Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Sandia Studies Botnets In 1M OS Digital Petri Dish

kdawson posted about 5 years ago | from the million-bottles-of-wine-on-the-wall dept.

Security 161

Ponca City, We love you writes "The NY Times has the story of researchers at Sandia National Laboratories creating what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of botnets. Sandia scientist Ron Minnich, the inventor of LinuxBIOS, and his colleague Don Rudish have converted a Dell supercomputer to simulate a mini-Internet of one million computers. The researchers say they hope to be able to infect their digital petri dish with a botnet and then gather data on how the system behaves. 'When a forest is on fire you can fly over it, but with a cyber-attack you have no clear idea of what it looks like,' says Minnich. 'It's an extremely difficult task to get a global picture.' The Dell Thunderbird supercomputer, named MegaTux, has 4,480 Intel microprocessors running Linux virtual machines with Wine, making it possible to run 1 million copies of a Windows environment without paying licensing fees to Microsoft. MegaTux is an example of a new kind of computational science, in which computers are used to simulate scientific instruments that were once used in physical world laboratories. In the past, the researchers said, no one has tried to program a computer to simulate more than tens of thousands of operating systems."

cancel ×

161 comments

Sorry! There are no comments related to the filter you selected.

Life imitates XKCD (5, Interesting)

Tackhead (54550) | about 5 years ago | (#28859543)

Once again, life imitates XKCD: Network [xkcd.com] .

Re:Life imitates XKCD (1)

Kotoku (1531373) | about 5 years ago | (#28859575)

I wanted to post that but the botnets slowed the internet down. Clogged tubes.

Re:Life imitates XKCD (4, Informative)

The_mad_linguist (1019680) | about 5 years ago | (#28859949)

Well, given that XKCD was imitating an old hacker competition...

Re:Life imitates XKCD (-1, Troll)

Anonymous Coward | about 5 years ago | (#28860001)

Linux is shit and anyone who uses it is gays.

Re:Life imitates XKCD (-1, Offtopic)

Anonymous Coward | about 5 years ago | (#28860145)

Hey! Just because I'm a virgin doesn't mean I'm gay!

Posting AC to keep my macho image intact.

Re:Life imitates XKCD (3, Informative)

dintlu (1171159) | about 5 years ago | (#28860353)

Goes to show that ideas are a dime a dozen.

Implementing something like this is what makes the news.

Re:Life imitates XKCD (1, Interesting)

Anonymous Coward | about 5 years ago | (#28860593)

Which is why patents are stupid.

Not exactly. (4, Insightful)

khasim (1285) | about 5 years ago | (#28860757)

A patent on an IMPLEMENTATION of an idea is a good thing.

A patent on an idea itself ... that's stupid. And that's what we're stuck with today.

Re:Life imitates XKCD (2, Interesting)

Ambvai (1106941) | about 5 years ago | (#28860859)

Is there any serious implementation of that XKCD comic, or even just in an imitation of what looks like computers fighting for control of a network?

I've got an easier way (3, Insightful)

iamapizza (1312801) | about 5 years ago | (#28859553)

what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of botnets

If they've set up this mini-internet and have set up this botnet, then the easiest way to understand its behavior would be to look at the source code

Re:I've got an easier way (0)

Anonymous Coward | about 5 years ago | (#28859603)

Not that kind of behavior.

Re:I've got an easier way (2, Funny)

Ant P. (974313) | about 5 years ago | (#28859605)

OK, here's seven hundred million lines of source code. Come back when you've solved the halting problem.

Re:I've got an easier way (2, Informative)

leuk_he (194174) | about 5 years ago | (#28859687)

The source code does not help you to imange what happens in peer to peer network with very large amounts of cleints that have a different kind of environment. Not to mention software that has bugs.

BTW... who is the first to post to the xkcd comic about it [xkcd.com] normal people have aquaria

Re:I've got an easier way (2, Informative)

dotgain (630123) | about 5 years ago | (#28859853)

BTW... who is the first to post to the xkcd comic about it

Uhh, the First Post?

Re:I've got an easier way (3, Insightful)

Sta7ic (819090) | about 5 years ago | (#28859925)

Just like the easiest way to understand how a dog works is to dissect them.

