Re: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)

From: purplebag (purplebag_at_gmail.com)
Date: 05/15/05

  • Next message: Jeremy Bishop: "Re: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)" 
    Date: Sat, 14 May 2005 23:34:38 -0400
To: nick@virus-l.demon.co.uk

    This thread is hogwash. There are clearly zealots that think anything
    with a worm or virus label on it is unacceptable, based on
    "experience" and there are also free thinkers that do not limit the
    scope of exploration to the work that has been done before them.

    Nick FitzGerald wrote:
    > Stejerean, Cosmin wrote:
    >
    >
    >>I think you are going a little overboard with this kind of response. The guy
    >
    >
    > Nope.
    >
    > The guy is clearly a chopper.
    >
    > Ten minutes "research" with Google would have shown him that "benign"
    > worms aren't, and only a very narrow fringe of mostly highly marginal
    > IT folk think that the idea is worth more than immediately flushing
    > down the toilet. Further, among those who do think it might be a good
    > idea or one worth studying, that support falls off very quickly with
    > actual, relevant academic or work experience.

    Would you extend that to researchers in the medical industry? Aren't
    viruses used every day in medicine to prevent and protect the host
    from more hostile attack? Have you ever received the flu shot?

    Of course, you will have some overblown opinion on this as well.
    Suffice it to say that simply because you believe, based on your
    "experience", that is it not possible or good is simply a testament to
    your closed minded nature.

    >
    > His floating such a stupid, time-worn, discredited notion, which he so
    > easily could have found to be such, in this list is much more closely
    > akin to trolling than "research".
    >
    >
    >>had a couple of questions about "benign worms." If you are going to provide
    >>some useful feedback then go ahead and do it. If you are going to write an
    >>insulting email you should probably think twice about it.
    >
    >
    > Thanks for the advice.
    >
    > I've filed it where my experience tells me it should be filed...

    Excellent choice of words as I have seen no wise teaching from the
    ancients in this thread. I think you would have been better served to
    use that experience to educate instead of attack. Wisdom is something
    people might attribute as a result.

    >
    > <<big snip>>
    >
    >>If I recall properly Stanford also used similar techniques to get rid of MS
    >>Blast on their networks especially from laptop machines that were infected.
    >>They had no administrative control over those machines yet the machines
    >>posed a threat and the threat had to be eliminated.
    >
    >
    > Assuming this is a correct recollection of whatever...
    >
    > Run that past us again -- Stanford had machines on their network that
    > posed a risk to the rest of their network BUT the Stanford IT folk had
    > no administrative rights to those machines? They couldn't configure
    > their network infrastructure so it didn't offer an IP to these
    > "anonymous" threats or at least configure it so it wouldn't route their
    > traffic?

    Quite possibly so.

    > If there really was a "need" to allow such anonymous machines
    > to come and go from their network, why had they not configured their
    > network so it only allowed such "anonymous" machines very limited
    > access (such as putting them in a separate sub-net so they screwed with
    > each other but not with "Stanford real", and that, perhaps, only had
    > very limited off-site access through their firewalls)? Sounds like
    > Stanford runs (ran?) a _really_ screwed-up network...

    Believe it or not there actually are politics, resource problems, and
    legacy issues involved.

    >
    > Worse though, you seem to imply that it was alright for Stanford to
    > take action against those machines by exploiting a vulnerability on
    > them to "fix" the threat posed to Stanford's network.

    Why does viral technology need to exploit any vulnerability to be a
    worm or a virus? What about simple tag along and mail and click happy
    users...

    I am not advocating the use of viral code as a cure all but there is
    clearly opportunity for it to do good as well as bad things. Like it
    or not people do do this, have done this, and will probably continue
    to do this. You have an opportunity to clearly state an opinion on why
    they shouldn't and instead you go on the attack as if you are the last
    word on the matter. Take the opportunity to further your cause instead
    of alienate yourself from the people that are thinking about doing it.
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Jeremy Bishop: "Re: [Full-disclosure] RE: Bening Worms (Cosmin Stejerean)"

    Relevant Pages

    • Re: Vast Spy System Loots Computers in 103 Countries
      ... A Plan to Catch the Conficker Worm ... infected millions of machines worldwide, ... signs of infection. ... it presents itself to the wider network. ...
      (sci.military.naval)
    • Re: Increasing ICMP Echo Requests
      ... How does it get into a secure network other than ... Bruce Martins wrote: ... >exploits the same vulnerability that the original MSBLAST worm did, ... >warnings and patching their machines when a patch is released for a very ...
      (Incidents)
    • Re: WinMX.exe HOW?
      ... Unless you somehow copied it over the network by ... but that was on my desktop computer and not the laptop. ... because I played them on both of my machines. ... So it had to be the worm I guess. ...
      (comp.security.firewalls)
    • Re: GAOBOT Worm reinfecting computers
      ... > The GAOBOT worm which has been infecting and reinfecting computers. ... Assuming that the machines involved are ... networked, has every machine on the network been checked including laptops ...
      (microsoft.public.security)
    • [REVS] Curious Yellow: The First Coordinated Worm Design
      ... The Warhol worm design began the theoretical discussion of so-called ... very quick infection of the network. ... Warhol superworm is to pre-scan the network for vulnerable targets. ... The method for nominating a worm to attack a target is easy. ...
      (Securiteam)
    • Quantcast