc. can make something pretty hard to break if its done right. the great thing about the combination of the three is the flexibility allowed; the different ways to accomplish the same effect on traffic are literally endless, so you see where a flooded job market is still starved for real talent.
one of the things i thought of, that nobody has even brought up that i could find on this post, is the fact that this "Billy Goat" only benefits microsoft in the long run. why should they change now when they can let big ass IBM fork out the funding for this kind of R&D?
after all, hasn't an entire industry spawned in the wake of microsofts neglegence? and to what avail? microsoft needs to either be held accountable or they need to release source code. these are the only 2 ways, and mark the words, one day it will come to that.
You are about to give someone a piece of your mind, something which you can ill afford...
NetScreen's IDP product had this technology almost 2 years ago - we called it a 'Network Honeypot'. All it does is respond to IP's that don't exist (or that do, but on ports the machine is not listening on) and then perform rules against that IP. The rules can be a simple as 'log' to aggressive as 'block the subnet of this IP for x hours', or anywhere in between.
But we didn't get press coverage, because:
a) We're not IBM
b) We don't come up with cool codenames
c) This is so obvious it doesn't deserve coverage.
-AC