A Failure to Learn from the Past Presented by Chad Frommeyer CSC 493/593 Professors Charles E. Frank/James Walden

Introduction Internet Worm and its Behavior Consequences to the Creator/Originator Resulting actions taken What have we learned?

Internet Worm October, 1988 Internet Contained 60,000 hosts Worm attack affected (5%- 10%) Infection lasted 3-4 days Only Unix based systems affected

Internet Worms -- Terms Worm – Independent program that can replicate itself Virus – Code that requires a host, and cannot run independently Malware – Malicious Software

Inernet Worm -- Operation Fingerd – Buffer Overflow (C-Language gets() – altering fingerd functionality Sendmail – DEBUG options exploit allowed execution of commands Password discovery Identify Trusted Machines Cleanup after Execution Chronology

Consequences Author Robert T Morris No Prison, 400 Hours Community Service Fine of $13,776 Suspended from graduate studies at Cornell Malicious Intent not proven Ultimately received Ph.D from Harvard, and is currently an associate professor at MIT. Adequate?

Resulting Actions CERT (Computer Emergency Response Team) Central switchboard for computer emergencies on ARPAnet and MILnet Not enough?

What have we learned? Software Flaws Incident Response Laws and Ethics

Learned? (Software Flaws) 95% of reported malware is against Microsoft Trust Relationships –Software –Hardware –Personal Buffer Overflows Default Configurations

Learned? (Incident Response) CERT/CC Delayed Communications Not Comprehensive What communication is good enough?

Laws and Ethics Fewer than a dozen people convicted Expensive/Difficult to Investigate Lack of Tools/Expertise Lack of Foreign Laws Lack of international cooperation

Conclusion Punishment not adequate – Needed precedence Awareness needs to be heightened Software processes need to recognize lack of expertise Security should be a priority to product management