1. Copyright Silicon Defense 2003. Worm Overview Stuart Staniford Silicon Defense www.silicondefense.com

2. Copyright Silicon Defense 2003. There will Always be Vulnerabilities Murphy’s Law, the fitness of evolving species and the limits of software reliability. R. Brady, R. Anderson, and R. Ball Paper: Shows that under continued random testing at constant rate, vulnerabilities decline at rate 1/t. In some sense, testing finds the fewest possible vulnerabilities that will get the software past the test. Software size is probably growing faster than t! So there will always be worms…

3. Copyright Silicon Defense 2003. Code Red Spread

4. Copyright Silicon Defense 2003. Theory of Random Scanning Worms a = e vS(t-T) /(1+e vS(t-T) ) a is proportion infected t is time Gives sigmoidal graph centered on T 1/vS is time to increase by factor e. v is vulnerability density (8x10 -5 for CRI, 1% would be really big) S is effective scan rate (~6Hz for CRI, ~10kHz for Slammer on well connected networks. Probably get to 50kHz for TCP scans)

5. Copyright Silicon Defense 2003. Sapphire/Slammer 170 Gbps!

6. Copyright Silicon Defense 2003. Enterprise environment Where the real damage can be done –Many companies control critical equipment Firewalls: –Worms often get in, but few starts –Nimda style dedicated firewall crossing function Enterprise address space consists of disjoint smaller pieces (eg two class B nets) –Worm has to find them –Random IP address very unlikely to be in net –Slows it down

7. Copyright Silicon Defense 2003. Subnet scanning Differentially choose a destination address near the source address Code Red II: Choose a random address from –Class B: p = 3/8 –Class A: p = 1/2 –Internet: p = 1/8 Worm can exploit pieces of network it finds Code Red II proportions not optimal

8. Copyright Silicon Defense 2003. Optimal Class B search (v = 0.1%)

9. Copyright Silicon Defense 2003. Optimal Class B search proportion

10. Copyright Silicon Defense 2003. Flash Worm Also theory: due to Silicon Defense Scan all vulnerable servers first Build a map of worm spread Optimize map for routing picture (BGP) Launch worm Worm carries address map with it Limited by bandwidth Tens of seconds to saturation on Internet 100ms to saturate on internal network Topological Worms are similar –Use information on host instead of precomputed map –Slower, less efficient than flash but no prep Flash/Topological not reliably containable at present

11. Copyright Silicon Defense 2003. Worm Containment: Goal Epidemic Threshold: E(Number of Children) < 1 Bad! Good ? Sum(i=0,infinity,a i ) = 1/(1-a) a<1

12. Copyright Silicon Defense 2003. Worm Containment Approaches Host based vs Network based For scanning worms –Block scans –Anything that will block scans will do in principle –HP, IBM, Silicon Defense have dedicated technology –Epidemic threshold = an average scan sees < 1.0 vulnerable machines

13. Copyright Silicon Defense 2003. Basic Facts of Life with Worms Spread faster than any human response –Signatures need not apply Cannot reliably detect novel worm on the first connection through us –Detect unknown badness in arbitrary app. data –Just as hard as getting applications right Depend instead on correlating multiple wormlike anomalies to get reliable detect Doesn’t work well inbound - need outbound Need complete deployment

14. Copyright Silicon Defense 2003. Inbound vs Outbound Containment This is why we need complete deployment to contain - otherwise just lowering v (slowing things down but not containing them).

15. Copyright Silicon Defense 2003. CounterMalice approach Inline device in network Divide network into cells Filters out scans (doesn’t handle Flash etc) Contacting many destinations is odd Contacting many dead destinations is odder If can cut off after T scans, then… E(C) = TvP N < 1

16. Copyright Silicon Defense 2003. Containment Simulation