As many people have undoubtably already seen, the newest variant of msblast (dubbed msblast.d, see http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSB LAST.D) is one of a growing group of "good/defensive worms." As every previous "good" worm has, this will of course touch off another debate on just how bad worms of this variety are. Coincidentally (really!) I have been polishing a presentation on defensive worms I will be giving at Toorcon. Since the historical portion of my presentation has become so timely, I've put up that first portion of my presentation on the web for anyone interested to review. It is directly linked at http://www.intrusec.com/resources.html, no registration of any kind is required to read. If you have any errata or additional references, feel free to e-mail me privately and I will incorporate them. Here is also the list of references from this presentation for anyone who just wants to go directly to the source material and skip my fluff: 1. Stansell-Gamm, Martha. "Good Worms Not Mature", May 26, 2003. URL: http://www.eweek.com/article2/0,3959,1109605,00.asp 2. Vision, Max. "Origin and Brief Analysis of the Millennium Worm", Sept, 1999. URL: http://www.whitehats.com/library/worms/mworm/index.html 3. Poulsen, Kevin. "Max Vision: FBI pawn?", May 8, 2001. URL: http://www.securityfocus.com/news/203 4. Mixter. "mw06.tgz", September 23, 1999. URL: http://packetstormsecurity.nl/groups/mixter/mw06.tgz 5. Barber, Bryan. "Cheese Worm: Pros and Cons of a Friendly Worm", July 21, 2001. URL: http://www.sans.org/rr/papers/36/31.pdf 6. Hexxer, Der. "CodeGreen beta release", September 1, 2001. URL: http://archives.neohapsis.com/archives/vuln-dev/2001-q3/0575.html 7. Kem, Marcus. "CRClean.zip", September 1, 2001. URL: http://archives.neohapsis.com/archives/vuln-dev/2001-q3/0577.html 8. Permeh, Ryan & Coddington, Dale. "Decoding and Understanding Internet Worms", November 21, 2001. URL: http://www.blackhat.com/presentations/bh-europe-01/dale-coddington/1 9. Houle, Kevin. Quoted in "Cheese worm: A Linux fixer-upper? By Robert Lemos", May 16, 2001. URL: http://news.com.com/2100-1001-257748.html?legacy=cnet 10. Hartmann, Joe. Quoted in "'Cheesy' Fix-It Worm Patches Security Flaws By Jay Lyman", May 18, 2001. URL: http://www.newsfactor.com/perl/story/9869.html 11. Russell, Ryan. "Re: Mitigating some of the effects of the Code Red worm", July 20, 2001. URL: http://www.securityfocus.com/archive/1/198283/2002-12-02/2002-12-08/0 12. Dyck, Timothy. "Thanks, but we don't want your Cheese (worm)!", June 30, 2001. URL: http://www.freeos.com/printer.php?entryID=4233 13. Rapoza, Jim. "Up With Good Worms", April 21, 2003. URL: http://www.eweek.com/article2/0,3959,1037004,00.asp -Dave ------------------- David J. Meltzer djmat_private CTO, Intrusec, Inc. --------------------------------------------------------------------------- Captus Networks - Integrated Intrusion Prevention and Traffic Shaping - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans - Automatically Control P2P, IM and Spam Traffic - Ensure Reliable Performance of Mission Critical Applications - Precisely Define and Implement Network Security and Performance Policies **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo Visit us at: http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814 ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Mon Aug 18 2003 - 11:33:26 PDT