Slashdot Mirror
Name That Worm
Ant wrote to mention a C|NET article reporting on the Common Malware Enumeration (CME) initiative, now emerging from its test phase. From the article: "Next month, the U.S. Computer Emergency Readiness Team (CERT) plans to officially take the wraps off the effort, meant to reduce the confusion caused by the different names security companies give worms, viruses and other pests. The project assigns a unique identifier to a particular piece of malicious software. When included in security software, in alerts and in virus encyclopedia entries, this identifier should help people determine which pest is hitting their systems and whether they are protected ..."
...Worms name YOU!
Run all antiviruses on a machine.
Exec the worm.
Blitblt the screenshot into an OCR buffer.
Compute the name of the worm
extra step: see if all AVs fired: if not so, the naming can become "AV killer"
gtkaml.org
Did you get my joke email? just save the billgatespie.exe and run it for a fun game
Yeah, because giving names to things, like say hurricanes, allows you to relate to their awesome destructive force in an altogether more empathetic manner...
All worms should be named "Bill"... after the man that made them all possible!
I think the most difficult part of this proposal will be getting the virus writers to include the unique identifier in their code. Besides, isn't the evil bit already supposed to take care of this issue?
The use of the name "FruitFucker 2000".
Thank you and good nite
If this step does anything to simplify the myriad of naming schemes provided by security & antivirus companies, then its more than welcome. Working out exactly what worms have which effects is hard enough without the confusion of complex names and differing schemes. However, the voluntary nature of this new naming scheme may mean it sits alongside the current identifiers and names, which would significantly lessen its effect. I guess only time will tell which way the companies decide to go..
Business Voyeur
What's an "internet worm?"
Signed,
Every OS X user
"Sufferin' succotash."
Why the article is in that section?
To be honest I imagine it's pretty kewl to have created a nasty piece of software that takes down millions of computers and costs billions in damages. At least in a perfect world where everybody is happy, corners are round and nobody ever gets hurt. It's even cooler if the virus you create gets a name like 'code red' or 'blaster' or 'buddy the smackhappy clown' and gets all sort of media coverage and everybody recognizes the name. I maen that's pretty awesome. So I hope that this naming system the 'Common Malware Enumeration' , makes names that are as exciting as it's own. In other words, boring. Take away some of the fun that the virus writers have been enjoying from their nasty little creations.
The rock, the vulture, and the chain
Why don't we just use the Linnean system?
I'm all about latin names for malware -- for one thing, malware creators won't feel so cool when their piece of code gets designated "Caenorhabditis Crapiticus" of the phylum Nematoda.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
It's not a like a hurricane in which everyone can agree on which worm is which. How do you know that Worm Bob really is an unique new worm, and not just a variant of Worm Jimbo? And what happens when the 21 names run out?
If brevity is the soul of wit, then how does one explain Twitter?
It's great that there will be at least one recognized identifier for worms, but when people talk about the worm are they really going to refer to it as CME-123 (for example)? There still needs to be a common name that's accepted. We don't for instance have 15 different names for chicken pox. The virus is called varicella-zoster, or human herpes virus 3. Everyone knows what chicken pox is though.
AccountKiller
"...this identifier should help people determine which pest is hitting their systems and whether they are protected ..."
Linux zealots. Immunize with a double dose of "Business at the speed of thought" and "The Road Ahead".
Instead of hard-to-remember ID numbers for malware, why not use those funky passwords that AOL puts on their CDs for creating new accounts. I'd like to here about viruses names such as WONTON-FLOES or GRAVEL-TAPE, to use two passwords from recently mailed AOL CDs.
Two wrongs don't make a right, but three lefts do.
What will the agreed-upon name be for that piece of malware? Seems like Norton's more tenacious than and presents a larger array of system-wide issues to users than do the many of the viruses/worms/trojans it's supposed to protect against.
~Someday, I hope to be an aspiring author.
