Legal Disclaimer

"...For Dummies" is a registered trademark of Wiley Publishing, Inc. Wiley has not given authorization for this title, nor is it associated in any way with the Wiley (nee IDG Books, nee Hungry Minds) series "... for Dummies."

January 25, 2003

Measuring the verocity of a worm

Today's MS-SQL worm attack has made me wonder about doing an analysis on internet susceptibility to such virii.

Like a normal human-born disease, a worm needs to have proper timing if it is to do the most damage to a network. Today's worm did a pretty good job of wrecking the 'net, with 5 of the root nameservers buckling. But it could have done better.

The problem with it was that it moved too quickly. While speed is a good way to infect the maximum number of hosts on the internet (like in real life), it has the problem that it draws too much attention to itself, especially when the cure is as easy as pennicilin. What the virus writer should have done was made it work a little more slowly for the first, say, 30-40 hours. Then on Sunday it should have started sending random UDP connections (ie to random ports, on random servers, with a big old chunky payload). That would have _really_ crippled the 'net.

| TrackBack

next tuesday in chapins class...

http://www.cs.berkeley.edu/~nweaver/warhol.html
http://www.silicondefense.com/flash/
http://archives.neohapsis.com/archives/incidents/2001-08/0341.html

Posted by: dfc on January 25, 2003 11:10 PM

Heh. Sweet.

Oh, remind Chapin in class or after class or before class or whatever's appropriate. He owes me a recommendation :). Just tell him "Did you get Reid's email?" or something like that. If you don't mind.

Wheee....

Posted by: K. Reid Wightman on January 26, 2003 12:22 AM
Post a comment










Please enter the number above into the box below.









Further back...

Archives