Eugene H. Spafford researches computer security and analyzed the computer worm that disrupted Internet systems in November 1988. His technical report reconstructed the program's behavior using independent reverse-compilations and a disassembly, connecting observed failures with weaknesses in the affected systems.[ref]
The Internet Worm Program: An Analysis by Eugene H. Spafford. Primary title-page byline and Abstract, incident and evidence used in the analysis
The historical program copied itself between vulnerable machines running versions of Unix. Its disruption illustrates a security failure involving computation and connectivity, even without defining the event solely by altered user files. Spafford's analysis treated program behavior, system assumptions and possible mitigations as related parts of the explanation.[ref]
The Internet Worm Program: An Analysis by Eugene H. Spafford. Abstract, propagation, disruption and review of security flaws
An original resource model separates stored-data correctness from service availability. Suppose legitimate work requires 25 percent of a CPU's capacity, and each unwanted running copy requires another two percent. Twenty copies demand of capacity; 40 demand . In this stipulated model, the latter demand exceeds what that CPU can supply, so some work must wait or fail. No changed document is required for users to lose timely service. These invented loads are an explanatory model, not measurements of the 1988 incident.
Reconstructing what a computer program did therefore supports a more precise security claim than merely observing that a machine became slow. The tested resource and the evidence for the failure mechanism must both be stated.
Articles by others on the same topic
There are currently no matching articles.