Microsoft is moving to counter some scathing comments regarding a security paper authored by researchers at its Cambridge, England, facility.
The paper, "Sampling Strategies for Epidemic-Style Information Dissemination," looks at how worms sometimes inefficiently spread their code.
The research explores how a more efficient method could, for example, be used for distributing patches or other software. The advantage would be that patches could be distributed from PC to PC, rather than from a central server.
That method would reduce the load on a server, and patches would be distributed faster. But the patches would have the same qualities as a computer worm, a generally malicious file.
Since a story about the paper appeared on Thursday in the New Scientist magazine, the paper has been roundly assailed.
"This is a stupid idea," wrote Bruce Schneier, a security expert, author and CTO of enterprise security vendor BT Counterpane, on Tuesday, before quoting a passage from the New Scientist story on his blog.
Schneier wrote that the idea of so-called "benevolent worms" comes up every few years.
However, a worm is designed to run without the consent of a user, which doesn't make it a good method of software distribution, Schneier wrote. The worm patching technique could also make the patches hard to uninstall or interrupt during installation, he wrote.
Worms designed to distribute software patches could also be hacked to distribute malicious software, wrote Randy Abrams, director of education for security vendor Eset, in his regular e-mail commentary.
Forced patching is also troublesome since some patches may not be compatible with critical software, Abrams wrote.
"Breaking into computers is a bad idea," Abrams said.
A Microsoft spokesman said on Monday that the New Scientist story is not inaccurate. However, the writer of the story "sexed" up the research paper a bit, particularly with the headline that used the phrase "friendly worms," the spokesman said.
In response to the criticism, Microsoft said it doesn't intend to develop patch worms.
"This was not the primary scenario targeted for this research," according to a statement.
The company also said it will continue to let customers decide how and when they apply security updates.
One of the paper's authors, Milan Vojnovic, said in a statement that there were no plans to incorporate the ideas into Microsoft's products. Efforts to reach Vojnovic for comment were unsuccessful.
Read up on the latest ideas and technologies from companies that sell hardware, software and services. Taking On Demand CRM Integration to the Next Level
Business Intelligence and Enterprise Performance Management: Trends for Emerging Businesses
Solve Exchange Mailbox Storage Issues Once and for All
Discover the advantages of an open architecture multi-vendor network solution
IT Service Management Needs and Adoption Trends: An Analysis of a Global Survey of IT Executives
How to improve employee productivity in small and medium businesses
Refresh your AUP: Top tips to ensure your acceptable use policy is fit for purpose
Email Archiving 101—Customer Case Study
Zones provide focussed content from Computerworld and leading technology partners.Discover how SOA can create smarter outcomes for your business.
Attend and learn:
- How SOA is helping leading companies to become more agile
- Where you should be applying SOA processes in your company
- The top SOA implementation mistakes to avoid
Click here for more information.
- +
Computerworld Live Podcast #97: The Future of Enterprise Networking 25/07/2008 09:45:36
This week CW Live chats with Mark Thompson, global sales and marketing manager for HP ProCurve, on the future of the enterprise networking. Mark discusses the trends we can expect to see in the near future and how the right infrastructure can ensure your enterprise network is secure. - +
Computerworld Live Podcast #96: Security at the Edge 11/06/2008 09:22:22
CW Live speaks with Amol Mitra, HP ProCurve Director of Marketing for Asia Pacific and Japan. Today's topic: how enterprises are starting to shift away from simply controlling security via server logins, firewalls and moving to more adaptive security frameworks. - +
Data Management Edition #10: Multi-Petascale Systems 02/05/2008 09:12:33
This week we look at sustainability and the development of multicore technologies to build multi-petascale systems. - +
IT Security Edition #11: How to poison the Storm botnet 01/05/2008 08:51:55
This week CW Live presents a case study on how to poison the notorious Storm botnet . Plus we take a look at Cisco's plans for Ironport. - +
IT Security Edition #10: Cyber-battles fought and won 24/04/2008 11:09:47
Vendors bow to end user pressure to improve product security, and we take a look at the latest concepts shaping the cyber-battlefield of the future.
Fortinet November Threatscape Report Shows Calm Before Holiday Storm 2008-12-05 16:00:00+11
Epicor® Cited as an Order Management Solutions Leader by Independent Research Firm 2008-12-05 15:52:00+11
F-Secure: Growth In Internet Crime Calls For Growth In Punishment 2008-12-05 13:00:00+11
International researchers gather in Sydney to preview the clever web 2008-12-05 09:48:00+11
Borderless corporate networks to shift focus to secure content management in Australia in 2009 2008-12-04 16:06:00+11
Best Practice in Building an Integrated Information Management Strategy
Discover the business value that creating an integrated information platform can bring. Learn how to provide consistent, accurate information to all stakeholders within your business network. Integrate vital data from disparate sources and deliver a trusted information foundation. Read on to uncover the stepping-stones to your new information management strategy.