In short, no. You can figure out how some of the parts work, but there's a lot within complex software that is non-deterministic, whether for internal, external, or thoroughly inadvertant reasons on either side. Just because you _think_ you know what it's doing doesn't mean it'll act the way you expect it to.

Also, see http://xkcd.com/397/ [xkcd.com]

Re:I've got an easier way (1)

Vellmont (569020) | about 5 years ago | (#28860301)

If it's unclear what the code does, run it in a debugger and control the inputs. Step through the code line by line. If the debugger doesn't do everything you want, write a better debugger.

I have to agree that this seems like a silly idea. Comparing the complexity of a botnet program to a dog is silly. It also ignores the fact that code run in a debug environment can look at every single aspect of running code while it's running. A dog is obviously many many many orders of magnitude more complex.

Re:I've got an easier way (5, Insightful)

caramelcarrot (778148) | about 5 years ago | (#28860529)

Simple rules can give rise to complex behaviour. Who knows what the botnet might do? It could have harmonic resonances, it could have phase changes at critical infection rates, it could do all sorts of interesting and complex behaviour. Looking at the source code won't tell you any of this.

Re:I've got an easier way (1)

Gerzel (240421) | about 5 years ago | (#28860017)

Exactly and biologists should only look at the DNA of animals to understand their behavior.

Just because we know what the instructions are doesn't mean we can account for what will happen when those instructions actually meet any given environment. Even simple things like instructions for installing or using software should be tested on some users in order to see their pitfalls and problems.

Re:I've got an easier way (2, Insightful)

coreboot (1607489) | about 5 years ago | (#28860703)

not really. Source code analysis goes just so far. Multiplied by 1M, it goes less far still. And then there's this little issue: http://en.wikipedia.org/wiki/Halting_problem [wikipedia.org]
ron

Re:I've got an easier way (0)

Anonymous Coward | about 5 years ago | (#28860745)

Sometimes having the code doesn't help you as much as you'd think: http://en.wikipedia.org/wiki/Busy_beaver

Re:I've got an easier way (0)

Anonymous Coward | about 5 years ago | (#28861259)

Source code tells you very little about emergent behavior.

Re:I've got an easier way (1)

X0563511 (793323) | about 5 years ago | (#28861287)

Just like the easiest way to understand human behavior is to look at our genetic code?

Nope. It's not that simple at that level.

Re:I've got an easier way (3, Insightful)

voidphoenix (710468) | about 5 years ago | (#28861353)

You can't study emergent behavior [wikipedia.org] by studying source code. Even within one host, the interactions between malware, applications and every the piece of the OS would already have emergent properties. Magnify by tens of thousands to millions (exponentially [wikipedia.org] , not additively or multiplicatively), and the sheer complexity of the entire system would overwhelm our ability to understand it.

We have ~100 billion neurons and ~100 trillion synapses. At 2^N - N - 1 subgroups, how many pieces before the system's complexity outruns our brain's processing power? A network of 47 pieces has ~140 trillion subgroups. With several million pieces...

First Findings! (2, Funny)

CorporateSuit (1319461) | about 5 years ago | (#28859559)

The first thing the researchers noticed is that within 30 minutes, the botnet had sent over 6 billion emails out of newly-registered gmail and hotmail accounts, and continued to send millions more each hour. The researchers say the botnet thrives on pain and misery, and probably shouldn't have been given access to the real internet.

But -- how can you infect it? (3, Funny)

Nefarious Wheel (628136) | about 5 years ago | (#28859681)

My first thought meme was "Yes, but does it run Linux?" ("Megatux". Duh.) Then I thought - hang on, how can you develop a botnet that runs on Linux in the first place? And if you did, how would it reflect the nature of real botnets if those millions of operating systems weren't running NT4 or variants?

Then it got surreal - I imagined all those bots emulating the game of life [wikipedia.org] , with little dots flashing on and off, and little gliders and factories...

Ok, I'll go back to work now.

Re:But -- how can you infect it? (1)

dotgain (630123) | about 5 years ago | (#28860383)

Ok, I'll go back to work now

Hundreds of use would *love* to know what that is now :)

Re:First Findings! (1)

maxume (22995) | about 5 years ago | (#28860671)

When I first glanced at the headline, I wondered if they were running it on top of a botnet.

It would have a nice poetry to it.

They can't afford an MSDN subscription? (3, Funny)

n0tWorthy (796556) | about 5 years ago | (#28859581)

Then they can run 1 million copies without a subscription.

Re:They can't afford an MSDN subscription? (0)

Anonymous Coward | about 5 years ago | (#28859705)

Yes, but their time has value too.

Is that really a windows environment? (5, Interesting)

damn_registrars (1103043) | about 5 years ago | (#28859583)

I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

Re:Is that really a windows environment? (2, Insightful)

geegel (1587009) | about 5 years ago | (#28859647)

Welcome to the world of open source software. The place where you can modify the code in any way you want.

Re:Is that really a windows environment? (1)

damn_registrars (1103043) | about 5 years ago | (#28859735)

Welcome to the world of open source software. The place where you can modify the code in any way you want.

Though Wine is just an API, AFAIK. It would seem that you would need to modify it extensively to actually have it truly behave like Windows. And I suspect not all botnet infections exploit the same Windows flaws, so wouldn't the total number of vulnerabilities to implement into Wine to reach the same level of vulnerability be rather substantial?

Re:Is that really a windows environment? (1)

geegel (1587009) | about 5 years ago | (#28859975)

Actually it would be plain more easier to just code their own virii and botnets, while modifying Wine slightly to make sure that the virtual computers get infected and the infection vector works.

They are not interested in how a certain virtual computer behaves like after all, but rather on how the mini-internet looks like as a result of these infections.

Re:Is that really a windows environment? (2, Insightful)

amicusNYCL (1538833) | about 5 years ago | (#28860061)

Since this is a closed environment for a scientific study, it would make sense for them to use viruses which spread via exploits that they know are present.

Re:Is that really a windows environment? (1)

UncleTogie (1004853) | about 5 years ago | (#28861071)

Since this is a closed environment for a scientific study, it would make sense for them to use viruses which spread via exploits that they know are present.

Captain Obvious here... If they create the exploits and viruses themselves, they might have a pretty good idea of the infection vectors. It doesn't have to be what's in the wild now. Even better that it NOT be; after all, Robert Morris didn't expect his worm [wikipedia.org] to replicate as far as it did, either...

Re:Is that really a windows environment? (1, Interesting)

Anonymous Coward | about 5 years ago | (#28859807)

Modifying Wine to emulate a Windows machine which is vulnerable to viruses does not result in a Windows machine. You still just have Linux running Wine. The very idea behind these tests is already critically flawed.

A previous poster already got it right. The researchers should just buy a MSDN Universal license and legally run 1M instances of actual Windows. Otherwise, their findings will have little to no real value (IMO).

Re:Is that really a windows environment? (1, Insightful)

Anonymous Coward | about 5 years ago | (#28859881)

Hell, they should have just called Microsoft, said "we'd like to do this research" and gotten a license to do things that way.

Re:Is that really a windows environment? (1)

Brian Gordon (987471) | about 5 years ago | (#28861149)

You wouldn't expect to pay for a million licenses, but then you wouldn't expect to pay for any additional licenses ....

Re:Is that really a windows environment? (1)

Zantetsuken (935350) | about 5 years ago | (#28861221)

So they can come up with study results that say "The vast majority of Windows boxen out there are horribly misconfigured and using out of the box defaults, making Windows one of the most insecure OS's in the world." I don't think there are enough chairs for Ballmer to throw when he sees those results...

Re:Is that really a windows environment? (1)

geegel (1587009) | about 5 years ago | (#28860041)

Flawed yes, critically flawed... I don't think so.

By having the power to control the infection vectors (by having different flavors of Wine designed with different vulnerabilities) you have a much better insight on how dangerous these vectors are.

Wine is simply the perfect lab rat, not quite the same as a human, but much better suited for scientific studies

Re:Is that really a windows environment? (3, Insightful)

amicusNYCL (1538833) | about 5 years ago | (#28860089)

The research isn't to determine how Windows reacts to a botnet. They're trying to figure out how the botnet itself communicates and spreads. Or, more specifically, what the botnet looks like as it is spreading. Windows is just the platform that they're running the botnet on (sort of), but they don't really care how Windows reacts to it.

In other words, they're studying the botnet itself, not the infrastructure it runs on.

Re:Is that really a windows environment? (1)

Wesley Felter (138342) | about 5 years ago | (#28861123)

In that case, why use Wine at all? Why not just write a pure Linux botnet?

Re:Is that really a windows environment? (1)

X0563511 (793323) | about 5 years ago | (#28861319)

When why bother with Wine at all? Isn't that just an added layer of complexity?

Re:Is that really a windows environment? (5, Insightful)

mcrbids (148650) | about 5 years ago | (#28859745)

I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

WINE is an implementation of the Win32 API. Since the *target* of WINE is to emulate Windows, then in order to be successful, it must implement the bugs as well. So the better WINE is, the better it runs *ALL* Windows software - including the viruses and malware!

I would assume (ass + u + me) that they've done enough unit testing on the particular botnet software in question to determine its compatibility with WINE, and so long as this compatibility is sufficient, then this could be a very useful test environment. It's the botnet being studied, not Windows itself!

Another example: Windows 2000. I build data management software. I test with Windows 2000. Not because Win2000 is an example of the latest greatest from MS, but because it costs me nothing extra and runs nicely in a VM. Since the only O/S features I care about are those that are already present in Win2000, it creates a very useful test environment despite lacking many pieces present in later OS versions.

Re:Is that really a windows environment? (1, Funny)

CarpetShark (865376) | about 5 years ago | (#28860063)

I would assume (ass + u + me)...

ASL?

Re:Is that really a windows environment? (1)

Tubal-Cain (1289912) | about 5 years ago | (#28861275)

ASL?

What about it? [wikipedia.org]

Re:Is that really a windows environment? (2, Insightful)

EdIII (1114411) | about 5 years ago | (#28859805)

I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

Yeah, I call bullshit that on too. If you want to study botnet behavior, which includes studying malware and viruses, then it should be a "real" Microsoft OS. I don't think WINE counts.

I am not the biggest fan of ol' M$, but considering how interesting this research is and it's possible positive impact on the greater community (which does benefit Microsoft) you would think they would at least ask Microsoft for some licenses gratis.

Microsoft would probably be reasonable, if just for the good PR, which they sorely and always need.

Re:Is that really a windows environment? (4, Insightful)

Anonymous Coward | about 5 years ago | (#28859891)

I can't possibly imagine how a simulation of millions of instances of your software infecting itself would be good PR.

Re:Is that really a windows environment? (1)

theskipper (461997) | about 5 years ago | (#28861125)

I respectfully disagree...have you read any Microsoft TCO papers?

Reading them is like watching David Copperfield make a pyramid disappear.

Re:Is that really a windows environment? (1)

Brian Gordon (987471) | about 5 years ago | (#28861201)

Probably about how encouraging every user to use a tool that publicly admits to security flaws is good PR. Customers like to hear that the software they buy is being secured by ongoing research.

Re:Is that really a windows environment? (2, Funny)

Anonymous Coward | about 5 years ago | (#28859909)

I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

Yeah, I call bullshit that on too. If you want to study botnet behavior, which includes studying malware and viruses, then it should be a "real" Microsoft OS. I don't think WINE counts.

I am not the biggest fan of ol' M$, but considering how interesting this research is and it's possible positive impact on the greater community (which does benefit Microsoft) you would think they would at least ask Microsoft for some licenses gratis.

Microsoft would probably be reasonable, if just for the good PR, which they sorely and always need.

True... But if they did use *real* windows instead of Wine, then the supercomputer could only virtualise a few hundred copies of Windows XP running simultaneously, or 2-3 copies if it's Vista. :E

Re:Is that really a windows environment? (1)

eclectro (227083) | about 5 years ago | (#28859945)

Microsoft would probably be reasonable, if just for the good PR, which they sorely and always need.

Hey guess what everyone?? There's millions of our OS infected with viruses because we have never been able to fix the code!

Re:Is that really a windows environment? (1)

Brian Gordon (987471) | about 5 years ago | (#28861217)

Hey guess what everyone?? We just rented a 4,480-processor supercomputer and set up a fascinating experiment in an attempt to better understand how we can secure our software. Look at all the money we're pouring into making our products better!

I would guess it wouldnt' be a problem at all (5, Interesting)

Sycraft-fu (314770) | about 5 years ago | (#28860077)

I work for a university and MS is extremely generous with academic licensing. When it is for academics, like education or research, it is actually no cost. For infrastructure it does cost, but not very much. I bet if they asked MS, MS would give them all the licenses they needed for little or no cost.

For that matter, they might be eligible for volume licensing. That is where you pay a fixed yearly fee and get an unlimited use of the software it is for. Often that is based on total academic headcount, which might not be very much.

Regardless, if they asked I'd give good odds MS would figure out a way to offer them a good deal.

I'm also with you that if you want to study something, you need to run it on the actual environment. Wine is a neat idea and a neat goal, but anyone who has made use of it for more than simple testing well tell you that it has some serious issues. Not only do things not run, worse is that they'll run but not completely correct. For a user this might be fine, something works in a bit of an unexpected way, you just work around it. For research though, it could mean your conclusion is invalid.

Re:Is that really a windows environment? (1)

ammorais (1585589) | about 5 years ago | (#28859857)

The objective is to study botnet behavior and propagation on Windows environments on large scale.
They don't need everything to work on WINE. They just need the some specific software like the botnets they use to behave and propagate exactly like in windows.
And that can be easily achieved.

Re:Is that really a windows environment? (4, Informative)

MaskedSlacker (911878) | about 5 years ago | (#28859921)

I think you're misunderstanding what they are doing. They are not studying in-the-wild worms. They are trying to build theoretical models of botnets and how they propagate through networks--this is the equivalent of computer simulations of viral epidemics. You don't need to simulate what the virus does in a person to study how it spreads through a population.

Re:Is that really a windows environment? (2, Interesting)

vux984 (928602) | about 5 years ago | (#28860461)

I think you're misunderstanding what they are doing.

I think you are correct. However, that raises the question: why use WINE?

Since they aren't relying on 'real in the wild exploits' they could model botnets and how they proagate through networks on linux or freebsd just as easily. Its really just specialized p2p and client server software to simulate botnet behaviour and spread.

Re:Is that really a windows environment? (2, Informative)

Antique Geekmeister (740220) | about 5 years ago | (#28861141)

WINE is far less resource intensive, and typically runs far faster, than fully virtualized simulation software, especially because it leaves out the basically rewritten-VMS kernel and memory management of the Windows kernel in favor of Linux's own pretty zippy kernel. And the cost of buying and running a million actual Windows boxes to avoid the performance penalties of virtualization is simply infeasible.

Inoculate them (1)

wsanders (114993) | about 5 years ago | (#28860099)

Just send the username, password, and IP address of a few of the virtual machines to Nigeria or somewheres, and let the fun begin.

Besides, the idea to not really to view the infections, it's probably to monitor how the botnets behave as a horde, and deduce who controls it and what their objectives are. That's nearly impossible from observice just a few machines.

Re:Is that really a windows environment? (1)

LeinadSpoon (1602063) | about 5 years ago | (#28861241)

Wasn't there an article posted a while back about trying to get windows viruses to infect a linux box with wine, and it didn't work too well?

Wine? (4, Insightful)

Facegarden (967477) | about 5 years ago | (#28859619)

I understand using WINE to avoid license fees, but wouldn't that potentially hinder the results of the experiment? I suppose that if they knew what functionality was needed by the botnet, they could be sure WINE provided what they needed, but it also seems like they might be able to work out a deal with MS to get a free site license for use in this test only, since it betters the computing world in general, which ultimately benefits microsoft?

Seems like a few phone calls might go a long way, if they get a hold of the right people.
-Taylor

Re:Wine? (1)

Shikaku (1129753) | about 5 years ago | (#28859643)

Wine can get Windows viruses.

Re:Wine? (1)

gad_zuki! (70830) | about 5 years ago | (#28859721)

Yes, but which ones? Trojans just set to run in userspace? Is this any different than just running a million .exe's and not really infecting anyone or emulating a real infection vector?

I dont see how, say, conficker would infect these machines. The RPC exploit doesnt exist in wine.

Re:Wine? (0)

Anonymous Coward | about 5 years ago | (#28859843)

The Wine project is actively working to support some of the more popular malware commonly found in the Windows environment - like IE.

