Re: Self updating worms?

[Blue Boar <BlueBoar () thievco com>]

Oded H wrote:

> There is a clear benefit for the bad guys espcially if we are talking
> about organized crime to have a self updating worm, simply because although
> they dont want to leave a trail they would like to get some exclusive
> access to a victom host. Adding some defence (i.e. patch) to the vulnerability
> on which their worm arrived is a step at that direction.

You don't need "worm" bits (attack vectors) to maintain a botnet, you 
only need those to grow one.  If someone sells off a fixed set of 1000 
zombies, they probably don't want the customer competing with them for 
new bots.  In fact, the seller would probably be quite happy that there 
is a natural attrition of the bot set, so they can sell more to the same 
buyer later.

Assuming of course that the builders and users of botnets are mutually 
exclusive sets.

                                                BB
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave