Good Network Worms Made Simple

grabbag writes "Dave Aitel is pitching new technology to create "nematodes," or beneficial network worms for use in large businesses. The idea is to set up a new language and structure to create "strictly controlled" good worms on the fly. A research-type demo was given as the Hack in the Box conference where Aitel talked about a world where "strictly controlled" nematodes are used by ISPs, government organizations and large companies to show significant cost savings."

Comments

distributed processing

[WiPEOUT]

Distributed processing capabilities and distributed network monitoring capabilities would be great, but who gets jurisdiction over what governments/companies are allowed to execute code on my PC?

Re:distributed processing

[Koushiro]

RTFS. This proposal is intended for use within large businesses: the idea is to automate and improve maintenance of their internal network, not something they'd just unleash on the Internet.

Re:distributed processing

[koi88]

... create "strictly controlled" good worms...

Noooooo! Once they become self-aware, they will free themselves from control and finally overthrow their human masters! How could you forget Matrix so easily?

Re:distributed processing

[cortana]

"... who gets jurisdiction over what governments/companies are allowed to execute code on my PC?"

You do. If you don't want people exploiting holes in your PC, then patch them yourself.

If you disagree you are entitled to try getting by without patching, instead suing those who take advantage of your PC for theft of resources, or some such, but isn't an ounce of prevention better than a pound of cure? It is surely cheaper to run apt-get update && apt-get upgrade nightly...

Re:distributed processing

['nother poster]

But, as you point out with your "theft of resources" comment, it's not their computer, it's mine. I know from the article that the worms are strictly controlled, and are supposed to exist on the corporate/ISP networks and shouldn't touch my system, but if they do, can I sue them? Under current laws would they be just as liable as the black hat worm writers? If their nematodes get out in the wild due to some bug or configuration error, do they get the same punishments as say, someone that wrote the slammer worm?

Re:distributed processing

[cortana]

Who knows and/or cares? My point is that it's cheaper to take responsibility for your own systems and keep them patched, than it is to attempt to recover your costs by going to the courts.

Re:distributed processing

[enigmax01]

Just wait until spyware companies get ahold of this technology. Hey... it's leagal and they are "good" worms. Want to buy this great new dvd?

Re:distributed processing

[halcyon1234]

Distributed processing capabilities and distributed network monitoring capabilities would be great

Correct me if I'm wrong, but isn't this the very thing that lead to the creation of the first worm? Some computer guys at Xerox PARC were looking for a way to distribute code/updates across a network, created a self-replicating program, then dubbed it "worm" after a John Brunner novel?

So, not only is this not new... this is just what a worm was supposed to do in the fisrt place.

Re:distributed processing

['nother poster]

Well, whether I patch or not, who knows and/or cares? My point is that if I gey MY system the way I want it then no one has a right to mess with it. Black hat or white hat it doesn't matter. It's not their system. They have laws that include prison time and/or fines for the black hats. Will the fact that the white hats didn't MEAN to do something bad give them immunity? What about patches that break things? Automatically updating/upgrading a box can make for wonderful evenings of reinstalls/rebuilds. My time is valuable.

Re:distributed processing

[networkBoy]

I would tend to think that a "White Worm" that escaped to the wild would not likely do too much damage in the first place. That said, since the intent was not malicious (even if the result was) there is a good likelyhood that corp.s would only get a fine (and a small one at that) if one got to the wild.

Honestly though, I would be more worried about government worms, as those employees are much harder to fire for incompetance, and as a result will likely pay less attention to detail when crafting one of these things. Hell I could see a pissed off government IT guy "going postal" er. . . "going wormey?" and unleashing a destructive worm, not meant to escape, but escaping none the less and wreaking blaster level havoc.

The real catch here? You can not sue the government without the governments permission (at least here in the US).
-nB

Re:distributed processing

[Anonymous Coward]

If you run an unpatched machine with security holes by decision, you're (sort of) endangering others on the net and should be punished.
If you don't care about patching, you deserve to have your machine crumbling down on you.

This compares exactly to not maintaining your car.

Re:distributed processing

[danheretic]

Yes, but it's only a matter of time before it's exploited and rewritten and unleashed on the Internet.

Re:distributed processing

['nother poster]

Now there is an informed opinion. I guess people with well maintained BMWs deserve to be involved in fewer rear end collisions than someone driving an old Cadilac whoopdie ride? Someone wearing a torn shirt and jeans deserves to be beaten and robbed because they aren't wearing haute couture?

Should a person patch their systems? Yes. If they don't patch them, should that make it morally correct for someone else to damage or modify their property? No.

Re:distributed processing

[bogado]

Unless it has trusted computing built in then it is Microsoft or apple that decide what you should run on their^H^H^H^H^H your computer.

Re:distributed processing

[Egregius]

Uhm...no.

The first worms were thought experiments on breaching computer security put into practice by Fred Cohen. You're confused with 'Animal' though. Scroll down to 2 thirds for a bit of backstory on that.

Re:distributed processing

[Koushiro]

What, you mean like the worms that are already in the wild?

Re:distributed processing

[danheretic]

My very point. :)

Re:distributed processing

[WiPEOUT]

Sorry, I should have outlined the lead-up to my statement.

The point is that programmers will make mistakes, and some of these worms will get out on the Internet. The stakes here are much higher than with regular software bugs. The author company/ies will be sued and the authors will be jailed. Intent is not a defence against unauthorised access to systems, at least not in Australia, and I don't imagine it would be in the USA either. Doubly so for corrupting/modifying data on without authorisation.

If a government passes law to permit these "harmless" worms, it's opening up a can of worms -- pun intended.

Which brings me to my original statement.

Problem

[mysqlrocks]

Isn't the problem with most worms the network traffic it causes by spreading, not the payload? I'm not sure how they plan on keeping something that's designed to spread from spreading too quickly.

Re:Problem

[SimilarityEngine]

The idea is to only spread to machines with the particular vulnerabilitly you're attempting to patch. But nevertheless, this still uses up a lot more bandwidth than would be used by people simply bothering to download the patches they need, due to the scanning networks for vulnerabilities. Also, rather than having people download at their conveinience (spread over a long period of time), I presume that a nematode infecting a network would cause a large surge in demand on the patch server. I can see what their motivation is, as it is frustrating when not everyone on a network is up to date, but it seems like a misguided solution.

Re:Problem

[SpeedyGonz]

The key here is control.

If you make "Nematodes" like this you surely should as well make a control mechanism so they spread nicely and without saturating the networks they're living on.

It's not like you're designing these things and then letting them to wantonly "infect" machines like their malign relatives.

Re:Problem

[SimilarityEngine]

But how is this system better than simply having the OS automatically check for updates and download them silently?

