Researchers Tout New Network Worm Weapon

coondoggie writes "Can Internet worms be thwarted within minutes of their infection? Researchers at Ohio State University believe they can. The key, researchers found, is for software to monitor the number of scans that machines on a network send out. When a machine starts sending out too many scans — a sign that it has been infected — administrators should take it off line and check it for viruses. In a nutshell, the researchers developed a model that calculated the probability that a virus would spread, depending on the maximum number of scans allowed before a machine was taken off line.'The difficulty was figuring out how many scans were too many,' researchers said."

Comments

Neat

[Zironic]

One of the hardest things to account for when it comes to setting the limit for the number of scans a computer can resonably make must be bittorrent, a computer actively seeding files through bittorrent might connect to hundreds of computers for each file.

I suppose the admin of a corperate network will probably frown on active bittorrent use in general though.

Re:Neat

[zappepcs]

It's not the corporate network where this will be problematic. It is TimeWarner and Comcast. Remember the recent story about MediaDefender? Assumptions about scans are just that. As soon as this methodology is implemented, worms will scan much slower. After all, a virus/worm author normally has some time to build the botnet before they want to activate it. Nothing really depends on quick proliferation except damaging worms.

IMO, it is the botnets that do the most damage as a collective thing. Stopping a worm that bricks your machine is not hard LOL, stopping one that bricks other machines is good. Stopping DDoS attacks is even MORE important. It is the attack for hire model of hacking that really sucks bad.

If the botnet owner takes a few months to build the botnet, it is still a botnet. Even better if s/he hides data in video packets or VoIP or IM packets.

The only real way that I can see to stop the damage is to have 99.9999%+ computers in the world running in a sandbox where the perimeter monitors everything that the user software is doing. So, even if the corporate network is functioning like a sandbox (as it already should be) the danger from worms forming botnets is still a threat, this merely lessens the threat of a quickly spreading/created botnet/worm.

Re:Neat

[moderatorrater]

They were looking at 10,000 scans, which would be about how much I would expect my constantly-on bittorrent to do over the course of a week or more. I don't think it'll be a problem at that threshold.

At lower thresholds (which they'll surely need since worms and viruses will just start scanning more slowly), they can start analyzing patterns and individual packets. This won't solve the problem overnight, but it will eliminate virtually all worms and viruses in the wild right now and make future worms and viruses propagate much more slowly.

Re:Neat

[deroby]

In theory, worms simply don't have 'months' to spread, because, in theory, a vulnerability is detected and fixed within a short time-span, hence, the worm needs to abuse it as much as possible in the shortest time possible, right !?

In practice off course :
* there are vulnerabilities that nobody (except the abuser) knows about and hence 'spreading slowly' is fine too
* exploits are only created AFTER they have been identified (see "script kiddies") and rely upon people that are too uneducated/lazy/slow/dumb/paranoid/... to keep there system (more or less) secure, so again, 'spreading slowly' is fine again... the target audience will be smaller, but is still there.

So yes, it think it WILL help to have this kind of system in place (**), but indeed it sounds like it will simply be a matter of 'knowing the magic value' and making sure once's worm stays right below that threshold.

FTA : "An infected machine would reach this value very quickly, while a regular machine would not," Shroff explained. "A worm has to hit so many IP addresses so quickly in order to survive."

The main question here is IMHO : what do they mean with SCANS ? Are those (failed) connections that do not get ACK's back ? I'm pretty sure most P2P traffic would be able to cause false alerts, and although the network admin wouldn't be too happy to have bittorrent or emule on a machine (different from his own =), I can tell you that eg Skype can't be missed anymore where I work.

** remember MS already did something similar when SQL SLAMMER hit IIRC, and look where that got us : major cry-out that MS limited the number of new outward connections per second.

Well?

[Anonymous Coward]

Can useless messages be moderated within minutes of their posting?

Re:Well?

[ELProphet]

They could, if I didn't just waste my mod points by commenting in a thread I just modded... crap!

iPhones

[Enderandrew]

Don't iPhones send out an insane number of scans per minute? Isn't that why Duke University banned them from their network, and how that couple had a $3,000 data charge bill from taking their iPhone on a cruise, even though they didn't use it?

