Researchers Tout New Network Worm Weapon

coondoggie writes "Can Internet worms be thwarted within minutes of their infection? Researchers at Ohio State University believe they can. The key, researchers found, is for software to monitor the number of scans that machines on a network send out. When a machine starts sending out too many scans — a sign that it has been infected — administrators should take it off line and check it for viruses. In a nutshell, the researchers developed a model that calculated the probability that a virus would spread, depending on the maximum number of scans allowed before a machine was taken off line.'The difficulty was figuring out how many scans were too many,' researchers said."

Neat

[Zironic]

One of the hardest things to account for when it comes to setting the limit for the number of scans a computer can resonably make must be bittorrent, a computer actively seeding files through bittorrent might connect to hundreds of computers for each file.

I suppose the admin of a corperate network will probably frown on active bittorrent use in general though.

Re:Neat

[zappepcs]

It's not the corporate network where this will be problematic. It is TimeWarner and Comcast. Remember the recent story about MediaDefender? Assumptions about scans are just that. As soon as this methodology is implemented, worms will scan much slower. After all, a virus/worm author normally has some time to build the botnet before they want to activate it. Nothing really depends on quick proliferation except damaging worms.

IMO, it is the botnets that do the most damage as a collective thing. Stopping a worm that bricks your machine is not hard LOL, stopping one that bricks other machines is good. Stopping DDoS attacks is even MORE important. It is the attack for hire model of hacking that really sucks bad.

If the botnet owner takes a few months to build the botnet, it is still a botnet. Even better if s/he hides data in video packets or VoIP or IM packets.

The only real way that I can see to stop the damage is to have 99.9999%+ computers in the world running in a sandbox where the perimeter monitors everything that the user software is doing. So, even if the corporate network is functioning like a sandbox (as it already should be) the danger from worms forming botnets is still a threat, this merely lessens the threat of a quickly spreading/created botnet/worm.

Re:

[Yath]

Can we stop using the term "brick" in reference to something that merely makes a system unbootable?

Merely? M E R E L Y ????

[Anonymous Coward]

I'm betting that you have never been in a hurry but had to buy a new copy of Windows to replace the OEM version that just was FUBAR by a virus or malicious piece of software, or perhaps even by a malignant end user who knows far too much about the delete command and far too little about the windows and system directories.

Unbootable does NOT even begin to describe what you have on your hands. Brick, on the other hand, gets kind of close and conveys the proper frame of mind when you have experienced that kind

Re:

[Anonymous Coward]

"Brick" means not revivable except possibly with special equipment that nobody has (an eprom programmer for example). What you describe is nowhere near that, it is only a temporary inconvenience.

Re:

[Bryansix]

No Brick is like when the virus ups the voltage on the motherboard and literally ignites the processor on fire. THAT is a brick. It's not coming back and would better serve as a building material then a computer.

Re:Merely? M E R E L Y ????

[Yetihehe]

And this is the way "hacker" word lost its meaning.

I, for one, love this "brick" terminology

[Christophotron]

I love it when stupid people believe their hardware is "bricked" and throw it away. It really sucks for the environment, though; I can't get to every old PC before it ends up in the local landfill. It *is* a serious problem, but that doesn't mean I can't benefit from it occasionally. It's a guilty pleasure.

I scour the local dumpsters for computers (college dorm room dumpsters on move-out day are a freakin' gold mine), reinstall the OS, and do some good with them. Or just fix them and sell them back to

Anti-DDoS TCP/IP additions?

[Mathinker]

> Stopping DDoS attacks is even MORE important.

What if a "you're DoS-ing me" reply packet was added to TCP/IP, which could be picked up at the ISP level and would (ideally) cause the ISP to throttle that user's bandwidth to the site in question for a short period of time?

The problem with this kind of hacked-on solution is that it often causes other vulnerabilities --- in this case, what if the botnet was set up to spread faked "you're DoS-ing me" packets? One could hope that ISPs would filter such outgoi

Re:

[MagicM]

Something like this? ICMP Source Quench [wikipedia.org]

Re:

[Mathinker]

Thanks for the info!

Yes, something like that, but designed for malicious overloading. But as I said, it would have to be enforced at the hardware modem level or the ISP level for it to be effective. Along with similar measures against packets with forged headers (so the replies actually return to the abuser).

Maybe someday!

Re:

[deroby]

In theory, worms simply don't have 'months' to spread, because, in theory, a vulnerability is detected and fixed within a short time-span, hence, the worm needs to abuse it as much as possible in the shortest time possible, right !?

In practice off course :
* there are vulnerabilities that nobody (except the abuser) knows about and hence 'spreading slowly' is fine too
* exploits are only created AFTER they have been identified (see "script kiddies") and rely upon people that are too uneducated/lazy/slow/dumb/p

Re:

[redxxx]

The main question here is IMHO : what do they mean with SCANS ? Are those (failed) connections that do not get ACK's back ? I'm pretty sure most P2P traffic would be able to cause false alerts, and although the network admin wouldn't be too happy to have bittorrent or emule on a machine (different from his own =), I can tell you that eg Skype can't be missed anymore where I work.

This runs over a network right? Between ARP poisoning, MAC address spoofing, and promiscuous tcp/ip, wouldn't it be pretty easy to obfuscate which computer is doing the scanning? They can just dump whatever packets they want onto the network, and see the responses.

It would still show that some computer on the network is being naughty, but is should be easy to hide which computer it actually is.

Not that it won't help somewhat, but it's just another step in the arms race.

That word brick...

[Joce640k]

I don't think it means what you think it means.

Re:

[Vectronic]

Although, this may work for a University/College, or business network (to a signifigant degree at least) where someone can physically go to the computer and check it out, or at least momentarily take it offline and tell it to scan/scan it...

But, I dont see how this would work (such as you mentioned BitTorrent, et al) for the 'public' unless ISP's starting DoS-ing their customers, or sending them direct messages...

Suspicious Amount Of Traffic Detected, Disconnect From Internet?
(Cancel) (Allow)

Which would mea

Re:Neat

[moderatorrater]

They were looking at 10,000 scans, which would be about how much I would expect my constantly-on bittorrent to do over the course of a week or more. I don't think it'll be a problem at that threshold.

At lower thresholds (which they'll surely need since worms and viruses will just start scanning more slowly), they can start analyzing patterns and individual packets. This won't solve the problem overnight, but it will eliminate virtually all worms and viruses in the wild right now and make future worms and viruses propagate much more slowly.

If I am in a position of authority over a network,

[patio11]

...blocking Bittorrent isn't a bug, it is a feature.

Re:

[Stewie241]

Don't know if you were joking or not (you were modded funny), but I wish I could easily block bittorrent traffic with my netgear router, or at least throttle it. I share my connection with tenants in our house, and it would be great to be able to limit their bandwidth rather than telling them not to use bittorrent.

Re:

[Redwin]

I can't access the paper to check, but I think it is the same paper I read when it first came out in 2005 (search scholar.google.com for "Collaborative Internet worm containment"). They gave a possible fix for p2p traffic at least by examining the number of unique connections made over a long period of time (say 1 month). If 10,000 unique connections were made within the course of the one month time frame the threshold would be breached. If I remember correctly they found out that the average user who uses

Well?

[Anonymous Coward]

Can useless messages be moderated within minutes of their posting?

Re:

[ATMD]

Sure. You set up a system to detect increased levels of slashdotting, which indicates that people have given up looking at imbecilic comments like this one and actually gone to RTFA.

Re:

[ELProphet]

They could, if I didn't just waste my mod points by commenting in a thread I just modded... crap!

iPhones

[Enderandrew]

Don't iPhones send out an insane number of scans per minute? Isn't that why Duke University banned them from their network, and how that couple had a $3,000 data charge bill from taking their iPhone on a cruise, even though they didn't use it?

Re:

[tlhIngan]

Don't iPhones send out an insane number of scans per minute? Isn't that why Duke University banned them from their network, and how that couple had a $3,000 data charge bill from taking their iPhone on a cruise, even though they didn't use it?

Not really.

The reason Duke had to ban them was because the way they did their WiFi somehow clashed with the way Duke's WiFi network was set up. The end result was that a small concentration of iPhones managed to actually take down the WiFi network by consuming inordina

Re:

[superdave80]

Sorry, you must be new here. Car analogies are the only acceptable analogy on /.

Re:

[kcbanner]

But my UID Yours

Re:

[Dachannien]

I can explain how this works with a simple cat analogy!

