Sunday, August 17, 2003

Hunter/Killer Anti-Virus

I wonder why hunter/killer anti-viruses are not more prevalent in today's environment. They are as technologically feasible as any worm or virus, yet we don't hear enough about this potential boon to internet security. Here's how the concept works...

White-hat hackers (that same group that finds exploits and reports them to manufacturers) would participate in the creation of "beneficial" worms. These worms would seek out vulnerable computers in the same way malicious worms do; however, when a vulnerable system is found, the beneficial worm would patch that system in a way that does not allow the malicious worm to penetrate the system. In addition to performing the patch, the beneficial worm would try to spread itself to other vulnerable systems (using the same methodology as malicious worms), but only until a particular expiry date had arrived, or until no such vulnerable system could be located - whichever came first.

Some may say that a worm is a worm is a worm, and that "white-hats" should be allowed no more freedom to infect your system than "black-hats". In principle, I agree. But sometimes, a well-intentioned intervention, while not appreciated at the time, is the best long-term solution.

For people running Windows software, the windows update service offers a means of applying patches before things get out of hand. It's a mystery to me why more people don't run it more often. It's also a mystery why users don't take advantage of the automatic application of patches, so staying protected becomes a no-brainer.

No comments: