Message-ID: <014d01c365b0$188c1930$be01a8c0@ian>
Date: Mon, 18 Aug 2003 13:42:29 -0400
From: "David J. Meltzer" <djm@...rusec.com>
To: <bugtraq@...urityfocus.com>, <incidents@...urityfocus.com>
Subject: msblast.d and a review of defensive worms


As many people have undoubtably already seen, the newest variant of
msblast (dubbed msblast.d, see
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSB
LAST.D) is one of a growing group of "good/defensive worms."  

As every previous "good" worm has, this will of course touch off another
debate on just how bad worms of this variety are.  Coincidentally
(really!) I have been polishing a presentation on defensive worms I will
be giving at Toorcon.  Since the historical portion of my presentation
has become so timely, I've put up that first portion of my presentation
on the web for anyone interested to review.  

It is directly linked at http://www.intrusec.com/resources.html, no
registration of any kind is required to read.  If you have any errata or
additional references, feel free to e-mail me privately and I will
incorporate them.

Here is also the list of references from this presentation for anyone
who just wants to go directly to the source material and skip my fluff:

1. Stansell-Gamm, Martha.  "Good Worms Not Mature", May 26, 2003. 
URL: http://www.eweek.com/article2/0,3959,1109605,00.asp
2. Vision, Max. "Origin and Brief Analysis of the Millennium Worm",
Sept, 1999.
URL: http://www.whitehats.com/library/worms/mworm/index.html
3. Poulsen, Kevin. "Max Vision: FBI pawn?", May 8, 2001.  
URL: http://www.securityfocus.com/news/203
4. Mixter. "mw06.tgz", September 23, 1999. 
URL: http://packetstormsecurity.nl/groups/mixter/mw06.tgz
5. Barber, Bryan. "Cheese Worm: Pros and Cons of a Friendly Worm", July
21, 2001.  
URL: http://www.sans.org/rr/papers/36/31.pdf
6. Hexxer, Der. "CodeGreen beta release", September 1, 2001.
URL: http://archives.neohapsis.com/archives/vuln-dev/2001-q3/0575.html
7. Kem, Marcus. "CRClean.zip", September 1, 2001. 
 URL: http://archives.neohapsis.com/archives/vuln-dev/2001-q3/0577.html
8. Permeh, Ryan & Coddington, Dale. "Decoding and Understanding Internet
Worms", November 21, 2001. 
URL:
http://www.blackhat.com/presentations/bh-europe-01/dale-coddington/1
9. Houle, Kevin. Quoted in "Cheese worm: A Linux fixer-upper? By Robert
Lemos", May 16, 2001.  
URL: http://news.com.com/2100-1001-257748.html?legacy=cnet
10. Hartmann, Joe. Quoted in "'Cheesy' Fix-It Worm Patches Security
Flaws By Jay Lyman", May 18, 2001.
URL: http://www.newsfactor.com/perl/story/9869.html
11. Russell, Ryan. "Re: Mitigating some of the effects of the Code Red
worm", July 20, 2001.
URL:
http://www.securityfocus.com/archive/1/198283/2002-12-02/2002-12-08/0
12. Dyck, Timothy. "Thanks, but we don't want your Cheese (worm)!", June
30, 2001.
URL: http://www.freeos.com/printer.php?entryID=4233
13. Rapoza, Jim. "Up With Good Worms", April 21, 2003.
URL: http://www.eweek.com/article2/0,3959,1037004,00.asp

-Dave

-------------------
David J. Meltzer
djm@...rusec.com   
CTO, Intrusec, Inc.


---------------------------------------------------------------------------
Captus Networks - Integrated Intrusion Prevention and Traffic Shaping  
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Ensure Reliable Performance of Mission Critical Applications
 - Precisely Define and Implement Network Security and Performance Policies
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
Visit us at: 
http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814
----------------------------------------------------------------------------

Powered by blists - more mailing lists