Slashdot Mirror
Fujitsu To Develop Vigilante Computer Virus For Japan
wiedzmin writes "Japanese Defense Ministry has awarded Fujitsu a contract to develop a vigilante computer virus, which will track down and eliminate other viruses, or rather — their sources of origin. Are 'good' viruses a bad idea? Sophos seems to think so, saying, 'When you're trying to gather digital forensic evidence as to what has broken into your network, and what data it may have stolen, it's probably not wise to let loose a program that starts to trample over your hard drives, making changes.'"
Would be the answer. A polite virus doesn't migrate automagically- it *asks* before it migrates.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
[eliminate] their sources of origin.
Windows XP users then.
Any "good" virus will be caught, captured, studied, mutated, and turned into a "bad" virus very quickly.
Also, a virus by definition installs software on a machine without the owner's consent. So it's never a good idea.
Advice: on VPS providers
... or Core Wars Reloaded?
Are 'good' viruses a bad idea?
McAfee, Norton, AVG, etc have built businesses around good viruses.
What do I know, I'm just an idiot, right?
Skynet, Landru, M5, the Matrix, HAL
There's plenty of art for reality to follow.
... the white cells from the attacking entities.
And the ramifications could get interesting.
For example, will it be illegal to tamper with such a white cell virus that's on your system? To reverse engineer it? To release your own distributed anti-virus system that might view such a white cell virus as a threat, and hunt it down and destroy it across multiple networks?
Check your premises.
Considering this is Japan, I'm pretty sure they got the idea from Ghost in the Shell. The Major often times references performing a Back Hack, to determine the location of an attacker. Now if only I could teach Windows how to enter Autistic Mode...
Windows has detected an undetectable error.
undo moderation
What happens when the Fujitsu virus meets itself and destroys its own source of origin?
An arms race against an opponent that know no boundaries is typically futile.
It would be extremely difficult to develop a virus that could effectively spread and eliminate other infections without stooping to the same low levels as the malicious developers, at which point the friendly virus isn't so friendly anymore.
Sophos is right that such a counter-attack launched on a managed network with security-aware personnel capable of removing the malicious infections and performing a proper investigation is only going to complicate matters.
I could see this having a lot of collateral damage, since hackers like to bounce their connections off of legitimate IPs to hide their own locations. The Chinese hackers, for example, use HTran to do this for them - it makes it look like the attacks are coming from University campuses or from IPs belonging to dissident groups.
Aside from all the hype, its basically a distributed IDS. Since everything I do as a sysadmin is done in puppet, and my ids image is an ids image because of about one line, I'm half way tempted to try it at home, "everything under puppet control instantly becomes an IDS".
The biggest problem I can find is scalability of alerts. So now when one machine sees something weird I get it in the daily status report. What happens when 25 or so machines see something weird and all decide to simultaneously spam me?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
There are viruses and malware out there that already does this sort of in that they delete out competing virus/malware and patch the vulnerability they entered from. This is because often times, viruses/malware can conflict with each other causing large problems especially if they use the same exploit.
Overall though, I think it's a good idea though limited in success. A virus that attacks other viruses and fixes security holes for people who don't know how or are too lazy to would be sorta like an antibody rather then a virus. But really, it would be extremely limited in success. The winner of the fight would be the first to access the system, and these antibodies would be reactive rather then active meaning viruses can be designed to lock these special viruses out much like some do for other viruses.
If there will be defense measures that will avoid deleting the "vigilante virus", then it seems likely that there will also be viruses with a similar signature to this one, with a slightly different agenda of course.
to develop operating systems that are impervious to viruses, trojans, worms and rootkits & etc... probably could not be done to 100% certainty but it can be implemented so the bad software is the rare exception to the rule rather than wide spread chronic infections like you see with that software from Redmond...
that would more than likely put Microsoft in to a niche corner and out of the desktop operating system & office software suite business...
Politics is Treachery, Religion is Brainwashing
The Internet and the vast number of computers connected to it form a vast, dynamic, and complex system whose detailed behaviour is difficult to fully understand and impossible to confidently predict.
Just like the introduction of Cane Toads in Australia, ( http://en.wikipedia.org/wiki/Cane_toads_in_Australia ), and so many other similar introductions of organisms to 'fix' some problem in a complex ecosystem, this will probably turn out badly. And it may be impossible to undo once the virus is released into the favourable ecosystem that is the Internet.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Summer Wars anyone ?
In theory, if you could deploy such a worm within your own network (e.g. corporation) and guarantee it wouldn't infect any other machines, then MAYBE, but how would you guarantee that?
What works is a vulnerability scanner (e.g. satan type programs) to detect and inform you of potential vulnerabilities in your system
plus a known malware scanner (e.g. MSRT, MalwareBytes, AV software).
plus "behavior detection" software that flags malware-like behavior.
Such software must be installed and run by an administrator/root and should be scheduled to run periodically. You can't rely upon users to run it because users who are sufficiently security aware to run it periodically are the ones least likely run untrusted software and get infected.
make imaginary.friends COUNT=100 VISIBLE=false
A few years later than predicted, but coming nonetheless.
"Anti-virus Virus" were a common thing back in the day; boot from a floppy and if the screen didn't fade blackwhite a couple times, you knew something more evil was present. And of course, a few virii came out that mimiced the 'all clear!' animation....
Cycle, repeat!
Depends on if you liked that movie and what the character did. Or..if you like the "Jack Bauer" consequentialism approach to justice. You know...."Chaotic Good" in D&D parlance where the ends justifies the means.
Except when the ends don't end up the way you wanted it to go after exercising your idea of what the "means" should be....
And created by worshipers of SATAN.
The only good thing that can come of this is that those who use technology will realize that it Just Isn't Worth It. When people realize that things like mathemagic, science, and the Higgs Boson will only bring about the End of Days, that will be the day that we won't have to worry about scientists destroying humanity and the Earth.
We can't continue to pollute our planet, and we can't keep eating animals!
Do you people not know what is happening here?!
This path leads us not only unto temptation, but to damnation as well! We must strive to purify ourselves! We must rid ourselves of anything more advanced than the abacus!
I will begin by not posting anymore. This is my last post as Anonymous Coward. If you see any more posts from me, know that it is not I, but an impostor. A charlatan, pretending to me, but not me. Quite possibly someone wearing my skin, stolen from my murdered cadaver. And know that they probably inseminated my male corpse with their semen. Anally, orally, and they probably managed to put some semen inside my penis.
Im torn between liking this and hating it. On one hand it could mean less spam but on the other i will loose money from removing viruses from peoples computers.
SKINNER
Well, I was wrong. The lizards are a godsend.
LISA
But isn't that a bit short-sighted? What happens when we're overrun by lizards?
SKINNER
No problem. We simply unleash wave after wave of Chinese needle snakes. They'll wipe out the lizards.
LISA
But aren't the snakes even worse?
SKINNER
Yes, but we're prepared for that. We've lined up a fabulous type of gorilla that thrives on snake meat.
LISA
But then we're stuck with gorillas!
SKINNER
No, that's the beautiful part. When wintertime rolls around, the gorillas simply freeze to death.
Don't let the door hit you on the bob side!
No brain, no pain.
The Land of the Raising Sun is full of wonder, but the day of the Ronan is long past. There appears to be an classical arthritic choke point in Japanese culture that does not allow for information to travel UP TO policy makers. It appears that after the cluster fuck that is the Fukushima Daiichi nuclear disaster, that those in charge of making policy do so in a "dark room," still. If the policy makers of Japan are so caviler about insulting the intelligence of their constituents, then the contempt for the people of planet earth is a fore gone conclusion.
See http://en.wikipedia.org/wiki/Morris_worm That didn't turn out so well, did it? One minor miscalculation, and it'll shut down the internet. And how will it adjust itself to handle different versions of Windows, let alone different versions of Mac, Linux, PalmOS, etc, etc?
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Call good viruses "agents" and then it's perfectly okay.
They should first read some history about the very first computer virus, written by Robert Morris (Jr) in 1988. If for no other reason than to realize they are so very late to this ideas party...
He had the same idea and only wanted to make a program that can spread itself around, but not actually do anything (aka payload), however due to a single incorrect counter value in an otherwise harmless virus, the very act of spreading itself so aggressively is what ended up taking down the entire Internet (Or at least all 6000 sendmail servers, which was basically all of it at the time.)
They seemingly are calling it the Morris Worm now:
http://en.wikipedia.org/wiki/Morris_worm
Or just Google on "Robert Tappan Morris" (To not be confused with his father, whom was also at MIT and also had some involvement with the initial Internet)
In either case, this is an especially poor *name* for what they are doing.
Either A) It infects machines they do not own (aka a Virus), which is a crime, and a very very bad/stupid thing to do,
or B) They run it on their own machines only, where they have permission and authority to do so, in which case this is not a virus but is instead is called "Pushing an app to my network"
Nothing new to see here, move along. "Good" virus == Existing virus scanners with pre-approved permissions to "handle" said virus (i.e. quarantine, delete, etc...) Now if a virus scanner is considered a virus (many think they are), then I sense a recursion problem ahead...
TL;DR: They're a bad idea due to possible unintended consequences.
It's a more than two decades old issue. Real-life 20-year old example? The "Den Zuko" virus (written by a guy called Denny Yanuar, from Bandung, Indonesia) was designed to kill the Pakistani/(C) Brain virus.
Before long there were more Denzuko infections than Pakistani ones. So far, so good. But "Den Zuko" cleverly used track 41 and 42 of floppy disks, space that on a normally formatted floppy disk wasn't used. There were utilities around, however, that permitted floppy disks to be formatted at 420kb by using those last 2 tracks and by formatting each track at 10 sectors each (double sided). Guess what happened if you had formatted your floppy disks like that and ran into this "Good" virus? Bye bye data!
I think it is a great idea but is not legal, as it can also delete by error files that are infected, so that legal copy of LMFAO mp3 is deleted because it had a virus...no thank you! The best is what MS is doing, hunting down the C&C and shutting them down as well as shutting down all infected pcs.
I have a solution for combating malware on PC already. It's called antivirus, and while it's not perfect, it's predictable. Software that I didn't put on my machine doesn't belong there. Regardless of the intention.
It's obvious!!!
Reminds me of some movie plots.
---- Booth was a patriot ----
2012, good intention computer virus = end of the world?
...but not the one they need right now.
Maelstrom by Peter Watts The evolution of a viral soup on the net is illustrated beautifully in this (freely available) book: http://www.feedbooks.com/book/975/maelstrom It's a great read. Viruses fighting for supremacy and interbreeding on the net may be an inevitable part of an evolving net-biosphere but probably not the best thing to encourage!
Test runs in closed networks have helped the ministry to confirm the cyberweapon's functionality and compile data on cyber-attack patterns.
I'd like to see these test networks, I am willing to bet they are just some group of corporate big-shots trying to sell a few more government contracts to a broken government that is trying to assure their naive populace that they are doing everything they can against those nasty Chinese hackers.
What makes them think their test network is any representation of the real world? What makes them think they can actually discover viruses using viruses when anti-virus software can do no better? They can't do it. Once the virus is live, attackers will figure out a way to circumvent it, and this project will have accomplished nothing.
So it's a self replicating anti-virus that involuntarily heals computers to protect others? Sounds good, but isn't gaining unauthorised access to a computer illegal (At least in the UK and US)? And you'd have to trust the vendor. Maybe the government would give the vendor legal immunity, but then paranoid conspiracy theorists (eg. RMS) would go crazy, and they might have a point for once
You're all talking and giving references of XXth century virii which infected files.
Virii today use these infection paths:
1.- Exploits on browsers/plugins while browsing infected servers.
2.- Exploits on open ports.
3.- User installing software that carries spyware or trojans.
The paths 1 & 2 are caused by non-updated vulnerable software and somebody MUST do something about that if the user doesn't care.
Path 3 can be mitigated by using an updated antivirus. An antivirus would block the "good virus" too, as it would not be required on that computer.
The best way I can think of this working is to get back to the origin of virus. Create and release viruses using known vulnerabilities that brick the machine they infect. The logic being if this virus can brick the machine they remove it from whatever other bot-nets that infected machine is inevitable already part of.
One major problem with currently infected machines is that the user is unaware of any issue at all. If your PC got bricked when you didn't update you would soon have to learn to set-up correctly or update correctly in order to be allowed to use a machine.
We all know this is how SkyNet started this way.... I guess 2012 really /is/ the end of the world!
Welchia brought the internet to a stand-still in 2003 while trying to remove Blaster. This is a problem resolved by education, not technology.
Finally had enough. Come see us over at https://soylentnews.org/
the petri-dish that the term "computer virus" thrives best on is ... A20 keyboard interrupt. -kidding- it's windblowz.
called
http://it.slashdot.org/comments.pl?sid=2603836&cid=38589290
Shame they could not have done this at the nuclear power plant.
All cows eat grass!