Slashdot Mirror
Common Malware Enumeration Initiative
LogError writes "The Common Malware Enumeration Initiative was just announced. Headed by the United States Computer Emergency Readiness Team (US-CERT) and supported by an editorial board of anti-virus vendors and related organizations it should provide a neutral, shared identification method for malware outbreaks."
I don't see any specifics. Is this going to be Windows-centric, or are they reporting on ALL malware, regardless of platform?
Reality test... am I dreaming?
Seems like kind of a simple concept. "Let's make sure we're all using the same name." But I guess being able to identify a virus by name is a kind of important step in finding a fix for it.
Bradley Holt
This is just another example of getting entrenched in a default permit world which has proven itself time and again not to work. We need to be enumerating the good programs and not the other way around.
My first really debilitating virus I encountered was the "Pakistani" virus in 11th grade computer science. Our teacher possessed a doctorate degree in CS, had worked at NASA in the past, and we were certain he wrote the virus (he was of Pakistani origin) to prevent his students from sharing their diskettes in order to cheat on course assignments, because this was the only time it showed up!
This is the first time I've been to the US-CERT website, so please forgive my enthusiasm.
This document on viruses should be required reading for anyone who uses a computer.
http://www.us-cert.gov/reading_room/virus.html
Most common malware can be stopped with the same virus-avoidance techniques listed in this brief document.
As for this initiative, it's not explained very well, that's for sure. It seems like a simple naming convention for viruses as well as a central location for all virus information. I'm not big on the government taking away such a role from private industry, but with the threat of viruses affecting everyone, it makes sense that the government provide a baseline starting point for all antivirus companies to start from. It is not in the best interest of the public to have a single private company hoard virus information.
Jesus saved me from my past. He can save you as well.
If you have a blessed scroll of genocide, you can wipe them all out in one go.
From TFA: "During a virus outbreak, participants on the CME board request an identifier from an automated system by providing a sample of the virus and as much additional information as possible. An identifier in the format 'CME-N' where N is an integer between 1 and 999 is generated and distributed to the other participants. The participants then disseminate the CME identifier to their contacts in the industry and reference the CME identifier on their web pages, in their product, or when speaking to the press. "
It's much easier when there's an actual name to refer to like Blaster or Sasser than referring to the distinctions between CME-46 and CME-50. While the automated system seems to make sense to prevent slowdowns by having people discuss naming, this doesn't seem like a great solution. Many people may even think: I've heard of that CME thing before, I'm already protected.
It would be WAY easier to keep a list of names and heuristics for all of the legitimate code out there and have a default deny policy with a whitelist. The only condition that would need to be met is that no legitimate application is denied entry or the concept could become worse than DRM.
Firstly let me just say I thought this was going to be an initiative to create a working group to assist in identifying threats quicker, but as I RTFA I find out all this is really is just a control gate for naming malcode.
Now that being said I 100% agree that we need a methodology in place to ensure that malcode names follow a fixed format. There have been too many times that we have had to research viruses and it is annoying as all hell to see a worm as Variant B on one site and Variant C on another. It adds to the confusion during an outbreak, which in turn usually costs more research and fix time... But saying that I do not like the naming format because it doesn't clearly identify similar variants... On the site it shows an example of two variants of Zotob. One is CME-164 and one is CME-243. For tracking purposes I would much rather see something along the lines of Zotob-A being named CME-164A and Zotob-B being CME-164B. Or better yet as numbers don't stick in your head as well as words IMO stick to names like Zotob but ensure the major AV vendors follow the CMEI variant guidance...
News Reporters Make Tasty Polar Bear Treats!
Here.
May 22, 1990. A day that will live in computer science infamy.
Lets say we don't implement a common naming scheme. Lets say McAfee comes out and identifies a new piece of malware called malware192 and releases a patch for. Ok, you go ahead and patch your system. Later on, you read that Symantec has issued an alert for malware195. Are they referring to the same one you just patched? Should you hurry up and try to get your system up to date? Clearly, having a common name is a step in the right direction.
End transmission.
..."Broken Arrow":
I don't know what's scarier, Windows malware or that there's so much of it that they need a naming body to keep track of it all.
``Default Deny is good. Centralized lists of "good" software is bad. Think about it for a second and you'll realize why.''
He never said "centralized". Default deny is secure, but cumbersome to work with. People find ways around things that are cumbersome (like taping passwords on monitors when they are too strong to be remembered). Outsourcing the decission of what software to trust to a third party is a good compromise, as long as you can freely chose the parties you trust.
What I'm imagining is something like APT repositories. You trust the maintainers to put up good software, and you verify it was really put there by the maintainers by checking the signatures. If, one day, you decide you don't trust some server anymore, you just remove it from your sources.list.
Please correct me if I got my facts wrong.
I cannot see an entry for Windows in this malware enumeration. Am I missing something here?
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
enum malware { IE, PERL, EMACS, OUTLOOK, VB };
We could call this a starting point.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
(1) Windows Malware will be identified by a prefix of "" (without the quotes)
Fleur de Sel
Most identifiers are just for reference, but may not be intended for the type of indexing that you're expecting.
Consider the following situation:
We now have two options -- change the identifier from 'x' to 'p.1' or leave some sort of note attached to 'x' that it's a derived from 'p'. (well, there's two other options -- don't try to identify them, or don't assign identifiers until all research is done, which defeats the whole purpose of building the system in the first place)
The list they're making is more like a glossary -- a flat list of items, as opposed to something which might have a concept of heirarchy. (but that's not to say that some other values in the descriptions can't be used to generate a heirarchy).
If you'd like an even worse example of selecting identifiers -- imagine if you found a worm 'y' that used the same code for vulnerability exploits as 'c', but carried the same payload as 'g' ... is it 'c.1' or 'g.1' or 'c.g.1'?
Sequential identifiers may seem like a bad choice, but they're so much easier to maintain in the long run, and handle the heirarchy through some other field.
Build it, and they will come^Hplain.
Yeah I fail to see where you are going with the comment that centralized lists of "good" software are bad. If you had a system that blocked everything that wasn't on a list of good software what would be the problem? Maybe you are worried like some of the posters about getting on the list. All virus scanners have an option to ignore a program. Why couldn't you add your own software to your private list. I am THE IT guy for my company and if I had a place I could go to check what the industry thinks of say Weather bug then I would have something concrete to give my supervisor when someone tries to go over my head cause I said they can't have weather bug. Of course I would need to be able to add my own software and make exceptions, that doesn't ruin the idea.
In the first hours of an outbreak, different vendors will call the same malware by different names. Some may identify it as a variant of previous malware, others may give it a new name based on an attribute, and yet others may give it a name based on a different attribute. Having a common format will let you know that Sasser-435 (CME-42), Blogkiller (CME-42)and SlamDunk (CME-42) are all the same thing named by different vendors, fairly important when trying to solve a problem.
This strikes me as a bunch of pomp and circumstance to no real effect. So big viruses have common names now? Great. What about Trojan-downloader-delf.xxx that's still going to have a different name everywhere? What about nail.exe which will still be called VX2 by some, ABI by others. Pardon me for witholding my applause but if they only allow numbers up to 999, this is hardly comprehensive, and since Blaster and Zotob and SDBot are pretty similarly named already by most major vendors, I'm not sure I see the point. Also, they're missing a significant number of anti-virus companies. What about Eset, Grisoft, and Panda (for starters). When you're missing half the people, you cant really call this a global standard. I've always griped about proprietary naming schemes, but this seems like paying lip service to a convention without any real oomph behind it
To err is human, to really foul up requires a computer
The most significant step to solving a problem is first to identify it.
Why is this important in this case? Think about it. For one, it clearly identifies malware entities leaving their status unambiguous. Ambiguity and status disputes have been an area of concern and contempt for many people including the courts, the systems administrators and the 'marketters' responsible for their deployment. Further, one of the biggest problems in the anti-malware area has been that various products seem to omit protection or detection of specific types and sources of malware. With clear identification, these issues can be brought into a much brighter light and more clear scrutiny.
I wouldn't underestimate the importance of a clear and active identification scheme.
I can also see where this initiative can add layers of administrative/bureaucratic overhead, resulting in delays to releasing fixes.
I think the solution is to handle things the same way that we handle hurricanes. Keep a big list of names and iterate through that for each new virus.
In that vein I would like to now suggest that viruses be given the dumbest names possible as a means of discouraging stupid kids from writing them to seek publicity. After all who would want to see themselves listed as the author of ChickenChaser
Slashdot: Where anecdotes and generalizations can be freely substituted for facts, logic, or intelligence
1000 pieces of malware should be enough for anybody!
If you don't risk failure you don't risk success.
communication between anti viri companies is great, BUT I hope this doesn't turn into a type of "registry" that can be hacked or spoofed and allow networks to be compromised wholesale.
"He's a real midnight golfer"
Now watch Gator sue them into oblivion!!!
