The problem is with using a counterattack technique to stop a worm is that it is effectively equivelent to quarrantining known infected machines.

David Moore, Colleen Shannon, Geoffrey Voelker and Stefan Savage, have an excellent analysis of how to respond/contain self propigating code on the Internet.
http://charlotte.ucsd.edu/users/savage/papers/Infocom03.pdf

It turns out that identifying/removing infected machines is not an effective response strategy unless you are really hyper-sensitive. What is needed is identifying the infection and blocking the INFECTION from spreading to new machines.

Additionally, counterattack to stop unknown threats (which nimda in the first few hours was) requires automatic systems to identify and respond, which may be suseptible to spoofing. Someone I don't like? I fake a scan from his machine to your counterattacking network range.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17606#17606