Is it the Roman equivalent of Sirius? What is it? I see people using the word "virii", but nobody has ever said what a virius is.
Whatever happened to the Compute Antivirus Research Organization (CARO)? I thought they were the de facto standard for naming of viruses.
Are they going to use alphabetical-ordered human names like with hurricanes?
Can't you just see the newspaper headlines already? "Worm Andrew Batters Microsoft Servers! The worm overtopped firewalls and flooded into data-centers throught the country. Emergency officials said that it will take a week to repair the firewalls and begin letting users back into the data..."
http://linuxmafia.com/~rick/faq/plural-of-virus.ht ml
"National Security is the chief cause of national insecurity." - Celine's First Law
name that worm in 3 infections.
Science : Proprietary , Knowledge : Open Source
Hate the worms and love the worm writers? Or hate the writers and love the worms? Hate windows and love the worms?
...Oh wait...
Motherland Russia!!!
How is this any different from using a single firm for virus/worm names?
If I always look at the AVG name of whatever gobbledygook is out there, it doesn't matter what else it's called. If i'm searching for info on it, other vendors will have the Symantec / McAfee / TrendMicro / YourMomAV name alongside their own.
It's just another "vendor" name to add to the list:
Vendor A calls it this
Vendor B calls it this
Vendor C calls it this
Government A calls it this
This project is likely intended to do for viruses, spyware, and other malicious programs what CERT's existing Common Vulnerabilities and Exposures (CVE) does for security issues. CVE has attained widespread acceptance for use in unique and unambiguous identification of security issues; hopefully this project will have the same level of success.
hmm... all they really need is ONE common base name.
windows _________
windows killer
windows stopper
windows blaster
windows wiper
windows zapper
windows destroyer
windows billyboygonemad
windows replacer (aka linux)
and cuddle him and call him George.
I enjoy large posteriors and I cannot prevaricate.
they use for hurricanes. It is very simple, just name them after the ex-boyfriends and ex-girlfriends of every employee in the organization that names such things.
:)
"Katrina discovered that I was cheating on her with Rita? I'll show them both after I get my organization to name hurricanes after them!" -Anonymous Weather Scientist
Perhaps they can name them after strippers, like the Melissa worm was named? Better yet, how about celebrities? I got infected with the Tom Cruse worm. Yeah well I got infected with Paris Hilton worm.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Usually when I get to the point where I feel like naming the worm, I'm already near the end of the bottle so I'm not likely to remember what name I come up with.
nt
There's nothing like a good gunfight to uplift the spirit--Calvin
softwareproduct-year-n
where year is the year, and n is count of worms/viruses/trojans/ that have hit that product that year.
Ex:
Internet explorer-2001-55
Microsoft Excel-1999-33
Firefox-2004-44
MacOSX--2005-2
windows-2003-666
Oh, and people would be all better off just leaving computers alone for the holidays...
"We are all geniuses when we dream"
- E.M. Cioran
I lean toward Harry Seldon's naming approach: "Idiot number 1", "Idiot number 2", etc. For both a virus creator and their product. His emperor's approach of following that with execution is an optional enhancement.
For Hurricanes, this makes sense, because hurricanes only exist for a couple of weeks each. Viruses on the other hand may well still be active 6 years after...
Everyone knows what chicken pox is though.
Unless you are not from an English speaking nation, in which case varicella-zoster makes more sense.
Carbon based humanoid in training.
Mac fanboi mods on crack yet again.
Political language
I think you're exactly right that CME is trying to do for malware identifiers what CVE has done for vulnerability ids. CVE's adoption is a good example of how a voluntary standard can make real progress. Seems from the article that the major players (Symantec, McCaffee, Trend Micro, Kaspersky) are already on board with CME, too, which is very encouraging.
One clarification, though: I believe CVE is run by MITRE, and funded by US-CERT. CERT/CC uses CVE IDs in their publications, but doesn't control the effort. (Not sure who you meant by "CERT.")