Friday, June 30, 2006

Poison against Poison

There's a Chinese saying: "use poison against poison."  We can use this method to combat computer virus and worms.  What virus and worms do is to exploit discovered bugs or weaknesses in software.  When bugs are first discovered, software companies are usually quick to make patches to fix it, but not everyone gets the patch, or get in time.  To prevent discovered bugs being exploited in malicious code, we can send a benevolent worm that just exploit this weakness but at the same time patch the host machine first.  To maximize the good and minimize the bad of this "poison", here are the rules:

1. upon infection, the code will patch first
2. then make a limited effort to infect the next 0-N vulnerable machines (this step is optional)
3. inform the user that the machine has been saved from potential catastrophic disaster, and provide further information to allow users educate themselves
4. ask users if they would like to contribute their idle computer power to patch other computers (including their friends), just like looking for ET signals
5. if yes, they can configure the rescue effort
6. if no, the code provides the option to remove itself
7. there should be a federation of these codes, so they use resources in an orderly manner and according to regulations.  A URL is embodied in the code to allow users to validate its authenticity on the federation official website.

Inspired by the article German Court Convicts Sasser Worm Creator


No comments: