151 lines
8.0 KiB
Plaintext
151 lines
8.0 KiB
Plaintext
|
[Image]
|
|||
|
|
|
|||
|
|
Things that Go Bump in the Net
|
|||
|
|
|
|||
|
|
This is a brief look at some of the more colorful characters in the
|
|||
|
|
menagerie of network security threats, with an emphasis on how they relate
|
|||
|
|
to agent-based systems. The Massively Distributed Systems group in IBM
|
|||
|
|
Research conducts research into these and other emergent concerns in future
|
|||
|
|
distributed systems.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
Trojan horses
|
|||
|
|
|
|||
|
|
A Trojan horse is a program that does something that the programmer
|
|||
|
|
intended, but the user would not approve of if he knew about it in advance.
|
|||
|
|
Because most current security systems are based primarily on user-level
|
|||
|
|
privilege rather than program-level privilege, any program that you run can
|
|||
|
|
read any object you have read-access to, write to any object that you have
|
|||
|
|
write-access to, and execute any program or command that you are authorized
|
|||
|
|
to execute.
|
|||
|
|
|
|||
|
|
A Trojan horse concealed in a random game program downloaded from your
|
|||
|
|
favorite newsgroup can read any file you have read access to, and mail it
|
|||
|
|
anywhere in the world. It can erase, or just shuffle around a few bytes in,
|
|||
|
|
any file you can write to. It can send obscene messages to the White House,
|
|||
|
|
or post embarassing things to random newsgroups.
|
|||
|
|
|
|||
|
|
And it can copy itself into any program that you have write access to (see
|
|||
|
|
Viruses and Worms below).
|
|||
|
|
|
|||
|
|
In a mobile-agent system, it is critical to ensure that arriving agents
|
|||
|
|
execute in a controlled environment, and are able to do only those things
|
|||
|
|
that they are authorized to do. Agents should be trusted only as far as the
|
|||
|
|
least-trusted entity that may have been able to alter the program or
|
|||
|
|
internal state of the agent; secure authentication methods (such as digital
|
|||
|
|
signatures) must be used carefully when it is necessary to establish the
|
|||
|
|
real author or sender of an agent. See Itinerant Agents for Mobile Computing
|
|||
|
|
for some related security considerations in these sorts of systems.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
Viruses and Worms
|
|||
|
|
|
|||
|
|
A virus is a program (generally a Trojan horse) that spreads, by making
|
|||
|
|
copies of iteslf in one way or another. In the microcomputer environment,
|
|||
|
|
viruses generally spread by writing copies of themselves into other
|
|||
|
|
programs, or into boot records of disks and diskettes. (For more information
|
|||
|
|
on computer viruses in PC-compatible machines, see the IBM Computer Virus
|
|||
|
|
Information Center.)
|
|||
|
|
|
|||
|
|
A worm in a networked environment is generally a self-sufficient program
|
|||
|
|
that spreads by spawning copies of itself on other hosts in the network. One
|
|||
|
|
famous worm caused great disruption on the Internet in 1988. There is no
|
|||
|
|
hard line between viruses and worms; in general, if the spreading entity is
|
|||
|
|
a self-sufficient program, it will be called a worm, whereas if it embeds
|
|||
|
|
itself inside other programs or boot code, it will be called a virus.
|
|||
|
|
|
|||
|
|
Can a virus spread between agents in a mobile-agent system? So far, the
|
|||
|
|
consensus seems to be that there is no particular reason to allow one agent
|
|||
|
|
to alter the code of another already-existing agent. If the agent
|
|||
|
|
infrastructure does not allow this, no virus will be able to spread from
|
|||
|
|
agent to agent. On the other hand, if the infrastructure accidentally or
|
|||
|
|
purposely does allow one agent to alter another, inter-agent viruses will be
|
|||
|
|
possible.
|
|||
|
|
|
|||
|
|
Are worms possible in mobile-agent systems? If one agent can create another
|
|||
|
|
agent, the possibility of runaway worm reproduction exists. Agent
|
|||
|
|
reproduction must be controlled in one way or another to limit the
|
|||
|
|
possibility; if agents can create other agents, they must be charged in some
|
|||
|
|
scarce currency, or limited in how large their tree of descendants can get,
|
|||
|
|
or otherwise kept from having children and grandchildren without bound.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
Flash Crowds
|
|||
|
|
|
|||
|
|
The term Flash Crowd was first used by Larry Niven, in a science fiction
|
|||
|
|
short story. In the story, cheap local teleportation has become possible;
|
|||
|
|
now, the sites of attractive news stories are instantly innundated with
|
|||
|
|
rubberneckers teleporting in to watch.
|
|||
|
|
|
|||
|
|
As systems become more interconnected and more powerful, we have the
|
|||
|
|
equivalent of cheap teleportation; if a Web site becomes known as
|
|||
|
|
particularly interesting, its usage curve can go exponential, causing
|
|||
|
|
network bottlenecks and server crashes. In networks of agents, a vast number
|
|||
|
|
of similarly-programmed agents, like a horde of similarly-programmed trading
|
|||
|
|
programs causing a market crash, can cause network congestion and server
|
|||
|
|
overload. And if the agents all adopt similar fallback strategies in
|
|||
|
|
response to overload, the flash crowd can migrate from server to server on
|
|||
|
|
the net, leading to surging hard-to-remedy travelling overloads.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
Weeds, Freeloaders and Flying Dutchmen
|
|||
|
|
|
|||
|
|
A weed is a program (or anything else in a system) that does no one any
|
|||
|
|
good, but that uses such a small amount of resources that it's often not
|
|||
|
|
cost-effective to do anything about it. Eventually, weeds start to
|
|||
|
|
accumulate, and it's time to get out the clippers. Or the herbicide.
|
|||
|
|
|
|||
|
|
A freeloader is a program that uses some system or server resources to
|
|||
|
|
survive and possibly benefit its creator, without paying for them. Servers
|
|||
|
|
may provide some minimal service for free, in order to attract paying
|
|||
|
|
customers, or unintentionally, as an unintended effect of complex cost
|
|||
|
|
structures; there may be ways to arrange for some transaction charges,
|
|||
|
|
especially small ones, to be lost in the shuffle. A freeloader exploits
|
|||
|
|
these sorts of things to operate free of charge.
|
|||
|
|
|
|||
|
|
Named for the legendary ghost-ship, a Flying Dutchman is a freeloader that
|
|||
|
|
manages to become effectively immortal, without paying for the resources
|
|||
|
|
that it uses to survive. A Flying Dutchman may move from host to host, never
|
|||
|
|
quite using enough resources to be killed; it may spawn a copy of itself on
|
|||
|
|
another host just before it is terminated, ensuring an unending gene-line.
|
|||
|
|
|
|||
|
|
A Zombie is similar to a Flying Dutchman; it is a program that has been
|
|||
|
|
terminated, but continues to consume some resources anyway, due to
|
|||
|
|
(sometimes infinite) delays in cleaning up all the resources associated with
|
|||
|
|
it. Zombies can sometimes get enough resources to do actual processing; more
|
|||
|
|
often, they exist only as the undead owners of various kinds of space.
|
|||
|
|
|
|||
|
|
A single freeloading or immortal program will not in itself damage a
|
|||
|
|
distributed system, and we anticipate that a typical agent-based system will
|
|||
|
|
tolerate a low level of freeloading. An analogy is to physical stores, which
|
|||
|
|
will tolerate a certain number of people coming in to get out of the rain
|
|||
|
|
and using the restrooms, on the chance that they may eventually buy
|
|||
|
|
something.
|
|||
|
|
|
|||
|
|
Uncontrolled, a large number of weeds can waste significant amounts of
|
|||
|
|
system resources; distributed systems will need the ability to monitor this
|
|||
|
|
sort of activity, and impose controls if it gets out of hand. Requests from
|
|||
|
|
known freeloaders may be charged for, even in cases that are normally free.
|
|||
|
|
Intelligent monitoring processes may be needed to identify and terminate
|
|||
|
|
intentionally or accidentally immortal programs that are serving no useful
|
|||
|
|
purpose. Other sorts of weeds will no doubt require other sorts of
|
|||
|
|
solutions; the unexpected is likely.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
The Usual Suspects
|
|||
|
|
|
|||
|
|
As well as these new and somewhat speculative threats, most of the
|
|||
|
|
traditional computer-security worries, such as basic access control,
|
|||
|
|
authentication, secure encryption, and so on, also apply to network and
|
|||
|
|
agent security. IBM Research has various other security-related projects. Or
|
|||
|
|
follow this link for some good leads on both traditional and non-traditional
|
|||
|
|
computer security topics in the rest of the universe.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
David Chess, chess@watson.ibm.com
|
|||
|
|
|
|||
|
|
Thanks to Gene Spafford at Purdue, whose talk "Viruses, Worms, and Things
|
|||
|
|
that go Bump in the Net" may have inspired the title for this page; tricky
|
|||
|
|
things, replicators!
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
[ IBM home page | Order | Search | Contact IBM | Help | (C) | (TM) ]
|