*D'you know who was in charge of the Bush Administration's
"cyberspace security" policy? RICHARD CLARKE, that's who.
Do you think they took any of his advice?
This Black Ice worm, the Witty worm, that thing
was dynamite. Are you running Microsoft software?
Back up everything and store it safely. Do it
now and keep doing it. You are living very
dangerously. You have no genuine security no
matter how fast you are patching. You
have nothing between you and a wiped disk
but Washington's spin and Microsoft's PR theater.
Listen to what these security people are saying.
They know what they are talking about.
This is important.
CAIDA's post-mortem Black Ice analysis
John Gilmore:
Date: Sun, 28 Mar 2004 16:19:45 -0800
From: John Gilmore
Subject: [E-INFRA] Colleen Shannon: [Caida] witty worm writeup available
Sender: [email protected]
To: [email protected], [email protected]
CAIDA's analysis of the "Witty" worm from two weeks ago is
frightening. It was targeted to hit a particular vendor's firewall
product. The worm came out one day after the vulnerability was
disclosed and patched. Within 10 seconds it had spread to 110 hosts.
Within 45 minutes, it had compromised almost all of the vulnerable
machines on the Internet. As a destructive worm, it gradually
disabled its hosts (by periodically writing garbage to a random spot
on disk). If instead it had been a stealth 'bot', it would now have
about 12,000 machines ready to do its creator's bidding – the entire vulnerable population.
(If it had been targeting more numerous Linux, BSD, or Microsoft
systems, it would have spread as quickly, or more quickly.)
Worms are now able to propagate MUCH faster than humans can react to stop them. They can be released MUCH faster than humans can install patches. In short, the patch-and-pray model can't prevent massive-scale attacks from succeeding (and using the resources of the attacked machines for any other purpose).
This worm, along with others, validates the thesis from the seminal
2002 security paper, "How to 0wn the Internet in Your Spare Time" by Stuart Staniford, Vern Paxson, and Nicholas Weaver. For that, see:
http://www.icir.org/vern/papers/cdc-usenix-sec02/
This has policy implications at many levels, from software development, to security analysis, to infrastructure defense.
John
