Dante's Inferno

To be honest I have never struggled so hard to write something. I can write a fairly decent quality ten page conference paper (having done the research) in two to three days. Writing this seems to be far slower. I keep finding other projects to which I can meaningfully contribute to make myself feel competent. We affectionately call this WABing for Work Avoidance Behavior. I will get around to blogging some of the great, completely non-thesis related ideas I have implemented. In the past I have pushed myself to the point of requiring medical intervention, most notably while on the SRC last year. At the moment however, I struggle writing for more than a couple of hours and end up feeling absolutely awful about myself. I find with a confusing mix of inadequacy, a need for perfection and feelings that the task is too big. Worse still, I am stuck in our quiet university town with nobody here and will be missing out on new year celebrations.

Luckily I have some great friends, a wonderful girlfriend and a supportive family.

I found a kindred spirit in the thesis writing blog and some great advice in Stop Procrastinating and Complete your Dissertation (also see Procrastination & Time Management). Then there is always the great PhD (Piled High and Deeper) comics. However, the best advice by far is in Dr. Tucker-Ladd's chapter on Procrastination, it spoke to me.

As an aside, congratulations to Yusuf who has handed in his completed thesis already.

Aaw, I'm just whining, some people have real problems.

UPDATE: Serendipity went mad on the HTML for this one, it managed to break my atom feed. All fixed.

I have been writing my thesis and am trying to come up with some a priori reasons as to why vendors releasing patches in certain ways will have certain effects.

The bit of research I have just cooked up seems to indicate that for software which has a large community of users likely to get involved in the testing of patches, it makes more sense to release a detailed advisory and patch as soon as possible, instead of keeping it to yourself and releasing a patch when it is ready. This is still a very early version and is changing rapidly, please treat it as such.

I don't want to flood things with large images, so click on the graphs for a larger version.

It seems attacks are maturing. Instead of wide-scale mass penetrations, attackers appear to be going for targeted and specific penetrations. This is backed up by several sources. Sophos' 2005 Report, Message Labs 2005 Report⁽¹⁾ and a warning from holy_father, author of the Hacker Defender rootkit.

There are several advantages to a targeted hack:

• The intrusion is less obvious. Attack detection is pretty poor, especially amoung home users, there is less chance of the attack being noticed.
• The results are more manageable. Attackers don't need a million credit card numbers when several hundred will do.
• General information about the attack is less useful. Sharing information about the attack with the wider community is less useful. This is most obvious with signature based products such as IDS and anti-virus, which are less likely to get a sample of the attack to create a signature, and the resulting signature is too specific.

Both Sophos and MessageLabs reports indicate that these sorts of attacks are on the risk. While, holy_father's tool indicates how easy it is to make anti-virus researchers run a loosing signature creation race. Given the large number of variations of existing malware; Netsky, Sober and Bagle in particular, just creating signatures for each variant seems silly. The old whitelist vs blacklist debate. Hacker Defender's premium solutions demonstrate this, you pay for a customised rootkit, thus on the off chance it is detected the resulting signature is only effective against the one customised version.

This isn't a new type of attack. Skilled attackers generally use a very targeted attack. This indicated that the threat's attack methods are maturing and getting better as a general trend. Pretty scary. This also means that threat monitoring with services such as DSHIELD and Snort become less useful, so we know even less about potential threats.

I have believed for a while, that there is too much of a focus on script kiddie attacks, mostly because they are visible. There is no public research into skilled threats. The little there is, is mostly sensationalised e.g. Titan Rain.

A worm exploiting the MS05-051 Windows Distributed Transaction Coordinator vulnerability has been released. The first variant was crippled, but it appears a fixed one has been released. F-Secure has done the footwork on this with the help of malware samples from the ISC. Both worms are using the exploit code released by Swan on Dec 1st. They are calling it Dasher. The ISC thinks this is what has been responsible for the spike in port 1025 activity.

Dasher.A, Dasher.B, Dasher.C

The now-typical rapid variation of malware is occuring. Dasher.C is out with an anti-anti-malware payload, probally more to come.

Patch, firewall port 1025, update anti-virus, monitor (snort sigs).

update: added link to snort rules
update: added link to dasher.c