Re:iPhones

[tlhIngan]

Don't iPhones send out an insane number of scans per minute? Isn't that why Duke University banned them from their network, and how that couple had a $3,000 data charge bill from taking their iPhone on a cruise, even though they didn't use it?

Not really.

The reason Duke had to ban them was because the way they did their WiFi somehow clashed with the way Duke's WiFi network was set up. The end result was that a small concentration of iPhones managed to actually take down the WiFi network by consuming inordinate amounts of CPU time on the WiFi processors. This was confined to that one network - everywhere else, even those using the same WiFi accesspoints, worked just fine. It was an oddball configuration issue.

As for the $3000 phone bill, it is true. But it's not because of the scans - it's because the person was roaming, and data roaming is pricey. You can configure the iPhone to poll a mail server every so often (regular POP or IMAP). Guess what? Checking POP or IMAP takes bytes, and bytes are pricey (easily 5 cents per 1000 bytes or less - some providers count every byte sent over the air including all headers and trailers, and not just raw IP packets). This was resolved in a 1.1 firmware update which has the option to disable data roaming (the iPhone will not make an EDGE connection if it detects it's roaming - it won't even make a standby connection).

SOP - Standard operating procedure

[bernywork]

Network admins quite often scan large amount of network space especially for vulnerabilities, I know, I do it every day. Device discovery on networks for monitoring, IP address management, the list goes on.

There is the alternative though...

http://xkcd.com/416/

IDS

[imunfair]

Isn't the described method basically a slight variation on the whole IDS scheme? Establish a baseline and compare to it...? For some reason they don't seem to have thought of the baseline part yet though - apparently they didn't do their research well. Granted I think the baseline is usually bandwidth usage or something of that sort, but this is basically the same thing.

Re:IDS

[ShakaUVM]

Yeah, just watching the number of scans a computer makes isn't worm detection, per se, but more of intrusion detection, as you say.

It will incidentally also allow network admins to automatically shut down bittorrent, so it should be quite popular.

And now that...

[Ai Olor-Wile]

...it has been posted on the front page of Slashdot, every future worm author will code their stuff to spread more slowly, so that the increase in scan rate is negligible. Hooray for self-obsoleting discoveries!

(Don't get me wrong, I'm a huge proponent of publicly posting computer security information. But this seems pretty easy to circumvent when considered, no?)

Re:And now that...

[quercus.aeternam]

If the worms are coded to spread more slowly, it will decrease the rate of propogation, making it more difficult for the worms to survive.

If they don't alter their code, worms will have a much harder time surviving on networks that take advantage of this discovery.

The net effect is positive.

Re:And now that...

[Goaway]

Actually, worms are already spreading slower in order to survive longer. Even without a system like this, a worm that spreads fast gathers much more attention than one that spreads slow.

Re:And now that...

[Goaway]

Yeah, that has worked great so far, hasn't it?

The paper

[textstring]

Here's the pdf http://www.ece.osu.edu/~shroff/journal/worm.pdf. Seems like if these countermeasures were put in place, viruses would have to be choosy about which hosts they scan instead of just scanning tons of random addresses if they wanted to propagate.

This is trivially defeated

[Arrogant-Bastard]

Sufficiently intelligent worms can use passive OS fingerprinting to identify hosts likely to be susceptible to infection (as they make their presence known) and then make a single attempt per host (which will, obviously, succeed or fail), keeping track of such attempts so as to avoid duplicates. Alternatively, worms could use a passive approach and not attempt to propagate at all except in response to traffic from other hosts -- that is, piggybacking themselves on the responses to ordinary traffic, say, HTTP requests, or Torrent requests, or IM requests. While use of such approaches might slow the propagation of a worm in a local sense, they won't slow down network-wide propagation appreciably if initial seeding is done in sufficient numbers and with sufficient network diversity.

