Slashdot Mirror
Using Layered Defenses to Stop Internet Worms
An anonymous submitter writes "Following last week's release of security configuration guidance for Mac OS X, the National Security Agency has released a paper on Internet worms and how to stop new worms using layered defenses (pdf). A good read - your US tax dollars at work."
Hrmmm...
Do I "notify the author" (malcodeteam@nsa.gov> or just assume that Echelon will do it for me when you read this?
Trolling is a art,
I'm rich.
Proud patriot and republican voter.
Stopping Worms:
-Patch your systems.
-Use a firewall.
-Stop running web servers and other stuff.
Thank You,
Uncle Sam
wormpaper.pif?
Heh. Such a typical government tech report. No pics, just text and tables.
The owls are not what they seem
Obviously multilayered security is a solution to many problems. A worm would have to exploit problems at multiple levels before being able to do what it wants. This would make it much harder for the average script kiddie to write a worm, and would force an excellent programmer to write a much larger program. It also has the benefit of stopping worm variations by applying a security fix at any one of the security levels, since it's unlikely for that complex a worm to include multiple attacks for every level.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.
In my perfect world they would advocate open standards and address the flaws in the system not just individual "patients." As these plagues come and go, if we all have the same immune systems, our collective odds are not good.
I am glad they are putting good info out there. I guess I am hoping that in each case they identify the larger problem so we can all keep our eye on the ball.
Who is General Failure, and why is he reading my hard disk?
Does anyone else find it pretty cool that this battle is NSA vs script kiddies? I mean, a $2B a year cost is equvialent to a small terrorist attack, this is a big problem. I'm glad to see people from all walks of life attempting to combat the little punks.
https://www.accountkiller.com/removal-requested
Um...
Hmm... Nevermind.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
we're all screwed now...
Pay no attention to that man behind the curtain.
1) Use Linux
Well, the mods think it's funny, but I've been doing exactly that since 1997, and it's worked wonders for me. Linux was ready for my desktop back then, it was ready for the desktop of most clerical employees, and it's gotten nothing but better in the last seven years. For most folks, there's no reason not to use Linux except inertia.
Of course, if you don't mind buying Apple hardware, there's always OSX. If your organization has an exclusive contract with Dell, that's not an option, though.
See what I've been reading.
I know this was meant to be funny, but I think it is this type of thinking that could one day lead to other operating systems being exploited or filled with worms as much as Windows is now. I don't care what operating system you run, if you do not patch a hole it is still exteremly dangerous to your system. I think that this problem afflicts Mac users more than linux ones as I've often heard one too many Mac lover say how Apple's machines never get viruses or suffer from security problems. (Don't get me wrong, I love my Mac, but I know the importance of keeping it patched.) If someone honestly thinks that simply running an operating system other than Windows will keep them safe, then I fear the future will be much dimmer.
SIGFAULT
8) Don't dig into the ground ....
9) Step carefully after it rains
10) Stay away from bait shops
11)
12) Profit!
(Sorry, couldn't resist...)
EricWhy the Vioxx recall reduced spam (humor)
[...] what average user is auctually going to take the time to read this?
The average user? No.
The average manager needing justification before buying new security tools? Heck yeah! The clever ones will append the NSA document to their budget proposals.
With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
There is a regular discussion (or flame war) over which operating system is more "secure": Windows, Linux, the BSDs, Mac OS X, or whatever. Anyone with a bit of understanding knows that there's no answer to that discussion, except if you ask which one is easiest to secure, and even then you have to ask who the securer is and what tasks will be performed. But that's not what I want to talk about.
Telling less experience users that a particular OS is "secure" leads them to think they don't need to be vigilant. Same thing with telling them a firewall will solve their worm problems, or that as long as they keep up with patches they're safe from attacks. All of these are important, but no single one of them is a panacea.
I didn't RTFPDF, but it's common wisdom that a multi-layered approach to security is best. No individual step fixes everything, nor usually even stops all of the attacks it's designed to stop. All we do is raise the bar, and hope attackers will go elsewhere.
So don't tell me that an OS is "secure". I know there isn't such a thing. Tell me what its soft spots are, so I can layer other defenses around them. Maybe the bad guys will pass me by for a while.
sigs, as if you care.
I really don't understand that if the government spends billions of dollars a year on IT products and billions more in house fixing the holes why they don't simply create a master RFP for Microsoft clearly articulating what the security requirements are and that if they are not met they lose pieces of the bid until it is. I mean if the DoD doesn't have the clout to bash these lazy slackers in Redmond upside the head then we're all wasting our time worrying about security.
MS annnounced yesterday that they are seriously considering ending FREE security patches in order,
now listen real carefully -
NOT to provide better or worse security, but to wield an effective blunt object against counterfeiters.
Microsoft views YOUR security as nothing more than a convenient tool to blackmail the entire known world into paying for MS's product. It doesn't matter that you or I never actually stole any of their product - we WILL be threatened with cyber terrorism for the criminalities of other people until WE ALL cough up more money to pay.
And at the end of the day MS makes zero warranty that patches that cost real money will be any better than the FREE updates we already get.
Seriously, in other countries and in other industries this why industries get nationalized by an irate fed up underserviced populace.
Considering there is a complete cycle that the worms take to propagate and persist, without user intervention, I would say that you could (not have to) consider them akin to what kinds of life you would find in biological viruses. They're pretty stupid. They generally stick to doing one thing. Once they're known and decoded, a defense can be formed.
However, reading the article, the advance of programming technology is getting pretty sneaky. Self-decrypting program code (hmm.. similar to DNA, only the parts in use are exposed), Self-modifying code (probably close here, though with VB's capacity to recompile on any windows machine...), Command and Control, built in analytical heuristics (worms using scanners and 'decision making' on how to propogate), and even getting to the point where they start to operate at less than full throttle to avoid the common detection method, interference in the host's performance.
The similarity between computer worms and viruses and biological viruses is very close, just on different platforms. While these aren't 'alive' in the common sense, they sure have the capacity to act like it on occasion.
Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?
If you mean stacking VMs up to filter traffic...no...that won't work.
If you mean stacking VMs so that only specific VMs 'see' each other at the network level, yes. That works with VMs or connected systems with properly configured routers.
The reason? Firewalls are not designed to block the network. Firewalls are designed to allow access for specific ports in specific ways. If you chain systems together, and each hands off the allowed packets to the destination system, you've just punched a hole through the firewall to that final system.
By isolating systems so that only ones that are required to 'see' each other can 'see' each other, you've added a meaningful level of protection. This does not require a firewall. It requires router configuration even if the router is software running in another VM and routes for VMs on the same machine. It also requires that you design services and apps to work in this environment; seperate the web server from the DB for example. If it is a web server, and you just remap the default web server port 80 to another port, you've done nothing; the data still passes both ways and the destination is still potentially exposed.)
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Then again, they should already know how to do this and learn for themselves, but a dollar saved is a dollar earned. Damn worms!
Berto