Worm for Testing Purposes?

P.S.

You may be right that there is no such thing. I thought I might find one on
a security website, but quite a bit of searching before I posted here turned
up zilch. I guess people fear such a thing would be turned to a destructive
purposes - as some people here seemed to assume. And perhaps too that
someone using it to test their own setup would not know enough to pull the
cord to the internet.

Mike

"FromTheRafters" <erratic @nomail.afraid.org> wrote in message
news:%(E-Mail Removed)...
> "dubya" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Hello\,
>>
>> Does anyone know of a non-destructive, safe worm - one that doesn't do
>> anything but propagate and is easy to remove - that I can use for testing
>> in small networks?
>
> There's no such thing, but there are things that come close.
>
> You probably need to find another way of accomplishing what you want, but
> 'what you want' isn't exactly clear in your post
>
> Are you intending to study the worm, or are you trying to test a network?
>

"dubya" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>
> "FromTheRafters" <erratic @nomail.afraid.org> wrote in message
> news:%(E-Mail Removed)...
>> "dubya" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> Hello\,
>>>
>>> Does anyone know of a non-destructive, safe worm - one that doesn't
>>> do anything but propagate and is easy to remove - that I can use for
>>> testing in small networks?
>>
>> There's no such thing, but there are things that come close.
>>
>> You probably need to find another way of accomplishing what you want,
>> but 'what you want' isn't exactly clear in your post
>>
>> Are you intending to study the worm, or are you trying to test a
>> network?
> Sorry for the lack of clarity. Test the network. A mix of virtual
> machines and hosts with various firewalls or lack thereof. I just
> want to see what it gets through and what it doesn't. Nothing will be
> connected to any public networks, so no risk to public bandwidth.

True worms are generally dependent upon software vulnerabilities. The
only test worms I know about are historical in nature, and were written
for historical exploits of historical vulnerabilities. Google Fred Cohen
and read some of his papers on viruses (many of what were called viruses
then were actually worms in retrospect now that worms are better
defined). Part of the reproductive function of his test virus asked the
user for permission to infect IIRC - something any self-respecting true
worm wouldn't dream of doing.

You could concieveably install the necessary vulnerabilities (retrograde
your patches for instance) to provide an environment that supports a
particular kind of worm (like CodeRed or Sapphire) - but what would be
the point then, as you wouldn't actually be testing the network.

....as for playing with worms, that might work, but it could be
dangerous.

There are basline security analyzers and vulnerability scanners out
there. It is those things that actually support true network worms, the
networking aspect is what networks are *supposed* to do. It is usually a
vulnerability that allows the parent to ensure its progeny is executed,
and this is what separates true worms from viruses.

By "no such thing", I was referring to your request:

"...a non-destructive, safe worm - one that doesn't do anything but
propagate..."

To be *safe* it must do *more* than just propagate - it must set serious
restrictions on itself. )

"dubya" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> P.S.
>
> You may be right that there is no such thing. I thought I might find
> one on a security website, but quite a bit of searching before I
> posted here turned up zilch. I guess people fear such a thing would be
> turned to a destructive purposes - as some people here seemed to
> assume. And perhaps too that someone using it to test their own setup
> would not know enough to pull the cord to the internet.
>
> Mike
>
> "FromTheRafters" <erratic @nomail.afraid.org> wrote in message
> news:%(E-Mail Removed)...
>> "dubya" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> Hello\,
>>>
>>> Does anyone know of a non-destructive, safe worm - one that doesn't
>>> do anything but propagate and is easy to remove - that I can use for
>>> testing in small networks?
>>
>> There's no such thing, but there are things that come close.
>>
>> You probably need to find another way of accomplishing what you want,
>> but 'what you want' isn't exactly clear in your post
>>
>> Are you intending to study the worm, or are you trying to test a
>> network?
>>
>
>

In article <(E-Mail Removed)>,
"dubya" <(E-Mail Removed)> wrote:

> Hello\,
>
> Does anyone know of a non-destructive, safe worm - one that doesn't do
> anything but propagate and is easy to remove - that I can use for testing in
> small networks?
>
> Thanks!
>
> Mike

Be careful, if you let your worm hang out you'll get arrested.