Forgot your password?
typodupeerror
Security Software Supercomputing Wine

Sandia Studies Botnets In 1M OS Digital Petri Dish 161

Posted by kdawson
from the million-bottles-of-wine-on-the-wall dept.
Ponca City, We love you writes "The NY Times has the story of researchers at Sandia National Laboratories creating what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of botnets. Sandia scientist Ron Minnich, the inventor of LinuxBIOS, and his colleague Don Rudish have converted a Dell supercomputer to simulate a mini-Internet of one million computers. The researchers say they hope to be able to infect their digital petri dish with a botnet and then gather data on how the system behaves. 'When a forest is on fire you can fly over it, but with a cyber-attack you have no clear idea of what it looks like,' says Minnich. 'It's an extremely difficult task to get a global picture.' The Dell Thunderbird supercomputer, named MegaTux, has 4,480 Intel microprocessors running Linux virtual machines with Wine, making it possible to run 1 million copies of a Windows environment without paying licensing fees to Microsoft. MegaTux is an example of a new kind of computational science, in which computers are used to simulate scientific instruments that were once used in physical world laboratories. In the past, the researchers said, no one has tried to program a computer to simulate more than tens of thousands of operating systems."
This discussion has been archived. No new comments can be posted.

Sandia Studies Botnets In 1M OS Digital Petri Dish

Comments Filter:
  • Life imitates XKCD (Score:5, Interesting)

    by Tackhead (54550) on Tuesday July 28, 2009 @05:46PM (#28859543)
    Once again, life imitates XKCD: Network [xkcd.com].
  • by iamapizza (1312801) on Tuesday July 28, 2009 @05:47PM (#28859553)

    what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of botnets

    If they've set up this mini-internet and have set up this botnet, then the easiest way to understand its behavior would be to look at the source code

    • Re: (Score:3, Funny)

      by Ant P. (974313)

      OK, here's seven hundred million lines of source code. Come back when you've solved the halting problem.

      • Re: (Score:3, Funny)

        by AliasMarlowe (1042386)

        OK, here's seven hundred million lines of source code. Come back when you've solved the halting problem.

        Power switch. Halts that sucker every time.

    • Re: (Score:2, Informative)

      by leuk_he (194174)

      The source code does not help you to imange what happens in peer to peer network with very large amounts of cleints that have a different kind of environment. Not to mention software that has bugs.

      BTW... who is the first to post to the xkcd comic about it [xkcd.com] normal people have aquaria

      • Re: (Score:2, Informative)

        by dotgain (630123)

        BTW... who is the first to post to the xkcd comic about it

        Uhh, the First Post?

    • by Sta7ic (819090) on Tuesday July 28, 2009 @06:19PM (#28859925)

      Just like the easiest way to understand how a dog works is to dissect them.

      In short, no. You can figure out how some of the parts work, but there's a lot within complex software that is non-deterministic, whether for internal, external, or thoroughly inadvertant reasons on either side. Just because you _think_ you know what it's doing doesn't mean it'll act the way you expect it to.

      Also, see http://xkcd.com/397/ [xkcd.com]

      • by Vellmont (569020)

        If it's unclear what the code does, run it in a debugger and control the inputs. Step through the code line by line. If the debugger doesn't do everything you want, write a better debugger.

        I have to agree that this seems like a silly idea. Comparing the complexity of a botnet program to a dog is silly. It also ignores the fact that code run in a debug environment can look at every single aspect of running code while it's running. A dog is obviously many many many orders of magnitude more complex.

        • by caramelcarrot (778148) on Tuesday July 28, 2009 @07:27PM (#28860529)
          Simple rules can give rise to complex behaviour. Who knows what the botnet might do? It could have harmonic resonances, it could have phase changes at critical infection rates, it could do all sorts of interesting and complex behaviour. Looking at the source code won't tell you any of this.
          • Re: (Score:3, Insightful)

            by Vellmont (569020)

            Maybe. But why use ACTUAL botnets for this purpose and not study the underlying algorithms and infection behavior directly? That would give you the ability to generalize instead of relying on -botnet X, version z-

            If that's what you care about, study it. Why rely on botnet authors to code some arbitrary botnet spreading code when you can write your own and study various different scenarios at will?

            • I'm sure both approaches have valid benefits, and both approaches will be tried, even if not by this particular research group.
        • by swillden (191260) <shawn-ds@willden.org> on Tuesday July 28, 2009 @11:58PM (#28862125) Homepage Journal

          If it's unclear what the code does, run it in a debugger and control the inputs. Step through the code line by line. If the debugger doesn't do everything you want, write a better debugger.

          Is that right?

          Here, I'll describe a program so simple it can be coded in under 100 lines, and can be fully specified in a few sentences, then ask you a question about its behavior. It should be easy, right?

          There is a 100x100 grid of cells. Each cell is in one of two states "live" or "dead". Each cell has 8 neighbors, the cells horizontally, vertically and diagonally adjacent (the edges of the grid "wrap", so this is true even for edge cells). Each "generation", the state of the cells is updated according to the following rules:

          1. Any live cell with fewer than two live neighbours becomes dead.
          2. Any live cell with more than three live neighbours becomes dead.
          3. Any dead cell with exactly three live neighbours becomes live.
          4. All other cells remain unchanged.

          That's it. Now, given an initial state of the grid, tell me what the state is after 100, 500 and 1000 generations. Further, tell me whether or not any patterns of live cells will survive across across generations. Will patterns repeat? Can patterns move? Interact?

          Amazing complexity can arise from very simple rules. In this case (known as Conway's Game of Life, if you hadn't recognized it), the above rules contain enough power that if you make the grid infinite in size, the result is a Turing-complete computation system. In addition, the shifting patterns it creates are bewildering in their number, complexity and behavior.

          Now scale that up to thousands of lines of code. Granted, not code specifically chosen to create interesting interactions, but still 2-3 orders of magnitude more complex. Further, code that itself lives in and interacts with a complex and varied ecosystem of other code, some of which is trying to detect the code and kill it -- so the code is written to be self-modifying, to "mutate" a bit, after a fashion. Also add in the ability to migrate between "ecosystems", reproduce, receive deliberate external updates and instructions, etc.

          Simulation is the only way to get a handle on this sort of thing. And that's why the very smart people who designed and built the world's first million-machine simulator decided to do it.

      • by knarf (34928)

        Just like the easiest way to understand how a dog works is to dissect them.

        If by dissecting the dog you got access to the 'source code' of the 'program' which runs the dog you might actually get a better idea of how a dog functions and *why* it does so. Alas, this is not possible - yet. Genetic information can be decoded quite easily nowadays but whatever goes on in the brain is still mostly a mystery.

    • by Gerzel (240421) *

      Exactly and biologists should only look at the DNA of animals to understand their behavior.

      Just because we know what the instructions are doesn't mean we can account for what will happen when those instructions actually meet any given environment. Even simple things like instructions for installing or using software should be tested on some users in order to see their pitfalls and problems.

    • Re: (Score:2, Insightful)

      by coreboot (1607489)
      not really. Source code analysis goes just so far. Multiplied by 1M, it goes less far still. And then there's this little issue: http://en.wikipedia.org/wiki/Halting_problem [wikipedia.org]
      ron
    • by X0563511 (793323)

      Just like the easiest way to understand human behavior is to look at our genetic code?

      Nope. It's not that simple at that level.

    • Re: (Score:3, Insightful)

      by voidphoenix (710468)

      You can't study emergent behavior [wikipedia.org] by studying source code. Even within one host, the interactions between malware, applications and every the piece of the OS would already have emergent properties. Magnify by tens of thousands to millions (exponentially [wikipedia.org], not additively or multiplicatively), and the sheer complexity of the entire system would overwhelm our ability to understand it.

      We have ~100 billion neurons and ~100 trillion synapses. At 2^N - N - 1 subgroups, how many pieces before the system's complexity

    • You have the source for this trojan? First, I'd pay well for it. Second, there are some guys that wanna talk with you.

      Even if you had the source (which isn't really that long, judging from its disassembly), it's like trying to figure out how two different classes play in an MMO from the values of their attacks. If it was easy, balancing would be trivial.

      Also, this "petri dish" allows you to test vaccines and remedies, and check how successful they are. With much better accuracy than a statistical "what if"

    • by mikael (484)

      If they've set up this mini-internet and have set up this botnet, then the easiest way to understand its behavior would be to look at the source code

      By that logic, by dissecting a single neuron you would be able to understand how a human brain works. Unfortunately, human brains have a wide number of different neurons, each of which serve a separate purpose. While the DNA may contain the instructions to build a brain, it's not possible to deduce what the final layout will be.

      Similarly, in a botnet, each host

  • by CorporateSuit (1319461) on Tuesday July 28, 2009 @05:48PM (#28859559)
    The first thing the researchers noticed is that within 30 minutes, the botnet had sent over 6 billion emails out of newly-registered gmail and hotmail accounts, and continued to send millions more each hour. The researchers say the botnet thrives on pain and misery, and probably shouldn't have been given access to the real internet.
    • by Nefarious Wheel (628136) on Tuesday July 28, 2009 @05:56PM (#28859681) Journal
      My first thought meme was "Yes, but does it run Linux?" ("Megatux". Duh.) Then I thought - hang on, how can you develop a botnet that runs on Linux in the first place? And if you did, how would it reflect the nature of real botnets if those millions of operating systems weren't running NT4 or variants?

      Then it got surreal - I imagined all those bots emulating the game of life [wikipedia.org], with little dots flashing on and off, and little gliders and factories...

      Ok, I'll go back to work now.

  • by n0tWorthy (796556) on Tuesday July 28, 2009 @05:49PM (#28859581)
    Then they can run 1 million copies without a subscription.
    • Re: (Score:3, Informative)

      by Anonymous Coward

      Someone marked this as 'funny' but it is true. Read the license it is per user... If your creating a cluster with THOUSANDS of nodes and testing things you are perfectly within your rights to do this. You can even get most of the different versions of the OS going. 98, 98se, 95 (shudder), ME (double shudder), NT4, 2k, XP, Vista, 7, etc... Putting different versions at different patch levels etc...

      http://msdn.microsoft.com/en-us/subscriptions/cc150618.aspx [microsoft.com]

      They lost me at Wine. As that would not truly c

      • by Fred_A (10934)

        They lost me at Wine. As that would not truly create the environment they are trying to describe.
        I have had up to 100 desktops all going from 10 msdn licenses (10 users). With different levels of the OS to test install and different configurations. They probably dont even need a very high level of it.

        You're looking at this at the wrong level. They're interested in what the botnets do, not in what the hosts do. What runs the botnet software is irrelevant as long as it runs it.

      • by sjames (1099)

        Just imagine all the clicking to set up and manage 1 million Windows environments. No mouse can stand up to that. Imagine all the bandwidth 1 million copies of windows phoning home would burn up.

  • I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

    However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?
    • Re: (Score:2, Insightful)

      by geegel (1587009)
      Welcome to the world of open source software. The place where you can modify the code in any way you want.
      • Welcome to the world of open source software. The place where you can modify the code in any way you want.

        Though Wine is just an API, AFAIK. It would seem that you would need to modify it extensively to actually have it truly behave like Windows. And I suspect not all botnet infections exploit the same Windows flaws, so wouldn't the total number of vulnerabilities to implement into Wine to reach the same level of vulnerability be rather substantial?

        • by geegel (1587009)

          Actually it would be plain more easier to just code their own virii and botnets, while modifying Wine slightly to make sure that the virtual computers get infected and the infection vector works.

          They are not interested in how a certain virtual computer behaves like after all, but rather on how the mini-internet looks like as a result of these infections.

        • Re: (Score:3, Insightful)

          by amicusNYCL (1538833)

          Since this is a closed environment for a scientific study, it would make sense for them to use viruses which spread via exploits that they know are present.

          • Since this is a closed environment for a scientific study, it would make sense for them to use viruses which spread via exploits that they know are present.

            Captain Obvious here... If they create the exploits and viruses themselves, they might have a pretty good idea of the infection vectors. It doesn't have to be what's in the wild now. Even better that it NOT be; after all, Robert Morris didn't expect his worm [wikipedia.org] to replicate as far as it did, either...

        • by hairyfeet (841228) <bassbeast1968&gmail,com> on Tuesday July 28, 2009 @10:36PM (#28861693) Journal

          As an old greybeard PC repairman I can tell you that Windows bugs are screwing around with the guts of Windows more than any tweaked Wine could ever replicate. I don't see why they wouldn't just pony up for MSDN where they could then run all the real Windows versions they wanted and then get more realistic results. This seems like they are going pretty far out of their way to keep from spending a buck, when the cost of that monster PC makes being so "penny wise, pound foolish" seem extra crazy to me.

          But IMHO you aren't gonna see how a real botnet works without running real unpatched Windows boxes. I used to keep a box here in the shop for dropping bugs on to find the best ways to clean them (before cleaning got to be pointless) and the amount of crap some of these bugs were screwing with was just mind blowing, we are talking fake .tmp files, stuff hidden in places like program files/ windows media player, a couple that would even rip out different windows system files and replace them with their own hacked versions, just really crazy stuff. But since Wine is primarily a very tiny subset of the Windows susbsystem I really don't see how they are gonna get any real results from this.

          If it was just some guys playing in their basement I would think "okay...maybe cool" but spending the amount they did on that "Bigtux" makes it just nuts not to buy an MSDN and run a real simulation. I feel this is a moment where we need the late Graham Chapman to come out in his military uniform and tutu and demand that they cease and desist for being just too silly, because spending all that cash to study Windows botnet behavior and then cheaping out on a ...what? $600 MSDN license? It is just too silly.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Modifying Wine to emulate a Windows machine which is vulnerable to viruses does not result in a Windows machine. You still just have Linux running Wine. The very idea behind these tests is already critically flawed.

        A previous poster already got it right. The researchers should just buy a MSDN Universal license and legally run 1M instances of actual Windows. Otherwise, their findings will have little to no real value (IMO).

        • Re: (Score:1, Insightful)

          by Anonymous Coward

          Hell, they should have just called Microsoft, said "we'd like to do this research" and gotten a license to do things that way.

          • You wouldn't expect to pay for a million licenses, but then you wouldn't expect to pay for any additional licenses ....
          • So they can come up with study results that say "The vast majority of Windows boxen out there are horribly misconfigured and using out of the box defaults, making Windows one of the most insecure OS's in the world." I don't think there are enough chairs for Ballmer to throw when he sees those results...
        • by amicusNYCL (1538833) on Tuesday July 28, 2009 @06:34PM (#28860089)

          The research isn't to determine how Windows reacts to a botnet. They're trying to figure out how the botnet itself communicates and spreads. Or, more specifically, what the botnet looks like as it is spreading. Windows is just the platform that they're running the botnet on (sort of), but they don't really care how Windows reacts to it.

          In other words, they're studying the botnet itself, not the infrastructure it runs on.

    • by mcrbids (148650) on Tuesday July 28, 2009 @06:02PM (#28859745) Journal

      I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

      WINE is an implementation of the Win32 API. Since the *target* of WINE is to emulate Windows, then in order to be successful, it must implement the bugs as well. So the better WINE is, the better it runs *ALL* Windows software - including the viruses and malware!

      I would assume (ass + u + me) that they've done enough unit testing on the particular botnet software in question to determine its compatibility with WINE, and so long as this compatibility is sufficient, then this could be a very useful test environment. It's the botnet being studied, not Windows itself!

      Another example: Windows 2000. I build data management software. I test with Windows 2000. Not because Win2000 is an example of the latest greatest from MS, but because it costs me nothing extra and runs nicely in a VM. Since the only O/S features I care about are those that are already present in Win2000, it creates a very useful test environment despite lacking many pieces present in later OS versions.

      • Re: (Score:2, Funny)

        by CarpetShark (865376)

        I would assume (ass + u + me)...

        ASL?

      • by rm999 (775449)

        "Since the *target* of WINE is to emulate Windows"

        I hope I'm not missing your point, but WINE stands for "WINE Is Not an Emulator". It's a compatibility layer, and I'm sure it wouldn't keep any bugs that exist in Windows. Code that is required to run legitimate software is not a bug.

        • Actually, many of the things that make windows incompatible (Microsoft's embrace and extend) are bugs of one kind or another. For instance, often, websites written to work with IE's bugs don't work on functioning browsers that don't have those bugs. I think there are similar issues with kerberos, etc. So WINE does have to implement some buggy things exactly as they are on windows. Obviously, especially with security bugs, it tries to make things work without the bugs, or at least without them affecting

          • by rm999 (775449)

            You are talking about IE, I am talking about the Windows kernel and core dlls. Yes, IE is a buggy POS, but the Windows NT kernel is extremely mature, and any bugs in it would only hinder applications.

            I'm sure the researchers will be running some buggy versions of IE 6, but my comment was about WINE specifically.

    • Re: (Score:2, Insightful)

      by EdIII (1114411) *

      I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

      However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

      Yeah, I call bullshit that on too. If you want to study botnet behavior, which include

      • by Anonymous Coward on Tuesday July 28, 2009 @06:16PM (#28859891)

        I can't possibly imagine how a simulation of millions of instances of your software infecting itself would be good PR.

        • I respectfully disagree...have you read any Microsoft TCO papers?

          Reading them is like watching David Copperfield make a pyramid disappear.

        • Probably about how encouraging every user to use a tool that publicly admits to security flaws is good PR. Customers like to hear that the software they buy is being secured by ongoing research.
      • Re: (Score:2, Funny)

        by Anonymous Coward

        I understand not wanting to buy 1M windows licenses; I am of the persuasion that is not inclined to buy 1 license.

        However, the summary seems to claim that Wine == Windows environment. I don't see how they are analogous in this sense. In particular, if you are trying to understand botnet behavior, you need infected botnet systems. Is there a way to make Wine vulnerable to the infections that frequently hit Windows systems?

        Yeah, I call bullshit that on too. If you want to study botnet behavior, which includes studying malware and viruses, then it should be a "real" Microsoft OS. I don't think WINE counts.

        I am not the biggest fan of ol' M$, but considering how interesting this research is and it's possible positive impact on the greater community (which does benefit Microsoft) you would think they would at least ask Microsoft for some licenses gratis.

        Microsoft would probably be reasonable, if just for the good PR, which they sorely and always need.

        True... But if they did use *real* windows instead of Wine, then the supercomputer could only virtualise a few hundred copies of Windows XP running simultaneously, or 2-3 copies if it's Vista. :E

      • by eclectro (227083)

        Microsoft would probably be reasonable, if just for the good PR, which they sorely and always need.

        Hey guess what everyone?? There's millions of our OS infected with viruses because we have never been able to fix the code!

        • Hey guess what everyone?? We just rented a 4,480-processor supercomputer and set up a fascinating experiment in an attempt to better understand how we can secure our software. Look at all the money we're pouring into making our products better!
          • Hey, that's great! What did you find?

            Well... that it takes nanoseconds to infect our system.

            Oh... and what are you doing against it?

            Umm... beats me...

      • by Sycraft-fu (314770) on Tuesday July 28, 2009 @06:33PM (#28860077)

        I work for a university and MS is extremely generous with academic licensing. When it is for academics, like education or research, it is actually no cost. For infrastructure it does cost, but not very much. I bet if they asked MS, MS would give them all the licenses they needed for little or no cost.

