Ethics and computer security

The highly succesfull bagle worm was capable of being removed remotely.

From f-secure http://www.f-secure.com/v-descs/bagle.shtml

"Remote Removal
F-Secure can confirm that the remote removal method found by Joe Stewart of Lurhq does indeed work.
Sending a specific byte sequence to port 6777 on the infected computers causes the worm to delete itself from the System Directory and terminate its process. The registry values are not removed but since the file does not exist Windows will ignore those.
The byte sequence to be sent:
0x43 0xff 0xff 0xff 0x00 0x00 0x00 0x00 0x04 0x31 0x32 0x00
Please note that the usage of this method agains someone else's computers might be legally questionable."

F-Secure notes above that using this method is legally questionable when run against someone elses computer. Putting aside the legality of this method (although anyone who has worked in "cyber" law please comment) I am curious if the community thinks the method is morally acceptable.

i could see going in remotely and removing the worm being questionable, because you would be gaining access.
but how is sending a specific 'byte sequence' to a certain port questionable or "gaining access"? its basically no different than pinging another machine, you're just doing it with a certain byte sequence, or at least thats what i understood from readin that.
maybe i'm missing something.

Basically you should not use a remote tool against a computer that you do not own or administer.

There have been one or two of these that were badly written and caused more problems than they solved:eek:

If you wrote something like that you would be in big trouble no matter how honourable your intentions.

I don't think that it is worth the risk.

Quote:

---

F-Secure notes above that using this method is legally questionable when run against someone elses computer

---

By aknowledging that what they are doing can and could be considered illegal, then why are they doing it? what's the point, and the reverse is true, if they can remove remotely then they can also add remotely which is the principle of the idea, so they shouldn't do it without the owners approval.JMO :cool:

It depends... What protocol does it use? UDP? You're not establishing a connection, so technically you're not gaining access. If it is TCP, then you'd be establishing a connection and thus unauthorized access.

If it was UDP, the tool could simply "spoof" the src address so there would be no "proof" of who sent the sequence. (well, depending on how the ISPs routers are setup)

It's not like you're installing a tool to uninstall it. You're executing a built in command but doing so in a way that you don't connect to it?

Hmmmm,

I think we need to be a bit careful in our definitions. I would guess that such an action was not strictly "immoral" or "unethical" as the intentions are not malicious.

However, as the activity is not authorised, it could well be technically illegal, depending on your local legislation.

dalek,

The above information taken from F-Secure was their analysis of the worm. F-Secure was not remotely removing the virus. I've edited the post adding a link to the page I quoted.

Quote:

---

Originally Posted by stevel

dalek,

The above information taken from F-Secure was their analysis of the worm. F-Secure was not remotely removing the virus. I've edited the post adding a link to the page I quoted.

---

Tks for clearing that up...;)

Okay, after reading this, I would assume it's on private networks we are talking about, and if so, then admins can certainly go ahead and use it to catch any of the infected PC's on a network. Is that how it plays out, if so then the legalities are moot?

Quote:

---

Good morning.
The following forwarded message is from Joe Stewart to TH-Research (The Trojan Horses Research Mailing List).
In it Joe explains of a way for admins (or anybody really) to easily and massively remove Bagle infections from their networks.
There are other ways to do this, but this is the most simple that I saw thus far.

Thanks again to Joe for all his work.
Drop him a thank-you note if this helps you, he's a good guy!
Gadi Evron

The Trojan Horses Research Mailing List - http://ecompute.org/th-list


From: Joe Stewart <[email protected]>
To: TH-Research
Subject: [TH-research] Bagle remote uninstall
Date: Tue, 20 Jan 2004 17:19:41 -0500
Mail from Joe Stewart <[email protected]>

If you can't wait till January 28, Bagle has a remote uninstall command
which can be sent over port 6777, the port also used to upload the
second stage.
For instance, using perl and netcat, you could send the uninstall
command with the one-liner below:
perl -e 'print "\x43\xff\xff\xff\x00\x00\x00\x00\x0412\x00"' \
| nc infected_host_IP 6777
When the command bytes above are received by an infected host, the virus
will exit and delete its executable (using a batch script after the
fact). The registry keys are not removed.
-Joe

---

http://archive.cert.uni-stuttgart.de.../msg00197.html

I was thinking more along the lines of using this against a machine outside your network. For instance if your users were getting spammed with email virus from an infected machine outside of your network and the infected machine is not behind a firewall, is it acceptable to use this remote removal technique?

It is an open port with a "service" running on it. You would not be manipulating the software to function outside of its intended purpose... I'm thinking it is acceptable.

Yeah, someone else's port, service and hardware.

Check out the nachi/welachia worm if you want to see what happens when people meddle where they should not.

If it is not your equipment and your network you really don't know what on Earth is going on on it, and you would not have tested your "solution" on it. I am sure all the sysadmins here would really love someone doing that:D

I don't think the sysadms here would have an infected machine sending email worms outside their network at least not for an extended period of time. ;D

I think doing this individually and manually is perfectly acceptable. You connect to others hardware, ports and services constantly while using your PC. The worm itself was written with remote removal capabilities. You are using the software within the range of its intended purpose.

Now if you automate this process such as nachia, which also installed malware to scan for infected machines, you've gone to far.

I am sorry to have to disappoint you but it doesn't work like that. I am afraid you will just have to trust me but when an incident like that happens the stuff comes flying at you thick and fast. You honestly do not have the time or resources to do things individually and manually.

At least NOT for third parties...............you are too busy looking after those who pay your salary;)

The tool/technique cited was designed for network admins to do bulk/remote clean-ups on their own domains.

Which brings me to another point: even if it were legal where you live, you still wouldn't do it. You see you would still be liable under civil law for any damage you might cause, and, as you don't know other people's systems that would be quite possible.

You only have to look around the AV vendor's and security sites at the free tools that are on offer. They all come heavily festooned with legal disclaimers.

Anyone going out and doing things without permission would have no such protection whatsoever.:eek:

My intentions for this thread seem to have gone askew in part because of the scenario I chose as an example but more so because I was to vague. Let me pose another similar scenario.

A machine OUTSIDE of your network is aggresively scanning your network for a well known vulnerability in IIS. This is causing your log files to be more difficult to parse, perhaps setting off a large number of ids alerts or just generally being a nuisance.

You know that this scanning is typically caused by a machine that is infected with a specific worm. You also know that along with scanning for vulnerable hosts this worm connects the infected machine to an irc botnet channel.

If given the ability you could join this irc botnet channel and excecute a command that would uninstall the worm from the infected hosts, would you do it?

Nihil, I think your definition of authorized access is to narrow. If someone has a wide open ftp server with no authentication and no banner stating it is for authorized use only and I upload a large file that crashed the server, am I legally and morally responsible for the crash for using the service as it was intended?

Quote:

---

If given the ability you could join this irc botnet channel and excecute a command that would uninstall the worm from the infected hosts, would you do it?

---

no

Quote:

---

Nihil, I think your definition of authorized access is to[o] narrow.

---

You asked for opinions, but Nihil's opinion, your opinion, and my opinion are not what really counts, but the opinion of the courts in the respective jurisdictions are what really matters. Nihil is just giving you what you asked for based on his understanding about how generally the laws are written and how the courts interpret those laws.
I think Nihil's definition is based on years of study and quite possibly personal experience dealing with attorneys!

Since you restructured your question, let me try to keep it simple by posting part of a legal definition of "Authorized Access" ( taken from N.J.S.2C:20-23 )
"... An actor has authorization if a reasonable person would believe that the act was authorized.

Naturally, if there is a banner or warning posted upon accessing a system it is clear who is and is not authorized. ( A tool such as described probably would not even locate such a banner as it is using other, non-standard ports and/or protocols to access the systems. )
But just because the is no banner does not mean that someone can assume ( or reasonable believe ) they are authorized to access a system, or access a system in a why not normally intended.
Example: just because you are authorized to access google to perform searches on the Internet does not give you authorization to ssh into the server and search through their code, even if you don't disturb anything. And just because a computer is connected to the Internet does not automatically mean you can access it in any way, even to stop it from doing something that in itself is illegal ( this I believe is called vigilantism. )

You do have other recourses, including contacting the ISP of the offending computer or blocking the computer from any and all access to yours ( even if you have to create a separate rule to just drop everything from that offending computer and/or network block, and either cause your system to reduce the number of logs per attempt or not log it at all. )

This discussion has been going on for years, and the answer is always the same; you do not have the authority to attempt to clean a computer of a virus unless you are properly authorized to do so.

A more relevant question for todays state of the InternetI believe would be:
How much liability is there on the ISP of a computer that is spreading worms, virus, and/or spyware once that ISP has been notified of the illegal activity?
What time frame would be considered reasonable for the ISP to react before they could be considered at least partially liable for damages caused by continued connection of an infected computer?

"However, as the activity is not authorised, it could well be technically illegal, depending on your local legislation"

Nihil perhaps u looking for the term contra bonus mores? against the moral standard of the day.

The issue raised here, is at what time is it acceptable to open the door to a strangers house, because you have a master key. You not necessarily going inside, but hey there is a problem with the lock on the door and you want to help point that out. So legally at which stage are u a burgular/intruder/professional?

SO hey, isnt that what some real haxors are out to do? "test the realms of security of companies?"

Where is the differentiation between what security professionals are doing and haxors? i need permission to do a pen test dont i no matter what type of test? this would be the same as me tresspassing/perhaps even grey hatting, i should lose my license or quali if caught in that situation.

i thus agree with nihil, taking it further, in my case, vigilantiasm, which i akin this to, should not be permitted

For me the answer is a bit simpler. Removing an infection without telling the owner of the machine wont really do much to help you as if they got infected once they will more than likely get infected again. Where possiable you should inform the owner of the machine.