Printable View
Why are all viriis bad? Can't virus makers create a exploit-patch-virus? A virus that come into a computer and patch the exploit without doing any bad things like install a trojan. If it were someone who got the loveletter and modified it with a outlook-patch, then the loveletter (the original) didn't do so much damage. So all nice computer programmers, start make friendly viriis!!!!!
Someone did attempt to do this. I think it was around the time Code Red or Nimda came out. I believe he/she got into some pretty deep **** for doing it too. I'll check around and see if I can find more info.
Cheers:
well...you might call symantec live update a friendly trojan...it can connect to the internet without your knowledge..(ok you have to tell it to...but after that...you won't know...) it updates itself and other programs and files...all without your knowledge...
windows update too...
both could easily do bad things...and hmmm...maybe do.......hehe
I did find some Info. on a Virus which was called the "Cheese Worm". This worm/virus attempted to fix/patch systems which were infected with the "Lion Worm". The Anti-Virus community(vendors) were not that impressed and believed sending one virus out to attack another was not the correct method for fighting Viruses. You can find more information HERE and HERE
Cheers:
The worm you were referrring to was known as code green. It actually used the same exploit as code red but would download the fix for it. I kinda wish they would have let it run a little more, even months later our gateways are still pounded by servers infected with code red...kinda sad commentary on how many people are dilligent with their server security...
Neb
Quote:
Originally posted here by nebulus200
The worm you were referrring to was known as code green. It actually used the same exploit as code red but would download the fix for it. I kinda wish they would have let it run a little more, even months later our gateways are still pounded by servers infected with code red...kinda sad commentary on how many people are dilligent with their server security...
Neb
Well that got me looking again, I think we're both wrong, I think (hey, I could be wrong again) it was Code Blue Here's some Info on it.
Thanks Neb.
Cheers:
Code blue was a response to code red. Code red supposidly was a chinese worm that only attacked 'english' or 'american' web sites. Code blue was a response that attacked only chinese ones...or at least that is what I remember. And that code green was the one that fixed them. I remember seeing it on security focus when it all came out...
neb
i've actually been thinking of that for a while. it would be an interesting job to write. you try to take all of the virus info and put it into one roving "doctor" not necessarily a trojan. i have a feeling that the virus companies would block it to avoid losing the customers to a free antivirus.
Well I think the reason that people would not agree to having good viruses is that they won't have actual control of their system. If for example, I have a vulnerability in my machine and a good virus comes and fix it, I would not be that impressed still because I did not approve of it coming and fixing my machine. Even if it fix it, the fact that I was not aware of it is the bad thing.
While the motivation for writing a "good virus" is at root an attempt to be help and keep systems safe the author is still has to use some sort of exploit in order to get into the system to apply the patch. Most companies would still consider this an attack, especially if it uses the same tactics of the Code Red, Blue, etc.
...especially considering the fact that a lot of IDS's out there are looking at protocol violations as an attack on the network. Just because the "virus" would be doing something "good", the program would still be violating a protocol's RFC and therefor would be blocked.
I think Neb is right, Code Green fixed the problems that both Code Red and Code Blue made.
As for making a 'friendly' virus, it really isn't a very popular idea, people that write them think that destroying things is more fun that building them, and in some ways it is, but helping the poor saps that get hit with those virii wouldn't be a bad idea if somebody had the time and skills...I'm learning but I still can't write any lengthy programs that work. :(
There is a good book put out by SANS on this, I will try to find out what the title is...
Found it: Intrusion Signatures and Analysis, Stephen Northcutt, et.al, New Riders, Indianapolis, Indiana, ISBN 0-7357-106305
Kind of dry reading at times, but I found it fairly informative...and it is pretty much what you are asking for...
Neb
The problem with that is that it still causes many of the same problems that destructive virii do. It will still clog networks looking for things to fix.
Virilli writers keep peter noton in new shoes.And with out the trojan and virilli writer's finding the expliots every one would be in deep poopoo,wouldnt ya think?Theres good and bad in all things.The last new p/c i bought had the Backweb server on it ,as most new p/cs do ,so the manufacturer can do "Auto" updates And allow a person to get online techhelp. I disable all those and remove Backweb as soon as I get a new system.We are at a time on the net when we wont have complete control over what we say or view online,so why let someone "update our systems "when its easier to do manualy.
but when you think about it, who really does have much control or understanding of their machines. even most techies don't don't but scratch the serface of their operating system or hardware. there's just too much. more often then not we're at the mercy of our own machines.Quote:
Well I think the reason that people would not agree to having good viruses is that they won't have actual control of their system
i think that good viruses would be a great idea, but most people who write viruses do so becase they have no regard for other peoples property. luckily, most people who are inclined to write viruses aren't smart enough to do anything worse then a vb script.