Couldn't help noticing the similarity between this title and item number 2 on Marcus Ranum's list of the Six Dumbest Ideas in Computer Security. :)
The first computer virus I encountered was back in the glory days of the Amiga 500. I forget the name of it, but the virus re-wrote your video driver so the screen displayed everything upside down and backwards.
The second virus I encountered (same machine) was just as interesting: a tiny helicopter flew onto your screen, dropped a grappling hook to grab your pointer, and fly off with it, never to be seen again.
I tell ya, those were the days, when men were men, gurus meditated, and virus writers were... but I digress.
Today, those guys probably are making a fortune somewhere writing video DRM for Vista.
"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." --Senator Carl Schurz (1872)
Publish a list at the first of the year, and everyone just follows the list.
:)
Only problem is that you need a list about 15,000 names long every year
I used to write assembly code on the Amiga on 68000 10+ years ago.
When I started writing 8086 (pc assembly code) all my executables were detected by antivirus as infected (i think it was FProt).
Turns out that my prefered location of storing data in my code looked like it was a virus burrowing its way into legitimate code.
So considering the number of people that code and the amount of code that is out there in the wild how the hell would you ID good code and bad code ?
another case in point I downloaded tiny VNC onto a windows machine and AV blocked the install. (that was the auto installer, downloading the ZIP and manually extracting worked fine.
ERR 411[Max number of witty sigs reached]
Didn't we already decide, that enumaration, amongst other things was a Dumb Idea?
www.wavefront-av.com
Is another man's Comet Cursor.
I'm a federal employee and information assurance is a huge part of my job. I don't understand why CERT needed another resource rather than tying things into NISTs shiny new National Vulnerability Database. Seems to me that one-stop shopping for both software vulnerabilities and malware alerts would be the thing to do.
we see things not as as they are, but as we are.
-- anais nin
LINUX!
Never seen that site before. It's exactly what they should be using.
one item that sort of bothers me from that page:
"Trojan horses can be included in software that you download for free or as attachments in email messages."
I'd prefer that it said, "Trojan horses can be included in any software.".
>dumbest names possible as a means of discouraging stupid kids from writing them to seek publicity.
I think we need to step down further than dumb and make them insulting and/or demeaning, like:
KnobGobbler
BrainPus
LympNudle
FemtoTalent
So, now that we have people cataloging it... how about shutting down sites that are full of it, or blocking them from the 'net?
Yeesh.
MoM++ - A Classic Expanded - [Master of Magic 1.5]
http://mompp.sourceforge.net/
The idea is that there are several ways of identifying a security threat. One could be the common "street" name given to it by the community or vendors: "HackerWorm.X". Another description created could be regarding how the threat is exploited. "BackDoorLeftOpen.Y" A third might be what strain and what OS it affects, etc. "WindozeSucks.Z" From what I understand, the idea with CME is to tie all those loose threads together to point at one "entity" so that it reduces confusion as to who's talking about what. Ok, so you're talking about a HackerWorm that uses a BackDoorLeftOpen on a WindowsSucks configuration. Now we know what we're all dealing with, instead of reinventing the wheel 3 times.
do I hear a second?
[/sarcasm]
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Microsoft bought Gator
Release the Flying Monkeys!! [Lawyers]
Fly my prettys Fly!!!
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
It's very simple. Centralization takes power from most and gives it to a few.
If you trust the few, it has the benefit of being more efficient. (Instead of everyone needing to put the effort into making correct decisions, only a small group needs to do so.)
Unfortunately, people have demonstrated throughout history that small, powerful groups are almost always untrustworthy. They end up using the power for their own benefit.
Leave it to the bureaucrats to use weasel words. What is "malware?" Is adware "malware?" I'd say it is, you may not. Is DeCSS "malware?" No Linux geek would think so, since it's the only way to watch a DVD on Linux, but I'll the government thinks it is.
Face it, by "malware" they probably mean viruses and/or trojans. Take trojans, rootkits, and all other single-machine attack vectors out of the equation and you're left with only one platform: Windows.
No other platform has viruses. Worms, rootkits, trojans, yes; but no viruses or other mass-propogating zombie-making malware.
Windows should be first on their list of malware, followed closely by WiMP, Word, Access, and Excel. If we could rid the world of Microsoft we would rid the world of most "malware."
Most malware is a windows problem that Microsoft has foisted on itself and on the rest of us.
