Every single thing you say here is wrong.
For one, Mullen does not talk about random hack-backs. His Blackhat presentation was the best of the entire conference. He convinced many people, some in my agency, that this is actually viable. There is alot of talk about it internally.

If you research a bit, you will see that a 3 way handshake, required for CR and Nimda, cannot be easily spoofed. Machines attacking with Nimda or CR are easily identifiable. Mullen's technique also leaves the system fully functional- this amazed me. He uses the worm code against itself to stop it from attacking other boxes. Nothing else is effected. He demo'd it.

I firmly believe that this process will be utilized in the future.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/98/16091#16091