mailing list archives
msblast.d and a review of defensive worms
From: "David J. Meltzer" <djm () intrusec com>
Date: Mon, 18 Aug 2003 13:42:29 -0400
As many people have undoubtably already seen, the newest variant of
msblast (dubbed msblast.d, see
LAST.D) is one of a growing group of "good/defensive worms."
As every previous "good" worm has, this will of course touch off another
debate on just how bad worms of this variety are. Coincidentally
(really!) I have been polishing a presentation on defensive worms I will
be giving at Toorcon. Since the historical portion of my presentation
has become so timely, I've put up that first portion of my presentation
on the web for anyone interested to review.
It is directly linked at http://www.intrusec.com/resources.html, no
registration of any kind is required to read. If you have any errata or
additional references, feel free to e-mail me privately and I will
Here is also the list of references from this presentation for anyone
who just wants to go directly to the source material and skip my fluff:
1. Stansell-Gamm, Martha. "Good Worms Not Mature", May 26, 2003.
2. Vision, Max. "Origin and Brief Analysis of the Millennium Worm",
3. Poulsen, Kevin. "Max Vision: FBI pawn?", May 8, 2001.
4. Mixter. "mw06.tgz", September 23, 1999.
5. Barber, Bryan. "Cheese Worm: Pros and Cons of a Friendly Worm", July
6. Hexxer, Der. "CodeGreen beta release", September 1, 2001.
7. Kem, Marcus. "CRClean.zip", September 1, 2001.
8. Permeh, Ryan & Coddington, Dale. "Decoding and Understanding Internet
Worms", November 21, 2001.
9. Houle, Kevin. Quoted in "Cheese worm: A Linux fixer-upper? By Robert
Lemos", May 16, 2001.
10. Hartmann, Joe. Quoted in "'Cheesy' Fix-It Worm Patches Security
Flaws By Jay Lyman", May 18, 2001.
11. Russell, Ryan. "Re: Mitigating some of the effects of the Code Red
worm", July 20, 2001.
12. Dyck, Timothy. "Thanks, but we don't want your Cheese (worm)!", June
13. Rapoza, Jim. "Up With Good Worms", April 21, 2003.
David J. Meltzer
djm () intrusec com
CTO, Intrusec, Inc.
- msblast.d and a review of defensive worms David J. Meltzer (Aug 18)