Slashdot Mirror
Slate On Worms That Plug Security Holes
gwernol writes "Slate has a well-written article on 'white knight" worms like Nachi that attempt to automatically patch security holes; Nachi try to patch the hole that MyDoom exploits. The article calls for Google and others to incent White Hat programmers to create better White Knights. But are 'good viruses' really a good idea? Nachi created almost as much bandwidth congestion as MyDoom. Do we really want programs jumping onto our systems and 'fixing' them without permission? What about a socially engineered worm that claims to be doing good?"
But are 'good viruses' really a good idea?
No.
These could be Trojan.
If I give you some worm that's supposed to cure another but which in fact is another one...
No.
Trolling using another account since 2005.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
Next thing in line: an automatic spyware remover. Followed by: an automatic licence checker. And in true 1984 style: an automatic open source software remover.
-- (:> jms cs.vu.nl (_) --"---
...on the problems with beneficial computer viruses.
Geeky modern art T-shirts
Nachi took advantage of a RPC/DCOM vuln, a WEBDav vuln or a Blaster infected system. It had nothing to do with MyDoom.
TECMATIC - Intelligent Technology News
for most users, who experience bewildering slowdown of the internect connectivity, or the intranet access, which mysteriously disappears after a few days - for them, such "White Knights" may probably be useful. For grannys, gramps and other naive users it would be a blessing.
For others, who have mission critical application or other extensions on the target OS, such "White Knights" may send a shiver down the spine:
What if it plugs a hole, but breaks something else?
From what I have seen, such socialist stuff doesn't really go down well with corporations. They don't give away things for free, and they don't expect anything given to them for free.
http://efil.blogspot.com/
If White Knight viruses become common there will be viruses designed to attack them as well, it's just making an extra battleground. This has happened with anti-adware products - many of the new trojans and viruses try to stop software like Adaware working.
The answer is to have a secure system, as that's not happening in the Windows world at the moment, then frequent patches to plug the holes and a way to encourage everyone who uses Windows on the net to download them is the way to go, as is installing more secure software (e.g. Firefox rather than Internet Explorer.)
"What if they're using IE?" "I've dumbed Mozilla down to cope with it." - BOFH
It's like somebody is stealing your bike just to take it for a service.
Would you like that?
No. My reasoning is that a trojan, no matter how it modifies a system, has a chance of fucking it up.
Even valid updates from manufacturers have the odd really bad messup. Making a service crash, modifying a config file so it doesn't work, causing unexpected behaviour.
To give support to those writing such whiteknight worms gives support to any anonymous coder who might wish to fix a problem, with no concept of testing things on a system other than their own or a few others belonging to a "friend of a friend".
RST
Anti-virus programs like Norton AV,McAfee etc would still block these intelligent programs.They are still viruses.are they not?
fifteen jugglers, five believers
One should note that a "white kight" worm is illegal like "bad" worm and would fall under the same criminal charges. And the author would have to pay civil damages as the worm consumes bandwidth. The affected party might even argue that such a worm requires a complete security check-up with reinstalls etc. as the source of the worm can't be trusted.
A white kight worm author would end up with the same civil damages to pay only gaining perhaps a small reduction of the criminal charges.
"White Knights" are a horrible idea. They're a horrible idea for the very same reasons letting MS automatically push upadates onto your computer without your knowledge or permission are a bad idea.
It's not for someone who "knows better" to decide for me how to "Secure" my computer. What happens if one of these virus-like apps(either from MS or a third part) "patches" my server with my multi-million dollar application system and somehow breaks it, as unintentional as it may be?
If these hackers want to do good and create 3rd party patches that people can download and install on their own, that's one thing and I applaud them for their efforts. But, please, don't insult my intelligence and do something that's "best" for me without my knowledge or consent.
I really am sick of viruses.
Being an IT professional, I get on average 1 request per week to remove viruses / spyware / browser hijacks etc from people's computers.
Recently I started turning them down, but offer to install Linux on their computer instead of trying to fix their Window installation.
If I were writing a worm, however, I'd take a different approach. I'd make it spread quietly, and then destroy the Windows install completely 1 day after infection. The whole fucking lot. People who get viruses are asking for it. If you put your computer on the internet, you have a responsibility to do the right thing by everyone else. If you stick your head in the sand and click on all the 'click here' and 'free hardcore XXX' links, then come bitching to me when the whole thing comes crumbling to the ground then you really only have yourself to blame.
ALL computer users should take reasonable steps to keep their computers secure. ALL computer users who don't take these steps should have their hard disks wiped clean.
Once a few viruses start doing this, people will get the hint and keep their systems secure.
Blaster had very little impact on our network. Nachi on the other hand caused absolute bloody chaos.
There is absolutely nothing "white hat" about running code on someone elses machine without their permission.
The white worm needs to be passive; a compromised system will try and attack other systems - all the "good" virus has to do is wait for an attack. When an attack occurs, our "good" virus has the IP of a compromised machine on which to mount a counterattack/patch.
The white worm should also uninstall itself after a predetermined length of time, say 10 days.
I understand the concern people have about auto-patching, however I am certain that none of those people would put themselves into a situation where they were vulnerable in any case - they would only see a benefit from this, in the overall lessening of net traffic.
I'm a network engineer at a reasonable size isp.
These bloody worms caused us so much bother, our customer terminating (ethernet) routers (Cisco 7206 NPE300 VXR's) really suffered CPU wise against these because the ethernet based services are procssed switch unlike ATM/POS etc unfortunately. And the netflow accounting tables were just out of control.
AND the old legacy routers we have that still ran snmp based ip accounting, the cpu on them went ballistic. It was a big pain in the butt and took a lot of stuffing around to fix/block etc.
Unfortunately just blocking the traffic doesn't help as you have to recieve the traffic in order to block it, so I was dumping netflow tables and getting the support guys to call infected customers. Many hours of work just because some little shit script kiddie/newbie programmer thought it'd be funny.
On the bright side though, it promped management to give me a lot of money to get some more grunty gear so we are now better prepared for the next time it happens, and I'm sure it will.
What about a subscription-type system for such a service? I can imagine a variant of the virus definitions auto-update that does this. It wouldn't be kicked off by the user's computer, as it could be disabled by the Blaster-style worm, but would rather be initiated by a remote server. Next time a 'bad worm' spreads across the Internet, the service releases the 'good worm' to patch its customers' systems. My mom would probably appreciate something like that.
Of course we want control of our machines and would object to anything running on them. Thats why WE protect and patch them regularly, RIGHT?
NO... this is for those Joe Sixpacks, grandmas and - worse of all - the selfish dumbasses who dont know OR CARE if their machine on their spanking new broadband connection is fouling the net for the rest of us.
If ISPs dont employ some kind of active blocking, then the combination of the worlds most used OS (STILL having gaping holes) + users who'll open any attachment and OK every install query + broadband means the battle will be lost without some "friendly agent" on our side.
And whats with these PCs you buy with one years free subscription to virus updates? Whaddaya think happens when that expires? The expiry warning dialogs get dismissed, the machines become increasingly vulnerable.
For these users, patching needs to be proactive, automatic and on by default.
Course the nay sayers will argue that an auto update mechanism creates a vulnerability in itself. This is arguable, but the fact is you're not gonna win trying to "educate" users.
You could just sit back until a nice cosy CLOSED internet standard is imposed on us by the powers that be when the frustration level reaches breaking point.
- zero-day remote hole
- replicate for 24 hours
- then really mess up the filesystem, destroying most of the data
That would teach most people to patch there systems.The Big One, anyone taking?
no sig
The definitive (and about ten-year-old) paper on this is:
http://www.virusbtn.com/old/OtherPapers/GoodVir/
Well worth a read if you've not seen it before
Score:-1, Funny
Linux has it's fair share of worms to, and if you move the same 'stupid' windows users over to linux there still going to be stupid, and your still going to get worms and trojans and spyware, though more will be at user not system level, since it's harder to evevate priviilages on a Unix bos than a Windows one.
thank God the internet isn't a human right.
If your system is a mission critical one, you should be running a firewall and anti-virus to begin with. You should also stay on top of software updates. This is standard computing in my book.
There is no excuse for Corporate security exploits. Unless the corporation just doesn't care about it's computing.
I dont want to see any "friendly trojans" but a while ago someone wrote a very neat java app which acted like an IIS server, listened for attacks, and used the exploit from the exploited to send the infected party a "net send localhost YOUVE GOT A VIRUS!!" message or something to that effect. What was that worm called? Red Alert? I think the software was called red alert vigilante or somesuch.
