Re: question about misusing protocol

From: "fatemeh kazemeiny" <[email protected]>
>  I have some questions.
>  Can a worm change Gnutella protocol packets, or use them for spreading? 
>  How do P2P worms spread? Do they use P2P protocol packets or only their behavior is like P2P traffic?
>  Thank you for your answer in advanced
>  Regards

ANY serious P2P protocol like Gnutella contains all the technical features that a worm would like to help its spreading : 
* a host discovery mechanism for finding new infection candidates
* a host registration mechanism for collecting the list of infected hosts and avoid multiple infections, and spread first to the uninfected ones
* a file distribution mechanism for downloading/uploading the worm code
* a proxying mechanism that helps hiding the true source of the first infection

Gnutella can be used both as a target for worms, but also as a tool to help worm writers hiding their path, and to remove the dependency of a single point of failure for controling the worm propagation.

This is not specific to Gnutella. True Gnutella providers can help in the fight against worms, by finding ways to avoid the spread of worms:
* interfacing the servent with anantivirus or an external base of known viral file signatures
* allowing users to remove any undesirable contents from the shared files, and to add filters to the message that the servent are proxying to other servents.