Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Cheap, Distributed Zero-Day Defense?

Posted by CmdrTaco on from the yeah-that-won't-get-gamed dept.

coondoggie writes "Shutting down zero-day computer attacks could be carried out inexpensively by peer-to-peer software that shares information about anomalous behavior, say researchers at the University of California at Davis.The software would interact with existing personal firewalls and intrusion detection systems to gather data about anomalous behavior, says Senthil Cheetancheri, the lead researcher on the project he undertook as a grad student at UC Davis from 2004 to 2007. He now works for SonicWall."

3 of 116 comments (clear)

  1. Not so fast... by Jah-Wren+Ryel · · Score: 5, Insightful

    On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.

    --
    When information is power, privacy is freedom.
    1. Re:Not so fast... by girlintraining · · Score: 5, Insightful

      On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.

      You forget that the system is also leaking information about the traffic it is sending/receiving at the same time, and possibly internal state information (such as what applications are loaded, plugins, etc). That data in and of itself is valuable to an attacker, nevermind whether the vector can be protected or not... It opens up the possibility of discovering new vectors in ways maybe not possible remotely.

      --
      #fuckbeta #iamslashdot #dicemustdie
  2. My first thought too by A+nonymous+Coward · · Score: 5, Insightful

    Who watches the watchers?

    Any system like this would be a premium cracker target. All it would take is one false positive or false negative before no one would trust it again.

    Six months later, some other researcher would make a new proposal for a p2p system to guard the broken p2p system.

    --
    Infuriate left and right