Slashdot Mirror
A New Approach to Mutating Malware
mandelbr0t writes "CBC is reporting that researchers at the Penn State University have discovered a new method of fighting malware that better responds to mutations. From the article: 'The new system identifies a host computer with a high rate of homogeneous connection requests, and blocks the offending computer so no worm-infected packets of data can be sent from it.' This is a change from previous methods, which compared suspected viruses against known signatures. Mutations in malware took advantage of the time-delay between the initial infection and the time taken by the anti-virus system to update its known signatures. This new system claims to be able to recognize new infections nearly instantly, and to cancel the quarantine in case of false alarm."
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
What happens when I buy a new game and it connects to the other players in a tight mesh.
It might send out a storm of packets to each of the possibly hundreds of other servers.
Will it be blocked, if so who do you see to get it unblocked, what happens if my ISP are running this software?
liqbase
This will (mostly) work on worms which attack flaws which behave in a nondeterministic fashion; A worm isn't guaranteed an infection by only one connection attempt. I don't think it would work for flaws that require only one connection to infect, though.
That could be improved by setting up a pool of computers which combine their connection details, but that poses privacy concerns, along with the possibility of misidentifying a host. If someone running a cjb.net server gets assigned a new IP address, and someone keeps attempting to connect to the old IP (Say, via a badly-configured DNS cache like they have at my college), that whole pool of computers would block the client, possibly harming his participation in P2P networks.
tasks(723) drafts(105) languages(484) examples(29106)
... or is porn just an actively sought out form of malware?
"I only know 2 things: The love for me, and the fear of me."
'The new system identifies a host computer with a high rate of homogeneous connection requests, and blocks the offending computer so no worm-infected packets of data can be sent from it.'
So they're focusing on a symptom. But it sounds like this could be used block other "homogeneous" traffic, like Bittorrent, no?
The theory of relativity doesn't work right in Arkansas.
Perhaps it performs its detection based upon the evil bit.
liqbase
Hello,
There's not really a lot of information about how Proactive Worm Containment (PWC) works in the article. A quick bit of searching found the Penn State University Cyber Security Lab's home page here and Professor Peng Liu's home page here along with the university's press release here, but I did not see any actual articles on PWC.
A more detailed description would be most welcome, since the press release makes it sound like this is an automated response to quarantining a host which is performing a DDoS, and it is not clear how PWC would differentiate between that and just a very busy server.
Regards,
Aryeh Goretsky
Dexter is a good dog.
I wish the article didn't pretty much suck...
This is the webpage for the Cyber Security Lab. I don't see anything about this on there, but a Google search for Proactive Worm Containment brings up this presentation.
OK. This will work for a while. However, sooner or later, two things will happen:
1. The Malware Boys(TMB) will change the software to spit out connection attempts more slowly so that
it falls below the threshold
and
2. Since TMB seem to be increasingly financed by organized crime, they'll duplicate the technique
in their own labs and build worms that work around it, just the way they've gotten a lot of crud
by Bayesian Filters and anti-virus software.
Summary: no magic bullet
I don't see what anyones sexuality or promiscuity should matter. Live and let live.
I read the article, and I'm still wondering what the 'new' part is. The text doesn't mention anything that hasn't been around for ages, is this a bad article or bad research?
This idea was discussed in considerable depth on various
anti-spam lists several years ago. Nearly all hosts on the
Internet talk to one mail server: the one designated for
mail submission from the network they're on. (s/one/few/
for networks large enough to have multiple SMTP gateways.)
Such systems, if observed suddenly making connections on
port 25 to hundreds (or more) other mail servers, are almost
certainly spewing spam. This is particularly true if those
connections meet certain criteria (e.g. traffic sent before
waiting for SMTP greeting from remote side, or failure to
send QUIT before closing connection). Slapping a port 25
block on such systems at least partially quarantines the
problem, buying time for more thorough investigation.
The same could be said of systems observed making hundreds
of SSH connections (to one destination or many), etc. The
basic concept is to figure out what "normal" looks like --
which, granted, may vary with what uses a system normally
has -- and then do something when things don't look normal.
"something" could be "log it" or "issue an alert" or "rate-limit
connections" or "rate-limit traffic" or "block" or some
combination; the trick is to select an appropriate response
that does something useful while not making the mechanism
so twitchy that it trips when it shouldn't.
The ability to block things by numer/frequency/type/foo of connection attempts is pretty old...it's just not particularly useful in cases as open-ended as this (trying to block worm activity based on no other information than connection behavior). It seems someone here is, as usual, reporting on the rediscovery of the wheel. (Not to mention the fact that the fast moving DoS worm is out of fashion right now. The heat is too much for people looking for kicks and people looking to make money from it have better tools.)
connectionless packet services?
Or have we forgotten about SQL Slammer, which used a UDP vector?
Unless, with appropriate hand-waving, we are no longer talking about connections patterns and switching the discussion to packet-destination patterns. Which opens up other UDP-based legitimate applications to pre-emptive blockage. Imagine your lag rage when your antivirus whacks your MMO session.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Hunt down the authors and cut their balls off. Publically. People underestimate the visual deterrent power of a Bowie knife taken to some testicles.
Seriously, we need to start SOLVING problems in this world, and you don't solve problems without leaving at least a few asses in a well kicked state.
Sorry, but welcome to the human race.
We are... PENN STATE!
Vote monkeys into Congress. They are cheaper and more trustworthy.