RE: Self updating worms?

[Dave Aitel <dave () immunitysec com>]

On Thu, 2004-09-09 at 16:18, Anton A. Chuvakin wrote:
> > Frankly, I'm surprised this hasn't already been implemented many times
> > over...
> I'd buy what Gadi Evron said over that. Why update a worm leaving a trail
> if you can make a new one? Resilient and untraceable worm update mechanism
> is a cool idea, but there might be no business case for it :-) in the
> realm of retail worms. Now, if you are talking custom stuff ... who knows.

I think the business case is there. Immunity has a lot of research (see
Advanced Ordnance slides) going into multi-headed worms and transports
and such. Not all hosts vulnerable to your new exploit are reachable
from other hosts vulnerable to your new exploit - you want to just feed
the exploit into the mill and see what comes out.

-dave


_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave