Slashdot Mirror
HP Shelves Virus Throttler Program
longlanekid writes "Though HP has apparently designed a great program for slowing the spread/proliferation of virii and reducing the impact of DoS attacks, it's all being shelved due to Windows incompatibilities."
I'd like to know what the problems are with Windows machines. If you're router/gateway/firewall is limiting outgoing connections, your OS should be able to handle it. Even if it does cause problems, how often does the throttle kick in where there isn't a worm/virus present on the host machine? If this false positive rate is low enough then I'd implement it anyways.
This is a pretty interesting idea, I only wish I worked. Of course, the only thing that DOES work in Windows, is everything that you DON'T want to work, such as...you guessed it...viruses.
It's not compatible with windows, so let's not even try getting MS to make newer versions compatible, or spend resources writing a virtual device driver. They argue that defense is better than treatment, but forget that a 2 pronged attack is better than pure defense. Even the best firewall and antivirus programs can be worked around. What happens when the next virus or worm comes out and antivirus and firewall manufacturers are caught with their pants down again? Do they plan on letting it spread freely until someone makes a removal tool?
I'm afraid that this tool will also affect P2P tools which connect to many hosts every second aswell. Novice users will stop using P2P cause they don't understand why it isn't working.
From the article...
Virus Throttler slows the spread of virus and worm attacks by limiting the network destinations that a virus-infected computer can attempt to connect to each second, according to HP.
Wait a second. This doesn't really protect internal networks as much as it protects the Internet from your-machine-gone-mad. That is to say, this product's operation assumes your anti-virus security measures have already failed you, and you've got a server making attack attempts outbound on the world at large. This would kick in and shut down that server's attempted attacks.
That'd be a great thing for all of us to be running to be good citizens of the Internet... but who'd buy such a thing? Afterall, you have to admit that your existing security products may occasionally fail you before you can even start to explain what this thing will do. And, after such a failure, you're already 0wned. So, you really have nothing internal left to protect at that point, and all there is to protect is the outside world. If your IT house is already on fire, it's sure nice to want to protect the neighborhood, but who's going to pay for that in advance?
Pointing to the fact that this would require some changes to Windows is a nice excuse, but anybody can get Microsoft to do anything when they come equipped with a truckload of money. I think the realization that people would run this if it was free, but no business in their right mind is going to buy it. I think HP realized that, and that's why they spiked this product. HP, afterall, is a business and can't afford to spend too much money on a research project that isn't going to lead to a profitable product.
I wonder if there are any academic groups working on similar projects who might be able to finish the work on this one...
In other news a cure for cancer and AIDS is quietly being shelved. The medical wonder has incompatibilities with most HMOs . Maybe I just don't see the point or perhaps the technology really wasn't all that good.
I blame them only in so much as the REASON HP couldn't get it to work was because Windows is a closed, proprietary OS. You would think that MS would WANT stuff like this to work on Windows with their "Trustworthy Computing" initiative.
SP2, from what I understand, limits the number of outgoing connections a PC can make. Could it be that HP was just a bit too slow to market on this one? Why pay for a product that does something your OS is about to start doing for free?
Can anybody find the HP press release that clearly has to be the primary source behind the report? Having nearly every paragraph's main body be a quote attributed to the same source is the tell-tale sign that the report was based on information from a single source...
true - it protects the internet at large from you. By limiting the number of connection attempts per second.
So, once you're infected, your server fails to spread at a rate of 10,000 connection attempts per second, instead it spreads slowly, maybe 100 attempts per second? Would this actually do anything besides give your sysadmins a few extra seconds to patch your system?
Wouldn't it be better to block the connection attempts instead, like with an outbound firewall? Maybe stop the app that was trying to connect unless authorised by the user (eg a P2P app)?
A fair point ideologically, but on the other hand, whose closed operating system is both flawed and popular enough to let those flaws cause massive monetary damage to other networks?
I should not talk so much about myself if there were anybody else whom I knew as well. -Henry David Thoreau
This seems like a good idea that they just couldn't get to work. If they're just going to shelve it and not make a penny anyway, how about releasing the source code and see what the community can do with it? HP makes the same amount of money on it either way ($0), but this way they can get open source brownie points and maybe start something that could be useful down the line.
And yes, the juxtaposition of the unfortunate person's name is very funny.
No you cant actually, or at least not tcp packets. Of course you could install a packet driver and bypass tcpip.sys altogether, but that usually involves admin access, restarting etc.
I.O.U One Sig.
English may not be static, but that doesn't mean every moronic new word gets to go in the dictionary either.
I didn't see anywhere in there that said they even asked Microsoft to do anything about it or that Microsoft had refused to do anything about it.
I could just as easily write a program that won't run on Windows and not even try to port it to Windows and start claiming that Windows won't run it because it isn't Open.
Until I see something that says that Microsoft refused to make changes to Windows that HP suggested, I'll chalk this up to a publicity campaign by HP to join the M$ bashing bandwagon and make themselves look better to the F/OSS community.
That's nice... but what's gonna prevent viruses from chosing UDP to send their attacks with? :)
Damn you for making me defend MS. I can make an OSX box just as insecure as an XP box. It's all about ignorant users and default settings. That's why the market share argument works here. MS's setting, by default, are very weak, at best. If I replace my grandparents Dell with an iMac and security setting equivalent to XP's defaults, they still would break it.
This *always* happens on slashdot when 'virii' is mentionned. It's worth noting, however, that the protests when encountering the word 'virii' are getting less frequent and not as fast as they used to be. A tell-tale sign that, even here, it's slowly becoming accepted. After all, immer more artcles and posts make use of it, outside the pure scriptkiddie/leet speaking populace. Let's face it: it's getting commonly used and well on it's way to some day reach dictionary status. But in the meantime, you always will have those that opose it.
A whole bunch of "It's latin", "no, it's not", "it's slang", "no it's not" posts will pop-up like mushrooms.
While I agree that it's not correct latin, and I understand that some people have difficulties with the 'correctness' of it, it really doesn't matter one bit as to the validity of a word.
1)Language 'lives'; it changes with the passing of time.
2)Slang is not 'inferior' or 'wrong'; it are just words that are used in a subculture.
3)Words of a subculture can and have become 'mainstream'
4)In the past, english (as many other languages) has been 'corrupted' with equally 'wrong' words...yet we use them today as if they always have been correct, mostly not even being aware that once they were considered stupid, wrong, grammatically incorrect, foreign, nonsensical, inferior, ridiculous, the result of laziness, plain misspelled, etc.
Yet they are *all* considered mainstream english now! So, let's face it, there is *no* objective mechanism where you can say; this word has no place in our language or not.
If it's understood and used in this language, then ipso facto, it *IS* part of that language.
Now, anyone understands what is meant by 'virii' and more and more people/posts use the term virii, with purpose, even beyond their 1337 roots.
So it really is silly to fulminate that virii is not a word; it is used as one, it is understood as one, and it even has left it's pure sub-culture 1337 roots behind so that now it's actually becoming slowly mainstream. So what, in a year or 5, it may end up in the dictionary, as so many 'non-existent' words before it...and what will be the the contra-argument then?
Why, in another 20 years most persons won't even know anymore that it was once considered as 'non-existent' or 'wrong'. They will use it, as we use all those other words where people fulminated against, just as with they will with new, totally wrong words that will pop-up. That's what it means when we say a language lives, after all.
--- "To pee or not to pee, that is the question." ---
The throttling functionality really needs to reside on the router side, on routers that don't run Windows. Then every joe-shmoe virus/worm won't be able to bypass it easily.
"Can we settle this once and for all?"
Well, no. You can't.
English is a decentralized and developing language. Refrences like dictionaries follow rather than lead.
A program to slow the spread of viruses and it does not work on Windows. So basically, if you can run this program you will (by nature of not running windows) not contribute to the spread of viruses and worms. BRILLIANT!
That's exactly the difference. It takes an experienced user to make Windows secure. It also takes an experienced user to make a Mac insecure. How many "ignorant users" would buy a Mac, and then spend an hour or so de-activating the firewall, changing the default permissions, and enabling the root account?
If your IT house is already on fire, it's sure nice to want to protect the neighborhood, but who's going to pay for that in advance?
The neighborhood would want to pay for that. Really, we're talking about people who already can't figure out how to operate windows update or install firewalls of their own, they certainly aren't going to buy this because they don't care. But, when their ISP gives them a nice shiny CD that just happens to include this, they'll chuck it onto the machine with the rest of the junk ISPs give you. Think AOL, SBC Yahoo's self-install CD, Roadrunner.
If I have been able to see further than others, it is because I bought a pair of binoculars.
If HP or somebody would modify the approach, it would work well in a home router, without having to modify any O.S. outside the router.
The software would need to monitor every IP address on the LAN for viral indications, and then kick into throttle mode only for the indicated IP address.
It wouldn't take too much CPU or memory to monitor 1-10 IP addresses, but it might be prohibitive for 100-1000.
HP owns two class A networks (15.* is old HP's, and 16.* is old DEC's which came with the Compaq merger). If you have that much network of your own, you want to suppress infected machines in order to defend your own network. It's not the Internet they are trying to defend. Other companies with big networks may also have similar problems, so they are the potential customers for this technology.
I suspect that the problem is not that HP can't get something to work on some particular Windows configuration, but that they can't create a commercially viable product that can be deployed to all kinds of corporate Windows desktops without an XP SP2 kind of incompatibility nightmare. Remember that it's the corporates who are holding back on SP2 because of compatibility issues, and no sane company wants to stare into that support black hole with no control over the main engines.
Note also that the article did not say that HP were abandoning the work, it is going back into the labs and they are looking for other ways to use it.