        For that matter, they might be eligible for volume licensing. That is where you pay a fixed yearly fee and get an unlimited use of the software it is for. Often that is based on total academic headcount, which might not be very much.

        Regardless, if they asked I'd give good odds MS would figure out a way to offer them a good deal.

        I'm also with you that if you want to study something, you need to run it on the actual environment. Wine is a neat idea and a neat goal, but anyone who has made use of it for more than simple testing well tell you that it has some serious issues. Not only do things not run, worse is that they'll run but not completely correct. For a user this might be fine, something works in a bit of an unexpected way, you just work around it. For research though, it could mean your conclusion is invalid.

    • by ammorais (1585589)
      The objective is to study botnet behavior and propagation on Windows environments on large scale.
      They don't need everything to work on WINE. They just need the some specific software like the botnets they use to behave and propagate exactly like in windows.
      And that can be easily achieved.
    • by MaskedSlacker (911878) on Tuesday July 28, 2009 @06:18PM (#28859921)

      I think you're misunderstanding what they are doing. They are not studying in-the-wild worms. They are trying to build theoretical models of botnets and how they propagate through networks--this is the equivalent of computer simulations of viral epidemics. You don't need to simulate what the virus does in a person to study how it spreads through a population.

      • Re: (Score:3, Interesting)

        by vux984 (928602)

        I think you're misunderstanding what they are doing.

        I think you are correct. However, that raises the question: why use WINE?

        Since they aren't relying on 'real in the wild exploits' they could model botnets and how they proagate through networks on linux or freebsd just as easily. Its really just specialized p2p and client server software to simulate botnet behaviour and spread.

        • Re: (Score:3, Informative)

          WINE is far less resource intensive, and typically runs far faster, than fully virtualized simulation software, especially because it leaves out the basically rewritten-VMS kernel and memory management of the Windows kernel in favor of Linux's own pretty zippy kernel. And the cost of buying and running a million actual Windows boxes to avoid the performance penalties of virtualization is simply infeasible.

      • by cenc (1310167)

        They are studying the net more than the bot. It is just simpler to create a super cheap net of bots on wine, then I am sure they have just for fun tossed in a couple virgin copies of windows to keep them fed and find out if they differ much from the wine versions. Bots are extreamly simple animals in isolation. It is the colective that gives them balls.

    • Just send the username, password, and IP address of a few of the virtual machines to Nigeria or somewheres, and let the fun begin.

      Besides, the idea to not really to view the infections, it's probably to monitor how the botnets behave as a horde, and deduce who controls it and what their objectives are. That's nearly impossible from observice just a few machines.

    • I was wondering the very same, and I don't think it's a good idea to use this machine for exploits that use a security problem in a part of the Windows OS, but in this special case the exploit relies on third party software (in this case, flash) which can be installed in Wine just like it would be in Windows, thus making the use of Wine possible. Despite being from Adobe and Adobe products being notorious for not behaving nicely under Wine.

      (seriously, when it's easier to run MS-Office on Wine, a product whe

  • Wine? (Score:5, Insightful)

    by Facegarden (967477) on Tuesday July 28, 2009 @05:52PM (#28859619)

    I understand using WINE to avoid license fees, but wouldn't that potentially hinder the results of the experiment? I suppose that if they knew what functionality was needed by the botnet, they could be sure WINE provided what they needed, but it also seems like they might be able to work out a deal with MS to get a free site license for use in this test only, since it betters the computing world in general, which ultimately benefits microsoft?

    Seems like a few phone calls might go a long way, if they get a hold of the right people.
    -Taylor

    • by Shikaku (1129753)

      Wine can get Windows viruses.

      • by gad_zuki! (70830)

        Yes, but which ones? Trojans just set to run in userspace? Is this any different than just running a million .exe's and not really infecting anyone or emulating a real infection vector?

