Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Malware :: bt912.txt

msblast.d and a review of defensive worms

As many people have undoubtably already seen, the newest variant of
msblast (dubbed msblast.d, see
LAST.D) is one of a growing group of "good/defensive worms."  

As every previous "good" worm has, this will of course touch off another
debate on just how bad worms of this variety are.  Coincidentally
(really!) I have been polishing a presentation on defensive worms I will
be giving at Toorcon.  Since the historical portion of my presentation
has become so timely, I've put up that first portion of my presentation
on the web for anyone interested to review.  

It is directly linked at, no
registration of any kind is required to read.  If you have any errata or
additional references, feel free to e-mail me privately and I will
incorporate them.

Here is also the list of references from this presentation for anyone
who just wants to go directly to the source material and skip my fluff:

1. Stansell-Gamm, Martha.  "Good Worms Not Mature", May 26, 2003. 
2. Vision, Max. "Origin and Brief Analysis of the Millennium Worm",
Sept, 1999.
3. Poulsen, Kevin. "Max Vision: FBI pawn?", May 8, 2001.  
4. Mixter. "mw06.tgz", September 23, 1999. 
5. Barber, Bryan. "Cheese Worm: Pros and Cons of a Friendly Worm", July
21, 2001.  
6. Hexxer, Der. "CodeGreen beta release", September 1, 2001.
7. Kem, Marcus. "", September 1, 2001. 
8. Permeh, Ryan & Coddington, Dale. "Decoding and Understanding Internet
Worms", November 21, 2001. 
9. Houle, Kevin. Quoted in "Cheese worm: A Linux fixer-upper? By Robert
Lemos", May 16, 2001.  
10. Hartmann, Joe. Quoted in "'Cheesy' Fix-It Worm Patches Security
Flaws By Jay Lyman", May 18, 2001.
11. Russell, Ryan. "Re: Mitigating some of the effects of the Code Red
worm", July 20, 2001.
12. Dyck, Timothy. "Thanks, but we don't want your Cheese (worm)!", June
30, 2001.
13. Rapoza, Jim. "Up With Good Worms", April 21, 2003.


David J. Meltzer   
CTO, Intrusec, Inc.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH