Mobile Contagion: Simulation of Infection and Defense

Abstract

For worms with known signatures, properly configured firewalls can prevent infection of a network from the outside. However, as several recent worms have shown, portable computers provide worms with an entry point into such networks, since these computers are connected behind the firewall. Once inside, the firewall provides no protection against the worm's further spread. Wireless networks are particularly dangerous in this regard, as the act of connection is often invisible, and improperly configured wireless networks allows anyone within radio range to connect. In this paper, we use real data on a large-scale wireless deployment to analyze the speed with which a worm could spread if it used only this propagation vector. We discuss several possible solutions and provide analysis on how much protection those solutions would provide.