Anyway, I should have the right to take attackers and use their own exploit to inform them about their situation. A real world comparision would be me finding a trespasser and instead of just kicking them out, telling them they are doing wrong and then kicking them out.
Granted, this kind of vigilate action can be seen as, say, tracking down the trespasser and going on his property to yell at him. I guess this is where the analogy breaks down, but its a good concept and doesnt waste bandwidth like the "friendly trojan" shotgun approach.
This would only work with worms with machines with open firewalls, but it sure beats nothing.
I'm not a real doctor but I am a real worm
Don't go to a brothel if you want to buy broth
Bruce Schneier touched on this very subject in his September 2003 cryptogram in response to Nachi (or Blast.D), you can find his original article in the cryptogram archives.
Automatically installing code on a user's system without their consent is never a good idea. Virally propegated code, no matter the intent, still generates network traffic, just because the payload is different doesn't mean the virus/worm/whathaveyou isn't adding to the problem of conjested networks. And as someone else pointed out, even if the 'white hat' programmer has good intentions, that doesn't mean they won't make mistakes in their code which could have adverse effects on the systems they are attempting to patch.
While I don't think users should have to directly interface with security protocols/techniques, I do think they should be aware of them. If they are made fully aware of the damages that can be done to them, they're more likely to patch, or back away from the internet in fear, either way, there is a reduction in exploitable hosts.
I have discovered a truly remarkable sig which this margin is too small to contain.
The parent poster writes:
..."
"I really am sick of viruses. Being an IT professional, I get on average 1 request per week to remove viruses / spyware / browser hijacks etc from people's computers."
Welcome to the IT club. So far, you aren't sounding special.
"Recently I started turning them down, but offer to install Linux on their computer instead of trying to fix their Window installation."
I hope you like supporting that Linux install... And like fielding questions like: "I just bought a brand new digital camera. How do I get my pictures and video into the computer? Oh, and I bought a new printer, too. I want to print my new pictures with my new printer. Oh, oh, and my cellphone has this cool service where I can download ringtones... I want to do that, too. I need to do XYZ with some application I use for XYZ. How do I get it on my Linux PC?" Face it. Linux is still a second-class citizen in the desktop market. Having one or two category apps isn't the same thing as having 99% of the market.
"If I were writing a worm,
Then I would hope that you got caught and spent a few years in jail to think about it, and have it on your record for the rest of your life. Maybe you'll be branded as a terrorist! Talking about writing worms doesn't get you my respect. Even hypothetically. It has been done before. It has been discussed to death before. There were viruses that damaged your equipment. There were other viruses that repartitioned your hard drive. Plenty of worms can do these things.
"ALL computer users should take reasonable steps to keep their computers secure. ALL computer users who don't take these steps should have their hard disks wiped clean."
A) What are reasonable steps?
B) What is secure? If I get an email from "you" telling me to run the attached security update to my computer, and don't know any better, and I run it, and it is an emailing worm, then I am now hosed. Worms do this all the time. Do I blame you because I thought I could trust you, or do I blame the worm author who masqueraded as you through their program.
If some application I download to do X has a bug that's exploited and does Y, and I don't know it, is it my fault?
C) Your statements are quite harsh. Have you ever had your hard disks wiped clean with all of your hard work on them? Your statement is akin to saying, "People who get diseases should be shot. That'll teach 'em to get sick!"
I can't believe your post was modded insightful. Flaimbait, yes. Insightful, no.
no matter how you slice it, its still code executing on your computer without your permission and That's a virus.
/. readers fall into this category as well.
As a usually security minded person, I do what I can to keep my system up to date and to keep any non-requested traffic off my network. So.. most of these "white knight" viruses wont even get to my computer. Im sure most
As for the general public, These could be used for good.. but there is much more potential for evil, as is usual with situations like this.
"Hey, Im a program that unknown to you got onto your computer.. My intentions are good, I promise... You should click yes to fix the security hole that I got in through and distribute me to all your friends"(muahahaha)
?SYNTAX ERROR IN LINE 42
Well we keep seeing the "white virus" explained as a computer/network immune system. Well ok lets consider this for a second or two my immune system is restricted to my body, my phagocytes don't go invading other people in a bid to help them out.
