Slashdot Mirror
Using Layered Defenses to Stop Internet Worms
An anonymous submitter writes "Following last week's release of security configuration guidance for Mac OS X, the National Security Agency has released a paper on Internet worms and how to stop new worms using layered defenses (pdf). A good read - your US tax dollars at work."
Hrmmm...
Do I "notify the author" (malcodeteam@nsa.gov> or just assume that Echelon will do it for me when you read this?
Trolling is a art,
I'm rich.
Proud patriot and republican voter.
Stopping Worms:
-Patch your systems.
-Use a firewall.
-Stop running web servers and other stuff.
Thank You,
Uncle Sam
wormpaper.pif?
And *my* guide to avoiding worms :
1) Use Linux
Slashdot anagrams to "Sad Sloth"
Ok, here's mine:
Use OS X.
Run Software Update every once and a while.
Make sure the firewall stays on.
Back up.
Watch Slashdot for malware that isn't just FUD.
What I say does not represent the views of my employers, my friends, my cats, or myself.
Heh. Such a typical government tech report. No pics, just text and tables.
The owls are not what they seem
Obviously multilayered security is a solution to many problems. A worm would have to exploit problems at multiple levels before being able to do what it wants. This would make it much harder for the average script kiddie to write a worm, and would force an excellent programmer to write a much larger program. It also has the benefit of stopping worm variations by applying a security fix at any one of the security levels, since it's unlikely for that complex a worm to include multiple attacks for every level.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
Odviously this is aimed at the average american, as all the IT people and geeks out there already know this. But tell me, what average user is auctually going to take the time to read this?
I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.
In my perfect world they would advocate open standards and address the flaws in the system not just individual "patients." As these plagues come and go, if we all have the same immune systems, our collective odds are not good.
I am glad they are putting good info out there. I guess I am hoping that in each case they identify the larger problem so we can all keep our eye on the ball.
Who is General Failure, and why is he reading my hard disk?
Does anyone else find it pretty cool that this battle is NSA vs script kiddies? I mean, a $2B a year cost is equvialent to a small terrorist attack, this is a big problem. I'm glad to see people from all walks of life attempting to combat the little punks.
https://www.accountkiller.com/removal-requested
Um...
Hmm... Nevermind.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
A more useful list would be shorter yet:
1) Make sure all users are intelligent with regards to computers.
Nothing to see here. Move along.
we're all screwed now...
Pay no attention to that man behind the curtain.
1) Use Linux
Well, the mods think it's funny, but I've been doing exactly that since 1997, and it's worked wonders for me. Linux was ready for my desktop back then, it was ready for the desktop of most clerical employees, and it's gotten nothing but better in the last seven years. For most folks, there's no reason not to use Linux except inertia.
Of course, if you don't mind buying Apple hardware, there's always OSX. If your organization has an exclusive contract with Dell, that's not an option, though.
See what I've been reading.
Worked for my sister too and she is a typical non-technical user. Of course, she didn't installed it by herself and still have very little knowledge of what the system do (same level she had with Windows anyway) but she managed to do everything she was already doing with Windows.
I switched her since I was tired of reinstalling her Windows system which she always found ways to break. So far, her Linux box works flawlessly.
Slashdot anagrams to "Sad Sloth"
I know this was meant to be funny, but I think it is this type of thinking that could one day lead to other operating systems being exploited or filled with worms as much as Windows is now. I don't care what operating system you run, if you do not patch a hole it is still exteremly dangerous to your system. I think that this problem afflicts Mac users more than linux ones as I've often heard one too many Mac lover say how Apple's machines never get viruses or suffer from security problems. (Don't get me wrong, I love my Mac, but I know the importance of keeping it patched.) If someone honestly thinks that simply running an operating system other than Windows will keep them safe, then I fear the future will be much dimmer.
SIGFAULT
8) Don't dig into the ground ....
9) Step carefully after it rains
10) Stay away from bait shops
11)
12) Profit!
(Sorry, couldn't resist...)
EricWhy the Vioxx recall reduced spam (humor)
There is a regular discussion (or flame war) over which operating system is more "secure": Windows, Linux, the BSDs, Mac OS X, or whatever. Anyone with a bit of understanding knows that there's no answer to that discussion, except if you ask which one is easiest to secure, and even then you have to ask who the securer is and what tasks will be performed. But that's not what I want to talk about.
Telling less experience users that a particular OS is "secure" leads them to think they don't need to be vigilant. Same thing with telling them a firewall will solve their worm problems, or that as long as they keep up with patches they're safe from attacks. All of these are important, but no single one of them is a panacea.
I didn't RTFPDF, but it's common wisdom that a multi-layered approach to security is best. No individual step fixes everything, nor usually even stops all of the attacks it's designed to stop. All we do is raise the bar, and hope attackers will go elsewhere.
So don't tell me that an OS is "secure". I know there isn't such a thing. Tell me what its soft spots are, so I can layer other defenses around them. Maybe the bad guys will pass me by for a while.
sigs, as if you care.
I really don't understand that if the government spends billions of dollars a year on IT products and billions more in house fixing the holes why they don't simply create a master RFP for Microsoft clearly articulating what the security requirements are and that if they are not met they lose pieces of the bid until it is. I mean if the DoD doesn't have the clout to bash these lazy slackers in Redmond upside the head then we're all wasting our time worrying about security.
MS annnounced yesterday that they are seriously considering ending FREE security patches in order,
now listen real carefully -
NOT to provide better or worse security, but to wield an effective blunt object against counterfeiters.
Microsoft views YOUR security as nothing more than a convenient tool to blackmail the entire known world into paying for MS's product. It doesn't matter that you or I never actually stole any of their product - we WILL be threatened with cyber terrorism for the criminalities of other people until WE ALL cough up more money to pay.
And at the end of the day MS makes zero warranty that patches that cost real money will be any better than the FREE updates we already get.
Seriously, in other countries and in other industries this why industries get nationalized by an irate fed up underserviced populace.
On this topic of layered defenses:
Is it possible to use the Xen VM that was on Slashdot earlier today to run multiple OSes and use one OS on the machine as a firewall for the other?
Could you rig the setup of one so that it couldn't crash the hardware, it could at most make itself crash and reboot without the computer going with it?
Considering there is a complete cycle that the worms take to propagate and persist, without user intervention, I would say that you could (not have to) consider them akin to what kinds of life you would find in biological viruses. They're pretty stupid. They generally stick to doing one thing. Once they're known and decoded, a defense can be formed.
However, reading the article, the advance of programming technology is getting pretty sneaky. Self-decrypting program code (hmm.. similar to DNA, only the parts in use are exposed), Self-modifying code (probably close here, though with VB's capacity to recompile on any windows machine...), Command and Control, built in analytical heuristics (worms using scanners and 'decision making' on how to propogate), and even getting to the point where they start to operate at less than full throttle to avoid the common detection method, interference in the host's performance.
The similarity between computer worms and viruses and biological viruses is very close, just on different platforms. While these aren't 'alive' in the common sense, they sure have the capacity to act like it on occasion.
Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?
Security isn't about the OS, it's about awareness and prudence. I don't run software of unknown provenance or whose capabilities I don't fully understand. I keep Linux-based firewalls between the (mostly unpatched) Windows machines and the Internet. I don't use Internet Explorer or Outlook.
Then again, they should already know how to do this and learn for themselves, but a dollar saved is a dollar earned. Damn worms!
Berto