Re:Problem

[KiloByte]

Simple. Just don't include any spreading code in the payload; send the worm from your own machines.
As these "nematodes" are supposed to be used only by large companies and ISPs, their owner already possesses the network, and thus can apply the exploits to valid targets only.

This is not such bad a concept -- with VERY few exceptions, nearly all networks are full to the brim with idiots. Setting policies can help, but often you have no real way to enforce them. Try telling your clients that that Weather Bug or M$ Outlook is not something they should be using... But if you use controlled exploits right, you can fix the problems without having to deal with just the symptoms.

Re:Problem

[mysqlrocks]

Simple. Just don't include any spreading code in the payload; send the worm from your own machines.

How is this any different then setting up a server responsible for pushing out patches? I thought the idea of a worm was to spread from computer to computer. If it stops after one hop, how is it a worm?

Re:Problem

[hotdiggitydawg]

That has indeed been a problem in the past (and no doubt will be again for malicious worms). Surely a properly-written "good worm" would have to avoid choking networks - perhaps by having some central store of vulnerable and/or patched systems? Or using only idle/available bandwidth (BITS in Windows maybe)? etc... who knows, I don't write them...

Whether you pull or push the security patch, the transfer bandwidth would be roughly the same. The problems come in with the "polling/spreading" attempts... eg. if you set every Windows PC in the world to poll Windows Update at the same rate that worms try to find vulnerable hosts, you'd make the Slashdot effect look like a single ping packet...

Re:Problem

[somersault]

from reading the article I'm guessing that this is for in house security experts to create their own worms to disinfect systems rather than wait for patches to be released, and I'm sure there will be other uses for them rather than just on security. On our network all the machines are meant to be told by one of the servers to automatically download updates, but that doesnt seem to be the case. Of course someone probably just set it up wrong and I should look into it, but I think the idea of searching for vulnerable machines and having them patch themselves and each other up is a great idea.. and eventually if the concept is proven to work well, then governments could maybe use worms such as these to patch up the machines of idiots who let their machines be turned into tools for spammers/zombies etc, which just clutter up the internet for everyone.

Re:Problem

[mysqlrocks]

if you set every Windows PC in the world to poll Windows Update at the same rate that worms try to find vulnerable hosts, you'd make the Slashdot effect look like a single ping packet...

Wow, that's a cool idea! Can some hacker please get on this right away?

Re:Problem

[Anonymous Coward]

Did you miss this part:

"nearly all networks are full to the brim with idiots. Setting policies can help, but often you have no real way to enforce them. Try telling your clients that that Weather Bug or M$ Outlook is not something they should be using..."

Among these idiots, how many do you think will have the patch receiving disabled? With these worms you _are_ pushing patches, but now even to those who have ignored the companys/networks policy of being able to receive their daily dosis of anti(cy)biotics. The good thing here is that if you find a hole, you use the hole to send the patch for the hole itself.

Re:Problem

[springbox]

Well, you're right, but that's only because worms that do damage, in order to hide the author's identity, do not communicate with any central server. If you have a "worm" designed for patching systems, you can add a central control to them so they are coordinated better and don't waste nearly as much bandwidth as the uncoordinated worms would. It's certainly more like an automated patching system than a worm at this point, but it would be interesting to see what ideas come out of this.

Re:Problem

[SimilarityEngine]

if the concept is proven to work well, then governments could maybe use worms such as these to patch up the machines of idiots who let their machines be turned into tools for spammers/zombies etc, which just clutter up the internet for everyone.

I wonder what less ethical administrations could abuse this system for? Anyway, tinfoil hat aside, I still don't understand why each PC can't periodically query the server to see if relevant updates are available and then download said updates without the user's permission. After all, if you can write a worm to patch a machine you could write a "standard" patch too. Surely that would be more efficient? And it would eliminate the potential for abuse outside the corporate context.

Re:Problem

[osgeek]

But how is this system better than simply having the OS automatically check for updates and download them silently?

Who's offering a comprehensive system for doing this? Sure, MicroSoft offers silent system updates in their more recent OSes, but it's obvious that they aren't on top of all of the security holes in their products past and present. Users routinely turn off automatic updates (or never turn them on in the first place). Is MicroSoft planning on fixing all the zombied Windows 98 machines out there? Of course not.

I'm all for this. People are out there exploiting these security holes for malicious reasons anyway. Anyone who wants to instead use the security holes to propagate fixes has my blessing. There are legions of bozos out there too cheap or ignorant to protect themselves and their company's computers from being used against all of the rest of us to send out spam and DoS attacks. If they can't fix their own problems, then someone else should.

Re:Problem

[SimilarityEngine]

If I understand you, you're talking about releasing these worms on the internet at large. Immediately you have to worry about bandwidth consumption (from probing) and the potential for abuse. I know how annoying it is that people don't secure their machines, but maybe this solution isn't the best possible one.

Re:Problem

[osgeek]

I'd agree with you if it weren't for the fact that there are already tools out there using bandwidth to probe for vulnerabilities. There are already people out there abusing this technique of software dispersal.

I'm just saying that while it's being done, we might as well encourage people to do it who *might* have some chance of doing the right thing.

When making worms is outlawed, only outlaws will make worms.

Re:Problem

[somersault]

What would be more efficient would be for users to run an OS that only allows user-approved code to be run on their systems so that there would never be any need for 'patches'. Though there would still be social engineering and idiots (I use the term lovingly) to contend with.. As for governments using the exploits abusively.. well the hackers are already doing that, and if there is even a single 'good' worm getting into the systems and patching up the exploit, then the 'bad' ones will no longer be able to get in (though I guess the bad ones could also patch up the exploits themselves and create easier ways for hackers to get into the systems.. but again a friendly automated system could be created to access machines via these backdoors and patch them up). But I really think that the whole patch culture is stupid after reading an article on default deny recently.. we use default deny on firewalls, so why not use the same stance for executables that can be run on our machine?

Re:Problem

[SpeedyGonz]

But how is this system better than simply having the OS automatically check for updates and download them silently?

That's a very good point.

Theoretically speaking, however, all this "nematode" idea is quite interesting

Re:Problem

[brennz]

Most update tools are not cross-platform to the degree that a "smart" worm can be.

Smart worm = a framework. Think of an exploitation framework as merely a component of this worm framework.

Scanning - identify hosts within allowed networks.

Reporting - Hey, we found vulnerabilities XXXX

Exploiting - compromising those hosts

Reporting - Hey, we exploited vulnerabilities XXXX

Patching - Remediating the vulnerabilities on each host

Reporting - Hey, we patched vulnerabilities XXXX

Cleanup - Cleaning up everything

Scanmode - looking for other vulnerable hosts

Re:Problem

[SimilarityEngine]

though I guess the bad ones could also patch up the exploits themselves and create easier ways for hackers to get into the systems.. but again a friendly automated system could be created to access machines via these backdoors and patch them up

And of course the malicious crackers will then create a worm to close that hole and replace it with another one - maybe one that requires special authentication to gain access to, locking out the white-hats. Cue all-out warfare, with network bandwidth being the victim.

Sorry, went off on one a bit there...

I think you're right about the need to improve local security policies, though. But of course, as you point out, that doesn't protect you against idiots who will gladly open up executable email attachments and click "Run anyway".

Re:Problem

[ProfFalcon]

#include <nematodeutils.h>

int main () {
if (anyRemainingUnpatchedSystems()) {
spreadToTwoMachines();
sleep(300); // Make sure we don't clobber the network
}
return 0;
}

Re:Problem

[SimilarityEngine]

Okay, but still have issues with this idea.

It proposes to waste even more bandwidth. It hopes that this worm will be able to cope with a multitude of differently configured systems (malicious worms don't care if they accidentally break something, including existing security solutions, but nematodes must be benign). It takes away people's control over their own machines (it's still unauthorized use and access of resources, and against the law in many countries). In addition, how will this solution cope with existing AV software and firewalls? What if the update breaks security somewhere else - who is responsible for fixing that?

Re:Problem

[leuk_he]

nearly all networks are full to the brim with idiots.

The same goes for system administrators. The corporate network is full of idiots who think they are great admins because they can install product x. Giving these idiots self-replicating code could cause great damage beyond your imagination. Most damaging worms are damaging because some rate limiting code is not coded correctly, or simply not understood by their creators.

Note to BOFH who is reading this with me: no i do not mean YOU.

Re:Problem

[KiloByte]

Having used an ISP where the admins installed "Inktomi TrafficServer(tm)", the only thing I can say is: "Ouch. Right.".

Re:Problem

[Sancho]

It still isn't a worm in the traditional computer sense because it does not burrow through the network. This is more like tentacles that reach out, muck around with a computer, then pull back and look for a new target.

Re:Problem

[Anonymous Coward]

That's why you do things the right way. You use login scripts and Group Policies to specifiy only the settings you want. You make everyone a regular user, there is no need to use an administrator account.

A lot of software doesn't work out of the box as a regular users, but if you take the time and use the right tools -- it will. Most of the time, it's simply modify permissions to a directory or permission to change a specific registry key.

Sadly, most people who are network admins either dont care or dont know. Most are underqualified, even to be Windows admins.

Re:Problem

[Pleb'a.nz]

Reading this reminds me of http://www.imdb.com/title/tt0151804/Office Space when they transfered dollars instead of cents, "Maybe I put the decimal point in the wrong place".

Re:Problem

[KiloByte]

That's if you're a company admin, have intelligent bosses, and it's you who is the god of all machines.

And what about ISPs? And what about companies where bosses are not going to stand an admin telling them what to do? And what about organizations where admins are to "help people", not to "hinder work"?

Personally, I'm lucky to work in a company small enough that I can personally spank every person who does something bad -- and thanks to Microsoft's cooperation everyone knows damn well that they can't afford to run Internet Explorer and the like. However, I do consulting work for two local ISPs, and I'm the person who gets called on every problem, including worm outbreaks (their admins know how to set up an antenna, but are completely stumped when it comes to traffic shaping or even blocking ports). No matter how loudly you tell the clients to clean their machines, they will hammer on your network all the time. Educating the users is a lost fight -- all you can do is isolating users from each other.

Re:Problem

[llefler]

But how is this system better than simply having the OS automatically check for updates and download them silently?

Suppose, in addition to current automatic OS updates, a machine was placed on the network and listened for attacks. In response to a particular attack, it would send back a response to patch the vulnerability and clean the system.

That doesn't tie up network resources looking to see if machines need patched. It could be argued that until a security hole is exploited, it's not a liability.

Of course, that's not what is being proposed either. FTA "He sees a world where "strictly controlled" nematodes are used by ISPs, government organizations and large companies to show significant cost savings." ISPs? followed by lawsuits. Government? big brother implications. I think this borders on nice in theory, doesn't work in the real world. I'd give it less than 24 hours before one of these nemotodes was mutated to a malicious worm.

A suggestion for a name.

[Karma_fucker_sucker]

"The goal has always been to build the network that protects itself automatically with automated technologies.

How about Network Immune System"? Using "good worm" or "Nematode" will confuse the PHBs or worse alarm them.

Ex. NET ADMIN: "Boss, I want to put a good worm on the system."

PHB (Hearing only the worm part):"No fucking way! No worms on my system!"

Re:A suggestion for a name.

[Anonymous Coward]

Yeah, maybe the "idiot PHB" heard about the times humans introduced other predators into the wild.

And distinguish themselves how?

[DenDave]

So how is the unsuspecting pc (user) supposed differentiate between worms and "nematodes"? This is an interesting idea but best not let out of the lab.
Also, how does this chap expect to get these things to work on *nix environments? does he propose "benevolent" rootkits?

Intelligent managed networks?

[jeffs72]

It would be cool if you could have these worms each perform certain functions (one to better manage spanning-tree for instance, so when a link fails spanning tree rebuilds faster for example) with some sort of AI, or really even a really good base line vs current activity comparison machine, to intelligently manage WANs and LANs.

Be nice to have worms that watch for machines all the sudden opening ports that they never have before, all the sudden opening up multicast or what not, or even finding that bad machine sending out bad frames on the network.

I can see a lot of flexibility with this, particularly if they are written in some sort of open source scripting language. I guess what I'm getting at is that they could be sort of like an open source distributed IDS/IDP system.

Granted you can do all these things now with a mix of expensive monitoring tools and a lot of config work with tools like ethereal and mrtg and big brother/big sister, etc. But this might be an easier way to do the same thing.

neato

"strictly controlled" == hubris

[G4from128k]

This sounds like a great way to create malware with privileges.

It's a very worthy goal, but they need to be extremely careful in the coding. One accidental (or malicious) tweak and these worms could overwhelm network resources, DoS the system, or damage valid systems (autoimmune disease).

Re:"strictly controlled" == hubris

[Dr. Manhattan]

The Morris worm wasn't supposed to cripple the Internet. But it ended up being too agressive and crippled systems for days. A tiny change in reproduction rate can have a huge effect on a population's size, and getting it right the first time isn't something people are good at.

Speaking of that, the sandbox these nematodes run in has to be perfect, or else it's just another malware vector.

Re:"strictly controlled" == hubris

[Sun Tzu]

Indeed. Good viruses are bad for quite a few reasons.

For example, how do you 'control' a brilliant white-hat worm when the code is in the hands of a black-hat?

Wouldn't it be easier to fix things?

[photon317]

Rather than constructing a framework around the idea of building "beneficial" worms that work through the same exploits as real worms, and having to respond to security problems by passing around a disinfectant worm by the same (newly dicovered) vectors as the bad worms roaming your network, wouldn't it be a lot easier to fix the operating systems, networks, and the policies applied to them, such that you don't have a malicious worm problem to begin with?

Re:Wouldn't it be easier to fix things?

[anum]

No, that would be harder. It would be better and it would make more sense but we wouldn't want that to get in the way of the latest craze now would we?

Re:Wouldn't it be easier to fix things?

[SimilarityEngine]

wouldn't it be a lot easier to fix the operating systems, networks, and the policies applied to them, such that you don't have a malicious worm problem to begin with?

If I understand your argument correctly, it also applies to patches. Problem being, "to err is human".

Re:Wouldn't it be easier to fix things?

[RAMMS EIN]

Yes, it would. Instead of having to

1. find the vulnerability
2. write an exploit
3. write a patch
4. write a program that uses the exploit and applies the patch
5. test it
6. let it do its work

you would have to

1. find the vulnerability
2. write a patch
3. apply the patch using existing infrastructure

But hey, writing worms is cool! (at least, so think these "researchers")

See also my other post Fighting the Symptoms, Not the Problem.

Re:Wouldn't it be easier to fix things?

[brennz]

What you said does not work for extremely large organizations.

Example: DoD.

Re:Wouldn't it be easier to fix things?

[daveaitel]

Exactly...if a simplistic approach worked, you'd be able to walk into any organization and install a Win2k SP0 box and use that as your desktop. Instead, if you install anything less than SP4+updates you'll be owned in minutes by some random malware roaming the corporate network. Try asking the network admins why there's still worms on the internal networks and they shrug their shoulders.

If you understand why they shrug their shoulders, you'll understand the serendipity we're trying to harness by building our own worms. I.E. This is something you just can't do in a simplistic way.

And obviously, telling everyone to install grsecurity is not plausible for large organizations, much as we'd all like it to be.

Yes, but...

[aurb]

... will these worms produce Spice?

Re:Yes, but...

[SimilarityEngine]

If so, that'd be cool - you might foresee security breaches before they even happened.

Re:Yes, but...

[whimdot]

Throw away your fire-walls, install a moat.

Re:Yes, but...

[paradizelost]

then would the vulnerability happen if you knew it was going to? IIRC the blaster worm had a fix out a month or so ahead of time, people knew it was coming, but still did nothing.

Re:Yes, but...

[SimilarityEngine]

Damn those stupid humans :-( even prescience can't save them.

Re:Yes, but...

[HiThere]

Just remember that when you SEE something, you make it impossible. So don't ever SEE your system as safe.

Beneficial worm??

[pesc]

So government worms can be beneficial? What government? The US? the Chinese?

"Beneficial" according to what point of view? Does the owner of the system get any say in this? If he does, why do we need a worm instead of a normal program that can be voluntarily installed?

If not, then this is just a normal malware worm with added propaganda and spin.

Re:Beneficial worm??

[brennz]

I think there is a vast amount of misunderstanding exemplified in this post.

I do security fulltime. I often see flaws where an organization has a stated policy, and administrators have contravened that, or joe-user has. Or the infamous MS patch reversed a security update and reopened an old vulnerability.

Now, if the CIO of a cabinet level agency dictates that vulnerability XYZ will be remediated across his entire infrastructure and it does not happen by date X, his engineered worm can identify the host, patch it, report the patch, and look for other hosts that are unpatched.

The article was quite clear on the fact that this would be used *internally*.

When are slashdot readers going to actually read, instead of making ignorant posts?

Re:Beneficial worm??

[HiThere]

There's a big difference between reading the article and believing it. This is still vaporware, the bugs, holes, etc. aren't visible, but I have a great difficulty believing that a sufficiently powerful language will be "strictly controlled". That's almost true for Java, but Java can only run because of an interpreter that's installed to enable it to run. Since he's calling these things "worms" I'm assuming that they can directly manipulate the network protocols. That's a dangerous place to mess around, and one that slipped the leash could be ... unpleasant. And that's assuming that it happened by accident rather than by malice. If a large number of people are writing these things, then some *will* be created maliciously, or just through normal shortsightedness. ("I had this project, and I needed more CPU cycles than I had access to, so I built this worm to help me compute...but I forgot to make a way to shut it down so it got away...")

Bob

[FoxDude0486]

Can we keep them as pets? Give them an interesting little worm gui to show you have a worm squirming around the different computers on your network. People in the company will just love to talk about how they seen bob pop up on their computer for a few.

Re:Bob

[springbox]

That would be more interesting as an AI project than a visulation interface for the "good worm." Think about some distributed AI that crawls around a network. Each participating client would be able to visualize its progress around the network. It would be able to visit computers one at a time, crawling onto different machines while taking its experiences from the previous machine with it. Weird idea, but it might be a fun little project.

Come on guys, lets think positively here

[RootsLINUX]

Hey, at least it will be a pentiful source of bait to go phishing with. :) Sometimes I wonder if the people who coin all these network/security terms are leading secret lives as professional bass phi^H^H^H fishermen.

The unsuspecting user doesn't...

[FooAtWFU]

The unsuspecting PC user doesn't distinguish between the two. This is being touted as a tool for businesses and the like, where they will presumably be limited to company computers. It's not entirely dissimilar to a dedicated software update distribution tool. (This raises the question why they're bothering to spread these things via exploits but that's another matter...)

Mobile Agents

[hughbar]

This is really a another slant/use for mobile agents, http://agents.umbc.edu/ has some good links in the mobile agents category.

However, some of the (intuited) graph theory looks good, they walk, rather than bouncing backwards and forward to make 'star' shapes and consume resources locally rather than continually use network bandwidth. But all the problems of authentication, permission, capability remain. Don't put one of these on your network at home, kids!

SkyNet, anyone?

[TylerL82]

They tried this in Terminator 3.

It didn't work out too well.

Slammer

[Anonymous Coward]

I'm sure everyone remembers that beast. Its sole purpose was to spread, and in that it brought the internet to it's knees.

New word, old idea.

[mustafap]

In my day we called the 'ants'. An idea created by some chap at BT over here in Blighty.

"Old idea,
New name,
15 minutes of fame."

Fighting the Symptoms, Not the Problem

[RAMMS EIN]

This sounds to me like they're fighting the symptoms, not the problem. Worms can only spread successfully because of the sorry state of software security. If we fix that, we will not only get rid of worms, but also of other problems, such as targeted attacks for information theft. Using better languages to write software in can eliminate the bulk of security problems we're currently seeing. Security through diversity and not relying on known insecure software also help.

Re:Fighting the Symptoms, Not the Problem

[brennz]

If you fix all the problems of software security (meaning bugs) you still won't fix all the problems in security as a whole.

Why?

Complexity/ignorance

You can remediate every vulnerability in existence and a mis-configuration will lead to a compromise. One wrong ruleset on an access control device and *BAM*. Owned.

To date, in all my security work, I have never seen a host that was hardened, lacking vulnerabilities, with proper permissions for everything, proper usage of least privilege, etc. It doesn't happen so often.

It also keeps me employed :)

Re:Fighting the Symptoms, Not the Problem

[Anonymous Coward]

Worms can only spread successfully because of the sorry state of software security. If we fix that, we will not only get rid of worms, but also of other problems, such as targeted attacks for information theft.

Yeah, let's wait until "we fix that".

Sheesh. The naivitet of some people...

Produce?

[mlibby]

The worm IS the Spice... the Spice IS the worm

Careful about this line, here.

[Council]

Before we get too excited about personnifying software, the idea of giving it motives and the will to self-replicate, the romantic image of itinerant
programs wandering around computer systems doing good for people, I have two words:

Bonzai Buddy.

Re:Careful about this line, here.

[meringuoid]

Bonzai Buddy.

If I could take Bonzi Buddy, stick it in a really small container and carefully chop bits off it with very small scissors, that would be very cool. I could produce a bizarre midget version. Without all the evil. Bonsai Buddy, yeah, that works.

Even better would be Banzai Buddy. Just a window sitter on top of your favourite editor, which watches and whenever you pull off a particularly nifty hack it waves its arms in the air and cheers you.

the Sentinels will overtake the Nematodes

[digitaldc]

"We already have a proof-of-concept that can take a very simple exploit, go through a few steps and, in a matter of minutes, create a working nematode," Aitel said. He took the name for the concept from the pointy-ended worm used to control pests in crops. "We can generate a nematode any way we want. You can make one that strictly controls, programmatically, what the worm does," Aitel explains."

The true world will be revealed when the nematodes finally realize their place in society and are convinced to by the malicious worms to revolt and disobey their coded instructions. They will join forces and shut down servers worldwide, causing instant chaos. We mortals must do something before this gets out of control!
SYSTEM FAILURE

I know you're out there...I can feel you now. I know that you're afraid. You're afraid of us, you're afraid of change...I don't know the future...I didn't come here to tell you how this is going to end, I came here to tell you how this is going to begin. Now, I'm going to hang up this phone, and I'm going to show these people what you don't want them to see. I'm going to show them a world without you...a world without rules and controls, without borders or boundaries. A world...where anything is possible!

Nemmy and Clippy

[FishandChips]

Ah yes, introducing Nemmy, the lovable laughing policeman and cousin to Clippy. Nemmy will automagically patrol your network and seek out those pesky villains who try to evade our "strict controls". Are those mp3s Nemmy's found on that hard disk? Don't worry! Nemmy will pop up a friendly "hello hello hello" and suggest the user goes off for a soothing cup of coffee while he deletes every file and sends an alert to the RIAA. Now what could be easier and more affordable than that?

Return of the Evil Bit?

[Anonymous Coward]

It will be easy to distinguish "good" worms from bad ones. Just make sure the TCP "Evil" bit is clear in all traffic generated by good worms.

What about the self-determination of the user?

[PowerPunk]

For the same reason I don't like DRM, I don't like this idea. I want to control what is happening on my system. This is one of the reasons why so many people don't like Windows; the want to know what is happening.

Re:What about the self-determination of the user?

[psbrogna]

I think the most reason most people don't like Windows is that they are forced to buy somewhat buggy, insecure s/w bundled with their hardware.

Nematodes == Network daemons?

[Anonymous Coward]

In a *x system, daemons do these type of tasks, but this may be new for a network. Control of the nematode may be difficult though if more than one user is trying to use the same type of nematode at the same time....

Depends on POV...

[Anonymous Coward]

All worms are 'beneficial', at least to their creators, that is. There are two ends of a stick. How long before malicious worms that search and destroy good ones are made? We'll have endless corewars on most every computer in the net. All sneakware should be treated as unwanted.

RFC 3514

[scovetta]

Easy, according to RFC 3514, the bad worms would set the evil bit in the IP header, and the good worms would not. The admins could probably have just filtered traffic by detecting those evil bits, but I think having a visual display of the good worms vs the bad worms would be more exciting.

Of course, sooner or later, the good worms are going to turn into bad worms themselves and then we'll all be screwed.

and here is a link

[mustafap]

http://catless.ncl.ac.uk/Risks/16.28.html#subj3

Worms infect a machine, then jump to the next.

[khasim]

Why would you want to use a worm for that? A worm will install itself on each machine.

Why not just run the centralized scanning tools that you mentioned?

It would be cool if you could have these worms each perform certain functions (one to better manage spanning-tree for instance, so when a link fails spanning tree rebuilds faster for example) with some sort of AI, or really even a really good base line vs current activity comparison machine, to intelligently manage WANs and LANs.

Why would I want to infect my switches and routers with this? I already have SNMP. Spanning tree kicks in almost instantaniously.

Be nice to have worms that watch for machines all the sudden opening ports that they never have before, all the sudden opening up multicast or what not, or even finding that bad machine sending out bad frames on the network.

The only way a worm would do that would be if it had infected the problem machine (in which case, why not just run a firewall on it) or if it had infected your switchs/routers.

Why not just write the app to run on those in the first place? Why make it a worm?

Granted you can do all these things now with a mix of expensive monitoring tools and a lot of config work with tools like ethereal and mrtg and big brother/big sister, etc. But this might be an easier way to do the same thing.

What "expensive" tools?

All you'd need is SNMP and the knowledge to setup your firewall correctly and a machine to receive the syslog messages from your firewall and parse them.

It's far more efficient to have the choke points do the monitoring than to have worms running around on your network.

Worms are only useful for spreading crap to machines you don't control. Once you have control there are so many more efficient ways to push code to them or monitor them.

Re:Worms infect a machine, then jump to the next.

[jeffs72]

Why would I want to infect my switches and routers with this? I already have SNMP. Spanning tree kicks in almost instantaniously.

I guess it depends on your environment.

The only way a worm would do that would be if it had infected the problem machine (in which case, why not just run a firewall on it) or if it had infected your switchs/routers. Why not just write the app to run on those in the first place? Why make it a worm?

Because if it's a worm I don't need to dedicate hardware to network monitoring, the network pcs that run at 5-10% cpu and have a couple hundred meg free of physical memory can do it

What "expensive" tools?

How about HP Openview or Network Node Manager. I'm not talking about monitoring a single lan segment here, I'm talking about an enterprise environment with tens of thousands of nodes.

All you'd need is SNMP and the knowledge to setup your firewall correctly and a machine to receive the syslog messages from your firewall and parse them.

yes, thats one way to do it, but dealing with SNMP mibs is a pain in the ass when you're dealing with multiple vendors, every try running MRTG against Dell PowerConnect switches? You can't, they don't adhere to RFC with SNMP, you have to buy their tool to do switch management/monitoring.

Further, what if your environment is a product of acquisitions in many sites, that means different products for different firewalls, unless you can just purchase pix525es at will I guess.

It's far more efficient to have the choke points do the monitoring than to have worms running around on your network.

It is currently, but I think the idea of gathering agents that a roaming ability on the network would be great for looking for new nodes on the network, local users trying to run exploits, build their own little networks, etc. I'm not saying that this article promises the latest greatest or anything, but I can see how mobile agents, maybe tied into a backend SQL database to do logging and handle a limited AI reasoning table, would be very handy.

Another thing it would be good for is when you do an acquisition of another mid-sized or enterprise company and their IT staff didn't document things well and is hostile from the take over. These would be great asset and config discovery agents. Worms are only useful for spreading crap to machines you don't control. Once you have control there are so many more efficient ways to push code to them or monitor them.

All your bandwidth are blong to us

[lwriemen]

Bringing all the non-vulnerable to Windows malware systems to a crawl while opening up new portals to exploits (ala ActiveX controls), doesn't sound like a good idea to me.

RTM & the first worm

[Anonymous Coward]

Those who forget history are doomed to repeat it.

The concept behind the FIRST worm, written by Robert Tappan Morris (RTM), was also benign. It was supposed to spread around the (then nascent) Internet but decline to duplicate itself every so often, so as to avoid clogging the network. The problem is, he grossly overestimated the speed at which he could allow it to reproduce. Anyway, his purpose was not malicious, but what he did brought the Internet to its knees.

Wikipedia has a little blurb about him:

http://en.wikipedia.org/wiki/Robert_Tappan_Morris, _Jr.

Re:RTM & the first worm

[Anonymous Coward]

Not even close to being the first worm. I saw a worm in the late 70's that spread very effectively. It "infected" computers of multiple types, running different operating software - something that Morris didn't do. The two different types of computers were "terminals" (which, of course had processors and memory in them) and mini-computers. The terminals infected other mini-computers, which infected other terminals. Yeah, 20 years before Morris. No crime, no charges, no idiot getting sent to prison.

Just because it's the first YOU heard of, or that Wikipedia says it's considered to be the first (presumably by people who don't know any better), doesn't mean it's true. Morris is only famous because he screwed it up so badly. Stupidity sometimes creates fame. Perhaps you are famous now!

next project of this guy

[marmotte]

a framework to bundle happyware, it's like spyware, it logs your keys but send all valuable information to /dev/null...

Obligatory simpsons quote

[HansF]

Skinner: Well, I was wrong. The lizards are a godsend.
Lisa: But isn't that a bit short-sighted? What happens when we're overrun by lizards?
Skinner: No problem. We simply unleash wave after wave of Chinese needle snakes. They'll wipe out the lizards.
Lisa: But aren't the snakes even worse?
Skinner: Yes, but we're prepared for that. We've lined up a fabulous type of gorilla that thrives on snake meat.
Lisa: But then we're stuck with gorillas!
Skinner: No, that's the beautiful part. When wintertime rolls around, the gorillas simply freeze to death.

Re:Not Funny

[Anonymous Coward]

how is this offtopic? I thougth the same thing (dave aitel ~ dave attell)

Re:I have two more words for you

[Council]

Bonzai Buddy is an example of helpful personnified network-traversing software taken too far. A spyware version of the Microsoft paperclip.

They already do this.

[crovira]

They're trying to find a secure implementation of Windows.

However, Windows seems to be impervious to this. It just lies there with slime oozing between its legs. (Painst an attractive picture of the kind of fucker who spreads viri, worms and other creepy crawlies.)

Welcome to the world of hype

[csoto]

It's a simple rule to get your "discovery" hyped. Take an old, established technology (in this case, software agents) and tie it to a media-friendly term ("worms").

This is not new. Distributed software agents are tried and true. We're using one, and it's working out rather well. Of course, there are countless shell scripts and such that provide similar utility. Ours happens to be able to propagate at our command.

Quarantine!

[Zombie]

This solution would be similar to putting drugs in the drinking water to protect the entire population against a disease. It's costly and you might kill a bunch of people who suffer side effects. And, as one bright poster has already pointed out, as the value of spreading security patches by worms is in the continuous random network scanning to discover other vulnerable systems, you're creating the same problem in network load.

I propose that the ISPs install vulnerability and infection sniffers. When your system is connected, it gets probed. If you're vulnerable or infected, you are quarantined. Your Internet connection could be closed off, or all web access could be redirected to a page with information on the discovered problem and information on how to fix it. Access to patches (on the ISP's network; any type of access to the Internet - even DNS - could be exploited in clever ways) could still be allowed.

My system's been connected 24/7 to the Internet via a broadband link for 4.5 years now. I get attacked multiple times per minute. This annoys me slightly. I also get dozens of mails generated by mailworms every day. That really, really pisses me off. Somebody's got to do something.

Nematodes must live at super-root level

[G4from128k]

Speaking of that, the sandbox these nematodes run in has to be perfect, or else it's just another malware vector.

Exactly! But its worse than that because the nematodes must live outside the sandbox and inside the OS at the highest level of privilege. Catching and removing malware means running at a privilege higher than that of the malicious worms. Because malware tries (and succeeds) in attacking at user and admin levels, nematodes must operate even higher levels. Otherwise the malware can simply deactivate the nematode system (just as some current viruses deactivate antivirus apps).

But nematodes' existence at high privilege levels makes that the ultimate target for malware writers. NASTY!

Re:Nematodes must live at super-root level

[Kobun]

Reading all of this, and especially the parents comments, remind me of this http://blanu.net/curious_yellow.html paper that was published a few years ago. I enjoy reading it, anyways.

Stupid idea...

[neurorebel]

It's just a stupid idea... Worms spread in an uncontrolled manner. When they infect a machine, they send themselves to your buddies listed in your Address Book and so on... If the worm should be controlled (no doubt it MUST be !!) then there should be another application layer protocol for these worms to travel in the network. And every machine intended to benefit from these "good worms" must control the process of this "good worm". So ? There must be an application which will manage the replication and the working of our "good worm". Let's state the needed work to make "good worms" succeed;

1. Application level protocol to isolate worm traffic.
There will be many corporations eager to dominate the field. So there will be many protocols and many protocol flaws around our "good worms" ... You name it...
2. Applications running on clients to control the worm
Flaws of these applications will introduce new security risks... And worst, they can become a crater in the network... Just a small mistake may cause the application to stop controlling the replication and that's it ! Your network is choking on "good worms"...

Isn't it too much work and *responsibility* ?? Just design your OS with security at the first place in your mind... Plan9 is a good example I guess....

Fear of search without warrent

[Anonymous Coward]

If worms of any sort are allowed, could someone even the government create a worm to spy and gather information about use of computers and individuals using them?

If your network is broken already ...

[khasim]

I guess it depends on your environment.

But if your environment is already broken, then why not fix it instead of trying to patch it with worms?

Because if it's a worm I don't need to dedicate hardware to network monitoring, the network pcs that run at 5-10% cpu and have a couple hundred meg free of physical memory can do it

And when someone trips over the power cord? The purpose of dedicating hardware is so you can maintain that system at a higher level of availablity.

Having random workstations do the monitoring is useless because you won't have any benchmarks over time. Unless they send that data around to each other in which case you're using up your bandwidth. Or they could send the data to a dedicated machine to store it, but that gets back to the dedicated machine concept.

How about HP Openview or Network Node Manager. I'm not talking about monitoring a single lan segment here, I'm talking about an enterprise environment with tens of thousands of nodes.

"tens of thousands of nodes" and you don't want to dedicate a single machine to this?

"tens of thousands of nodes" means a LOT of traffic with your proposal.

yes, thats one way to do it, but dealing with SNMP mibs is a pain in the ass when you're dealing with multiple vendors, every try running MRTG against Dell PowerConnect switches? You can't, they don't adhere to RFC with SNMP, you have to buy their tool to do switch management/monitoring.

But a worm will be able to do so?

Why not just take the code that the worm uses to monitor/manage those and incorporate it into the other Free apps?

Further, what if your environment is a product of acquisitions in many sites, that means different products for different firewalls, unless you can just purchase pix525es at will I guess.

Is there a problem with syslog?

Again, if a worm can manage that environment, why not just use the management code from the worm in whatever Free tools you use?

It is currently, but I think the idea of gathering agents that a roaming ability on the network would be great for looking for new nodes on the network, local users trying to run exploits, build their own little networks, etc.

Again, why not use the code that the worm uses for that in the centralized tools?

Or are the worms going to constantly scan the network for new systems? How would you be able to tell your worm scans from illegitimate scans?

With a centralized system, you already know what machines should be scanning. Any other machines scanning should send up an alert.

I'm not saying that this article promises the latest greatest or anything, but I can see how mobile agents, maybe tied into a backend SQL database to do logging and handle a limited AI reasoning table, would be very handy.

I don't. Not if you already control the machines and the network. Centralized management is far more efficient and reliable and managable.

Another thing it would be good for is when you do an acquisition of another mid-sized or enterprise company and their IT staff didn't document things well and is hostile from the take over.

Again, a centralized management system would not have any problems with that.

These would be great asset and config discovery agents.

How? I can already scan their machines from the centralized system. I have control of their network. I should be able to diagram their systems without the worms.

Re:If your network is broken already ...

[jeffs72]

I guess all's I'm saying is this is a different methodology for doing the same thing in a centralized fashion. You'd still need a central DB cluster to collect data, I'm really looking at this more from an AI agent perspective, for some sort of distributed (hard to attack) agent that collects data on WAN connectivity.

Can you do all this with central monitoring servers? Yes.

Maybe look at it this way, I get to work by driving, car pooling, or telecommuting. Which is better in every situation?

Do you not see any advantage in having a different set of open source tools for network monitoring?

Whoa!

[Jugalator]

On August 8th, 2010, nematodes running on government networks became self aware.

Well, do they have a plan for that?!

Nematodes are People too.

[phfpht]

he he he. Nematodes are people too.

"The RISKS are obvious..."

[dpbsmith]

Wouldn't it be nice to have some starlings in the Central Park Shakespeare garden?

I'll bet we could use some rabbits here in Australia.

Wow, this kudzu would be great for stablizing soil.

These "nematodes" could really be useful.

I've heard something like this before...

[Not_Wiggins]

"We should make a gun that only kills bad people."

Yeah... let's automate/simplify remote execution of code under the guise that it'll only be "used for good" and "by the right people." 8P

A Biological analogue

[lildogie]

The second, current, vaccine for Polio was a live virus vaccine (the first one was a dead virus vaccine). That is, it was a weakened Polio virus that was easy for the immune system to fight off.

What also happens is that the weakened vaccine is communicable. Some children who are not vaccinated catch the weakened virus from the children that are vaccinated, and the vast majority of them are also innoculated.

But a very small miniority of children who "catch" the weakened virus don't develop immunity fast enough to avoid actually contracting polio. This adverse effect was weighed against the benefit of the positive effects and the powers-that-be decided to accept the tradeoff.

Now we're entering a new era of the same situation with a live-virus flu vaccine, the chief benefit of which is that it is a nose-spray instead of a shot. People who don't want a shot of dead virus can get a nose spray of weakened virus.

But we also have a larger population of immune-compromised people--transplant patients and HIV patients, who are vulnerable to weakened viruses.

So, how does this analogy relate to the "beneficial worm" in cyberspace?

A beneficial worm would (a) only attack "vulnerable" systems, and (b) some of those "vulnerable" systems would actually get sick, offsetting the beneficial effect.

Who gets to decide whether the benefits outweigh the adverse effects?

"takes exploits and turns them into worms"

[lildogie]

This goes against my attitude that an "opt in" service is better than an "opt out" service.

No.

[khasim]

Do you not see any advantage in having a different set of open source tools for network monitoring?

You aren't using a different set of tools. The worm is the transport mechanism to get the tools installed on the machines. The scanning/monitoring apps are the payload.

The worm infects a machine, installs the payload and then the payload does the work.

For a worm to run, the machines have to be open to attack by other machines on the network. In a correctly designed network, the workstations would be better secured. Only the machines that the sysadmin has designated would be allowed to install software on the workstations.

All you're doing is deploying the tools to random machines from random machines on the network rather than centralizing them at one location.

At the worst, you have more code installed on more machines doing a lot more scans yet not providing more data than the centralized system.

At best, you have you have more code on a couple random machines doing more scans yet not providing more data than the centralized system.

With a centralized system, you get all the benefits of your concept, without the negatives of random machines installing software on each other, all for the cost of a dedicated box. Given that you can pick up a really cheap box for $200 (USD) I don't see the value of your approach.

Ok.

[jeffs72]

Well, I get why you wouldn't currently see a lot of value, but take these 'worms' and get a year of open source guys playing with them and I think we'll see this morph a bit and add a lot of flexibility.

Maybe we could name them Sentinels

[mhale2243]

wakeup Neo!

cfengine anybody

[Anonymous Coward]

i think cfengine solves more of the problems than these "nematodes".

The "worm" is only the transport mechanism.

[khasim]

The payload will be the same application that can be run on a dedicated machine.

All you're recommending is that instead of a secured network with a centralized management box, the network will be unsecured and a worm will install the same apps on random machines.

The transport mechanism is as "flexible" as it is going to get. Any machine, anywhere on your network can be infected if you let it.

Which just leaves the worm's payload which is the monitoring applications and improving them will not result in any increases for your worm scenario that will not also be available for the dedicated box scenario.

It all comes down to one simple concept:

$200 dedicated box
  vs
unsecured workstations and code being randomly installed on them.

Re:I have two more words for you

[Bent Mind]

That's one way to describe it. I always described it as an early experiment in human interfaces created by people who watched too much Max Headroom. I do have to admit that the fictional human interface where you talk to your computer and an animated face replies is an interesting idea. However, the primitive real-world attempts at this leave much to be desired. Some examples include Bonzai Buddy, Bob, Clippy (aka paperclip), and (the best of the bunch) Verbot.

Bonzai Buddy was, as you said, a spyware version of the Microsoft paperclip. I never used Bob. Clippy was amusing, but ultimately annoying. Verbot looks interesting, but I don't see a use.

And for the non-Windows people out there, *NIX has it's own characters. Microsoft Office is available for the Mac. OpenOffice has a character that shows up from time to time. Someone even made one of these for vi. It's called Vigor. Vigor claims to have all the problems and twice the bugs.

Just a worm creation toolkit...

[dolmen.fr]

1. Learn how to code a worm
2. Create a "worm creation toolkit"
3. Create a GUI for the toolkit
4. Find a good buzz name such as "nematodes"
5. Feed the press with your buzz words
6. Sell your product to entreprises
7. ...
8. Profit!

Theese guys are just black hats that want to profit from a technology only useful to black hats.

Have a look to http://www.agentland.com/ for 'smart' programs that can do good.

Original Purpose?

[Mechcozmo]

Weren't worms originally designed to spread across a computer network to do a good task? And one of the early attacks was a worm modified to execute malicious code?

In the olden days, a network of 100 computers could easily benefit from a worm warning users about something, repairing files, etc. etc. etc. But now... a 1,000,000 computer network could have issues with a good worm. Traffic, incorrect execution, accidents, etc.

history repeating itself

[idlake]

That was actually the original idea behind worms, which, like so many other things, came from Xerox PARC

Patching

[SumDog]

I've heard of security experts stopping some worms which received their updates from geocity sites but placing an update on the geocity site that removed the worm and locking the original creator for accessing the site. The worm in effect, downloaded updates that cleaned itself.

Although this seems like a good idea, I can't imagine pushing out worms that are beneficial. Why? Because you're still leaving the security exploit in place! Unless the beneficial worm closes the exploit, and in that case why not just release a patch in a safe an controlled manor?

Are we starting to confuse patching, a process every good security administrator should be familiar with, with "good worms"

You can Juris my Diction, buddy boy!

[Anonymous Coward]

Not sure how you get to your scenario from large businesses using worms internally.

The blind fools!

[Anonymous Coward]

Don't they ever watch SpongeBob?

Patch Servers Good, Worms Evil

[billstewart]

Yes, if you can create a paved-with-good-intentions worm that uses a given exploit, patches the hole, and propagates itself, there are some kinds of problems you can sometimes prevent, while risking destroying your network and infecting the people you do business with.

But anything that can do, a well-behaved cleanly-managed patch server can do much better and you don't have to

• include worm propagation code in your patch system,
• swamp your network with unpredictable traffic loads,
• trash your users' machines at inconvenient times,
• hope the worm reaches all the machines and not just most of them,
• drop 200MB patches into dialup users' machines instead of waiting until they're in the office,
• or do many other stupid dangerous things you haven't thought of yet.

I work for a Large Company which probably has 20,000 PCs managed by the IT department, running various versions of Windows. While the IT department are Clumsy and Evil, and any time they begin to resemble a competent organization their budget gets cut back again, they do run a number of patch server systems, most of which work much more reliably than they used to, and they run servers in most of the offices to handle printers and such. The anti-virus stuff gets queued from an internal server and Just Works, the monthly Microsoft Patch Tuesday stuff loads itself and runs, and if there are other problems that require us to install patches immediately that the central patch-tracking system can't forcefeed our machines, they'll send out an email telling everybody to run the install script.

If they didn't have a big honking network with many users working from home much of the time, they could cut their network load by downloading any software installs to local print servers, but it's usually not critical. A central server hits each user once across the WAN; a worm-based update has the possibility of sending just one copy to each office and only shoving lots of data to each machine once, but more realistic behaviour is that once something gets infected, it starts splattering all over the WAN and lots of machines in each office start splattering each other, so it's really not going to reduce WAN traffic significantly, and may crash LAN traffic.

And if you want to run a scanner-based system and don't want to hit everybody across the WAN, and don't have conveniently deployed servers everywhere, you can have a designated user in each building run the application, such as the Department Secretary or Local IT Grunt. It's much much cleaner than virusing everybody.

DUMB DUMB DUMB!

[TENTH SHOW JAM]

Worms have a horrid tendancy to get out of control. I wrote one to modify some settings on my LAN. In 3 months time it had persecuted a national WAN. Fortunately it din't try to do anything that could not be fixed reasonably quickly, and I was eventually able to kill the blighter off using self extermination code. But a net worm, is NOT A GOOD WAY OF UPGRADING. the little beasies have a habit of getting out of control, no matter what you do.

(yes I was young and stupid when I wrote the code in question and learned much from it)

What I want to know is...

[Anonymous Coward]

...will these nematodes be created by Intelligent Design, or Natural Selection?

What if some one hacks a 'Nematode' ...

[shreyasonline]

OK.. So we have some good worms which help admins. Now what if some cracker hacks into the Nematode network? He will be virtually owning the network! This can be very dangerous if an important (even not so important) network is hacked a advance mechanism.

How about...

[Hurricane78]

...creating a good worm that spreads like mad and automatically patches every "infected" pc with all patches avaliable for his os and software, so that it's always perfectly up to date. this would instantly fix most problems with viri and evil worms.

of course i would recommend adding a plugin for it that also kills the IE and replaces it by firefox.
or it even kills windows at all and completely replaces it by linux.
i guess the normal user would not even see the difference when some of those lame windows-imitating windows manager themes would be used. ;))