RE: MacOSX worm

Nick Fitzgerald wrote:

> As a possibly interesting point of "cultural difference", while I'll 
> accept your claim about "security folks", I'll note that 
> among the sub-
> group of those with whom I'm much more familiar -- antivirus 
> researchers -- the main distinction in Vess' definition, although not 
> necessarily the full definition, is by far the majority view.

Yes.  "Worms", however defined, have interested groups of people (including
me) from IDS or networking backgrounds who weren't previously all that
interested in viruses.  Because, as you note, worms are not immediately
amenable to traditional file-scanning AV approaches, but various NIDS and
HIDS techniques are extendable towards a solution.  Network researchers got
interested because (like DDOS), worms were a source of interesting and
problematic traffic on networks.

The malware itself doesn't to be very interested in respecting any
boundaries :-)  (Eg Nimda clearly did both virus-like things and worm-like
things).

Stuart.