Re: A question for the list...

From: Ed Shirey (eshirey_at_pclocals.com)
Date: 05/18/03

  • Next message: Dan Perez: "RE: A question for the list..." 
    Date: Sat, 17 May 2003 17:30:22 -0600
To: incidents@securityfocus.com

    Dan Hanson wrote:

    >As part of incident handling and response, most of us have had to respond
    >to virus infections that have affected networks and hosts. Reports are
    >circulating that members of the IRC operator community have distributed
    >code through the update mechanism of the Fizzer virus. The code reportedly
    >attempts to remove the virus from the host. The latest information seems
    >to indicate that the "update" code was removed until further testing can
    >be done and more discussion regarding the legalities of this are had.
    >
    I think that this approach to dealing with worms is an inevitable
    evolution of the network
    "organism". It obviously carries many risks, but it can also
    potentially provide tremendous
    benefit to the health of the overall system.

    It's certainly not always the case, but often an infected system has
    readily exploitable
    holes that an active "vaccine" could utilize to remove the malware.
    This approach has
    a host of ethical and technical issues, but assuming an altruistic and
    benevolent (and
    technically competent) source, this vaccine has a net benefit (sorry
    about all the puns).

    I suggest that many of the issues are similar to those associated with
    "Good Samaritans".
    Our overly litigous society has many would-be samaritans afraid to offer
    a helping hand
    because of concern for liability. Is this right? This isn't a
    rhetorical question -- there are
    certainly examples of well meaning, but inept assistance causing more
    harm than good.

    However, as more and more malware "organisms" begin to inhabit our
    network like
    virtual E. Coli. in the Internet gut, active measures may be required,
    if for no other
    reason than to protect bandwidth. Perhaps DSL providers should consider
    making
    permission to release active countermeasures part of the terms of use.

    This is going to be a fun thread...

    Ed

    ----------------------------------------------------------------------------
    *** Wireless LAN Policies for Security & Management - NEW White Paper ***
    Just like wired networks, wireless LANs require network security policies
    that are enforced to protect WLANs from known vulnerabilities and threats.
    Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs.

    To get your FREE white paper visit us at:
    http://www.securityfocus.com/AirDefense-incidents
    ----------------------------------------------------------------------------

  • Next message: Dan Perez: "RE: A question for the list..."

    Relevant Pages

    • A question for the list...
      ... to virus infections that have affected networks and hosts. ... attempts to remove the virus from the host. ... I have read the reports correctly, ...
      (Incidents)
    • help me
      ... I am not sure if i have a virus. ... We use a network and ... the host. ... at2pm it is over 1,600,000. ...
      (microsoft.public.security.virus)
    • Re: OT - Well some bike stuff at the end
      ... up and on the network. ... Usually when an A/V won't install it's due to a worm or virus already on the ... Do an online scan at http://housecall.trendmicro.com and see what it reports ...
      (rec.motorcycles.harley)
    • network variable error
      ... machine as host, PXI-8045 as target.  Whenever I create a network ... it breaks the VI.  The VI error window ... reports that "This node is not execuable." ...
      (comp.lang.labview)
    • RE: Securing a Local Network
      ... How much would it cost if a virus infected one ... be if a competitor hacked into their network and was able to access all ... Third issue is virus protection. ... can infect you from numerous other sources. ...
      (Security-Basics)