You mean.... like this? [icanhascheezburger.com]

SOP - Standard operating procedure

[bernywork]

Network admins quite often scan large amount of network space especially for vulnerabilities, I know, I do it every day. Device discovery on networks for monitoring, IP address management, the list goes on.

There is the alternative though...

http://xkcd.com/416/ [xkcd.com]

Re:

[cp.tar]

Hey, if Vigor was coded after appearing in UF, I don't see why this couldn't be done...

Re:

[Anonymous Coward]

There is an article [usenix.org] about the Blast-o-Mat in the December 2006 issue of the USENIX magazine. [usenix.org]

IDS

[imunfair]

Isn't the described method basically a slight variation on the whole IDS scheme? Establish a baseline and compare to it...? For some reason they don't seem to have thought of the baseline part yet though - apparently they didn't do their research well. Granted I think the baseline is usually bandwidth usage or something of that sort, but this is basically the same thing.

Re:

[ShakaUVM]

Yeah, just watching the number of scans a computer makes isn't worm detection, per se, but more of intrusion detection, as you say.

It will incidentally also allow network admins to automatically shut down bittorrent, so it should be quite popular.

Re:

[TubeSteak]

Establish a baseline and compare to it...? For some reason they don't seem to have thought of the baseline part yet though - apparently they didn't do their research well.

Huh? Did you RTFA?

Their baseline is 10,000 connections a month.
Anything over that gets flagged.

I guess 10,000 connection per month is a lot for a corporate environment.
Obviously that number would need to be tweaked depending on the company, but 10k is their baseline.

Or does baseline mean something other than what I think it means?

And now that...

[Ai Olor-Wile]

...it has been posted on the front page of Slashdot, every future worm author will code their stuff to spread more slowly, so that the increase in scan rate is negligible. Hooray for self-obsoleting discoveries!

(Don't get me wrong, I'm a huge proponent of publicly posting computer security information. But this seems pretty easy to circumvent when considered, no?)

Re:And now that...

[quercus.aeternam]

If the worms are coded to spread more slowly, it will decrease the rate of propogation, making it more difficult for the worms to survive.

If they don't alter their code, worms will have a much harder time surviving on networks that take advantage of this discovery.

The net effect is positive.

Re:

[Goaway]

Actually, worms are already spreading slower in order to survive longer. Even without a system like this, a worm that spreads fast gathers much more attention than one that spreads slow.

Re:And now that...

[Goaway]

Yeah, that has worked great so far, hasn't it?

Re:

[cp.tar]

The slower the worm propagates and the less it does in any noticeable manner, the lesser the chance it will be discovered by any means.

The paper

[textstring]

Here's the pdf http://www.ece.osu.edu/~shroff/journal/worm.pdf [osu.edu]. Seems like if these countermeasures were put in place, viruses would have to be choosy about which hosts they scan instead of just scanning tons of random addresses if they wanted to propagate.

This is trivially defeated

[Arrogant-Bastard]

Sufficiently intelligent worms can use passive OS fingerprinting to identify hosts likely to be susceptible to infection (as they make their presence known) and then make a single attempt per host (which will, obviously, succeed or fail), keeping track of such attempts so as to avoid duplicates. Alternatively, worms could use a passive approach and not attempt to propagate at all except in response to traffic from other hosts -- that is, piggybacking themselves on the responses to ordinary traffic, say, HTTP requests, or Torrent requests, or IM requests. While use of such approaches might slow the propagation of a worm in a local sense, they won't slow down network-wide propagation appreciably if initial seeding is done in sufficient numbers and with sufficient network diversity.

Re:

[Bryansix]

While using passive identifying techniques means it won't need to scan it will still have to attack. You can keep track of the number of attacks a specific computer makes by looking at the promiscuous traffic coming off of the first hop. Of course that's a lot of data to parse.

Seriously Useless

[Anonymous Coward]

Seriously, let's see how this will work.

sysadmin: $max_scans_allowed = 10;
worm: sh1t! $max_scans_allowed = 10;
sysadmin: sh1t! $max_scans_allowed = 9;
worm: sh1t! $max_scans_allowed = 9;
sysadmin: sh1t! $max_scans_allowed = 8;
worm: sh1t! $max_scans_allowed = 8;
sysadmin: sh1t! $max_scans_allowed = 7;
worm: sh1t! $max_scans_allowed = 7;
sysadmin: sh1t! $max_scans_allowed = 6;
worm: sh1t! $max_scans_allowed = 6;
sysadmin: sh1t! $max_scans_allowed = 5;
worm: sh1t! $max_scans_allowed = 5;
sysadmin: sh1t! $max_scans_allow

Re:

[brentonboy]

I'm looking all over the internet for what sh1t! means... or is it pure and simple just an obfuscated 4 letter word? If so, can someone explain this post to me? I don't get it.

