merry samhain everyone

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > merry samhain everyone

Sham bam bamina!: Nov 6, 2012; ƨtupid cat

General malware thoughts...(kinda long sorry)

I have a question for people, I have seen many worms come out with some interesting ideas for getting inside peoples machines. But every time a post mortem begins I see two comments in every one. In almost every single case programming mistakes handicaps the worm. Either it makes to much noise and is easily detectible or it shoots itself in the foot like this one. Does anyone here remember the Samhain Project? For those who do not the idea was a worm that propagates itself and hides in different locations that updates other instances of the worm when it contacts them. If some part of the worm gets cracked you patch it and it will update all other versions. If you try to analyze a file from the worm and it deletes itself. My point here is that we have not seen a really dangerous worm yet. But how long before we will see one that will bring parts of the Internet to its knees? Side note and disclaimer, I personally don�t believe that it is possible for even the Samhain worm to completely shut down the Internet. The major ISP�s would adopt the close everything then open read only port scheme first. I have been amazed that to date there has been no major outbreak of a worm that has not been really dangerous first. Now there is two ways to look at this. The poorly crafted worms are being made this way deliberately to force companies to fix what could be a major security issue before some armature gets lucky, or that writing a good worm is a lot harder then it should be. Now I don�t code (yet) so I can�t say how hard it should be but if what I read from the Samhain project is correct if any code slinger was crazy enough (or mad enough at the world) to put one out there the Internet would have a serious hurt on for a while. But this discussion touches on part of this issue. Are people putting out deliberately flawed attack code or has the world just been incredibly lucky so far? Why has there never been a small, cross platform, self-updating, morphing, invisible, independent, worm in the wild? There have certainly been enough people out there who would love the credit for it. Or who would like to see the havoc it could cause.

Thoughts ??