Benign Worms

[k k]

Hi,

I am an academic researcher. I benefited a lot during my previous
interaction at the full disclosure list on a different topic and now, I am
here to get some input on benign worms.

There is debate surrounding whether releasing benign worms such as Nachi or
Welcha, in general is ethical or not. But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.

1. Do people do that? Or at least, have you considered it?

2. If yes, under what conditions would you do that?

3. If not, what prevents you from doing that?

Best
Karthik

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha, in general is ethical or not. But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.
1. Do people do that? Or at least, have you considered it?

I doubt anybody seriously considers it

Post by k k
3. If not, what prevents you from doing that?

There's 3 basic setups:

1) You don't have a lot of machines. You don't *need* a worm to update 5 or 10
boxes, just walk to each and do it.

2) You have a lot of machines that aren't under your direct administrative control
(for example, an ISP or a university). You can't deploy a worm, because those
boxes aren't yours to screw around with - worming them could get you arrested
for hacking and/or end up liable for any damages caused if a machine glitches
during the patch.

3) You have a lot of machines under your control that you need to update.
You don't need a worm - there's plenty of tools like "Push an update via
an AD policy" and so on, and you should be using those.

[V***@vt.edu]

On Fri, 13 May 2005 11:13:03 CDT, k k said:
(Yes, even the best of us hit 'send' too soon sometimes ;)

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha, in general is ethical or not.

Oh? Who has lined up on the "it's a good idea" side of the room?

I suspect that "There is debate" means either:

1) The same sort of people who are still debating if the world is round or flat.

2) Ass-wipe academics who probably have never even *tried* to patch their
own systems, but feel qualified to talk about doing it to other people without
their prior informed consent. Given that most academics agree that "prior
informed consent" is a Good Thing, it will be a true ass-wipe (even for an academic)
who thinks doing it without consent is a wise idea.

3) Somebody thinks that somebody else saying "Yeah, it would be a good idea, except
this long list of reasons its's bad" indicates a debate.

Yes, there's quite likely overlap between the groups.

[Rob Lemos]

Post by k k
I am an academic researcher. I benefited a lot during my previous
interaction at the full disclosure list on a different topic and now,
I am here to get some input on benign worms.
There is debate surrounding whether releasing benign worms such as
Nachi or Welcha, in general is ethical or not. But network
administrators can still create benign worms for their need (not
necessarily Nachi or Welcha) and release them in their domain to patch
systems.
1. Do people do that? Or at least, have you considered it?
2. If yes, under what conditions would you do that?
3. If not, what prevents you from doing that?

Adding self propagation features to any program is problematic at best.
A good example of what can happen is the Nachi worm (a.k.a., MSBlast.D
and Welchia), which probably caused more havoc inside corporate networks
than the original MSBlast (a.k.a. Blaster worm) because of its
over-aggressive attempts at propagation.

http://news.com.com/Worm+double+whammy+still+hitting+hard/2100-1002_3-5066875.html

All one has to do, in fact, is go back to the original incident where
the term "worm" was first used and you can see the danger. Two
researchers at Xerox PARC decided to use a worm to update experimental
Ethernet drivers and ended up disrupting the entire network and crashing
all their nodes. The research was done in the late 70s and the paper was
publish in 1982.

http://news.com.com/Year+of+the+Worm/2009-1001_3-254061.html

Another good example is the Trend Micro update snafu that caused clients
to suck up 100 percent of CPU time. While the individual nodes did not
infect others, cleanup involved many, many nodes, similar to cleaning up
after a worm.

A better approach is an automated scanning and patch system (this is
more akin to the Trend Micro--or for that matter, any antivirus
company--update situation) or a system that sends out exploits for
various holes and, if a system is rooted, updates that system. Then, if
something goes wrong, you only have one system to shut down and fix the
programs on, rather than cleaning your entire network.

HP has played around with an exploit-node-type network.

http://news.com.com/HP+aims+to+throttle+Net+threats/2100-7349_3-5163633.html

Infecting other machines with even a "beneficial" worm is illegal if you
are not the owner of the machine. Infecting a network that you have
ownership over with a "beneficial" worm is generally a bad thing,
because the network effects of self propagation are hard to gauge and
small errors can easily turn into big problems.

Just wait until we start playing around with programming genes of
organisms that self replicate.

http://www.securityfocus.com/news/11082

-R

[Michael Holstein]

Post by k k
1. Do people do that? Or at least, have you considered it?

Well, obviously it's been done. You mentioned two examples. Both of them
caused significant network disruption in and of themselves.

Post by k k
2. If yes, under what conditions would you do that?

None. Not even on my own network and not even if I'd coded it to stay
within our /16. Too many things could go wrong.

Post by k k
3. If not, what prevents you from doing that?

Any worm/virus, regardless of intent, is still illegal -- and I don't
think I can get a DSL line in jail.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Eric Paynter]

Post by Michael Holstein

Post by k k
3. If not, what prevents you from doing that?

Any worm/virus, regardless of intent, is still illegal -- and I don't
think I can get a DSL line in jail.

Not true. Intent is *everything* as far a criminal activity is concerned.

Intent aside, if you restrict the worm to your subnet that you own and are
authorized to alter the systems on, then even releasing a malicious worm
would be legal. Maybe not very smart, but legal. It's only illegal if you
affect systems you're not authorized to affect.

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Benjamin Franz]

Post by Eric Paynter

Post by Michael Holstein

Post by k k
3. If not, what prevents you from doing that?

Any worm/virus, regardless of intent, is still illegal -- and I don't
think I can get a DSL line in jail.

Not true. Intent is *everything* as far a criminal activity is concerned.

Don't quit your day job to work as a lawyer. There are a many laws that
turn on facts rather than intent.

"Lack of criminal intent does not shield a citizen from the BATF. In
United States v. Thomas, the defendant found a 16- inch-long gun while
horseback riding. Taking it to be an antique pistol, he pawned it. But it
turned out to be short-barreled rifle, which should have been registered
before selling. Although the prosecutor conceded that Thomas lacked
criminal intent, he was convicted of a felony anyway.[64] The Supreme
Court's decision in United States v. Freed declared that criminal intent
was not necessary for a conviction of violation of the Gun Control Act of
1968.[65]"
David Kopel, in "Trust The People: The Case Against Gun Control"

Note: This is not intended to bring gun control into the argument, it was
simply the first clear example I found of a conviction for a crime without
intent.
--
Benjamin Franz

Simple things should be simple, complex things should be possible.
- Alan Kay

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Eric Paynter]

There are a many laws that turn on facts rather than intent.
"Lack of criminal intent does not shield a citizen from the BATF. In
United States v. Thomas, the defendant found a 16- inch-long gun while
horseback riding. Taking it to be an antique pistol, he pawned it. But it
turned out to be short-barreled rifle, which should have been registered
before selling. Although the prosecutor conceded that Thomas lacked
criminal intent, he was convicted of a felony anyway.[64] The Supreme
Court's decision in United States v. Freed declared that criminal intent
was not necessary for a conviction of violation of the Gun Control Act of
1968.[65]"
David Kopel, in "Trust The People: The Case Against Gun Control"

I think we're getting a little into an argument of semantics. The
defendant did in fact *intend* to sell the weapon, which was against the
law to do. He just wasn't aware of the law. Ignorance of the law does not
protect you.

Try these two scenarios out:

1. I kill somebody with the intent to kill, and then I claim I didn't know
killing was illegal. Most courts would still say murder.

2. I kill somebody because they are attacking me with a lethal weapon. I
know killing is illegal, but my intent is not to kill the other person,
but rather to save myself, and the only way to save myself is to use
lethal force. If I can *prove* my intent was to save myself, then it is
not murder.

Back to the original argument, if the intent is to patch PCs for which I
have the authority to patch, then I'm not doing anything illegal, no
matter what kind of software I create to do it. Even if the worm that I
create somehow gets out, but I can *prove* my intent was for it to not get
out, then even though releasing a worm is illegal, the worst I might get
is criminal negligence for not taking the proper precautions.

Anyhow, I think we all agree that writing a worm to do patch management is
generally a bad idea.

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Dan]

Post by Eric Paynter
I think we're getting a little into an argument of semantics. The
defendant did in fact *intend* to sell the weapon, which was against the
law to do. He just wasn't aware of the law. Ignorance of the law does not
protect you.

This is straying from the topic, and I agree with your general
conclusion anyway (that releasing a worm unintentionally could still get
you in legal trouble), but as a point of clarification, there are some
laws that don't require criminal intent at all, though you are right
that many (most?) hinge on intent. An example would be statutory rape,
in which intent is not an issue. Similarly, as you alluded to, there are
often options for prosecuting a defendant who lacked intent with a
lesser crime, e.g. manslaughter versus murder.

I'm not a lawyer, either, and I'm not all that familiar with this area
of law, but it is interesting to note that the Computer Fraud and Abuse
Act (http://www.panix.com/~eck/computer-fraud-act.html) _does_ require
criminal intent--"having knowingly accessed a computer without
authorization," "intentionally accesses a computer without
authorization," "intentionally, without authorization," etc. However,
I'm sure a creative prosecutor could drag up something criminal, if he
wished, and in any case, the inevitable civil suits would be quite
enough to deter me.

[V***@vt.edu]

Post by Benjamin Franz

Post by Eric Paynter

Post by Michael Holstein

Post by k k
3. If not, what prevents you from doing that?

Any worm/virus, regardless of intent, is still illegal -- and I don't
think I can get a DSL line in jail.

Not true. Intent is *everything* as far a criminal activity is concerned.

Don't quit your day job to work as a lawyer. There are a many laws that
turn on facts rather than intent.

Even if you *do* manage to code the worm correctly, all it takes is for *one*
person visiting your site to have plugged their laptop into the net, and you're
at least potentially screwed. And I posit that if your network is either small
enough or run *that* fascistly that you are ready to swear on a Bible in court,
under penalty of perjury, that you *know* everything that's connected to it,
then you don't need a worm to fix it.

[Eric Paynter]

Post by V***@vt.edu
Even if you *do* manage to code the worm correctly, all it takes is for
*one* person visiting your site to have plugged their laptop into the net,
and you're at least potentially screwed.

Hopefully as a minimum, one would code it to be limited to certain
subnets. That way, even if it does get the laptop, when the laptop goes
onto the Internet, it will not scan from the NIC with a public IP. It will
just go dormant.

Post by V***@vt.edu
And I posit that if your network is either small enough or run *that*
fascistly that you are ready to swear on a Bible in court,
under penalty of perjury, that you *know* everything that's connected to
it, then you don't need a worm to fix it.

Fascistly? Well, maybe from a university point of view, where the networks
tend to be more open. But for some corporate networks, the corporation
owns all equipment on the network and has a legal responsibility to ensure
the safety of the data on the network. That means forcing patches to all
machines.

With all the exploits over the years that allow users to escalate privs,
it's not too uncommon in medium and large corporations (several thousand
or more desktops) that some users have taken over their desktops and
removed the sysadmin's privs. If the corporation has a geographically
distributed wide area network, it may be cost-prohibitive to send people
to every site where one of these "rogue PCs" is detected, not to mention
that some can be very difficult to detect. Non-technical enforcement
(determining the user and escalating to HR) can also be difficult,
especially when inter-divisional politics get in the way (surprise: most
large corporations have very dysfunctional relationships
inter-departmentaly and especially inter-divisionally).

What's the easiest and fastest way to periodically sweep the network clean
of these PCs, to meet the mandate of ISD to have everything patched, to
avoid the politics of disciplining user X for breaking the rules, to just
make it happen without all the argument? This is the line of reasoning
that leads young support jockeys to consider benign worm development...

Although I would still suggest that a worm is not the way to go. Put the
"hack and patch" functionality on a server and point the server at each
subnet you want to target. Much safer. Much easier to control.

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

Post by Eric Paynter

Post by V***@vt.edu
Even if you *do* manage to code the worm correctly, all it takes is for
*one* person visiting your site to have plugged their laptop into the net,
and you're at least potentially screwed.

Hopefully as a minimum, one would code it to be limited to certain
subnets. That way, even if it does get the laptop, when the laptop goes
onto the Internet, it will not scan from the NIC with a public IP. It will
just go dormant.

No, I meant "visiting salecritter plugs into your net, your worm accidentally
trashes his laptop ("Hey, all *MY* boxen are Win2000, how was *I* to know that it
would mess up an XP box?"), and said salescritter and employer take action about it.

Post by Eric Paynter

Post by V***@vt.edu
And I posit that if your network is either small enough or run *that*
fascistly that you are ready to swear on a Bible in court,
under penalty of perjury, that you *know* everything that's connected to
it, then you don't need a worm to fix it.

Although I would still suggest that a worm is not the way to go. Put the
"hack and patch" functionality on a server and point the server at each
subnet you want to target. Much safer. Much easier to control.

Exactly. Among other things, you don't have to worry that some user 3 generations
of worm down the way removes some file he doesn't recognize, causing the worm
to mutate.

[James Tucker]

"There are no [X]" (benign worms)

What like X = Aliens, conspiracies, deities?

Many things which are not taken for granted are thought "non-existant"
but maybe thats why people shouldn't bother to try and present their
OPINION as FACT.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

Post by James Tucker
"There are no [X]" (benign worms)
What like X = Aliens, conspiracies, deities?

Bring me an example of any one of those 4, and I'll believe in it.

[Brian Anderson]

Post by V***@vt.edu

Post by James Tucker
"There are no [X]" (benign worms)
What like X = Aliens, conspiracies, deities?

Bring me an example of any one of those 4, and I'll believe in it.

The Boy Scouts were in on the JFK plot.

There's a conspiracy for ya. ;)
--
*********************************
Brian L. Anderson
Darton College
Office of Information Technology
bla at darton.edu
---------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[J.A. Terranson]

Post by Brian Anderson
The Boy Scouts were in on the JFK plot.

No - they just happened to be standing at the corner when Kennedy passed.
They were *really* waiting for the motorcade to pass so they could cross
the street on their way to the Good Father Of The Little Boys Catholic
Church ;-)

Post by Brian Anderson
There's a conspiracy for ya. ;)

Conspiracy confirmed.
--
Yours,

J.A. Terranson
***@mfn.org
0xBD4A95BF


"That bitch needs to learn proper Road Rage Etiquitte.
Never give up."

Me on 14 April 05, on I270, doing about 90mph and
realizing the girl I had been toying with for the
last 20 miles had decided safer was better than.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

Post by Brian Anderson

Post by V***@vt.edu

Post by James Tucker
"There are no [X]" (benign worms)
What like X = Aliens, conspiracies, deities?

Bring me an example of any one of those 4, and I'll believe in it.

The Boy Scouts were in on the JFK plot.

OK.. You've brought an example of an *assertion*, so I'll believe you asserted it. :)

Now, can you produce an actual *example* of a Boy Scout who was in on the plot? :)

Note that there *have* been plenty of *actual* conspiracies - in fact,
"conspiracy to commit <felony>" is one of the more common ways to get organized
crime leaders convicted and off the street. The difference between those
conspiracies and the average one from the tinfoil-helmet brigade is the
differing amounts of evidence presented.

So John Gotti was involved in a number of conspiracies, including one to have
Paul Castellano murdered. Probably somebody along the line has claimed that
Gotti was only acting on orders from the Trilateral Commission or the
Illuminati. The difference is that Sammy "The Bull" Gravano was around to talk
about Gotti's conspiring to the murder, but as yet no reliable witness has
surfaced regarding the Illuminati tie-in....

[Eric Paynter]

Post by V***@vt.edu
No, I meant "visiting salecritter plugs into your net

Eeek! In the current world of hacks and worms everywhere, I would suggest
you don't allow that. Otherwise, what's to stop visiting salescritter from
releasing a malicious worm and/or using other means to steal data? In an
age where more and more governments are passing legislation to hold the
executive personally accountable for what happens to private customer
data, a corporate policy that says "nothing not owned/managed by the
corporation goes on the corporate network" is not an unreasonable stance
to take, and one I've seen written into policy at more than one site. I
feel dirty just thinking about salescritter's laptop on my network! ;)

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Michael Holstein]

Post by Eric Paynter
Not true. Intent is *everything* as far a criminal activity is concerned.

Funny .. everytime I try and say "no, officer, I didn't realize the
speed limit was 25 on this street", I still get nicked.