Re:

[Anonymous Coward]

sh1t! is programing slang for 100100001

Easy to circumvent.

[thePowerOfGrayskull]

The easy way around this is to just slow down the rate of the scans and the type/quantity of scanning done at any one type. Whether it takes hours or weeks, time is not critical when you have millions of PCs at your disposal.

Re:

[Anonymous Coward]

Although this does mean we've effectively reduced the size of the botnet by a (possibly quite large) constant factor. It would be a greater effect if machines were patched faster.

Re:

[thePowerOfGrayskull]

Hm - kind of. An argument could be made that it would slow the spread of the botnet. And it is probably a safe bet that if the machines can get infected in the first place (unless it's a brand new exploit), there won't be patch updates/installs forthcoming from those particular users...

Re:Easy to circumvent.

[hedwards]

This has been brought up before. Basically, slowing down a worm allows for more time to create and disseminate a patch for the vulnerability. The idea was that when a virus is detected to throttle down on the bandwidth allocated to the computer and perhaps limit it to just specific securty sites for patching as well.

Basically dry up the resources available to the worm and make it as unprofitable as possible to run a botnet in that fashion.

Or in a more cost effective way, just throttle everybody's connection when there's a major outbreak while people get patched. Force the worms and viruses into a much smaller pool. Realistically when some of the larger worms have hit, the bandwidth ends up going mostly to the worms anyways, why not deny the resource to the worm.

Re:

[thePowerOfGrayskull]

But the point is if it was slowed down by design that wouldn't work - because it would remain undetected. That might have other repercussions as well: major outbreaks would not have immediately visible symptoms (such as flooding probes), and so may actually be harder to detect.

Undeployable

[gweihir]

Anything that requires changes in most or all sub-networks is garantueed to fail. Just look at egress-filtering. Many network admins are still unable or unwilling to do it. And these people expect them to implement a worm detector in every subnet? Forget it.

BTW, the idea is not new: "A Fast Worm Scan Detection Tool for VPN Congestion Avoidance" in Proceedings of DIMVA 2005 uses the same idea, but in a context where it is actually implementable and useful. Online under http://www.tik.ee.ethz.ch/~ddosvax/publications/papers/dimva06scan.pdf [ee.ethz.ch].

I didn't realize this was news 2 years ago...

[jafo]

I've been running the following iptables rules on our routers for at least the last year or two:

iptables -A ssh_attack -m hashlimit --hashlimit 200/min --hashlimit-mode srcip --hashlimit-name ssh_attack --hashlimit-htable-size 599 --hashlimit-htable-max 4096 -j RETURN

iptables -A ssh_attack -m limit --limit 1/sec --limit-burst 1 -j LOG --log-prefix "SSH-Attack:"

iptables -I FORWARD -o eth0 -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ssh_attack

In other words, for each internal host allow them to make 200 outbound SSH connections per minute (tracked individually). If they exceed that limit, log a message.

We then have a nagios plugin that checks for this message being in "dmesg". If it is, we get paged.

We watch the sites we host pretty closely, so we don't often run into them getting compromised. The last one was because a host admin re-enabled password logins in SSH *AND* set up a guest account with a password like "guest". Only the guest account was compromised, but I digress.

The thing is that people who compromise these hosts pretty much always use that host to scan for other hosts to attack. And looking for weak passwords on other hosts via SSH seems to be pretty common.

So, once we saw this it was a no-brainer to set up something to alert us when someone started doing it.

Sean

Re:

[Alpha830RulZ]

You are smart. You will make our people strong.

Re:

[gweihir]

And I did not claim the idea was new two years ago. Pointing out work that used it two years ago just demonstrates that it is not new now.

I used to do this maually

[Craptastic Weasel]

I used to work as the admin for a small wireless ISP company seven years ago. The equipment they used was easily broken by an infected machine (I think sasser was the big one back then), as the radios packet per second limit was very low compared to other last mile solutions.

To thwart attacks and keep the network working, I would have ntop running at the gateway looking for lots of SYN with no ACK, a usual sign of an infected machine. I would have to kick them off at the node and then politely call them

Move to MacOS -- worms are obsolete here

[Anonymous Coward]

Like Windows made MS-DOS viruses something to be mentioned in the past, I don't get why people just stop making slapdash hacks, and move to a platform that is 100% immune to this type of malicious software. MacOS has had -zero- remote rootings in the wild in its whole history. Even the vaunted OpenBSD has had three remote holes on its record.

I say leave the worm finding to the Windows and Linux people who are vulnerable to this stuff, and we Mac people can just point and snicker, because a worm or a botne

Re:Move to MacOS -- worms are obsolete here

[thejynxed]

Erm, actually, OSX has been found to be vulnerable to TONS of things, why else the 30 and 40 patch packs released all at once :)

Remote vulnerabilities such as this: http://www.securityfocus.com/bid/29514 [securityfocus.com] would say well, maybe MacOSX IS vulnerable to such types of malware (they only need to cause buffer overflows or exploit remote code vulnerabilities and you can get nailed just like any other OS that is coded by humans).

The question is: Are Macs with their puny marketshare, worth the bother of hacking?

Answer: Some people/groups are starting to show interest in this, yes. But on the whole, no, they aren't worth the bother. Mainly this interest has grown since Apple swapped over to x86 architecture. I find that interesting.

I think the bigger thing to sit and think about is this: No software written, and no hardware designed by humans will ever be perfect. There will always be a weakness somewhere in the system. Deal with it the best you can, like everyone else, and stop spouting stupid nonsense about an invulnerable OS.

Worm Weapon...

[DRobson]

Maybe it's because I haven't had my coffee, but after reading the headline as 'Researchers Tout New Worm Weapon' the only thing I could think of was, 'Holy crap, System Shock is for real...'

As a network admin...

[rAiNsT0rm]

I've been a network specialist/admin for a few companies including banks and a univeristy, and my personal idea/solution is a quasi-vlan system where each workstation is unable to talk directly to other workstations within the same LAN/Campus. Think about it, allow workstations to talk to servers and necessary resources but not directly to each other.

There is no need anymore. People need to connect to the Internet and file servers, etc. Rarely if ever is it actually necessary or preferable to have people connect to each other. The servers *should* be the best updated and protected systems and much easier to trust than Joe Sixpacks PC.

You stop worms from impacting you locally, and at worst your Internet pipe gets congested by a big outbreak which can be easier traced and combated when you aren't also fighting a spreading fire.

Re:

[Anonymous Coward]

Yeah, thats a fantastic approach, block computers from connecting to each other. Who wants a functional network anyway?

"What, you want your computers to be able to connect to each other via the network? Really? Let me guess, you also want printers that print too?"

Re:As a network admin...

[Gnavpot]

Yeah, thats a fantastic approach, block computers from connecting to each other. Who wants a functional network anyway?

The GP explained his point in an easily understandable way. I don't know how you failed to understand it. Anyway, here it comes again in slow motion for your benefit:

In most corporate networks, clients need to connect to servers. They do not need to connect to other clients.

If you block clients' ability to connect to other clients, no functionality is lost, but infected clients can not attack other clients directly.

(I know that some companies uses IM internally, but there is nothing forcing IM solutions to be P2P.)

Re:

[Bryansix]

Wha? How else am I supposed to connect the the administrative share of people's desktops and drop pictures on them?

Re:

[Corbets]

That's not quite as simple as you make it out to be. Ok, assuming a corporate network, you don't have to worry about as many peer-to-peer connections (such as bit torrent), but I can still think of a number of situations when workstations need to be able to chat with each other. Instant messengers, impromptu document sharing when there isn't an "official" share set up that both parties have access to, VoIP applications and teleconferencing solutions, and so forth.

You could design your network from the groun

Re:

[rAiNsT0rm]

I disagree completely. IM uses a central server. "Impromptu document sharing" is exactly the type of thing that this stops, which is dangerous and circumvents a number of safeguards. Macro viruses, viruses, scattered documents which aren't properly backed up, lost due to a system crash, misplaced, inaccessible once an employee leaves, etc. VOIP and teleconferencing can be handled via QoS or a central server.

It isn't hard. I have actually implemented this idea in labs and test case scenarios/labs and each an

Re:

[Hatta]

Of course they're going to tell you that. You're the BOFH, and if they complain, you'll just give them something to really complain about.

Re:

[rAiNsT0rm]

I think the real problem you have is that you are a researcher who has an interest or even a proficiency for computers and THINK that should make you GOD of your own little domain. If you want to be an expert researcher, research and defer the technology side to the experts in their field. If you want to be IT, then leave the research and complete the proper education/certifications and be an expert in IT.

I run into this daily, you are no special case, and again your ignorance shines through. I'm no BOFH, e

Re:

[Hatta]

Except that IT has little to no interest in supporting what I as a researcher need to do. They want to implement one size fits all solutions with crappy proprietary technology. I couldn't even get them to set up my gel documentation machine to mount our departments share automatically. As a result, people save their work on that machine and not the network drive. Fortunately, they don't care what I do as long as it doesn't create any extra work for them. So I just installed cygwin SSH and rsync everythin

Re:

[rAiNsT0rm]

Fair enough. The problem is that while you think (or even if you did) properly block that box to say 5 people, more than likely you didn't. You are a busy man with more important things to do than worry about and keep up with the latest patches, updates, and security holes. You probably don't understand vulnerabilities and security to the extent a properly trained/educated IT guy does. So what you THINK is us being one-size fits could be us being understaffed and underfunded and unable to support a bunch of

Re:

[Hatta]

Um, right. So when I'm out of the office for a meeting, I shouldn't be able to ssh into my desktop computer to grab some data I forgot to put on my laptop? Or if I need to host a wiki for the lab, I'm going to have to fight with IT instead of just installing a LAMP stack on a spare box and plugging it in? Or what about hosting our lab's database of plasmids, oligos, and cell lines? Or hell, even just retrieving data from various computers hooked up to instruments, our gel imager, phosphoimager, microscop

Re:

[rAiNsT0rm]

Umm, right. So all of your arguments fall flat. If you are out of the office you would be connecting one of two ways: VPN or SSH via the Internet, which BOTH would work and are secure. You can't be on Suzy's computer in Accounting though and SSH to yours which is for the better.

Exactly right, YOU CAN'T host a wiki or create an unauthorized server by "just installing LAMP" this is part of the problem. I'm sure you are an expert in each letter of LAMP which would qualify you to do that. "Fighting with IT" is

Caterpillars

[pigiron]

...are not worms.

Worms are not pretty

[ASMworkz]

Worms are ugly, but they are not that smart so it won't take long to stop them most likely.

Blinking Lights

[Joebert]

What's wrong with looking at the router lights blinking when the system shouldn't be doing anything and saying "Heeey, that's not right !" ?

Hardly news - already running at a uni for 5 years

[Boetsj]

A system called Quarantainenet attempting to do the same detection and isolation has been up and running for 5+ years at the University of Twente [utwente.nl] in the Netherlands. It's even evolved into a separate company [quarantainenet.com], which appears to cover several more universities and ISP's in the Netherlands with the system.

How about pre-emptive defence?

[Fri13]

Why to spend money to treat effects when you could prevent cause in first place using SELinux or AppArmor (those kind technics are for Windows too)?

Here's a better idea

[AmiMoJo]

If a machine gets infected by a worm, the anti-virus software must have failed to detect that worm. So, you get a report warning you about a particular machine, run a virus scan and find nothing. Now what?

What you need to do is have the software running on the PC itself, so that it can monitor what task is actually running the scans so a human can check it.

This will be news to Forescout.

[No-Cool-Nickname]

We purchased a Forescout appliance 2 years ago which does the exact same thing. I wonder if the OSU research was reading http://www.forescout.com/counteract/index.html [forescout.com] As an OSU Alum, I am embarrassed by this tripe.

Old News

[blendedmetaphor]

We have been doing this kind of analysis and mitigation since the days of blaster. Nothing new, but yes, it does work quite effectively for rapidly spread worms.

Still vexed by by SEC offense...

[smackwiki]

OSU scientists decided to focus on the issue of network worms when they were frustrated by efforts to diffuse offensive attacks by SEC virus. The Florida and LSU variants proved to be too much to handle, and the scientists choked under the pressure.