Seriously Useless

[Anonymous Coward]

Seriously, let's see how this will work.

sysadmin: $max_scans_allowed = 10;
worm: sh1t! $max_scans_allowed = 10;
sysadmin: sh1t! $max_scans_allowed = 9;
worm: sh1t! $max_scans_allowed = 9;
sysadmin: sh1t! $max_scans_allowed = 8;
worm: sh1t! $max_scans_allowed = 8;
sysadmin: sh1t! $max_scans_allowed = 7;
worm: sh1t! $max_scans_allowed = 7;
sysadmin: sh1t! $max_scans_allowed = 6;
worm: sh1t! $max_scans_allowed = 6;
sysadmin: sh1t! $max_scans_allowed = 5;
worm: sh1t! $max_scans_allowed = 5;
sysadmin: sh1t! $max_scans_allowed = 4;
worm: sh1t! $max_scans_allowed = 4;
sysadmin: sh1t! $max_scans_allowed = 3;
worm: sh1t! $max_scans_allowed = 3;
sysadmin: sh1t! $max_scans_allowed = 2;
worm: sh1t! $max_scans_allowed = 2;
sysadmin: sh1t! $max_scans_allowed = 1;
worm: sh1t! $max_scans_allowed = 1;
sysadmin: sh1t! $max_scans_allowed = 0;

Unplug the internet, no communications allowed.

Re:Seriously Useless

[Anonymous Coward]

sh1t! is programing slang for 100100001

Easy to circumvent.

[thePowerOfGrayskull]

The easy way around this is to just slow down the rate of the scans and the type/quantity of scanning done at any one type. Whether it takes hours or weeks, time is not critical when you have millions of PCs at your disposal.

Re:Easy to circumvent.

[hedwards]

This has been brought up before. Basically, slowing down a worm allows for more time to create and disseminate a patch for the vulnerability. The idea was that when a virus is detected to throttle down on the bandwidth allocated to the computer and perhaps limit it to just specific securty sites for patching as well.

Basically dry up the resources available to the worm and make it as unprofitable as possible to run a botnet in that fashion.

Or in a more cost effective way, just throttle everybody's connection when there's a major outbreak while people get patched. Force the worms and viruses into a much smaller pool. Realistically when some of the larger worms have hit, the bandwidth ends up going mostly to the worms anyways, why not deny the resource to the worm.

Undeployable

[gweihir]

Anything that requires changes in most or all sub-networks is garantueed to fail. Just look at egress-filtering. Many network admins are still unable or unwilling to do it. And these people expect them to implement a worm detector in every subnet? Forget it.

BTW, the idea is not new: "A Fast Worm Scan Detection Tool for VPN Congestion Avoidance" in Proceedings of DIMVA 2005 uses the same idea, but in a context where it is actually implementable and useful. Online under http://www.tik.ee.ethz.ch/~ddosvax/publications/papers/dimva06scan.pdf.

I didn't realize this was news 2 years ago...

[jafo]

I've been running the following iptables rules on our routers for at least the last year or two:

iptables -A ssh_attack -m hashlimit --hashlimit 200/min --hashlimit-mode srcip --hashlimit-name ssh_attack --hashlimit-htable-size 599 --hashlimit-htable-max 4096 -j RETURN

iptables -A ssh_attack -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "SSH-Attack:"

iptables -I FORWARD -o eth0 -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ssh_attack

In other words, for each internal host allow them to make 200 outbound SSH connections per minute (tracked individually). If they exceed that limit, log a message.

We then have a nagios plugin that checks for this message being in "dmesg". If it is, we get paged.

We watch the sites we host pretty closely, so we don't often run into them getting compromised. The last one was because a host admin re-enabled password logins in SSH *AND* set up a guest account with a password like "guest". Only the guest account was compromised, but I digress.

The thing is that people who compromise these hosts pretty much always use that host to scan for other hosts to attack. And looking for weak passwords on other hosts via SSH seems to be pretty common.

So, once we saw this it was a no-brainer to set up something to alert us when someone started doing it.