Re:Wine? (1)

Darkness404 (1287218) | about 5 years ago | (#28859823)

...Except for that they basically would have to say "Hey MS, your code is broken, so broken that we need free licenses in order to show the world how broken it is". While it is a great idea and would benefit them, all MS can see is bad press, and they want to avoid that.

Re:Wine? (2, Informative)

Facegarden (967477) | about 5 years ago | (#28859919)

...Except for that they basically would have to say "Hey MS, your code is broken, so broken that we need free licenses in order to show the world how broken it is". While it is a great idea and would benefit them, all MS can see is bad press, and they want to avoid that.

I'm pretty sure that the notion of windows being susceptible to malware and viruses is probably something Microsoft has come to terms with, i really can't imagine anyone getting terribly upset. Viruses exist, someone wants to do some research, it shouldn't be that offensive of an idea.
-Taylor

Re:Wine? (1)

bertoelcon (1557907) | about 5 years ago | (#28860021)

I thought MS used the "any press is good press" thinking, or is that just limited to Apple, music, and movies.

Re:Wine? (1)

andydread (758754) | about 5 years ago | (#28860171)

No it will not hinder the results. The goal of the project is not to evaluate the security of said 1million operating systems. The goal is to get the 1 million systems to be functional enough so as to be able to run a functional contained botnet. Basically u want the lowest common denominator (security-wise) as the base for all systems so as to easily infect them. The problem with WINE is that there is some code to mitigate SOME worm infections that would otherwise infect Windows. So they would have to remove this bit of code to make it easy to infect it. Also some worms do not run in wine as it is so they would have to massage it there too. Basically all they need is to have the 1million systems easily infected and compatible enough to run the code they need to run.

Imagine... (0)

Anonymous Coward | about 5 years ago | (#28859649)

a beowul... Oh, a butterfly!

Sounds like Software by Rudy Rucker (0, Offtopic)

Numbah One (821914) | about 5 years ago | (#28859653)

in the book, AI evolves as competing programs in a computing environment through natural selection. it was a pretty good book published in the 80's. the robots wind up on the moon (i don't remember how they got there in the first place) and eventually overthrow the humans there. here's an Amazon link http://www.amazon.com/Software-Rudy-Rucker/dp/0380701774/ [amazon.com]

WINE (2, Insightful)

Phroggy (441) | about 5 years ago | (#28859671)

Can a botnet run on WINE with 100% compatibility? Doesn't malware often use exactly the same kinds of tricks that WINE doesn't fully implement? This might not create an accurate picture.

Also, are they simulating network latency between nodes? Many bots take this into account.

Re:WINE (5, Funny)

monopole (44023) | about 5 years ago | (#28859933)

I hope Microsoft issues a statement that only Genuine Windows software can fully support viruses and malware in an effective fashion.

Re:WINE (5, Funny)

Eighty7 (1130057) | about 5 years ago | (#28860355)

In other news, Miguel de Icaza said that he believes botnet support is a good idea. Linux should support malware because Microsoft is going to win anyway, so linux would better be prepared if it doesn't want to be locked out of the future markets, and presented a beta version of the software. Members of the Mono project are participating in the standarization.

Re:WINE (0)

Anonymous Coward | about 5 years ago | (#28860501)

Nicholas Negroponte agrees too.

Re:WINE (1)

benjonson (204985) | about 5 years ago | (#28860677)

I hope Microsoft issues a statement that only Genuine Windows software can fully support viruses and malware in an effective fashion.

Actually, that is true. It is an undocumented feature.

Re:WINE (1)

Lehk228 (705449) | about 5 years ago | (#28861001)

if they are testing botnet behavior, they can do so while fudging the details of infection.

14 comments so far (2, Funny)

zmollusc (763634) | about 5 years ago | (#28859707)

and nobody yet has imagined a beowulf cluster of these? Standards are slipping!

Wine for viruses? (2, Funny)

Tubal-Cain (1289912) | about 5 years ago | (#28859717)

Wine's come a long way in the past 4 years [linux.com] if it can run viruses now!

