Secure Systems Editor: S.W. Smith, [email protected] How to Win an Evolutionary Arms Race ust about every computer user today is engaged in an McAfee makes a mistake with a virus signature, it could disable or even evolutionary arms race with virus writers, spam dis- delete legitimate users’ applications (legitimate applications have already tributors, organized criminals, and other individuals been disabled by virus scanners; see http://news.com.com/2100-7350 attempting to co-opt the Internet for their own pur- -5361660.html). If Microsoft makes J a mistake, numerous machines poses. These adversaries are numerous, adaptable, persistent, and might no longer even boot. The time between vulnerability disclo- ANIL SOMAYAJI unscrupulous. They’re creating in- able way to communicate and col- sure and exploit distribution is some- Carleton dependent agents—mobile pro- laborate, we must adopt another, times only a few days. If software de- University grams—that, once released, take on perhaps radically different, model for velopers haven’t been previously lives of their own. Their attacks are securing our computers. notified, there’s little chance that becoming more sophisticated every To better understand this conclu- they can release a well-tested fix in day, and the situation will likely be- sion, we should first re-examine why this time frame. Further, with fast- come much worse unless we, as de- developers and users are embracing propagating worms and viruses, fenders, take drastic steps. automated update systems. antivirus developers must play catch- We can’t hope to completely de- up: Malware can infect thousands of feat all our attackers. For every indi- Faster, machines before the causative agent vidual we arrest, every worm we easier updates is even identified. successfully eradicate, another virus Automated update mechanisms are So, while automated update sys- writer and his or her program will designed to solve one simple prob- tems solve one problem (available propagate on the Internet. In an evo- lem: humans can’t be counted on to updates not being distributed), they lutionary arms race, the best we can download and install anything in a don’t address the more fundamental hope for is to stay in the game no timely fashion. Home users forget to problem—developing and testing matter how the adversaries change update their systems (if they know to those updates. Although antivirus and adapt. This game is ultimately do it at all), and administrators developers have automated the sig- one of survival, and so far, our com- already have too much to do. Yet, nature creation and testing process puters aren’t very good at playing it malicious code can spread across the somewhat, they’re hampered in their on their own. Internet in minutes. Thus, software quest to detect zero-day worms by To keep up with malware writers, companies such as Microsoft, Sy- concerns over false positives. Soft- software producers in both the com- mantec, and Red Hat have created ware patches can potentially stop mercial and open-source software systems that remind users to initiate novel viruses and worms. However, worlds have adopted various auto- automated update processes or that patches must still be developed man- matic software update mechanisms. bypass the user completely and install ually, and because they’re complex Some of these mechanisms distrib- necessary updates on their own. and intrusive, they’re likely to cause ute updates after requesting a user’s To date, almost every virus or problems. Corporate IT depart- permission; others install updates au- worm epidemic has exploited a se- ments have traditionally required tomatically. Although such systems curity vulnerability for which there extensive internal testing of any up- provide some short-term relief, they was an existing software patch or dates before deployment precisely will likely soon become ineffective, virus signature. However, before because of these types of issues. Un- and further, they will also become software developers can distribute a fortunately, because of the frequency extremely dangerous once they are fix, they must identify the problem, and urgency of updates, corpora- inevitably co-opted by attackers. If craft a solution, and test that solution tions no longer have this luxury. we want the Internet to remain a vi- to ensure no untoward side effects. If Although the current situation 70 PUBLISHED BY THE IEEE COMPUTER SOCIETY ■ 1540-7993/04/$20.00 © 2004 IEEE ■ IEEE SECURITY & PRIVACY Secure Systems isn’t good, things could conceivably out help from modern medical sci- All animals evolve over time. become much worse. What if at- ence. To be sure, the human body Those better able to survive and re- tackers discovered new vulnerabili- has formidable perimeter defenses produce pass on their genes, and ties once a day? Once an hour? Once such as skin, mucous membranes, those who can’t adapt are eliminated. a minute? Malware developers can