OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Full-Disclosure] Re: Asynchronous, industry-wide virus naming scheme proposed

From: Feher Tamas (etomcatfreemail.hu)
Date: Thu Oct 02 2003 - 09:06:17 CDT


Hello,

>Interesting post... one thing tho, those root "VNS" servers will
>instantly be the target of DDoS attack by the virus writers...

As the root-VNS server need not serve end users, only the vendor-VNS
and maybe vendor-reseller-VNS servers, they could drop any packet
not coming from trusted IP addesses or just use data transmit line that
are not part of the internet.

Protecting vendor-VNS servers against DDoS is up to each AV-vendor,
e.g. they could rent massive capacity at Akamai.net or other huge
datapipe provide. FYIF, McAfee (NAI) already uses Akamai to distribute
its virus signature database updates.

>But I think its a problem that has a non-technological
>solution, if any solution is possible.

Indeed my proposal may be way over-complicated, but I do feel virus
naming must be technology-assisted. Else it will never be uniform and
crackers will reign over the confusion, while innocent, hex-illiterate
computer users continue to suck.

Sincerely: Tamas Feher.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html