A Cheap, Distributed Zero-Day Defense?

coondoggie writes "Shutting down zero-day computer attacks could be carried out inexpensively by peer-to-peer software that shares information about anomalous behavior, say researchers at the University of California at Davis.The software would interact with existing personal firewalls and intrusion detection systems to gather data about anomalous behavior, says Senthil Cheetancheri, the lead researcher on the project he undertook as a grad student at UC Davis from 2004 to 2007. He now works for SonicWall."

Comments

Wow...

[roc97007]

If you could break into that process, you could rule the world.

Cheap Defense?

[drewzhrodague]

Six Inches of Air?

Not so fast...

[Jah-Wren Ryel]

On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.

Re:Not so fast...

[girlintraining]

On the face of it, it sounds like he's proposing a "trusted" infection vector. A way to distributed code intended to patch holes to systems that want it. The obvious problem with such a system is the consequences of it being compromised. Then it becomes a way to distribute malicious code much more effectively than the way bot-nets infect new hosts now.

You forget that the system is also leaking information about the traffic it is sending/receiving at the same time, and possibly internal state information (such as what applications are loaded, plugins, etc). That data in and of itself is valuable to an attacker, nevermind whether the vector can be protected or not... It opens up the possibility of discovering new vectors in ways maybe not possible remotely.

Sooo...

[gblackwo]

What is the zero-day defense protocol for the zero-day defense software?

What to tell your boss

[MrEricSir]

"I'm not pirating movies... I'm protecting the network!"

Will never happen.

[girlintraining]

Detecting anomalies requires a baseline of what "normal" is. That means surrendering information about the type and nature of traffic being received by your computer (and possibly sent as well). It's a privacy problem that not many people will commit to. And businesses will be even more reluctant to surrender such information. That said, an aggregate of several hundred thousand firewall logs would be an asset to many organizations and individuals. For this reason, it will never be free... The moment someone realizes there is a monentary value in what they're doing, they will attempt to capitalize on it. So, effectually, what this project is asking you to do is give them your private, personal data, so they can turn a buck under the pretense of fighting those big bad evil hackers. Isn't the market already pretty crowded with the fear-mongers, anti-virus, anti-malware, anti-anti-anti businesses?

Also, this is not a defensive product. A defense requires the ability to resist or avoid an attack. Nothing about this scheme suggests it would provide that to the end-user. It is more of a "zero day surveillance" system than anything. It's a digital cow bell. Moo, ding ding, moo. The only problem is the cow moves at the speed of light and can replicate a few thousand times a second (conservatively). Don't ask about the milk. x_x

Comment removed

[account_deleted]

Comment removed based on user account deletion

This already exists

[charlesnw]

It's called dshield: http://isc.sans.org/howto.html

A Cheap, Distributed Zero-Day Defense?

[Thaelon]

A Cheap, Distributed Zero-Day Defense?

User education.

My first thought too

[A nonymous Coward]

Who watches the watchers?

Any system like this would be a premium cracker target. All it would take is one false positive or false negative before no one would trust it again.

Six months later, some other researcher would make a new proposal for a p2p system to guard the broken p2p system.