Worms could slip through detection nets
Future worms may be able to slip through the early warning networks deployed by the likes of SANS Internet Storm Center and Symantec, researchers from the University of Wisconsin said last week.
But experts from Internet Storm Center and Symantec discounted the impact of the researchers' proposed evasion tactics. In an award-winning paper presented last week at the Usenix Security Conference, three computer scientists from the University of Wisconsin-Madison said that attackers could launch a widespread probe of the internet, then use the publicly-available data of the detection networks to identify individual sensors.
A worm that encodes those IP addresses could conceivably sneak through the early warning networks, which are used by government and private enterprise to warn of unusual activity or developing attacks.
The whole purpose of these networks -- which include the one maintained by the SANS' Internet Storm Center and Symantec's DeepSight Threat Network -- could be undermined.
"The danger is to the service that these systems provide," said John Bethencourt, the researcher who presented the paper. "They now provide a useful service, but an attack like we outline could make them no longer useful."