        I dont see how, say, conficker would infect these machines. The RPC exploit doesnt exist in wine.

    • ...Except for that they basically would have to say "Hey MS, your code is broken, so broken that we need free licenses in order to show the world how broken it is". While it is a great idea and would benefit them, all MS can see is bad press, and they want to avoid that.
      • Re: (Score:3, Informative)

        by Facegarden (967477)

        ...Except for that they basically would have to say "Hey MS, your code is broken, so broken that we need free licenses in order to show the world how broken it is". While it is a great idea and would benefit them, all MS can see is bad press, and they want to avoid that.

        I'm pretty sure that the notion of windows being susceptible to malware and viruses is probably something Microsoft has come to terms with, i really can't imagine anyone getting terribly upset. Viruses exist, someone wants to do some research, it shouldn't be that offensive of an idea.
        -Taylor

      • I thought MS used the "any press is good press" thinking, or is that just limited to Apple, music, and movies.
    • Scientist: "I would like to buy 1 million Windows XP licenses for my botnet research."
      MS: "That would be 300 Million dollars please. Muahahaha!"
  • WINE (Score:3, Insightful)

    by Phroggy (441) <[moc.yggorhp] [ta] [3todhsals]> on Tuesday July 28, 2009 @05:55PM (#28859671) Homepage

    Can a botnet run on WINE with 100% compatibility? Doesn't malware often use exactly the same kinds of tricks that WINE doesn't fully implement? This might not create an accurate picture.

    Also, are they simulating network latency between nodes? Many bots take this into account.

    • Re:WINE (Score:5, Funny)

      by monopole (44023) on Tuesday July 28, 2009 @06:20PM (#28859933)

      I hope Microsoft issues a statement that only Genuine Windows software can fully support viruses and malware in an effective fashion.

      • Re:WINE (Score:5, Funny)

        by Eighty7 (1130057) on Tuesday July 28, 2009 @07:03PM (#28860355)
        In other news, Miguel de Icaza said that he believes botnet support is a good idea. Linux should support malware because Microsoft is going to win anyway, so linux would better be prepared if it doesn't want to be locked out of the future markets, and presented a beta version of the software. Members of the Mono project are participating in the standarization.
    • by Lehk228 (705449)
      if they are testing botnet behavior, they can do so while fudging the details of infection.
  • by zmollusc (763634) on Tuesday July 28, 2009 @06:00PM (#28859707)

    and nobody yet has imagined a beowulf cluster of these? Standards are slipping!

  • by Tubal-Cain (1289912) on Tuesday July 28, 2009 @06:00PM (#28859717) Journal
    Wine's come a long way in the past 4 years [linux.com] if it can run viruses now!
  • by coreboot (1607489) on Tuesday July 28, 2009 @06:13PM (#28859859)
    Hi, Ron here. Just thought I would mention a few things.
    I love the "life imitates xkcd" aspect. :-)
    We're well aware that Wine is not quite enough to run many windows bots. Until a year or so ago, however, there was a researcher in North Carolina running Storm under Wine, but he told me that that effort ended when Storm added a kernel driver. We've got some ideas in that area. We expect that implementing them will cost less than 1 million Vista licenses.
    I was surprised to find I have become a cybersecurity expert! What I really am is an HPC expert who is using HPC tools and resources to build a system for studying cybersecurity phenomena on a millions-of-nodes scale.
    Doing anything with a million of something gets interesting fast. There's a lot of interesting challenges.
    Thanks
    ron
    • by PCM2 (4486) on Tuesday July 28, 2009 @06:34PM (#28860095) Homepage

      Well Ron, since you're here, I'm curious whether you had in fact tried to approach Microsoft for a free site license. You could explain to them that you're doing security research in a unique environment and that you'd be willing to share your results with them, etc. I could even imagine a distorted PR spin where the fact that all this major security research is being done on Windows shows that Windows is clearly the dominant operating system, blah blah...

