Discussion:
Bening Worms (Cosmin Stejerean)
(too old to reply)
Stejerean, Cosmin
2005-05-14 16:42:18 UTC
Permalink
I think you are going a little overboard with this kind of response. The guy
had a couple of questions about "benign worms." If you are going to provide
some useful feedback then go ahead and do it. If you are going to write an
insulting email you should probably think twice about it.

More comments about specific parts of your email. If you don't care for the
comments you should read the last part of the email as it is a little more
relevant to the topic.
I am an academic researcher. ...
One so well-versed in the area of which you enquire and with such a
relevant academic record that you hide behind a Hotmailaddress?
Yeah, right...
I often write emails from my gmail address when posting to lists for various
reasons. One, I don't want SPAM in my work inbox. Second, it makes it clear
that my views are my views alone and it usually prevents questions such as
"Do these Purdue academics share your views of 'benign worms?' "
... I benefited a lot during my previous
interaction at the full disclosure list on a different topic and now, I
am
here to get some input on benign worms.
There are no benign worms.
I'm not denying that it is not actually possible to design such, but
once you've put _all_ the safety checks and other requirements in place
to fulfill any vaguely sane and "widely acceptable" notion of benign
worm" you'll have designed something massively more complex and
convoluted than any existing patch management system.
That was the only intelligent part of your email. Everything else you should
have left out.
If you don't think that's the case then you are not much of
_researcher_, "academic" or not. If you don't believe that, please
sensibly refute (in the true academic sense) a few of the arguments
against the possibility of "good viruses" in Vesselin Bontchev's papers
on the topic.
You would have looked a little more intelligent if instead of insulting him
you would have wrote something like "Please read Vesselin Bontchev's papers
on the topic of benign viruses"
There is debate surrounding whether releasing benign worms such as Nachi
or
Welcha, ...
You know, I've heard them called an awful lot of things but the word or
notion of "benign" was never one of them...
Are you _sure_ you're an academic?
[...]
You must really hang out in very limited circles. The only folk in
favour of such releases are miscreants with severely impaired ethical
development. Most of them still get kicks pulling wings off flies.
I don't think that was at all necessary.
... But network administrators can still
create benign worms for their need (not necessarily Nachi or Welcha) and
release them in their domain to patch systems.
1. Do people do that? Or at least, have you considered it?
Please see the last part of this email for an answer to this question.
2. If yes, under what conditions would you do that?
You would probably only do something like this in case of an emergency.
In most cases there are a lot better ways to patch management than spreading
a worm of your own.
3. If not, what prevents you from doing that?
There is a lot of risk associated with this. Exploits can be unstable and
crash production machines or have other undesirable side effects which in
most organizations can cost you your job.
Do these Purdue academics share your views of "benign worms"? Might
their intellectual and academic achievements in their collective
decades of research in closely relevant areas more than slightly
outweigh your twenty minutes musing over a term paper topic?
Like I mentioned before, this is why he probably used his hotmail address.
If he thought he was 100% right he wouldn't have emailed the list. He was
trying to get feedback on his idea without needing to be insulted.

...

I would like to make a few comments about the topic. The idea to use
"aggressive" techniques to "patch" computers is not new at all. This is
usually only done to patch computers that are infected. It is one of the
concepts of evil honey pots (http://cansecwest.com/csw04/csw04-Oudot.pdf) to
attack attackers. If the attacker is a computer infected with a worm that
you can write a program that will detect this attack and then attack back in
order to remove the initial worm. This has been done in practice with Honeyd
to fight the Blaster worm. You can read about it at

http://www.securityfocus.com/infocus/1740

You can also read more about active defense at
http://staff.washington.edu/dittrich/ad/AD-workshop-091203.ppt

If I recall properly Stanford also used similar techniques to get rid of MS
Blast on their networks especially from laptop machines that were infected.
They had no administrative control over those machines yet the machines
posed a threat and the threat had to be eliminated.

Perhaps the best example of how this was used and why it should be done this
way unless it's an emergency is the problem with the Xerox researches in
1978 that used worms to automate tasks on their network. The code was
corrupted and over 200 machines crashed.

Nachi can also crash machines and although it has a good intention it is not
generally welcomed by anyone on their machines. If you are going to do such
a thing make sure you limit the worm to only scan machines in your IP range
and set a time/date when the worm will expire and remove itself. Make sure
you test it well in a lab before you release it on your network.




Cosmin Stejerean
V***@vt.edu
2005-05-14 18:31:14 UTC
Permalink
Post by Stejerean, Cosmin
You would probably only do something like this in case of an emergency.
In most cases there are a lot better ways to patch management than spreading
a worm of your own.
Describe an emergency scenario where writing and testing a worm to do your
network is superior to deploying either a honeypot back-attack-and-patch or
centralized scan-and-patch service?
Post by Stejerean, Cosmin
Perhaps the best example of how this was used and why it should be done this
way unless it's an emergency is the problem with the Xerox researches in
1978 that used worms to automate tasks on their network. The code was
corrupted and over 200 machines crashed.
I think you meant "Why it *shouldn't* be done this way"?
Nick FitzGerald
2005-05-15 00:20:25 UTC
Permalink
Post by Stejerean, Cosmin
I think you are going a little overboard with this kind of response. The guy
Nope.

The guy is clearly a chopper.

Ten minutes "research" with Google would have shown him that "benign"
worms aren't, and only a very narrow fringe of mostly highly marginal
IT folk think that the idea is worth more than immediately flushing
down the toilet. Further, among those who do think it might be a good
idea or one worth studying, that support falls off very quickly with
actual, relevant academic or work experience.

His floating such a stupid, time-worn, discredited notion, which he so
easily could have found to be such, in this list is much more closely
akin to trolling than "research".
Post by Stejerean, Cosmin
had a couple of questions about "benign worms." If you are going to provide
some useful feedback then go ahead and do it. If you are going to write an
insulting email you should probably think twice about it.
Thanks for the advice.

I've filed it where my experience tells me it should be filed...

<<big snip>>
Post by Stejerean, Cosmin
If I recall properly Stanford also used similar techniques to get rid of MS
Blast on their networks especially from laptop machines that were infected.
They had no administrative control over those machines yet the machines
posed a threat and the threat had to be eliminated.
Assuming this is a correct recollection of whatever...

Run that past us again -- Stanford had machines on their network that
posed a risk to the rest of their network BUT the Stanford IT folk had
no administrative rights to those machines? They couldn't configure
their network infrastructure so it didn't offer an IP to these
"anonymous" threats or at least configure it so it wouldn't route their
traffic? If there really was a "need" to allow such anonymous machines
to come and go from their network, why had they not configured their
network so it only allowed such "anonymous" machines very limited
access (such as putting them in a separate sub-net so they screwed with
each other but not with "Stanford real", and that, perhaps, only had
very limited off-site access through their firewalls)? Sounds like
Stanford runs (ran?) a _really_ screwed-up network...

Worse though, you seem to imply that it was alright for Stanford to
take action against those machines by exploiting a vulnerability on
them to "fix" the threat posed to Stanford's network. That is clearly
wrong, both ethically and legally. By acting as you suggest, Stanford
would almost certainly have been exposing itself criminally (and quite
possibly federally -- what are the odds that at least one of those
laptops "belonged" to someone doing "critical" US government work on
contract, or pretty much any work relating to the banking, or other
"critical commerce", industries).

Stanford could have legally and "rightly" acted by denying further
access to its network from machines it had no administrative control
over, but of course that would have required it to have already
designed and implemented a better network infrastructure than it seems
they had in place. Their lack of forethought in that regard in no way
justifies their unethical (and almost certainly illegal) actions.


Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
V***@vt.edu
2005-05-15 00:40:55 UTC
Permalink
Post by Nick FitzGerald
Post by Stejerean, Cosmin
I think you are going a little overboard with this kind of response. The guy
Nope.
The guy is clearly a chopper.
A perfect proof of why benign worms are a Bad Idea. I've attached the Subject:
lines from the original thread, and the current sub-thread:

Subject: Re: [Full-disclosure] Benign Worms
Subject: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)

If the *subject* line has sprouted a mutation from 'Benign' to 'Bening',
why should we trust the *entire worm* not to mutate? ;)

(And no - I do *NOT* want to hear "but I typed that one in by hand" as
an excuse or rationalization. The Subject: had a mutation. And that's all
that's important.)
Randall M
2005-05-15 13:13:35 UTC
Permalink
:-----Original Message-----
:From: full-disclosure-***@lists.grok.org.uk
:[mailto:full-disclosure-***@lists.grok.org.uk] On Behalf
:Of ***@vt.edu
:Sent: Saturday, May 14, 2005 7:41 PM
:To: ***@virus-l.demon.co.uk
:Cc: full-***@lists.grok.org.uk
:Subject: Re: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)
:
:On Sun, 15 May 2005 12:20:25 +1200, Nick FitzGerald said:
:> Stejerean, Cosmin wrote:
:>
:> > I think you are going a little overboard with this kind of
:response.
:> > The guy
:>
:> Nope.
:>
:> The guy is clearly a chopper.
:
:A perfect proof of why benign worms are a Bad Idea. I've
:attached the Subject:
:lines from the original thread, and the current sub-thread:
:
:Subject: Re: [Full-disclosure] Benign Worms
:Subject: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)
:
:If the *subject* line has sprouted a mutation from 'Benign' to
:'Bening', why should we trust the *entire worm* not to mutate? ;)
:
:(And no - I do *NOT* want to hear "but I typed that one in by
:hand" as an excuse or rationalization. The Subject: had a
:mutation. And that's all that's important.)
:
:

Good point Valdis. A perfect proof that mutation can only produce useless
information. The only hope for this thread would be the injection and help
of intelligent design otherwise it will not survive.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
purplebag
2005-05-15 03:34:38 UTC
Permalink
This thread is hogwash. There are clearly zealots that think anything
with a worm or virus label on it is unacceptable, based on
"experience" and there are also free thinkers that do not limit the
scope of exploration to the work that has been done before them.
Post by Nick FitzGerald
Post by Stejerean, Cosmin
I think you are going a little overboard with this kind of response. The guy
Nope.
The guy is clearly a chopper.
Ten minutes "research" with Google would have shown him that "benign"
worms aren't, and only a very narrow fringe of mostly highly marginal
IT folk think that the idea is worth more than immediately flushing
down the toilet. Further, among those who do think it might be a good
idea or one worth studying, that support falls off very quickly with
actual, relevant academic or work experience.
Would you extend that to researchers in the medical industry? Aren't
viruses used every day in medicine to prevent and protect the host
from more hostile attack? Have you ever received the flu shot?

Of course, you will have some overblown opinion on this as well.
Suffice it to say that simply because you believe, based on your
"experience", that is it not possible or good is simply a testament to
your closed minded nature.
Post by Nick FitzGerald
His floating such a stupid, time-worn, discredited notion, which he so
easily could have found to be such, in this list is much more closely
akin to trolling than "research".
Post by Stejerean, Cosmin
had a couple of questions about "benign worms." If you are going to provide
some useful feedback then go ahead and do it. If you are going to write an
insulting email you should probably think twice about it.
Thanks for the advice.
I've filed it where my experience tells me it should be filed...
Excellent choice of words as I have seen no wise teaching from the
ancients in this thread. I think you would have been better served to
use that experience to educate instead of attack. Wisdom is something
people might attribute as a result.
Post by Nick FitzGerald
<<big snip>>
Post by Stejerean, Cosmin
If I recall properly Stanford also used similar techniques to get rid of MS
Blast on their networks especially from laptop machines that were infected.
They had no administrative control over those machines yet the machines
posed a threat and the threat had to be eliminated.
Assuming this is a correct recollection of whatever...
Run that past us again -- Stanford had machines on their network that
posed a risk to the rest of their network BUT the Stanford IT folk had
no administrative rights to those machines? They couldn't configure
their network infrastructure so it didn't offer an IP to these
"anonymous" threats or at least configure it so it wouldn't route their
traffic?
Quite possibly so.
Post by Nick FitzGerald
If there really was a "need" to allow such anonymous machines
to come and go from their network, why had they not configured their
network so it only allowed such "anonymous" machines very limited
access (such as putting them in a separate sub-net so they screwed with
each other but not with "Stanford real", and that, perhaps, only had
very limited off-site access through their firewalls)? Sounds like
Stanford runs (ran?) a _really_ screwed-up network...
Believe it or not there actually are politics, resource problems, and
legacy issues involved.
Post by Nick FitzGerald
Worse though, you seem to imply that it was alright for Stanford to
take action against those machines by exploiting a vulnerability on
them to "fix" the threat posed to Stanford's network.
Why does viral technology need to exploit any vulnerability to be a
worm or a virus? What about simple tag along and mail and click happy
users...

I am not advocating the use of viral code as a cure all but there is
clearly opportunity for it to do good as well as bad things. Like it
or not people do do this, have done this, and will probably continue
to do this. You have an opportunity to clearly state an opinion on why
they shouldn't and instead you go on the attack as if you are the last
word on the matter. Take the opportunity to further your cause instead
of alienate yourself from the people that are thinking about doing it.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Jeremy Bishop
2005-05-15 05:08:05 UTC
Permalink
Post by purplebag
This thread is hogwash. There are clearly zealots that think anything
with a worm or virus label on it is unacceptable, based on
"experience" and there are also free thinkers that do not limit the
scope of exploration to the work that has been done before them.
It does seem that the reaction comes a bit quickly. Once bitten, twice
shy, and all that. That said, it seems at least a few others have
pointed out that this problem is not the appropriate domain for a worm.

Worms generally infect machines on a stochastic basis. That means you'll
be able to make statements like "there is an xx% probability that an
unpatched machine on our network has been 'vaccinated' after n units of
time".

If it's /your/ network, you should know what's attached to it. If you
can't figure that out, you have bigger problems. If you do know what's
attached to it, you can deal with each machine directly instead of
playing with probabilities.

<snip>
Post by purplebag
Excellent choice of words as I have seen no wise teaching from the
ancients in this thread. I think you would have been better served to
use that experience to educate instead of attack. Wisdom is something
people might attribute as a result.
The 'wise teaching' seems to be that there is invariably a bug or
incorrect assumption that turns the worm from "benign" to "bening". I
can find /that/ teaching with just a cursory scan over the thread.
--
Nothing is intrinsically good or evil,
but its manner of usage may make it so.
-- St. Thomas Aquinas
V***@vt.edu
2005-05-16 02:28:02 UTC
Permalink
regular patching. There might be some cases when writing a quick "worm" to
patch rogue machines automatically might be better (especially to patch
laptops connected to a wireless hotspot, etc) but since it is risky it
Nope.. You don't *know* that a worm will or won't actually hit that vulnerable
laptop. It *probably* will, given enough time.

Or you can just have an attack-trained DHCP server, and *know* that laptop
will get fixed when it rears its head on the network. ;)

Loading...