Sean

Move to MacOS -- worms are obsolete here

[Anonymous Coward]

Like Windows made MS-DOS viruses something to be mentioned in the past, I don't get why people just stop making slapdash hacks, and move to a platform that is 100% immune to this type of malicious software. MacOS has had -zero- remote rootings in the wild in its whole history. Even the vaunted OpenBSD has had three remote holes on its record.

I say leave the worm finding to the Windows and Linux people who are vulnerable to this stuff, and we Mac people can just point and snicker, because a worm or a botnet "client" is just plain impossible to implement on MacOS.

Re:Move to MacOS -- worms are obsolete here

[thejynxed]

Erm, actually, OSX has been found to be vulnerable to TONS of things, why else the 30 and 40 patch packs released all at once :)

Remote vulnerabilities such as this: http://www.securityfocus.com/bid/29514 would say well, maybe MacOSX IS vulnerable to such types of malware (they only need to cause buffer overflows or exploit remote code vulnerabilities and you can get nailed just like any other OS that is coded by humans).

The question is: Are Macs with their puny marketshare, worth the bother of hacking?

Answer: Some people/groups are starting to show interest in this, yes. But on the whole, no, they aren't worth the bother. Mainly this interest has grown since Apple swapped over to x86 architecture. I find that interesting.

I think the bigger thing to sit and think about is this: No software written, and no hardware designed by humans will ever be perfect. There will always be a weakness somewhere in the system. Deal with it the best you can, like everyone else, and stop spouting stupid nonsense about an invulnerable OS.

As a network admin...

[rAiNsT0rm]

I've been a network specialist/admin for a few companies including banks and a univeristy, and my personal idea/solution is a quasi-vlan system where each workstation is unable to talk directly to other workstations within the same LAN/Campus. Think about it, allow workstations to talk to servers and necessary resources but not directly to each other.

There is no need anymore. People need to connect to the Internet and file servers, etc. Rarely if ever is it actually necessary or preferable to have people connect to each other. The servers *should* be the best updated and protected systems and much easier to trust than Joe Sixpacks PC.

You stop worms from impacting you locally, and at worst your Internet pipe gets congested by a big outbreak which can be easier traced and combated when you aren't also fighting a spreading fire.

Re:As a network admin...

[Gnavpot]

Yeah, thats a fantastic approach, block computers from connecting to each other. Who wants a functional network anyway?

The GP explained his point in an easily understandable way. I don't know how you failed to understand it. Anyway, here it comes again in slow motion for your benefit:

In most corporate networks, clients need to connect to servers. They do not need to connect to other clients.

If you block clients' ability to connect to other clients, no functionality is lost, but infected clients can not attack other clients directly.

(I know that some companies uses IM internally, but there is nothing forcing IM solutions to be P2P.)

If I am in a position of authority over a network,

[patio11]

...blocking Bittorrent isn't a bug, it is a feature.

Re:Merely? M E R E L Y ????

[Anonymous Coward]

"Brick" means not revivable except possibly with special equipment that nobody has (an eprom programmer for example). What you describe is nowhere near that, it is only a temporary inconvenience.

Anti-DDoS TCP/IP additions?

[Mathinker]

> Stopping DDoS attacks is even MORE important.

What if a "you're DoS-ing me" reply packet was added to TCP/IP, which could be picked up at the ISP level and would (ideally) cause the ISP to throttle that user's bandwidth to the site in question for a short period of time?

The problem with this kind of hacked-on solution is that it often causes other vulnerabilities --- in this case, what if the botnet was set up to spread faked "you're DoS-ing me" packets? One could hope that ISPs would filter such outgoing packets (from their home users), but given the general lack of cooperation of the ISPs against network hacking (or has this changed? Have any ISPs finally implemented egress filters for packets with faked headers nowadays?) I wouldn't hold my breath...

Blinking Lights

[Joebert]

What's wrong with looking at the router lights blinking when the system shouldn't be doing anything and saying "Heeey, that's not right !" ?

Re:Merely? M E R E L Y ????

[Yetihehe]

And this is the way "hacker" word lost its meaning.