Re: World's most powerful supercomputer goes online

I feel I should add a followup to the earlier post, this was
implied by the
rhetorical question about what the LINPACK performance of a
botnet is, but
I'll make it explicit here:

The standard benchmark for supercomputers is the LINPACK
linear-algebra
mathematical benchmark.  Now in practice the LINPACK
performance of a botnet
is likely to be nowhere near that of a specially-designed
supercomputer, since
it's more a distributed grid than a monolithic system.  On
the other hand bot-
herders are unlikely to care much about the linear algebra
performance of
their botnet since it doesn't represent the workload of any
of the tasks that
such a system would be used for.

Where Storm leaves every conventional supercomputer in the
dust is in terms of
the sheer hardware resources (number of CPUs, amount of
memory, and network
bandwidth) at its disposal.

Peter.

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography"
to majordomometzdowd.com

On Sat, Sep 01, 2007 at 03:46:45PM +1200, Peter Gutmann
wrote:

> I feel I should add a followup to the earlier post,
this was implied by the
> rhetorical question about what the LINPACK performance
of a botnet is, but
> I'll make it explicit here:
> 
> The standard benchmark for supercomputers is the
LINPACK linear-algebra
> mathematical benchmark.  Now in practice the LINPACK
performance of a botnet
> is likely to be nowhere near that of a
specially-designed supercomputer, since
> it's more a distributed grid than a monolithic system. 
On the other hand bot-
> herders are unlikely to care much about the linear
algebra performance of
> their botnet since it doesn't represent the workload of
any of the tasks that
> such a system would be used for.

Another interesting use may be data hiding. The botnet
software could
store information in RAM (never on disk), and replicate it
to other
nodes. If one node goes down, other nodes will still have
the
information. If one node detects that virusscanners or
forensic tools
are being used, it can easily wipe the information from RAM
or just
reboot the machine without fear that the information would
really be
lost.=20

Experience with tinc (a VPN daemon with peer-to-peer like
architecture,
which replicates certain information to all daemons in a
single VPN),
showed that even in a network with only 20 nodes, it is
extremely hard
to get rid of information.  You either need to shut down all
daemons at
the same time to make sure all state is lost, or modify the
software to
allow explicit deletion of certain information. With more
that 1 million
nodes it will be even harder to delete data.

-- 
Met vriendelijke groet / with kind regards,
      Guus Sliepen <guussliepen.org>

On Sun, 2 Sep 2007 14:48:31 +0200 plus or minus some time
Guus Sliepen
<guussliepen.eu.org> wrote:

> Experience with tinc (a VPN daemon with peer-to-peer
like architecture,
> which replicates certain information to all daemons in
a single VPN),
> showed that even in a network with only 20 nodes, it is
extremely hard
> to get rid of information.  You either need to shut
down all daemons at
> the same time to make sure all state is lost, or modify
the software to
> allow explicit deletion of certain information. With
more that 1 million
> nodes it will be even harder to delete data.
>   

Actually the stormworm network illustrates this example
perfectly.  As with
most DHT based P2P networks, stormworm suffers from
latent/stale node data
still in the memory of other nodes.  Asside from the overnet
peer bootstrap
files for each stormworm node, the list of nodes in the
network is
distributed in memory across all the nodes.

Stormworm is especially bad because the authors didn't take
the latent
data problem into account.  There is no built-in mechanism
for a botted
host to remove dead peers from their list in memory.  With
tens of
thousands of nodes, IPs of machines that were infected and
cleaned weeks
ago still occasionally show up.  I suspect this behavior is
the primary
source of the ridiculously high (and inaccurate) estimates
for the size of
the stormworm botnet.

Brandon

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography"
to majordomometzdowd.com