Post by Eric Paynter
Intent aside, if you restrict the worm to your subnet that you own and are
authorized to alter the systems on, then even releasing a malicious worm
would be legal. Maybe not very smart, but legal. It's only illegal if you
affect systems you're not authorized to affect.

The road to hell is paved with good intentions. Consider Nachi/Welchia :
the coders figured it'd be worthwhile to "ping" the host before trying
anything else, to save time. A good idea in principle until you get
thousands of machines infected and all-of-a-sudden, we all block ICMP
everywhere we can (and stuff like path-MTU breaks).

Besides, I do know my /16. I know it well enough to realize that there
is tons of stuff on it that isn't "mine". Student PCs, professors
laptops from home, whatever. Even having worked for a .gov where I was
releatively certian that everything *was* ours, there was tons of stuff
that couldn't afford to get crashed by a "helpful" worm. There was no
shortage of DBAs that would have like to seen my nipple in the ringer
for such a stunt.

We've all tried this sort of thing in one variation or another -- a
logon script to update A/V sigs, install some new software, whatever.
And I can bet nearly every one of us encountered some bizare install of
something that we didn't anticipate and it completely hosed the target.

Save yourself the legal expenses of writing such a worm and invest in a
enterprise management system (OpenView, LanDesk, etc).

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Mike Hoye]

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha, in general is ethical or not. But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.
1. Do people do that? Or at least, have you considered it?

No. It's lunacy. Worms spread through security holes. They are
by-definition uncontrolled. If you have known security holes on a system,
you should be fixing that, not relying on it for software updates.

The worms you are describing are well-intentioned mistakes. Modifying
somebody else's system without their permission is unethical, and if
they're your own systems, you should have way, way better techniques
in place for dealing with upgrades than that.

Post by k k
2. If yes, under what conditions would you do that?

I would employ this technique if:

- I were off my medication and drinking my way through a quart of gin,
or
- I really, really wanted to lose my job.

No sysadmin their right mind would employ the technique you describe
if they wanted to stay in that line of work.

Post by k k
3. If not, what prevents you from doing that?

The fact that it naked, gibbering insanity.

[J.A. Terranson]

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha,

First off, lets get something straight: Neither of your two examples was
in any way "benign". Both of these cost carriers and their customers
*billions* of dollars. Many of us spent weeks with little to no sleep
cleaning up the mess these "benign viruses" created.

Post by k k
in general is ethical or not.

I don't know where you've been looking, but the only place I've seen the
ethics of this "seriously debated" is in middle schools and the like.
There is no serious question that this is a hostile act, and cannot
logically be considered "ethical" under *any* conceivable circumstances.

Post by k k
But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.

You actually know admins that write viruses to do their patching? Sorry,
but I think you're full of shit. If you're not, then these "admins" need
to be immediately given a boot in the balls, followed by an unemployment
benefit. Why would an *administrator*, someone with FULL rights to the
machine, use such a device to place patches???
--
Yours,

J.A. Terranson
***@mfn.org
0xBD4A95BF

"What this country needs is a good old fashioned nuclear enema."


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

Post by J.A. Terranson

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha,

First off, lets get something straight: Neither of your two examples was
in any way "benign". Both of these cost carriers and their customers
*billions* of dollars. Many of us spent weeks with little to no sleep
cleaning up the mess these "benign viruses" created.

He confused "Once upon a time, some of us thought it might be a good idea,
until we thought it through and realized it was a Bad Idea. Unfortunately,
newbies keep falling out of trees and re-inventing Bad Ideas" with "this is
a topic where clued reputable people can hold different opinions on the issue".

[Chris Umphress]

Post by J.A. Terranson
You actually know admins that write viruses to do their patching? Sorry,
but I think you're full of shit. If you're not, then these "admins" need
to be immediately given a boot in the balls, followed by an unemployment
benefit.

Why should the taxes of this country be used to pay this guy after he
becomes unemployed (or when he goes on medical leave :) ?

[Steve Kudlak]

The idea of a begin worm is a nice idea but doesn't work in practice. Oh
I have known admins who let loose all sorts of automatic update process
that were little different from worms and they regretted it. These
people were far from middle school. and "millions and billions" sounds
something Carl Sagan used to say. I do worry that this is another of
those flame war topics that have been beat to death.

Have Fun,
Sends Steve

Post by J.A. Terranson

Post by k k
There is debate surrounding whether releasing benign worms such as Nachi or
Welcha,

First off, lets get something straight: Neither of your two examples was
in any way "benign". Both of these cost carriers and their customers
*billions* of dollars. Many of us spent weeks with little to no sleep
cleaning up the mess these "benign viruses" created.

Post by k k
in general is ethical or not.

I don't know where you've been looking, but the only place I've seen the
ethics of this "seriously debated" is in middle schools and the like.
There is no serious question that this is a hostile act, and cannot
logically be considered "ethical" under *any* conceivable circumstances.

Post by k k
But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.

You actually know admins that write viruses to do their patching? Sorry,
but I think you're full of shit. If you're not, then these "admins" need
to be immediately given a boot in the balls, followed by an unemployment
benefit. Why would an *administrator*, someone with FULL rights to the
machine, use such a device to place patches???

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Nick FitzGerald]

I am an academic researcher. ...

One so well-versed in the area of which you enquire and with such a
relevant academic record that you hide behind a Hotmailaddress?

Yeah, right...

... I benefited a lot during my previous
interaction at the full disclosure list on a different topic and now, I am
here to get some input on benign worms.

There are no benign worms.

I'm not denying that it is not actually possible to design such, but
once you've put _all_ the safety checks and other requirements in place
to fulfill any vaguely sane and "widely acceptable" notion of benign
worm" you'll have designed something massively more complex and
convoluted than any existing patch management system.

If you don't think that's the case then you are not much of
_researcher_, "academic" or not. If you don't believe that, please
sensibly refute (in the true academic sense) a few of the arguments
against the possibility of "good viruses" in Vesselin Bontchev's papers
on the topic.

There is debate surrounding whether releasing benign worms such as Nachi or
Welcha, ...

You know, I've heard them called an awful lot of things but the word or
notion of "benign" was never one of them...

Are you _sure_ you're an academic?

Oh wait -- of course you are! Some of the whacky, distant outfields of
abstract intelligentsia are the only places the notions of "good
viruses" and "benign worms" have ever been seriously considered
(apologies in advance to Fred, but I think deep down even he accepts
that at the level of real-world practicality, there can be no such
thing as a "good" virus).

... in general is ethical or not.

You must really hang out in very limited circles. The only folk in
favour of such releases are miscreants with severely impaired ethical
development. Most of them still get kicks pulling wings off flies.

... But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.
1. Do people do that? Or at least, have you considered it?
2. If yes, under what conditions would you do that?
3. If not, what prevents you from doing that?

Why would any semi-intelligent sys-admin who, by definition has
administrative rights over what s/he is allowed control of and does not
have such rights over that which s/he does not have control of, bother
with something as haphazard and potentially dangerous should something
go wrong with it?

Much better that s/he use the arsenal of system administration, patch
management, change control, monitoring, policy enforcement and so on
tools than arse around with some exploit code that is largely untested
and try to glue all the cotrols and restrictions onto it to meet that
reasonable standard of benevolence alluded to above.

...

I see the originating IP in your message is a machine in the "mgmt"
domain at purdue.edu. Rather than tossing your odd-ball notions around
in the Management department, did you consider talking to serious
computer security researchers, such Spaf and his fellow academics and
their students over in CS? Have you even heard of CERIAS -- The Center
for Education and Research in Information Assurance and Security?

http://www.cerias.purdue.edu/

Or the COAST (Computer Operations, Audit, and Security Technology)
project?

http://www.cs.purdue.edu/

Do these Purdue academics share your views of "benign worms"? Might
their intellectual and academic achievements in their collective
decades of research in closely relevant areas more than slightly
outweigh your twenty minutes musing over a term paper topic?


Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Sean Crawford]

As usual Nick I was enjoying the reading you created and agreeing with what
you were saying, except maybe the tone was a little harsh?...

But I was ultra impressed with the plural use of the word, 'miscreant'.

LMAO

---> You must really hang out in very limited circles. The only folk in
---> favour of such releases are miscreants with severely impaired ethical
---> development. Most of them still get kicks pulling wings off flies.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/