eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Its a recurring theme on security discussion lists: Someone ought to build a worm that infects insecure systems and remedies the problems on them.
Every six months or so someone thinks theyre the first one to think of it. So in case any of you think its a good idea, please stop wasting your time. Its a dreadful idea, its been tried, and its failed in the most miserable way. Its a Frankensteins Monster in an e-mail attachment.
It is a tempting notion, though, and even respectable researchers have looked into it. Heres a PowerPoint presentation on “automated strike-back systems” from a BlackHat conference in 2002. The author asks a lot of the right questions, but ultimately comes up with the wrong answer. The real reason its wrong for individuals to “strike back” at systems attacking them is because thats not how things work in a civilized society.
When you go out crime-fighting on the Internet, are you sure youre hitting back at the right target? I suggest that you shouldnt be so confident in your ability to know that youre going after the right people, without any knowledge of their circumstances and the damage youll cause to them by tampering with their systems.
The answer to lawlessness isnt to create your own militia, its the imposition of legal authority. Not that I have a good suggestion for how to do that, but I feel pretty safe saying that self-appointed crime fighters are only a good idea in comic books.
Joe Hartmann, Director of the Anti-Virus Research Group at Trend Micro, reminded me of some of the really horrible examples from the past.
The most successful—by which I mean “disastrous”—example of an attempt to use worm technology for good was the Nachi worm, also known as Welchia.
Nachi exploited two of the more unforgivable exploits in Windows history, the RPC DCOM Buffer Overflow and the WebDAV exploit, to infect the system. Once in control, it downloaded and applied a variety of patches to the system.
Nachi made a lot of mistakes. The initial version didnt check on Windows 2000 to see if Service Pack 3 or later were required. This and other errors caused problems in many systems. But the biggest problem was the same as with other worms: they have to spread themselves, and the more successful they are the more their spread gets out of control.
Im sure there were a lot of people out there who intentionally spread Nachi, thinking they were doing a public service. Nachi spread like wildfire through corporate networks, through systems that should have been protected through other means, leading me to believe that unauthorized persons attempted unofficial remediation. I hope they got caught and fired.
The reason so many companies take a certain amount of time to apply even important patches is that its a serious thing to do and can be disruptive to the proper function of a computer. To do patch management right, you need to control the system. If you dont do things 100 percent correctly, you can easily make the system unusable.
As Hartmann says, its unlikely that a vigilante worm like Nachi will be effective at its job, and likely that it will be wildly inefficient.
Remember that many of these Microsoft patches are huge downloads. There have been cases where an infection spreading in a corporate network has caused large numbers of clients on the network all to attempt to download a 2MB+ patch file from Microsoft, resulting in saturation of the Internet connection.
Even if you cant see what a bad technical idea it is to fight malware with malware, bear in mind that its illegal to do it, and for good reasons. Perhaps the moral problem of lawbreaking and the fear of punishment will deter some people.
Thanks, Batman, but I dont need you out there fighting cyber-crime. Nobody gave you the authority to tamper with other peoples systems, even if they are zombies. You can protect yourself and warn others, but leave the enforcement to those with authority to do so. Theyll show up some day.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. He can be reached at larryseltzer@ziffdavis.com.