5 ms·

Question - wouldn't it be feasible to write a worm that uses the vulnerability to deliver a patch for the vulnerability... and then maybe deactivate itself afte

Question - wouldn't it be feasible to write a worm that uses the vulnerability to deliver a patch for the vulnerability... and then maybe deactivate itself after several days (the worm / spreading portion)? Or is there something I'm missing?

protomyth 9y ago
Well, you could and I know someone who did just that in the NT 4.0 days, but you are taking one hell of risk. It is still illegal even if your intentions are good and you could truly f'up the machine you are patching. The road to hell is paved with good intentions after all.
naner 9y ago
Yes, this technique is sometimes used by malicious software in patching the vulnerability that was used to gain control of the host. Security and software companies typically do not want to use benevolent worms to patch vulnerabilities, though. Autonomous code spreading itself and making changes to people's machines without permission is generally frowned upon.
- hengheng 9y ago
  Is that because there is no business model behind it, or is it due to the high risk of scfewing up?
staticfloat 9y ago
This reminds me of an old story I read in an anthology called "Stealing the Network: How to Own the Box"; it was a series of modern-day hacking short stories loosely tied together through an overarching theme, and each chapter was written by a different professional in the security field. Fun reads, and an interesting introduction to many of the tools and practices of security pros, if a little fanciful at times. :) The particular chapter I was thinking of was named "The Worm Turns".
- problems 9y ago
  There's been several cases in history of "Fixer" worms. Welchia is probably the best known example. https://en.wikipedia.org/wiki/Welchia https://en.wikipedia.org/wiki/Welchia
- arca_vorago 9y ago
  I have the first two editions on my bookshelf. Was actually very entertaining and fairly technically accurate for its time. Great mention. I think the second was how to steal the planet.
jmnicolas 9y ago
This is called Windows Update ;-)
- lostlogin 9y ago
  Any white hat suggestions?
nebula 9y ago
Reminds me of a tricky situation I got myself into : When I was in college, I wrote a simple worm to display a new year greeting on all computers it infects. Once it infects a computer, it did the following: 1. it replicated itself to as many computers as possible 2. Displayed the greeting (till user acknowledges it through a key press) 3. self delete (in the hope that it will quickly die by itself) I seeded it in one of the computers in our college network. I didn't expect it to be so effective; It spread itself very quickly in the entire network. With self-delete, I thought it would die on its own. I was wrong. Machines kept infecting each other in a perpetual loop. The only way I could stop it was to write a new version that replicated, and cleaned the first version. This new version kept replicating in the network even after a year. This new version was not doing anything visible to the user, and I was saved :)
- hexrcs 9y ago
  You should have included another functionality to check the current date, like, it should stop spreading and just delete itself if it's already in April. ;)
  - nebula 9y ago
    Good thought :) When I put out the first version, I haven't really understood the consequences or its effectiveness; In fact it had my code name in the greeting :( When it first appeared, people found it amusing; but it quickly went out of control and kept appearing again and again. This annoyed people. I was in trouble. I had to quickly find a solution in that panic.
- lma21 9y ago
  technically speaking, how did you handle the replication across the network (nmap && scp?)?
- discardorama 9y ago
  That's exactly the mistake that Robert Morris (of the infamous Sendmail worm[1]) made: he kept re-infecting the machines. [1] https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm
Spooky23 9y ago
IIRC, Welchia tried to do that and ended up imploding networks globally instead!
- nthcolumn 9y ago
  I remember a Spooky who wrote (harmless) normal.dot worms a loooong time ago... any relation? ima lookup Anna K now...
nthcolumn 9y ago
The Adylkuzz smb variant - a monero miner which actually came out just before Wcry disables smb1 but clearly didn't seem to help probably because it afaik didn't have a hunter. In theory if it had done then wcry may not have happened as all the base would have been already gone.
ungzd 9y ago
Windows Integrity Protection will probably revert it back.

protomyth 9y ago

Well, you could and I know someone who did just that in the NT 4.0 days, but you are taking one hell of risk. It is still illegal even if your intentions are good and you could truly f'up the machine you are patching. The road to hell is paved with good intentions after all.

naner 9y ago

Yes, this technique is sometimes used by malicious software in patching the vulnerability that was used to gain control of the host. Security and software companies typically do not want to use benevolent worms to patch vulnerabilities, though. Autonomous code spreading itself and making changes to people's machines without permission is generally frowned upon.

hengheng 9y ago
Is that because there is no business model behind it, or is it due to the high risk of scfewing up?

staticfloat 9y ago

This reminds me of an old story I read in an anthology called "Stealing the Network: How to Own the Box"; it was a series of modern-day hacking short stories loosely tied together through an overarching theme, and each chapter was written by a different professional in the security field. Fun reads, and an interesting introduction to many of the tools and practices of security pros, if a little fanciful at times. :) The particular chapter I was thinking of was named "The Worm Turns".

problems 9y ago
There's been several cases in history of "Fixer" worms. Welchia is probably the best known example. https://en.wikipedia.org/wiki/Welchia https://en.wikipedia.org/wiki/Welchia
arca_vorago 9y ago
I have the first two editions on my bookshelf. Was actually very entertaining and fairly technically accurate for its time. Great mention. I think the second was how to steal the planet.

jmnicolas 9y ago

This is called Windows Update ;-)

lostlogin 9y ago
Any white hat suggestions?

nebula 9y ago

Reminds me of a tricky situation I got myself into : When I was in college, I wrote a simple worm to display a new year greeting on all computers it infects. Once it infects a computer, it did the following: 1. it replicated itself to as many computers as possible 2. Displayed the greeting (till user acknowledges it through a key press) 3. self delete (in the hope that it will quickly die by itself) I seeded it in one of the computers in our college network. I didn't expect it to be so effective; It spread itself very quickly in the entire network. With self-delete, I thought it would die on its own. I was wrong. Machines kept infecting each other in a perpetual loop. The only way I could stop it was to write a new version that replicated, and cleaned the first version. This new version kept replicating in the network even after a year. This new version was not doing anything visible to the user, and I was saved :)

hexrcs 9y ago
You should have included another functionality to check the current date, like, it should stop spreading and just delete itself if it's already in April. ;)
- nebula 9y ago
  Good thought :) When I put out the first version, I haven't really understood the consequences or its effectiveness; In fact it had my code name in the greeting :( When it first appeared, people found it amusing; but it quickly went out of control and kept appearing again and again. This annoyed people. I was in trouble. I had to quickly find a solution in that panic.
lma21 9y ago
technically speaking, how did you handle the replication across the network (nmap && scp?)?
discardorama 9y ago
That's exactly the mistake that Robert Morris (of the infamous Sendmail worm[1]) made: he kept re-infecting the machines. [1] https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm

Spooky23 9y ago

IIRC, Welchia tried to do that and ended up imploding networks globally instead!

nthcolumn 9y ago
I remember a Spooky who wrote (harmless) normal.dot worms a loooong time ago... any relation? ima lookup Anna K now...

nthcolumn 9y ago

The Adylkuzz smb variant - a monero miner which actually came out just before Wcry disables smb1 but clearly didn't seem to help probably because it afaik didn't have a hunter. In theory if it had done then wcry may not have happened as all the base would have been already gone.

ungzd 9y ago

Windows Integrity Protection will probably revert it back.