So the same should be applied to the software immune system, after all nature knows its shit better than we do.
"Things that you own end up owning you" - Tyler Durden (via Diogenes of Sinope).
This crap will be around forever, and the main problem is user education. I tell all 150 of my users twice a month to make sure their systems are up to date, and nearly 300 times a month I get the proverbial "yeah, yeah." It is not my job to do patch their systems. That's another guy's job, who doesn't do his job. I put out reminders because of this.
So when we got hit by Nachi, I tracked down the weak link. It was our Netware admin, who deliberately went around my firewall so he could peruse porn, logged into his dialup ISP, checked his personal POP mail at said dialup ISP, and within minutes, bam. Nachi in the house. Of course, this wouldn't have been a problem if he (and the 2 dozen other users that got hit because of him) had kept their systems up to date.
I was found to be the blame of this, despite the fact that there was absolutely nothing I could do about it, since he bypassed my security. After a week of TRYING to explain to management why it happened, that nobody should bypass security and so on, I took a long hard look at the incident.
While Nachi was good in concept, it had fatal programming errors in it that caused it to be more harmful than Blaster. We all know this. I chalk it up to a learning experience - whoever wrote Nachi definitely learned from this. Too bad there weren't any real variants of Nachi. Yes, I'm serious. However, people actually learned from Nachi. Three weeks after Nachi infections slammed into my firewall, it stopped. Nachi just went away.
Yet I still get pounded by Codered and Nimda YEARS after information, patches, and global press about it were made highly available and easily accessible.
Everybody bitches about spam and viruses and worms and popups, yet so few people actually do anything about it. Don't complain to me about pop-ups. Use a different browser. Refuse to "learn" a new browser, fine. Get Google toolbar. Don't know how check for viruses? Get AVG. Sick of spam? Fine, I'll adjust your SpamAssassin threshold.
But people don't want to do these things. In their minds, everything should just work, and work the way they want it to work. Everybody at my company knows that we have AVG, AdAware, Spybot S&D and so on. When new software is made available, I pass it on to my users. A user came up to me last week and asked why AdAware never has any updates anymore, for like the last year. Because she disregarded my notice about the new AdAware and kept using the old.
I have strict rules about email, and my SpamAssassin 50_scores.cf file is very, very harsh. My users have been told that some of their email contacts may be tagged as spam, and if that happens, let me know and I'll whitelist them. Not one person has asked me to whitelist anyone, yet everyone bitches behind my back that I'm a lousy admin because *I* somehow personally tagged their email as spam. Even the president asked me to remove all graphic/audio/video attachments, so I complied. Yet he complains that he can no longer get pictures and other non-work-related material through email.
It's an endless cycle. No appreciation for jobs well done. This is why I actually welcome such attempts to clean up the filth on the 'net. I originally despised Nachi. I now praise it.
As long as the end user refuses to heed educational advice about how dangerous the Internet is, the Internet needs vigilanteism.
Bring it on.
Think of the net as a big organism. We have invading viruses and worms [and other nasties], but no real immune system to speak of...
While there are certain to be real dillemas and dragons here, it seems that exploring the idea of white worms and whatnot is a good idea, after all, is there any other solution for the systems that are not managed? However, white worms should have oversight (e.g. registered source code to some oversight body, managed release into the wilderness, etc..) somewhat akin to oversight for the immune system in an organism..
When in doubt, consult how nature does it - the more complex our systems become, the more similar our solutions look to natures.. Very intriguing..
The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
That is a very interesting observation, and one that I agree with.
However, is it really a divide of the rich and the poor on internet? and what are the criteria for being the rich or the poor? it surely can't be software or AV updates, since there are a number of tools out there that are free..
http://efil.blogspot.com/
guys, the problem worms create beyond their security-related issues is one very simply of bandwidth consumption. come on, guys. it's the same exact problem as chain letters: even if the payload/content is innocuous, if these things are all over, stressing the pipes, how is this doing anybody any good?
and this ignores the problem that in a lot of shops, the IT staff likes to test out patches & make sure the patch doesn't break anything. if a patch hasn't been installed on an office box, there might very well be a good reason for it. a worm is a one-size-fits-all sledgehammer of a solution to the problem of unpatched boxes. how would you feel about allowing an unknown process, not critical to apps or OS function, run on every desktop in a LAN?
ed
They couldn't say "if everyone stopped using Internet Explorer and Outlook Express worms and viruses would be a fraction of the problem they are", now could they?