Actually, the Pakastani virus was written by a company that went by the name of Brain and is commonly refered to as the Pakastani/Brain virus. It was actually created to punish copyright infringers who bought pirated software from Brain Computer. That's right, even though they made their money by selling illegal copies of software they also deliberately infected it with a virus to punish people for buying their illegal copies.
"Unlike worms, viruses often require some sort of user action (e.g., opening an email attachment or visiting a malicious web page) to spread."
Wrong. If you have to run the program it's a trojan, regardless of its ability to copy itself. As to "visiting a malicious web page" that's just inane. How, pray tell, is someone supposed to know that a web page is "malicious?"
The fact is that if you don't use flopies and don't get on the internet, you cannot spread or be infected by a virus. Again, this is asanine.
"Most viruses, Trojan horses, and worms are activated when you open an attachment or click a link contained in an email message."
Yet there are no instructions as to how to safely open an attachment. They say:
"Most users get viruses from opening and running unknown email attachments. Never open anything that is attached to an email message unless you know the contents of the file. If you receive an attachment from a familiar email address, but were not expecting anything, you should contact the sender before opening the attachment."
Yet your friend could be sending you a trojan that he doesn't know is a trojan. If you save a jpg to the desktop and open it from within a photo editing program it cannot infect your computer if it is a bogus, non-jpg file.
The only "tip" given that has any merit is backing up your data. Antivirus doesn't work unless your virus is in its database. If you get yesterday's virus, Norton will tell you your PC is clean.
There is no mention of HOW to safely open an attachment, no mention that you should never EVER run as root (or administrator) without a damned god reason; no mention of firewalls, no mention of port blocking, no mention of "Windows file and print sharing"
There are one or two good tips for a computer newbie, but I'm afraid the misinformation and lack of information will do the public more harm than good.
Want to not worry about viruses again? Never get on the internet with Windows, PERIOD. If you need software that will only work with windows, make your machine dual boot and remove all internet and newtork functionality from the Windows side.
A Linux or BSD user can click on anything on the internet without fear provided he or she isn't stupid enough to run as root.
Hey, if you're going to write a virus, at least be clever and entertaining. Your data may be gone, but now you have a funny anecdote!
They say the first thing to go is your penis. Well, it's either that or your brain. I forget which...
Sweet, a few million in research and a co-op of vendor neutral organizations and we'll have the Virii vs. Viruses debate figured out in no time !!!
Well damn, why are tax payers funding this - should it not be a function of Microsoft Support???
Oh well, what the hell...
So now the number of known MS Windows viruses will go down 90% from 10,000,000,000 to only 1,000,000,000, while the number of Linux viruses will go down from 5 to well, about 5...
Oh well, what the hell...
I wish there was a Common Slashdot Dupe Enumeration Initiative.
"If you receive an attachment from a familiar email address, but were not expecting anything, you should contact the sender before opening the attachment."
This gave me a good idea for my next virus. It will send two emails to preconfirm that the attachment is OK.
Mail #1: Joe, I'm sending you a copy of the presentation...
Mail #2: InnocentLooking.doc.exe
So far, I have only gotten this to work with people named Joe.
tell ya, those were the days, when men were men, gurus meditated, and virus writers were... but I digress.
When men were men, women were too, and little girls were FBI agents?
Oh wait no, that was the golden age of the Internet. Sorry...
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
Hmm, how long till the first virus that is designed to mutate in order to make the naming system get a numeric overflow?
Oh well, what the hell...
It is viruses, not virii.
</pedant>
C17H21NO4
Oh! Oh! Follow the hurricane naming convention for viruses!
+5 Awesome Idea right there, seriously...
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
I doubt this will be the case. The sample needs to be provided to the analysts who decide whether this is a new piece of malcode or a varient of an old one. How fast will the code be provided? Are malcode experts staffed 24x7 to handle this? I bet the first few hours will remain as confusing as they every were. Maybe after a month, we'll have a common identifier for the malcode that took out all of our systems...
The NVD isn't all that crash hot, actually.
While it does a good job in terms of listing vulnerabilities that exist in various software applications, it can lag other public disclosure by up to a week.
The argument of it providing information that has been vetted doesn't necessarily gel, given that sometimes it leads the disclosure with some fairly vague reports.
Having said that, it is one of the sources that we use for our Information Security Advisory mailing list, but it isn't really one of the primary sources (due to the delays in disclosure).
InfoSec that matters, when it counts.
OK. 50 different IP addresses just nominated my program, so it must be OK. Is it on the list now? Think about it some more.
Intron: the portion of DNA which expresses nothing useful.