and stomach acid. These barriers are The opposition is also evolving, achieve such a rate of discovery by complemented by a complex im- though, and they do so much more working in parallel and automating mune system, part of which is adept rapidly. Humans reproduce every 20 vulnerability discovery and exploita- at handling most common threats years, but bacteria can reproduce tion. Because developers must ex- (the “innate” immune system), and every 20 minutes. tensively test each update to ensure an adaptive system that can handle Given such numerous and that it doesn’t break existing func- most other invaders. Even with these adaptable foes, it would seem that tionality, they can’t deploy fixes at formidable defenses, though, people all large animals, including humans, the same rapid rate. In the long run, still get sick, and many die of disease. should have become extinct long developers won’t be able keep up Furthermore, new threats constantly ago. Fortunately, nature has devised with attackers as long as they’re re- arise that defeat old defenses: Bacte- strategies that balance the scales by quired to respond to each vulnera- ria develop antibiotic resistance, and ensuring that we don’t give bility as it’s discovered. viruses such as HIV emerge that our pathogens a “stationary target.” In Several technologies exist, such immune systems can’t defeat. particular, we’ve survived using as nonexecutable stacks and anom- Despite the magnitude of these three basic moves: sex, death, and aly-based intrusion prevention sys- threats, our bodies go to extraordi- speciation. Confused? Well, con- tems, that promise to prevent nary lengths to preserve genome in- sider the following. exploits without signatures or soft- tegrity. Germ-line cells—those that ware patches. Many of these systems eventually form eggs and sperm— Sexual reproduction have considerable merit. Experi- are segregated during early embry- Many researchers have observed that ence teaches us, however, that onic development. The DNA in diverse populations are more resistant attackers can circumvent or even di- many of our immune-system cells to infection than populations of simi- rectly exploit such systems. Software changes in response to various lar individuals. Less well appreciated is patches, of course, can be created to pathogens we’re exposed to, but we the fact that the primary mechanism fix specific limitations, but then pass none of these changes to the animals use to generate and preserve we’re back where we started. next generation. Such “code conser- such diversity is sexual reproduction. We’re faced with adversaries that vatism” has probably arisen because Using a systematic mechanism for se- can potentially deploy attacks faster our genomes are rather fragile: Du- lecting and combining “code” from than we can deploy defenses, even if plicated or deleted chromosomes two parents to create offspring, ani- we use automated update systems. frequently cause severe birth defects, mals can create novel variants without Advanced defense technologies can and even a one-letter (single nu- resorting to random code changes. help, but because they’re imperfect cleotide) mutation in a critical sec- Code segments, or DNA, that are and therefore vulnerable to exploita- tion of an embryo’s DNA can cause a particularly fragile tend to be identical tion, they don’t change the overall miscarriage. Bacteria can tolerate in both parents, so the recombination balance of power. Is there anything large-scale changes in their ge- process won’t perturb these parts. On we can do, then, to even the scales— nomes—they can lose entire genetic the other hand, differences between to play this evolutionary game so that subsystems (plasmids) and acquire the parents are chosen randomly and we have a chance to keep up? How animals We’re faced with adversaries that can play the game Although our computer systems are potentially deploy attacks faster than we new at this game, living organisms have been fighting such battles for can deploy defenses, even if we use millions of years. In particular, large animals such as humans face a threat automated update systems. environment analogous to that our computer systems face. Our ances- new ones from other bacteria or the passed on to the child. Sex produces tors survived in a world filled with external environment. The com- such diversity that—except for iden- numerous pathogens such as bacte- plexity of most animal genomes tical siblings—no two individuals ria, viruses, and parasites—all with- seems to preclude such flexibility. born have ever had the same genome. www.computer.org/security/ ■ IEEE SECURITY & PRIVACY 71 Secure Systems Preprogrammed death painfully obvious: It’s simply much software diversity and obfuscation2,3 Although we might not like it, death more likely that new programs has been somewhat successful in is a useful and probably necessary evo- with novel functionality will arise achieving this goal.