Slashdot Mirror
Using Layered Defenses to Stop Internet Worms
An anonymous submitter writes "Following last week's release of security configuration guidance for Mac OS X, the National Security Agency has released a paper on Internet worms and how to stop new worms using layered defenses (pdf). A good read - your US tax dollars at work."
Hrmmm...
Do I "notify the author" (malcodeteam@nsa.gov> or just assume that Echelon will do it for me when you read this?
Trolling is a art,
"/home/grieder/WORMPAPER.pdf"? The NSA has you now, grub!!!
I'm rich.
Proud patriot and republican voter.
Stopping Worms:
-Patch your systems.
-Use a firewall.
-Stop running web servers and other stuff.
Thank You,
Uncle Sam
1) Always run antivirus software
2) Automatically filter all emails with attachments into a seperate folder
3) Only have one user/computer
4) Always virus scan software first
5) Always run a firewall
6) Always have twice as much bandwidth on the website as you need
7) Block virus/worm emails using filters
Video Game cheats, hints a
wormpaper.pif?
Heh. Such a typical government tech report. No pics, just text and tables.
The owls are not what they seem
Obviously multilayered security is a solution to many problems. A worm would have to exploit problems at multiple levels before being able to do what it wants. This would make it much harder for the average script kiddie to write a worm, and would force an excellent programmer to write a much larger program. It also has the benefit of stopping worm variations by applying a security fix at any one of the security levels, since it's unlikely for that complex a worm to include multiple attacks for every level.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
http://www.nsa.gov/snac/support/WORMPAPER.pdf.exe
But it is good to see the government is adopting some standards that are actually useful. but who wants to guess how much this cost them and how much it should have really cost?
Odviously this is aimed at the average american, as all the IT people and geeks out there already know this. But tell me, what average user is auctually going to take the time to read this?
I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.
In my perfect world they would advocate open standards and address the flaws in the system not just individual "patients." As these plagues come and go, if we all have the same immune systems, our collective odds are not good.
I am glad they are putting good info out there. I guess I am hoping that in each case they identify the larger problem so we can all keep our eye on the ball.
Who is General Failure, and why is he reading my hard disk?
Does anyone else find it pretty cool that this battle is NSA vs script kiddies? I mean, a $2B a year cost is equvialent to a small terrorist attack, this is a big problem. I'm glad to see people from all walks of life attempting to combat the little punks.
https://www.accountkiller.com/removal-requested
Um...
Hmm... Nevermind.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
...and I'm still upset I haven't gotten to read the OSX paper ;)
Here's a mirror. Don't hammer too hard, k?
http://seraphim.ecsis.net/~gregday/WORMPAPER.pdf
we're all screwed now...
Pay no attention to that man behind the curtain.
They never seem to stay the same. They take advantage of things that no one previously thought of, which is why they are so damaging. Defense in depth is great and all, but the next killer worm will probably blow through all of it...
I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.
Following the diversity mantra would require me to install Windows on some servers and run IIS. I doubt that this increases security of my systems, especially because I don't know much about Windows server administration.
There is a regular discussion (or flame war) over which operating system is more "secure": Windows, Linux, the BSDs, Mac OS X, or whatever. Anyone with a bit of understanding knows that there's no answer to that discussion, except if you ask which one is easiest to secure, and even then you have to ask who the securer is and what tasks will be performed. But that's not what I want to talk about.
Telling less experience users that a particular OS is "secure" leads them to think they don't need to be vigilant. Same thing with telling them a firewall will solve their worm problems, or that as long as they keep up with patches they're safe from attacks. All of these are important, but no single one of them is a panacea.
I didn't RTFPDF, but it's common wisdom that a multi-layered approach to security is best. No individual step fixes everything, nor usually even stops all of the attacks it's designed to stop. All we do is raise the bar, and hope attackers will go elsewhere.
So don't tell me that an OS is "secure". I know there isn't such a thing. Tell me what its soft spots are, so I can layer other defenses around them. Maybe the bad guys will pass me by for a while.
sigs, as if you care.