Sometimes I think the whole antivirus industry mostly serves as a diversionary tactic that lets companies keep shipping software with deep, fundamental security problems.
The Internet is a Wild West (or, to use 1990's terms, the Information Superhighway is overrun with Highwaymen) and those trying to make it a civil society (non-profit or for-profit) should not be expected to sit back and let maurading groups of Russia spammers and Nigerian Scammers ruin it for them and us. Once there is an authority in place to stop the MS-empowered superworms autopatching worms will necessarily be outlawed, too, but until then...some will do what they have to do.
-- @rjamestaylor on Ello
You, and that other frogtard out there that espouse the virtues of 'white worms' every single bleeping time a virus or worm makes it on CNN, suck. I'll avoid further commentary because I really don't want my post to be rated flamebait. First things first. As several other posters have rightfully indicated; competent system administrators will do what they can to mitigate malware outbreaks. Strong, zero-tolerance acceptable use policy for Internet and e-mail will mitigate most virus issues. Yes, I said zero tolerance. It disgusts me that people would 'just want to see what it looked like', or deliberately jack their workstation to get to play instead of produce, or feel that they should not have to exercise common sense when performing daily work activities - "my IT person should be preventing these from ever arriving so if I open them it's not my fault". This will not happen - the competent admin will do their best; but the antivirus updates and system patches may not always be there in time. I still cannot comprehend why anyone with even a fraction of IT experience would condone PATCHING WITHOUT TESTING. Fool. Any single one of us has horror stories about applying a hotfix or patch and then struggling to get it to work right or roll the system back because it fried a critical company application. Entire books; entire industries have sprung up around the phenomenon of not thinking - uhm, testing before you patch. This is common for non-security updates - remember ODBC and Jet database engine fiascos? I sure do. DLL protection my left... eye. Finally, anyone that supports the 'white worm' concept, even on controlled internal nets, needs to examine the path that lead to their support and then burn it clean. Nachi taught us that releasing a worm that spreads the same way as the malicious version WILL cause as much damage - by crashing systems, hammering network devices, breaking applications that have not been tested with the patch, saturating bandwidth... often causing more damage than the bad worm it is trying to fix. Secondary to that, the worm intended to fix runs the risk of being modified and used for 3V1L itself.
I think with the interesting people, their lives can't possibly be wrapped up into a nice little package.
> Being an IT professional, ... install linux
I hope you like supporting that Linux install... And like fielding questions like: "I just bought a brand new digital camera.
Er, I may be slow, but I fail to see how the grandparent poster's users, in a professional environment, couly justify the need of fancy stuff like digital cameras or downloading ringtones, or installing printers themselves. If there's an IT professional where he works, it is most probably in an environment big enough so that users should not mess with their computers.
blah
These are some of the things molecules do...... given 4 billion years -Carl Sagan
There are a few common things that viruses and worms do that we can use, without causing the bad things and avoiding many of the ethical problems
Start with a small set of manually seeded machines that have the white hat virus installed.
1. The "white hat" virus sits quiescently on a machine and monitors its own infection vector passively, therefore not utilising any bandwidth. Upon receiving an attack from the virus it is programmed to protect against it will move to step 2 and remembers not to approach the attacker again within a week.
2. Using the same known vulnerability that the virus exploits it is able to put itself on the attacking, infected machine. It then pops up a dialog box saying "your machine is infected with a XXX virus, may I deal with it?" with a cancel button which cancels, but if OK is clicked then we move to step 3.
3. It installs its package so it can be removed by the control panel, it paches the system so it is not vulnerable, cleans the virus and starts itself scanning, adding itself to the group of machines waiting in step 1.
4. if a month goes by without detecting anything, uninstall itself.
Benefits : minimal network traffic since only validated victims are addressed, no changes without authorisation and if the OS is secured then the white hat virus cannot propogate.
Worst case scenario : if someone is infected and will not patch their machine or remove the virus they may get irritated by popups.
-- Don't believe everything you read, hear or think