[info] World's most powerful supercomputer goes online

[Eugen Leitl]

----- Forwarded message from Brandon Enright <bmenrigh at ucsd.edu> -----

From: Brandon Enright <bmenrigh at ucsd.edu>
Date: Sun, 2 Sep 2007 21:02:19 +0000
To: cryptography at metzdowd.com
Cc: bmenrigh at ucsd.edu
Subject: Re: World's most powerful supercomputer goes online
Organization: UCSD ACS/Network Operations
X-Mailer: Claws Mail 2.10.0 (GTK+ 2.10.14; i686-pc-linux-gnu)

On Sun, 2 Sep 2007 14:48:31 +0200 plus or minus some time Guus Sliepen
<guus at sliepen.eu.org> wrote:

> Experience with tinc (a VPN daemon with peer-to-peer like architecture,
> which replicates certain information to all daemons in a single VPN),
> showed that even in a network with only 20 nodes, it is extremely hard
> to get rid of information.  You either need to shut down all daemons at
> the same time to make sure all state is lost, or modify the software to
> allow explicit deletion of certain information. With more that 1 million
> nodes it will be even harder to delete data.
>   

Actually the stormworm network illustrates this example perfectly.  As with
most DHT based P2P networks, stormworm suffers from latent/stale node data
still in the memory of other nodes.  Asside from the overnet peer bootstrap
files for each stormworm node, the list of nodes in the network is
distributed in memory across all the nodes.

Stormworm is especially bad because the authors didn't take the latent
data problem into account.  There is no built-in mechanism for a botted
host to remove dead peers from their list in memory.  With tens of
thousands of nodes, IPs of machines that were infected and cleaned weeks
ago still occasionally show up.  I suspect this behavior is the primary
source of the ridiculously high (and inaccurate) estimates for the size of
the stormworm botnet.

Brandon

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE