Subject: Current network/Internet is so weak...in face of Nimda-like worms

From: "Wang Hui" <[email-masked]>
Date: Fri, 20 Sep 2002 15:31:12 +0800

Hi, folks here,

Yesterday, our campus network was attacked by the Nimda worms, and the worm invoked tons of rubish network traffic as a result that our campus network got broken.  No one can enjoy the Internet any longer.   ALl the routers were overloaded, and no more bandwith was available at that time. 

From this accident, we can see the weakness of our current network.  But I wonder if in the next-generation network, we can avoid such kind of worm-attacking?

Your advice?

regards,
Wang Hui
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ignatios Souvatzis <[email-masked]>
Date: Thu, 20 Sep 2001 12:05:21 +0200

> >From this accident, we can see the weakness of our current network.  But I wonder if in the next-generation network, we can avoid such kind of worm-attacking?

Avoid using programs that are designed to forward viruses.

	-is

---

From: "Wang Hui" <[email-masked]>
Date: Fri, 20 Sep 2002 21:41:34 +0800

----- Original Message ----- 
From: "Matti Aarnio" <[email-masked]>
To: "Wang Hui" <[email-masked]>
Sent: Thursday, September 20, 2001 6:27 PM
Subject: Re: Current network/Internet is so weak...in face of Nimda-like worms

> > From: "Wang Hui" <[email-masked]>
> > To: <[email-masked]>
> > Subject: Current network/Internet is so weak...in face of Nimda-like worms
> > Date: Fri, 20 Sep 2002 15:31:12 +0800
> > Content-Type: text/plain;
> > charset="gb2312"
> > 
> > Hi, folks here,
> > 
> > Yesterday, our campus network was attacked by the Nimda worms, and the
> > worm invoked tons of rubish network traffic as a result that our campus
> > network got broken.  No one can enjoy the Internet any longer.   ALl the
> > routers were overloaded, and no more bandwith was available at that
> > time. 
> > 
> > From this accident, we can see the weakness of our current network.
> > But I wonder if in the next-generation network, we can avoid such
> > kind of worm-attacking?
> 
>    No.  Go sue Microsoft for deliberately making worm/virus
>    propagation platforms.
> 
>    Internet security is at the end-nodes, not in the network!

So I think we are also in need of making the network itself safe.   Why not make the transporting system more safe ?  I think  that simple network and complex end nodes will be a big risk in the new world.

> /Matti Aarnio

---

From: Feico Dillema <[email-masked]>
Date: Thu, 20 Sep 2001 16:20:45 +0200

On Fri, Sep 20, 2002 at 09:41:34PM +0800, Wang Hui wrote:
> So I think we are also in need of making the network itself safe.
Of course, but it does not make a difference for worm/virus type of
threats whether they are transported safely/securily or not. An
encrypted virus/worm is still a virus/worm.

> Why not make the transporting system more safe ?
Against what precisely? Of course, network integrity is important but
these worms/viruses operate at the application layer. So far, there is
no such thing as a virus/worm IP packet. However you may open up for
such if you make the network more complex/intelligent/active/whatever.

> I think  that simple network and complex end nodes will be a big risk in the new world.
Sure, but that is not solved by making the network also complex.

Feico.

---

From: "Vishwanathan K" <[email-masked]>
Date: Thu, 20 Sep 2001 20:00:28 +0530

> So I think we are also in need of making the network itself safe.   Why not make the transporting system more safe ?  I think  that simple network and complex end nodes will be a big risk in the ne…

Security policies can also be applied to the hosts within the network. But ultimately, the gateways
are responsible for security of its internal network.

On a philosphical note,this mirrors the real world. The intelligence(defense) is responsible for the security of the country.

---

From: Greg Maxwell <[email-masked]>
Date: Thu, 20 Sep 2001 10:41:34 -0400 (EDT)

> are responsible for security of its internal network.

Are are obviously from a different universe then the rest of us. In our
universe we us an incredibly flexible protocol called IP that is smart
enough to know that policy can only be truly effectively done on the
end-node and thus does it on the end node.

I don't know how you would expect a router to know that an application is
requesting a file called README.EML much less that it contains malicious
code and that IE5 will execute it without it's users knowledge, except as
an after the fact clean-up measure initated by humans.

---

From: "Vishwanathan K" <[email-masked]>
Date: Thu, 20 Sep 2001 20:31:27 +0530

> > are responsible for security of its internal network.

obviously 'virus-control' was not being implied here !!
I was referring to more of things like packet filtering, firewalling and IP security policies. which i
agree have nothing to do with detecting malicious code.

---

From: lazy <[email-masked]>
Date: Thu, 20 Sep 2001 17:29:57 -0400

> Yesterday, our campus network was attacked by the Nimda worms, and the worm invoked tons of rubish network traffic as a result that our campus network got broken.  No one can enjoy the Internet any…

Tell your users not to use Outlook, but some other
mail client. Stop running WinNT servers - they have
no advantage over to Unix solutions which tend to be
much more secure, and preform better most times.
Really, use better software and educate users on how
to be more secure users. If you must use Windows
try patching the OS and anti-virus software daily.

> >From this accident, we can see the weakness of our current network.  But I wonder if in the next-generation network, we can avoid such kind of worm-attacking?

Your network doesn't seem to really be the problem.
The real problems seem to the the software machines
on your network run.

There's nothing that can be implented into IPng that
can allow a simple blocking of worms, viruses, etc.
Maybe they can introduce a 'I am malicious' flag for
packets. But that would be a complete joke, since no
one who actually wrote worms/etc. would use it. ;)

-- 

 ..:: kill -9 `ps -U luser|grep sh|awk '{print $1}'`
 PGP: RSA 2048bit 0xB7673053 (keyserver.pgp.com)
 Web: http://packetjunkie.net  http://bsdbox.org
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------