Cyber Security Institute

§ Current Worries

Top 3 Worries

  • Regulations
  • Old Firewall Configurations
  • Security Awareness

§ Listening

For the best information

  • The underground
  • Audible
  • Executive Excellence
  • Music (to keep me sane)

§ Watching

For early warnings

  • 150 Security Websites
  • AP Newsfeeds
  • Vendors

Friday, January 27, 2006

Good worms back on the agenda

A researcher has reopened the subject of beneficial worms, arguing that the capabilities of self-spreading code could perform better penetration testing inside networks, turning vulnerable systems into distributed scanners.  The worms, dubbed nematodes after the parasitic worm used to kill pests in gardens, could give security administrators the ability to scan machines inside a corporate network but beyond a local subnet, David Aitel, principal researcher of security firm Immunity, said at the Black Hat Federal conference.  “Rather than buy a scanning system for every segment of your network, you can use nematodes to turn every host into a scanner,” he said during an interview with SecurityFocus.  “You’ll be able to see into the shadow organization of a network—you find worms on machines and you don’t know how they got there.”

The topic of whether self-propagating code can have a good use has cropped up occasionally among researchers in the security community.  In 1994, a paper written by antivirus researcher Vesselin Bontchev concluded that ‘good’ viruses are possible, but the safeguards and limitations on the programs would mean that the resulting code would not resemble what most people considered a virus.  Later attempts at creating ‘good’ worms have failed, however, mainly because the writers have not adopted many of the safeguards outlined in the Bontchev paper.  The Welchia worm—a variant of the MSBlast, or Blaster, worm—had apparently been created to fix the vulnerability exploited by the MSBlast worm, but had serious programming errors that caused the program to scan so aggressively for new hosts, it effectively shut down many corporate networks.

Immunity’s research is the latest attempt to create a more rigorously conceived framework for creating worms that could spread across specific networks to find and report vulnerabilities.  The research essentially offers two advances, a strategy for the controlled propagation of worms and a framework in which reliable worms could be created quickly, Aitel said.  The nematode worms would have to get permission to spread by querying a central server for a specific digital token, which Aitel dubbed a nematoken, before spreading to a particular machine.

http://www.securityfocus.com/news/11373?ref=rss

Posted on 01/27
NewsPermalink