Periodically someone comes up with the “good” idea to use a computer virus as a means to immunize security problems. Here is the latest: Viral cure could ‘immunise’ the internet. At the surface it sounds like a wonderful idea to utilize infection vectors to apply patches then continue on to the next machine. Using the same path a worm takes to close security holes even sounds clever and each time it is proposed there is a new twist. This time around the twist involves using honeypots.
They propose developing a network of “honeypot” computers, distributed across the internet and dedicated to the task of combating viruses. To a virus, these machines would seem like ordinary vulnerable computers. But the honeypots would attract a virus, analyse it automatically, and then distribute a countermeasure.
A honeypot is simply a host that masquerades as a vulnerable computer on the network. It fakes security holes in order to collect data on attackers. This application intends to automate the application of fixes for the attacks across the network.
The problem is that this assumes the honeypots are able to provide an appropriate fix for the security hole and propagate that fix to all of the vulnerable hosts on its network. The justification for this approach is:
Simulations show that the larger the network grows, the more efficient this scheme should be. For example, if a network has 50,000 nodes (computers), and just 0.4% of those are honeypots, just 5% of the network will be infected before the immune system halts the virus, assuming the fix works properly. But, a 200-million-node network – with the same proportion of honeypots – should see just 0.001% of machines get infected.
If you were paying attention you may have noticed that excerpt includes the words assuming the fix works properly. Thats a big assumption.
Assuming this works out properly, there is also the added issue of how the honeypots will distribute the intended fix to the network.
Security measures, such as encryption, would be needed to prevent viruses from exploiting the honeypot network.
Since they assume multiple machines on the network, for the math to work out acceptably, you must have the honeypots talk to each other. Encrypted or not this exposes another infection vector, the difference is this one is extraordinary tempting. Instead of possibly infecting a handful of machines with a worm, attacking the honeypots potentially exposes the entire network of machines.
Since the honeypots must be able to distribute patches to clients, they could be used to distribute the worm. Only this time around it’s your trusted network guardians that are doing the dirty work.
More discussion on the topic, from someone more authoritative than myself can be found on Bruce Schneier’s blog: