Nematodes and Blackworm

A couple of comments on recent events.

First up, at the Blackat Federal briefings (recently concluded), Imunity Sec maestro Davie Aitel presented on his Nematode idea again. I saw this at Hack In The Box 2005 (one of the best conferences I've ever been to), and have made comments previously. Dave's been getting some press traction with the idea, and I've been asked to comment. I still stand against the idea of a beneficial worm.

Secondly, the Blackworm has spread and is set to destroy your files this Friday, February 3. Note that a great consortium of people have come together to help notify customers that they are infected. Thanks to the cooperation of the ISP who is hosting the CGI counter to show how many infected hosts there are, various groups in industry and government are working to help prevent a massive problem. The Blackworm is known by many names by various vendors, but it's all the same thing. Note that this is one of the better efforts at this in the past, and unlike some worm outbreaks, this one doesn't consume insane amounts of bandwidth (ie by spewing scan traffic). This is the evolution of security approaches and efforts and represents a good step forward.