Feeds

Good worms back on the agenda

But are good viruses possible?

The Essential Guide to IT Transformation

ARLINGTON, Virginia - A researcher has reopened the subject of beneficial worms, arguing that the capabilities of self-spreading code could perform better penetration testing inside networks, turning vulnerable systems into distributed scanners.

The worms, dubbed nematodes after the parasitic worm used to kill pests in gardens, could give security administrators the ability to scan machines inside a corporate network but beyond a local subnet, David Aitel, principal researcher of security firm Immunity, said at the Black Hat Federal conference.

"Rather than buy a scanning system for every segment of your network, you can use nematodes to turn every host into a scanner," he said during an interview with SecurityFocus. "You'll be able to see into the shadow organisation of a network - you find worms on machines and you don't know how they got there."

The topic of whether self-propagating code can have a good use has cropped up occasionally among researchers in the security community. In 1994, a paper written by antivirus researcher Vesselin Bontchev concluded that 'good' viruses are possible, but the safeguards and limitations on the programs would mean that the resulting code would not resemble what most people considered a virus.

Later attempts at creating 'good' worms have failed, however, mainly because the writers have not adopted many of the safeguards outlined in the Bontchev paper. The Welchia worm - a variant of the MSBlast, or Blaster, worm - had apparently been created to fix the vulnerability exploited by the MSBlast worm, but had serious programming errors that caused the program to scan so aggressively for new hosts, it effectively shut down many corporate networks.

Immunity's research is the latest attempt to create a more rigorously conceived framework for creating worms that could spread across specific networks to find and report vulnerabilities. The research essentially offers two advances, a strategy for the controlled propagation of worms and a framework in which reliable worms could be created quickly, Aitel said.

"History has repeatedly shown us that people who write worms by hand make mistakes," he said. "Worms are difficult to build and very difficult to test."

The nematode worms would have to get permission to spread by querying a central server for a specific digital token, which Aitel dubbed a nematoken, before spreading to a particular machine. Another version of the software would use a whitelist to spread among only the company's computers.

Because the worms would be limited to spreading in a specific company's network, they would be completely legal, said Aitel. He noted that penetration testers today are given the right by a company to exploit systems on that company's networks. The distributed nature of the worms do make ascertaining permission more difficult, he acknowledged.

Aitel's idea is a new twist on an old concept. An author using the name MidNyte wrote a response to Bontchev's paper in 1999 arguing that a 'good' virus that kept information on the last 100 hosts to which it spread could help defend against bad viruses.

However, Aitel also argues that, in today's complex networks, nematodes could significantly reduce the cost of scanning a large network, by bringing the advantages of peer-to-peer concepts to penetration testing and network scanning. Rather than buying a new sensor for each subnet in a company, the nematode could spread using existing pathways to enumerate any computers with a given set of vulnerabilities. Moreover, the technology could be used to move search agents across a network to find specific files or to push intelligence to all desktops without a specific client.

On the other hand, the dangers inherent in self-propagating code are hard to overcome, said Jose Nazario, senior security and software engineer for network defense firm Arbor Networks.

"I still have my doubts that the controls he described are effective enough," Nazario said. "He addressed how you shut the nematodes down and how you make sure they don't infect other networks, but he hasn't addressed machine instability and the danger when people carry laptops across network boundaries."

Nazario, the author of Defense and Detection Strategies Against Internet Worms, believes the best way to find vulnerabilities on a large network is to use dedicated sensors, an approach used by Arbor Networks.

"There are a number of ways of finding those vulnerabilities in the network without the inherent risks involved in self-propagating code," he said.

This article originally appeared in SecurityFocus

Copyright © 2006, SecurityFocus

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.