      Or if Microsoft doesn't see the value of the kind of information your research could yield, maybe someone like Symantec would be willing to buy a license and donate it to you (if that's even possible, given EULAs etc.)?

      • Do you really think it would be easier to set up (and periodically reinstall) a million copies of Windows vs. telling Linux to virtualize a million instances? I mean, it would be nice to run on the real deal but there are practical issues to consider.

        • Re: (Score:3, Informative)

          by PCM2 (4486)

          Do you really think it would be easier to set up (and periodically reinstall) a million copies of Windows vs. telling Linux to virtualize a million instances?

          I'm assuming they would do both. If they didn't have to individually license each Windows instance, it would be trivial to clone a million virtualized instances of a fresh Windows install. (I'm sure he's right that this would make resource management more difficult/costly than using WINE, however.)

      • by coreboot (1607489) on Tuesday July 28, 2009 @07:38PM (#28860609)
        We will probably approach MS at some point, if it appears to be necessary, and see if they are interested. I do have friends there who might be interested in what we're doing.
        The biggest limit we've found on the VM side is memory footprint of the VM guests, and it's very easy to control that with Linux; harder with Windows. We have some ideas in that area too, but it's way too early to speculate on them.
        But from my point of view, it is a lot easier to do this kind of work in Linux than in Windows (I have done NT drivers in a past life), not least because of the openness of the environment. Hence, I'd rather try to find a way to make it all work on Linux.
        Consider this work the beginning of the story; it's not even chapter 1, maybe it's the preface. There's a lot of work left to do. There's a lot we still don't know.
        thanks
        ron
  • by node 3 (115640) on Tuesday July 28, 2009 @07:10PM (#28860411)

    What about Norton Antivirus? Specifically they should run a second experiment with a simulation of 1 million systems running Norton Antivirus, and compare the results of the first test to see which has the greatest adverse effect...

    • by sootman (158191)

      If they had a million VMs running NAV, the heat generated from CPU and disk usage would cause the data center to melt through the floor and start sinking to the center of the Earth.

  • Old News... (Score:5, Funny)

    by davevr (29843) on Tuesday July 28, 2009 @11:03PM (#28861843) Homepage
    There is already a system running somewhere around 420 million windows machines in a semi-private walled-off version of the internet, with no license fees paid to Microsoft, hosting several botnets and just about every virus under the sun.

    It is called "China".
  • by Entropius (188861) on Wednesday July 29, 2009 @12:20AM (#28862253)

    The researcher posted up above saying he's an HPC researcher, not a computer security guy, and in that context using Wine makes sense.

    HPC people typically study emergent behavior -- how a lot of nodes interacting by simple rules generate complicated phenomena. The challenge is coming up with the simple rules in a form that accurately captures whatever leads to the emergent behavior you want to model. In this case, "actually being Windows so all the viruses work exactly right" is less important than getting a lot of nodes running to capture the interesting behaviors of viruses spreading through a large network.

    Supercomputing is difficult on Windows. I'm at a computational physics conference now, and everything runs on Linux just because it's bloody *easier* to make everything go. I doubt many people here would even know *how* to run our models on a Windows supercomputer.

    Performance issues aside, my guess is that the fellow chose Linux because the computer *already* ran Linux.

  • by Michael Woodhams (112247) on Wednesday July 29, 2009 @12:42AM (#28862359) Journal

    for bots. Poor little things think they're in the real world.

  • by longacre (1090157) on Wednesday July 29, 2009 @03:14AM (#28863103) Homepage
    And in related news, Hummer will join the Formula 1 circuit next season.
  • Wine, making it possible to run 1 million copies of a Windows environment without paying licensing fees to Microsoft

    I sense a great disturbance in the arrangement of furniture in Microsoft's underground fortunes somewhere deep beneath the 'LOST' island....

  • Can you imagine... a Beowulf cluster of these!

  • Where will they get the one million lusers to download and spread the botnet in the first place?

    Does the Big Brother "show" still exist and recruit "people"?

Is a person who blows up banks an econoclast?

Working...