Peter Huang
03/02/03, 22:54
Abstract:
On January 25, 2003, the SQL Slammer worm (w2.SQLSlammer.worm), also known
as Sapphire (F-Secure), w32.SQLexp.worm (Symantec), and Helkern
(Kaspersky) fully exploited known vulnerabilities in Microsoft SQL 2000
servers and caused tremendous network jam around the world. In this
article, the concept of population biology is proposed to apply to the
computer programming. The concept is to diversify the same software
functionality with a population of executables to avoid being eliminated
or exploited by a virus or worm like SQL Slammer.
---------------------------------------------------------------------------
-
In biology, it is a known fact that a species with a diverse population is
less likely to be extinct than a species with a "cloned" population under
selection pressure. It is one of important reasons why we want to keep the
biodiversity, I believe.
What the SQL Slammer has exploited during the last weekend exposed not
only the vulnerabilities in Microsoft SQL 2000 but also the
vulnerabilities in the normal delivery methods of software package. A
normal software package contains the same documents, the same executable
files. In other words, the package is just copied or "cloned" without
diversity. What just had happened taught us a lesson about the importance
of diversity in computing world as well, I think.
If we study the SQL Slammer worm in assembly language
(http://www.eeye.com/html/Research/Flash/sapphire.txt) carefully, we will
realize how selective or "laser-guided" this worm is. If the population of
the SQL 2000 server executable had been diversified, then the impact of
the SQL Slammer would have been much less noticeable.
So, I propose the concept of installation time linking to diversify the
same software functionality with a population of executables. In other
worlds, different executables have the same functions.
Installation Time Linking Of Object Files Into An Executable
The concept of the installation time linking is that it enables the
executable to be randomly laid out (including the Import Address Table
abused by the SQL Slammer). Functionally speaking, the executable image #1
and image #2 listed above in Figure 1 are the same even though the layouts
are different. Therefore, if a program like the SQL Slammer is targeting a
special executable program, it will lose its effectiveness on another
executable because of different image layout or addresses, (unfortunately
it might crash the application).
The disadvantage of this technique is that it requires more customers'
support if the software has problems. It might become more difficult for
the vendors to patch or provide so-called service packages, (well a
service package just simply overwrites existing files or adds new ones
currently, right?).
If this concept goes further, then the operating system does the dynamic
linking of libraries or object files in a randomized order as well to
diversify further.
Whether this concept is practical or not remains to be seen.
---------------------------------------------------------------------------
-
For the article with the figure 1, please visit
http://members.rogers.com/yinrong/articles/PopulationComputing.pdf
Thank you and have a nice day.
Peter Huang
http://members.rogers.com/yinrong
On January 25, 2003, the SQL Slammer worm (w2.SQLSlammer.worm), also known
as Sapphire (F-Secure), w32.SQLexp.worm (Symantec), and Helkern
(Kaspersky) fully exploited known vulnerabilities in Microsoft SQL 2000
servers and caused tremendous network jam around the world. In this
article, the concept of population biology is proposed to apply to the
computer programming. The concept is to diversify the same software
functionality with a population of executables to avoid being eliminated
or exploited by a virus or worm like SQL Slammer.
---------------------------------------------------------------------------
-
In biology, it is a known fact that a species with a diverse population is
less likely to be extinct than a species with a "cloned" population under
selection pressure. It is one of important reasons why we want to keep the
biodiversity, I believe.
What the SQL Slammer has exploited during the last weekend exposed not
only the vulnerabilities in Microsoft SQL 2000 but also the
vulnerabilities in the normal delivery methods of software package. A
normal software package contains the same documents, the same executable
files. In other words, the package is just copied or "cloned" without
diversity. What just had happened taught us a lesson about the importance
of diversity in computing world as well, I think.
If we study the SQL Slammer worm in assembly language
(http://www.eeye.com/html/Research/Flash/sapphire.txt) carefully, we will
realize how selective or "laser-guided" this worm is. If the population of
the SQL 2000 server executable had been diversified, then the impact of
the SQL Slammer would have been much less noticeable.
So, I propose the concept of installation time linking to diversify the
same software functionality with a population of executables. In other
worlds, different executables have the same functions.
Installation Time Linking Of Object Files Into An Executable
The concept of the installation time linking is that it enables the
executable to be randomly laid out (including the Import Address Table
abused by the SQL Slammer). Functionally speaking, the executable image #1
and image #2 listed above in Figure 1 are the same even though the layouts
are different. Therefore, if a program like the SQL Slammer is targeting a
special executable program, it will lose its effectiveness on another
executable because of different image layout or addresses, (unfortunately
it might crash the application).
The disadvantage of this technique is that it requires more customers'
support if the software has problems. It might become more difficult for
the vendors to patch or provide so-called service packages, (well a
service package just simply overwrites existing files or adds new ones
currently, right?).
If this concept goes further, then the operating system does the dynamic
linking of libraries or object files in a randomized order as well to
diversify further.
Whether this concept is practical or not remains to be seen.
---------------------------------------------------------------------------
-
For the article with the figure 1, please visit
http://members.rogers.com/yinrong/articles/PopulationComputing.pdf
Thank you and have a nice day.
Peter Huang
http://members.rogers.com/yinrong