Slashdot Mirror
When Malware Attacks Malware
PetManimal writes "Researchers say that the Storm Trojan/Peacomm worm has been tweaked to spread via IM programs and attack rival malware. Symantec sounded the alarm, and says that the exploit launches in AOL, Google Talk, and Yahoo Messenger windows that are already open, making it appear to be a legitimate message from a known user. The worm has modified the code from last year's Nuwar worm, and when activated, enables a DDoS attack against any site, including antispam services and servers supporting rival malware: 'Systems hijacked by Peacomm have also conducted DDoS attacks against at least five domains used by the creators of the noted Warezov (or Stration) worm. After a busy September and October, Warezov was credited by some analysts as the genesis of 2006's massive fourth-quarter spike in spam volume.'"
When Malware Attacks Malware
You get total protonic reversal.
The theory of relativity doesn't work right in Arkansas.
It just means that, in a few years, all of the malware will be significantly harder to kill. All of the weaker 'species' will have been driven to extinction (via changes in coding). It had to happen eventually. We may even see 'anti-viral resistant' strains.
'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
So is there going to be a screen saver that will show the good and bad malware attacking each other as the computer keeps waving a white flag?
The well known malware Internet Explorer has been attacking another well known malware WinXP for quite sometime. So why get worked about these obscure ones?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Thus begins the ecology of internet software. CPU cycles are simply too valuable (en masse) for one piece of malware to share with others.
Eventually, look for malware to get better and better and rooting out rival malware in order to take its place. As well, look for malware to be more cautious about consuming host resources, lest it get noticed by a user or antivirus package.
It's no different than Earthly biology. We think nothing of the colossal number of parasitic microorganisms currently hitching a ride on our metabolism. Some like E. coli are so useful that we even enthusiastically encourage (Yoplait anyone?). Symbiosis carries major advantages along the lines of "division of labor". How many years before real symbiosis is realized among internet-connected computers?
It would also evolve the antivirus landscape. The "OMG sterilize all machines!!!1!" mantra would change into a more relaxed problem: calculate the most efficient amount of CPU cycles to allocate among the competing tasks of:
That's how our bodies do it, anyway.
FATMOUSE + YOU = FATMOUSE
Only to idiots, are orders laws.
-- Henning von Tresckow
In Soviet Russia, malware attacks... malware?
Will someone please write a worm that 1) turns Windows Update on, 2) turns the Windows Firewall on, 3) turns off the keyboard & mouse ports for Windows 3.1, 95, 98, and ME machines thus forcing the retarded end users running on these platforms to upgrade, 4) installs ClamWIN and scans the hard drive, 5) installs SpyBot Search & Destroy and scans the hard drive, and 6) administers an electric shock to the aforementioned retarded end user for not taking care of this themselves?
If your dog was running around the neighborhood barking at people and biting them, they'd make you do something about the dog. I don't see why your computer gets to the do the same thing on the internet with such impunity.
2 cents,
QueenB.
HDGary secures my bank
Given that today's ROMs are typically flash, how long until some malware just reflashes it? This would also allow the malware to take control even before the OS boots up.
The Tao of math: The numbers you can count are not the real numbers.
What isn't generally reported is that Peacomm uses "Your momma's so fat" insults in the DDOS attacks. By far the most devasting and hilarious DDOS this year.
Well, there's spam egg sausage and spam, that's not got much spam in it.
I'm the author of the technical writeup detailing the attack on the rival spam group. But the only reason I was investigating the DDoS attacks launched by the Storm Worm/Peacomm/Nuwar is due to my own site being attacked after I detailed the pump-and-dump stock spam operation of the Rustock trojan. It is getting riskier to publish research on viruses and spam. I believe since spammers were able to take out Blue Security by DDoS attack, they are getting bolder in who they target. There's no downside for them.
Regardless of the operating system or the applications which run upon it, the ultimate weakness at the end of the day lies upon the end user. You can only secure a system to a certain point until the user begins losing functionality, until the end user becomes more educated...well expect to see evolution in Malware.
Your comment is factually correct, but also very misleading. Users are the hardest element to harden in the chain of security, but right now they are by no means the weakest link. The OS development community and security research community could easily eliminate 90% of all malware and reduce the amount of education needed for a user to safely use a computer to a tiny fraction of what they need to know now, if Windows would be modified in order to be secure and deal with the realities of the malware ecosystem.
Right now, even in vista, the granularity of security is piss poor. You have three levels: 1) don't run software, 2) run software, and 3) run software and enter your password. This is wholly insufficient. Further, the UI used to present these levels is abysmal. I don't mean bad I mean abysmal. Whether MS hires the worst UI people in the world or whether they hire good people and their decisions are overridden by marketing and management, the end result is horrible from a UI/security perspective.
If I was running the show at MS and had a shred of human decency and respect for innovation in the industry this is what I would create. First, applications both included and third party now have a new format that is contained within a single directory including temp space for writing files and what is now a DLL. It would optionally include an ACL, one or more certificates for verification of the origin and binary, and location for updates. Based upon the certificate, users would be given the option to subscribe to verification services that provide a trust level for a given application and MS would provide the same. The trust level for an application would be determined by the consensus of verifications applied and the weight given them by the user and if it is pre-installed, downloaded, or loaded from CD or DVD. Based upon that trust level, the application would be restricted by a mandatory access controls framework to obey the ACL that shipped with the program combined with the ACL for that trust level (with the default being to restrict the application more stringently). If any application wanted to exceed that ACL, the user would be presented with a very strongly worded warning, explaining exactly what it wanted and presented via a good UI with no OK/Cancel crap.
This means if a user downloads some program via IM or the Web and if they run it the OS will look at the included ACL and cert and see what permission it wants and who will certify it as trustworthy, if anyone. Then, if it tries to exceed its authority, the OS will present a warning such as, "The program 'Storm' is not verified as trustworthy and would like to connect to the internet on a port normally used for sending instant messages. (Stop it from sending messages)(let it send messages once)(always let it send messages)(advanced options)."
If the user lets it send IM messages it can spread, but do nothing else. They also have to explicitly let it connect on other ports and access other resources if it is to be useful to a spammer or DoS user. Since almost all software on most machines is pre-installed and since most other software will be verified by at least one other party, these messages will be exceptionally rare and thus stand out as important and weird to users. Even if the attacker uses a buffer overflow to take over a thread, their malware will still be limited by the ACL for that originating application, so if they want to send spam they better find a buffer overflow in your e-mail client specifically.
When such a system is implemented the required user education will be a manageable level, a hour long class instead of a master's degree in computer technology. Then, if a user stil
I vote they make a spinoff of Robot Wars
I can see it now...
Malware wars... watch rival malware rip each other apart!
"Oh my god, Malwarior just executed an amazing kill maneuver!"
"it looks like Spymaster is only hanging on by a thread!
"Oh... and he's done for. Spymaster is terminated... add him to the hexdump!"
The original generic sig.
The real problem is security models that assume very few levels of security. Either you install it and it can hose your machine and kill babies, or you don't run it and don't know if it was malware or not. That's just crazy. Back in the day MS Word used to pop up a dialogue box and say something along the lines of "this .doc file contains macros that may be viruses (ok)(cancel)." I knew a manger who offered $1000 to anyone who could add a button that said "open the file but don't let it infect my computer with anything." The problem, aside from the terrible UI, was the control was not granular enough. Sometimes people want to run software or open a file, but don't want to trust it with their computer security for all time. Software should run in a sandbox by default. The inconvenience of having to explicitly allow my new e-mail program to send e-mail, once is worth it if I know no other software I download will ever send any e-mail or access my address book until I explicitly permit it. Some executable that shows up in my e-mail or over IM should never, ever, be granted that permission by default. Until MS gets their head out of their butt and realizes that, we'll suffer from this crap.
Hasn't norton a/v been doing exactly this for years? Malware, fighting malware? :)
I'm not really sure, and depending on how vicious this is, but sometimes maybe 2 wrongs do make a right... For those of you who haven't seen the movie "Swordfish" they pretty much use terrorism to dissuade other terrorist actions. Perhaps this type of virus/worm/etc could be a good thing for us, that for most virus/worm/spam creators it will become such a pain in the ass to wreak their havoc, it won't be worth it for them (would you keep intentionally making/distributing virus/etc if it meant you got DDoS'ed so hard your server melts every month, costing you money on hardware?)
But then again, perhaps 2 wrongs don't make a right...