Summer 2003 will sadly remain famous for netsurfers because of the propagation of an Internet worm known as MSBlast, which infected millions of hosts running Microsoft Windows. This event is far from unique; other worms such as Slammer, Code Red, Nimda have similarly wreaked havoc in the past.
The goal of these roaming computer entities is to autonomously reproduce themselves on every reachable system on the Internet, resulting in ongoing problems with computer security.
The human tendency to use the same types of systems and applications, correlated to a kind of Darwinism theory for computer "monoculture", could have some security experts fear the widespread destruction of a given family of systems connected to Internet if an especially malicious new Internet worm were to appear. What would have happened if the recent worm MSBlast had formatted the hard drives of millions of infected Windows machines? It didn't, but it could have very easily.
As computer attacks evolve, new responses are essential.
This paper will evaluate the usefulness of using honeypots to fight Internet worms. The first part of the article will discuss some background information on worms and their ubiquity, then move on to discuss some of the interesting interactive functions of honeypots. Finally, we will study how a honeypot framework can be used to fight off Internet worms and even perform a counterattack, before we conclude with some future perspectives.
1.0 Introduction to Internet worms
Simply put, an Internet worm corresponds to mischievous code that spreads itself over networks [ref 1]. This dreaded entity usually attacks vulnerable hosts, infects them, and then uses them as means to bounce or propagate to other vulnerable targets.
Most of the time, worms are written and developed by computer hackers, researchers in the security field and virus authors. While viruses infections are essentially based on problems of abusing human vulnerabilities through social engineering, such as encouraging a user to click on an email attachment, Internet worms usually abuse technical vulnerabilities.
From the old functional standpoint from Edward Amoroso [ref 2], there are three primary actions of an Internet worm:
Infection : infect a target by exploiting a vulnerability.
Payload : launch malicious actions on the local infected target or toward others remote hosts.
Propagation : use the infected target as means for external propagation.
continue at.. SecurityFocus