I really don't understand that if the government spends billions of dollars a year on IT products and billions more in house fixing the holes why they don't simply create a master RFP for Microsoft clearly articulating what the security requirements are and that if they are not met they lose pieces of the bid until it is. I mean if the DoD doesn't have the clout to bash these lazy slackers in Redmond upside the head then we're all wasting our time worrying about security.
MS annnounced yesterday that they are seriously considering ending FREE security patches in order,
now listen real carefully -
NOT to provide better or worse security, but to wield an effective blunt object against counterfeiters.
Microsoft views YOUR security as nothing more than a convenient tool to blackmail the entire known world into paying for MS's product. It doesn't matter that you or I never actually stole any of their product - we WILL be threatened with cyber terrorism for the criminalities of other people until WE ALL cough up more money to pay.
And at the end of the day MS makes zero warranty that patches that cost real money will be any better than the FREE updates we already get.
Seriously, in other countries and in other industries this why industries get nationalized by an irate fed up underserviced populace.
So, when you start feeling like a worm?
Do you feel like people are always looking down on you?
Do you feel segmented and isolated from society?
Do you worry about cholesterol given you have 8 hearts.
Are you always this slimy or are you just pleased to see me?
This is the sort of stuff we really need to know because to borrow the immortal words of that famous philosopher, John Rambo "To survive worm you must become worm".
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
Jeeze man... U type like I do. :)
-=fshalor
FreeBSD and OpenBSD make damn good worm-resistant webservers too.
I, as a European, would like to thank our American friends for funding this information for the entire world
;-)
It's very nice to see that an organisation such as NSA makes this info Globally Accessible.
This is important, especially with your current president.
Of course, the US benefits from the fact that worms do not spread to the nation of freedom
So once again, thank you for knowing we exist!
PS Slashdot is America-centric !
Exercise caution when modding this message up: the author acts like a jerk when his karma is excellent.
On this topic of layered defenses:
Is it possible to use the Xen VM that was on Slashdot earlier today to run multiple OSes and use one OS on the machine as a firewall for the other?
Could you rig the setup of one so that it couldn't crash the hardware, it could at most make itself crash and reboot without the computer going with it?
From their own report, it doesn't look like it:
"It is unrealistic to assume that users will become cautious about running unknown files."
p. 6, last line of second paragraph
Even the NSA thinks ordinary people won't get smart about computer security.
Playing pornographics games during the day is evil! Play at night!
Considering there is a complete cycle that the worms take to propagate and persist, without user intervention, I would say that you could (not have to) consider them akin to what kinds of life you would find in biological viruses. They're pretty stupid. They generally stick to doing one thing. Once they're known and decoded, a defense can be formed.
However, reading the article, the advance of programming technology is getting pretty sneaky. Self-decrypting program code (hmm.. similar to DNA, only the parts in use are exposed), Self-modifying code (probably close here, though with VB's capacity to recompile on any windows machine...), Command and Control, built in analytical heuristics (worms using scanners and 'decision making' on how to propogate), and even getting to the point where they start to operate at less than full throttle to avoid the common detection method, interference in the host's performance.
The similarity between computer worms and viruses and biological viruses is very close, just on different platforms. While these aren't 'alive' in the common sense, they sure have the capacity to act like it on occasion.
Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?
My.... eyes. They burn!
How many people can read hex if only you and dead people can read hex?
My point is that you need to have that kind of situation, which is a multi-layered approach.
But to answer directly, yes, they still need to be vigilant. They're still being a client, unless the box is unplugged from the network. Do I download that RPM or MSI and install it, or do I check it out first? Do I log in as root, or do I waste time with a luser account?
The user who thinks he has a "secure" OS doesn't bother with the basics, or with a virus checker, or checking the signature on a tarball.
sigs, as if you care.
Then again, they should already know how to do this and learn for themselves, but a dollar saved is a dollar earned. Damn worms!
Berto