en.wikipedia.org/wiki/Dan_Kaminsky
2 corrections found
On March 27, 2009, Kaminsky discovered that Conficker-infected hosts have a detectable signature when scanned remotely.
The remote-detection technique for Conficker was discovered by Honeynet Project researchers Tillmann Werner and Felix Leder, not by Dan Kaminsky.
Full reasoning
This sentence misattributes the discovery. The Honeynet Project page for "Know Your Enemy: Containing Conficker" lists Tillmann Werner and Felix Leder as the paper's authors and explains that the paper presents methods that "can be used to remotely detect a compromised system." The same page separately credits Dan Kaminsky for helping get the detection into scanning tools, saying that "as a result of this paper and the hard work of Dan Kaminsky, most vulnerability scanning tools (including Nmap) should now have a plugin or signatures" for remote detection.
Nmap's March 30, 2009 release announcement independently confirms the attribution, stating that the new Conficker detection was based on "new research by Tillmann Werner and Felix Leder" and that the remote detection added to Nmap was "based on new research by Tillmann Werner and Felix Leder."
So Kaminsky helped operationalize and spread the detection, but the article is incorrect to say he discovered the detectable signature himself.
2 sources
- The Honeynet Project — Know Your Enemy: Containing Conficker
Authors Tillmann Werner, Felix Leder ... The approaches presented take advantage of the way Conficker patches infected systems, which can be used to remotely detect a compromised system. In addition, as a result of this paper and the hard work of Dan Kaminsky, most vulnerability scanning tools (including Nmap) should now have a plugin or signatures...
- Nmap Development: Nmap 4.85BETA5: Now with Conficker detection!
We found out just yesterday about new research by Tillmann Werner and Felix Leder of a way to anonymously scan for Conficker worm infections ... remote detection of the Conficker worm ... is based on new research by Tillmann Werner and Felix Leder.
for showing that the Sony rootkit had infected at least 568,000 computers
Kaminsky’s Sony estimate was about networks that likely contained at least one infected machine, not a direct count of 568,000 infected computers.
Full reasoning
This overstates what Kaminsky actually showed. Quinn Norton's 2005 WIRED report on Kaminsky's analysis says his DNS-cache-snooping method pointed to the probable existence of at least one compromised machine in roughly 568,200 networks worldwide. The article explicitly adds: "This does not reflect a tally of actual infections" and explains that the method could not directly determine the number of compromised computers.
So the article is wrong to say Kaminsky showed the rootkit had infected at least 568,000 computers. What he showed was evidence consistent with roughly 568,200 networks / DNS servers having seen Sony-related queries, implying at least one infected machine on those networks, with the true computer count unknown and potentially much higher.
2 sources
- Sony Numbers Add Up to Trouble | WIRED
Using statistical sampling methods ... Kaminsky was able to trace evidence of infections in a sample that points to the probable existence of at least one compromised machine in roughly 568,200 networks worldwide. This does not reflect a tally of actual infections, however, and the real number could be much higher.
- Sony Numbers Add Up to Trouble | WIRED
While this couldn't directly give him the number of computers compromised by Sony, it provided him the number and location ... of networks that contained compromised computers.