A few notes from Ron Minnich (5, Informative)

coreboot (1607489) | about 5 years ago | (#28859859)

Hi, Ron here. Just thought I would mention a few things.
I love the "life imitates xkcd" aspect. :-)
We're well aware that Wine is not quite enough to run many windows bots. Until a year or so ago, however, there was a researcher in North Carolina running Storm under Wine, but he told me that that effort ended when Storm added a kernel driver. We've got some ideas in that area. We expect that implementing them will cost less than 1 million Vista licenses.
I was surprised to find I have become a cybersecurity expert! What I really am is an HPC expert who is using HPC tools and resources to build a system for studying cybersecurity phenomena on a millions-of-nodes scale.
Doing anything with a million of something gets interesting fast. There's a lot of interesting challenges.
Thanks
ron

Re:A few notes from Ron Minnich (3, Interesting)

PCM2 (4486) | about 5 years ago | (#28860095)

Well Ron, since you're here, I'm curious whether you had in fact tried to approach Microsoft for a free site license. You could explain to them that you're doing security research in a unique environment and that you'd be willing to share your results with them, etc. I could even imagine a distorted PR spin where the fact that all this major security research is being done on Windows shows that Windows is clearly the dominant operating system, blah blah...

Or if Microsoft doesn't see the value of the kind of information your research could yield, maybe someone like Symantec would be willing to buy a license and donate it to you (if that's even possible, given EULAs etc.)?

Re:A few notes from Ron Minnich (1)

amicusNYCL (1538833) | about 5 years ago | (#28860143)

Do you really think it would be easier to set up (and periodically reinstall) a million copies of Windows vs. telling Linux to virtualize a million instances? I mean, it would be nice to run on the real deal but there are practical issues to consider.

Re:A few notes from Ron Minnich (1, Informative)

Anonymous Coward | about 5 years ago | (#28860231)

MSFT licensing in the big leagues is almost an honor policy sort of thing.

There are ways for them to set up a single in-house activation server that doles out 1,000,000 activations, for example. It's what I would do.

Or they could run every license as an evaluation copy for the 30 days, they could script something to re-arm the licensing to run it up to 180 days. (This is possible on all copies of Windows.)

On top of that, as a research project they may be able to partner with Microsoft and not pay anything at all for 1,000,000 legit licenses for use in this project. Heck, Microsoft might want to help so they can fix some of these issues.

Re:A few notes from Ron Minnich (0)

Anonymous Coward | about 5 years ago | (#28860407)

You do realize that Windows is virtualizable, too, right?

Re:A few notes from Ron Minnich (5, Informative)

coreboot (1607489) | about 5 years ago | (#28860609)

We will probably approach MS at some point, if it appears to be necessary, and see if they are interested. I do have friends there who might be interested in what we're doing.
The biggest limit we've found on the VM side is memory footprint of the VM guests, and it's very easy to control that with Linux; harder with Windows. We have some ideas in that area too, but it's way too early to speculate on them.
But from my point of view, it is a lot easier to do this kind of work in Linux than in Windows (I have done NT drivers in a past life), not least because of the openness of the environment. Hence, I'd rather try to find a way to make it all work on Linux.
Consider this work the beginning of the story; it's not even chapter 1, maybe it's the preface. There's a lot of work left to do. There's a lot we still don't know.
thanks
ron

Re:A few notes from Ron Minnich (0)

Anonymous Coward | about 5 years ago | (#28860251)

Neat. LUK[1] has gotten pretty usable I hear. You might want to consider that. It's Wine after all, but a whole lot shinier than Wine. Good Luck.

[1] http://en.wikipedia.org/wiki/Linux_Unified_Kernel

Re:A few notes from Ron Minnich (0, Troll)

Mr 44 (180750) | about 5 years ago | (#28860763)

We expect that implementing them will cost less than 1 million Vista licenses

Do you not understand that under no sane circumstance would you ever be responsible for purchasing 1 million licenses? Volume or MSDN licensing would cover your situation quite handily. Repeating the above sentiment (esp with no smiley) just makes you sound ignorant.

If you want your results to be meaningful, you're going to need to figure out how to get some actual windows VM's into your mix.

fuck you queers (-1, Troll)

Anonymous Coward | about 5 years ago | (#28859879)

go show your live cds up your faggot asses.

Don't want to be there... (0)

Anonymous Coward | about 5 years ago | (#28859901)

... when this entity become sentient.

Re:Don't want to be there... (1)

node 3 (115640) | about 5 years ago | (#28860465)

... when this entity become sentient.

Sentience implies some minimal level of rationality. They're emulating the *Internet*, so I really wouldn't worry.

Cluster (0, Redundant)

CriX (628429) | about 5 years ago | (#28860259)

Has no one yet stopped to imagine a beowulf cluster of these mini-internets?!

Wine on Linux? (0, Redundant)

PhunkySchtuff (208108) | about 5 years ago | (#28860279)

But does Wine on Linux have the same vulnerabilities as Windows itself, and which version of Windows is it "emulating" these vulnerabilities from?
I'm sure there's a lot of malware code out there that may work well on particular versions of Windows, or instances of Windows without a particular hotfix/service pack, but this sounds like each of the 1M Wine instances will be pretty much the same...

Re:Wine on Linux? (3, Interesting)

geegel (1587009) | about 5 years ago | (#28860381)

Not necessarily.

You might want indeed at some point to emulate an internet choke full of unpatched machines, but other times you will probably want only a percentage of them to be this way, or you might want to study a particular vector of infection, or concurrent vectors of infection to see how they interact. The combinations are endless and so will probably be the number of WINE flavors used.

Re:Wine on Linux? (1)

node 3 (115640) | about 5 years ago | (#28860433)

But does Wine on Linux have the same vulnerabilities as Windows itself, and which version of Windows is it "emulating" these vulnerabilities from?
I'm sure there's a lot of malware code out there that may work well on particular versions of Windows, or instances of Windows without a particular hotfix/service pack, but this sounds like each of the 1M Wine instances will be pretty much the same...

WINE is open source, so they can patch it to be just as vulnerable as Windows is.

Yes, the notions of "progress" and "improvement" take a twisted turn when you take on the task of emulating Windows in Linux...

What about Norton Antivirus? (5, Interesting)

node 3 (115640) | about 5 years ago | (#28860411)

What about Norton Antivirus? Specifically they should run a second experiment with a simulation of 1 million systems running Norton Antivirus, and compare the results of the first test to see which has the greatest adverse effect...

Re:What about Norton Antivirus? (1)

FlyingBishop (1293238) | about 5 years ago | (#28860837)

For that they would need to use virtualization, rather than Wine. This would severely limit the number of computers they could use. From what I gather, they're more interested in how the individual machines interact than on whether or not they get infected. So they want each one to be as lightweight an environment as possible, while still providing enough for each bot to run. Wine allows them to run on smaller Linux VMs.

Re:What about Norton Antivirus? (-1, Troll)

Anonymous Coward | about 5 years ago | (#28860875)

whoosh!

Re:What about Norton Antivirus? (1, Interesting)

Anonymous Coward | about 5 years ago | (#28861233)

I thought nobody would talk about this. It was the first thing that came to my mind. I don't know if you meant that as a joke, but antivirus software has been, recently, the most annoying thing to remove a virus.

These subsystems are the first to get disabled, and sometimes even help the virus to spread around the computer.

The least suspect to a regular user would be an antivirus, because the user would think it's helping. Users are used to their machines slowed down by antivirus subsystems (on-access scans, etc), and the run one or more services under windows. If a virus would attack something is the antivirus itself, which increases its longevity.

However, how much would it cost to get the million mcafee or norton licenses?

One half of one percent of a cpu per VM? (1)

DotDotSlashDot (1207864) | about 5 years ago | (#28861187)

Any currently supported Windows OS platform would probably suffer from timeouts breaking everything in this environment. I bet the Dell SuperBungler can't launch a million Windows VMs whiile using Microsoft's virtualization products on such a pitiful platform with fewer than 5000 CPUs. My bullshit detector just vibrated it's way off my desk. WTF?

ROTFLMA, (1)

Stumbles (602007) | about 5 years ago | (#28861269)

to quote "The Dell Thunderbird supercomputer, named MegaTux, has 4,480 Intel microprocessors running Linux virtual machines with Wine, making it possible to run 1 million copies of a Windows environment without paying licensing fees to Microsoft.. That must really chap Microsoft's hide. Haha.

In a panic, they try to pull the plug (1)

Gothmolly (148874) | about 5 years ago | (#28861337)

The rest is history.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>