Copyright Silicon Defense Worm Overview Stuart Staniford Silicon Defense

Copyright Silicon Defense There will Always be Vulnerabilities Murphy’s Law, the fitness of evolving species and the limits of software reliability. R. Brady, R. Anderson, and R. Ball Paper: Shows that under continued random testing at constant rate, vulnerabilities decline at rate 1/t. In some sense, testing finds the fewest possible vulnerabilities that will get the software past the test. Software size is probably growing faster than t! So there will always be worms…

Copyright Silicon Defense Code Red Spread

Copyright Silicon Defense Theory of Random Scanning Worms a = e vS(t-T) /(1+e vS(t-T) ) a is proportion infected t is time Gives sigmoidal graph centered on T 1/vS is time to increase by factor e. v is vulnerability density (8x10 -5 for CRI, 1% would be really big) S is effective scan rate (~6Hz for CRI, ~10kHz for Slammer on well connected networks. Probably get to 50kHz for TCP scans)

Copyright Silicon Defense Sapphire/Slammer 170 Gbps!

Copyright Silicon Defense Enterprise environment Where the real damage can be done –Many companies control critical equipment Firewalls: –Worms often get in, but few starts –Nimda style dedicated firewall crossing function Enterprise address space consists of disjoint smaller pieces (eg two class B nets) –Worm has to find them –Random IP address very unlikely to be in net –Slows it down

Copyright Silicon Defense Subnet scanning Differentially choose a destination address near the source address Code Red II: Choose a random address from –Class B: p = 3/8 –Class A: p = 1/2 –Internet: p = 1/8 Worm can exploit pieces of network it finds Code Red II proportions not optimal

Copyright Silicon Defense Optimal Class B search (v = 0.1%)

Copyright Silicon Defense Optimal Class B search proportion

Copyright Silicon Defense Flash Worm Also theory: due to Silicon Defense Scan all vulnerable servers first Build a map of worm spread Optimize map for routing picture (BGP) Launch worm Worm carries address map with it Limited by bandwidth Tens of seconds to saturation on Internet 100ms to saturate on internal network Topological Worms are similar –Use information on host instead of precomputed map –Slower, less efficient than flash but no prep Flash/Topological not reliably containable at present

Copyright Silicon Defense Worm Containment: Goal Epidemic Threshold: E(Number of Children) < 1 Bad! Good ? Sum(i=0,infinity,a i ) = 1/(1-a) a<1

Copyright Silicon Defense Worm Containment Approaches Host based vs Network based For scanning worms –Block scans –Anything that will block scans will do in principle –HP, IBM, Silicon Defense have dedicated technology –Epidemic threshold = an average scan sees < 1.0 vulnerable machines

Copyright Silicon Defense Basic Facts of Life with Worms Spread faster than any human response –Signatures need not apply Cannot reliably detect novel worm on the first connection through us –Detect unknown badness in arbitrary app. data –Just as hard as getting applications right Depend instead on correlating multiple wormlike anomalies to get reliable detect Doesn’t work well inbound - need outbound Need complete deployment

Copyright Silicon Defense Inbound vs Outbound Containment This is why we need complete deployment to contain - otherwise just lowering v (slowing things down but not containing them).

Copyright Silicon Defense CounterMalice approach Inline device in network Divide network into cells Filters out scans (doesn’t handle Flash etc) Contacting many destinations is odd Contacting many dead destinations is odder If can cut off after T scans, then… E(C) = TvP N < 1

Copyright Silicon Defense Containment Simulation