From Julie Bort, one of the Microsoft Subnet editors: Microsoft researcher and mathematician Jennifer Tour Chayes set her skills on studying the best patch defense against mutating worms. She concluded that the fastest way to bring this insidious infection to a halt is to patch nodes that are most connected to others, even if those nodes are not exhibiting signs of infection. News reports such as this story in Science News hailed her research. But I thought her conclusions sounded absurdly obvious. It might be a cool mathematical exercise to model a mutating worm and show how patching key nodes works better than running around the country patching individual infected machines. But did the typical network engineer need a Microsoft researcher to study and conclude this? Is there a better way to fend off the mutating worm threat? These were the questions I asked of Jun Li, Assistant Professor in the Department of Computer and Information Science, University of Oregon and his student Cameron Hertel. Li directs the Network Security Research Laboratory (NETSEC). NETSEC has been studying self-propagating, mutating worms of late. He and Hertel answered my question: Are Chayes conclusions rather obvious? Hertel replied:
Yes, this is the obvious conclusion. If I administer an enterprise network with 1000 hosts, and each of them connects to a proxy for browsing the Internet, of course I would patch the proxy first, especially since it is a crucial backbone of the network.
But Lee added that he questions Chaye’s results altogether:
I find myself in disagreement with the so called “obvious” solution of patching the nodes that are the most topologically connected. These nodes are not necessarily the “hub” for the propagation of a worm. (Think about a topological worm or simply just a random scanning worm). It is true that a worm’s traffic probably go through them to reach others, but a worm does not have to affect such nodes to get propagated.”
What then, is a better way to address worms? Hertel says:
Make the default privileges of the system very low. Windows XP and previous versions were hit very hard with malware because most users always ran the OS in an escalated privilege level. Vista has taken steps to diminish this (the whole access control thing: Some action is being performed, Accept or Reject), and the Linux/UNIX variants already have operated under this mindset since the beginning (which one can see in the much lower number of worm infections in those operating systems).
OK, most network engineers may also be aware enough to have set their users’ default privileges low. What more can be done? A critical step is to detect fast moving, self-propagating worms as soon as possible after they are unleashed. And so NETSEC has created SWORD (Self-propagating Worm Observation and Rapid Detection). SWORD identifies the behaviors self-propagating worms must engage in to keep their infection moving. They claim it is one of the first systems to base worm detection on essential behaviors, rather than on analyzing byte patterns or looking for signatures of specific worms. (Think of this as anti-spam technology applied to mutating worm detection.) During initial tests of SWORD, the detection system had a remarkable 100% accuracy rating, and can detect a worm only after it infects a very small number of hosts inside a network, the researchers say. Now, it’s true that such amazing results happened in a lab setting. Nevertheless, it’s encouraging to see that researchers are getting faster at detecting worms. So, what of Lee’s concern that patching the physical hubs first wasn’t the best approach? He says:
imo, these nodes are the best place for applying detection solutions, which is where we apply our SWORD prototype system.
Such a detection system can help identify where the worm has actually set up its command post from which it is self-propagating. Then that command post can be patched first or taken offline. If self-mutating worms can be discovered within seconds to minutes after being unleashed, or only after a very small number of infection attempts, then (as everyone knows) when patches are quickly applied, damage can be minimized and, perhaps, halted completely.
