Slashdot Mirror
UCB, USC To Build (And Hack) A Model Internet
darksoulz writes "Associated Press stories from TheKansasCityChannel.com and TheChamplainChannel.com have an interesting report today. It appears that the U.S. Government has given a $5.5 million grant to the University of California, Berkley and the University of Southern California so that they can build a model of the internet, so they can hack it. They are trying to find better defenses against hacking, without breaking the real Internet. The first phase is scheduled to be completed by February."
someone's gonna get a shiny new network outta this
$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.
Man, we already know what came out of Berkeley before is a resounding success (see here). Is it time to have a stillborn?
(dammit, it's supposed to be a joke and I'm just not funny today. grrr.)
If you were me, you'd be good lookin'. - six string samurai
Who is John Galt?
Watch for someone to sue these guys under DMCA and government hacking laws because they create their own net and hack it.
(Just like you'll have a few lawyers salivating over the lawsuits if someone creates their own copy protection method for CD's and cracks it during testing. DMCA!!! DMCA!!!)
Surgeon General's Warning:
Failing to get the first post may cause homoerotic behavior toward slashdot editors. Slashdot trolls contain carbon monoxide.
How useful it was to have two completely unique articles, both of which shed light on the issue in a completely different way to the other...
The articles (which are identical) don't go too much into details. What exactly are they doing that is going to cost $5.5 million dollars? Are they planning on making it a coast to coast thing? Isn't the internet just a big ass network?
I mean, will sixty percent of it be model porn?
http://mediagoblin.org/
The research is funded by the National Science Foundation and the Department of Homeland Security.
If they find fundamental flaws in the systems will they keep them secret to shore up US networks while leaving foreign networks susceptable? It could be a great tool for "cyberwarfare" against EvilDoers...
Trolling is a art,
I know where I'm going to apply for grad school.
Would love to be hacking a model Internet.
Why do you need 5 million for that? How many computers can it possibly take? 50? 100? Let's say 100. That's $100,000 (and that's generous these days) Let's say $200,000 to lease building space and power for 2 years (also generous) and let's pay 3 professors part time, plus 10 students work study wages (Figure $50,000 per professor and $20,000 per student...$350,000)
What do we got?
$100,000 parts
$200,000 space
$350,000 labor
--------
$650,000
What's the other ~5 million going for?
Oh wait... they must need Windows licenses and full copies of Outlook to properly test the hacks...
How the hell would you make a 'model' of the internet. It's just a bunch of linked up servers, is it not? Hell, just run all the services on the same box and 'hack' it remotely or locally... I don't see where the 5.5 million comes into play unless they are going to make a 'model' of a big lanparty...
So basically they just spent $5.5 million built the worlds most expensive intranet? Man with that kind of money I would've rather had the government buy 2 more toilet seats.
Since Internet is quite a proper name nowadays I wouldn't call it "model of the internet". It's just a simple WAN intended as a test-bed for various incidents which can happen on the Internet.
you won't be needing any additional hypothetical .connections, or even a model rocket cam, to smell which way the wwwinds of change are bullowing?
/. corepirate nazi ?pr? ?firm? scriptdead hypenosys 'moderation' FUDgeLickers.
mynuts won: still bucking the felonious georgewellian fuddite
the lights are coming up now.
tell 'em robbIE?
how do they think they'll reproduce the Internet's first characteristics : diversity, with a budget that might at most buy them 10000 computers ?
Trolling using another account since 2005.
Hell no. More likely grad students. In case you haven't heard of these creatures... grad students are a mechanism for turning coffee into graphs.
That smell is REWARD!
$250,000 = lifetime supply of cheetoes and pr0n!
Eve Fairbanks says I drive a hybrid!LOL
In ten years everyone will wonder why USC and Berkley produced all of the decade's best crackers. This project will result in three things:
1. Good dissertations for CS PhDs.
2. More secure software, which will rarely be implemented and even more rarely be implemented well.
3. A whole bunch of research assistants who think they are l33t h4x0rs. And some of them will be right.
Eagles may fly, but weasels don't get sucked into jet engines.
A "model" of the internet? Are they referring to an electronic model of the physical structure? A very large LAN? $5.5 mil will buy a lot of hardware.
Me thinks this will pay for $500k worth of cisco gear and workstations for the modem, and $5 mil worth of 'testing labor'?
Didn't we discuss this the other day???
No, this is
It seems to me that the current government would like nothing more than to be able to control the flow of information in the internet.God forbid we ever learn the truth about anything or question the
'facts' as presented.This is one area if not the last that any government should stay the fuck out of.I'm a little more than leary about a trial run on a model,it sounds a bit like the "model terrorist
attack" on the pentagon on or right before 9/11.
I would rather see a global non-profit entity tend to the garden rather than the vermin.
I want on that internet! This one sucks, please oh please for the sake of all that is good and fermented, let me off this one! :)
Someone giving out money is a fool, it only stands to reason that if the intenet was created to survive a nuclear Holocaust, that, being World War 3, that it could probably survive some Script kiddy college punks using others software to hack it. Break the internet,what fools to think that they can do such an enormous task...what a TOTAL WASTE of money... -JC
What made them pick those schools to do this? Did they do a survey or check for a high quantity of hackers in those schools? They should just open it publicly and let people take trys at it and submit logs of what they did. "Open-Source Internet"
These people should get set up with vmware, it might save them some money.
It would definately cut down on cable wiring costs.
blog.jonnyro.com - Jeep/IT blog
It's Berkeley. Cripes.
I wonder how they will be going around to simulate the current p2p and other activity on it...
It would be interesting to see how they implement this network.
I don't think that we have a requirement to see any of the information that I've questioned above but this information could lead /. to be more informed on this situation.
... but can I be the RIAA and sue all the users of your model internet???
This is in the name of science!
I won't be real bad, just demand they hand over all their old video cards when they get new ones.
I'm still running my old Voodoo 3 3500, yeah baby it still ROCKS!
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
"Berkeley engineer said they can't do experiments on the real Internet, because they can't afford to break it."
Al Gore would not like that
...or is that the *shortest* article I've ever read? Sheesh, the copyright is almost longer than the content.
;)
OK, I'm trolling. Get over it.
Karma only matters to me now and zen.
I hear they already have the free pr0n servers up and running. Just waiting for the rest of the system to be built. ;)
I know you can hack a server, but how exactly do you hack "the Internet" (model or otherwise)?
This sounds like a Utopia internet, free porn, disconection from the rest of the net... What are they going to do next, give the free caffeine and each gets a new PC to use on this internet?
That's it, I'm getting out my transfer papers, USC here I come!!
so now we're teaching college students how to hack?
Yes, an article from a few months ago has some info.
When did this stop them before?
Tech support companies the world over are tired of people calling up and asking, "Is your internet better than the internets of other companies?" They made a plea to the US government to do something about it, who, out of embarassment for the American people's stupidity, promptly made up a new reason to make another, lower quality internet.
From now on, rather than spending several hours trying to explain the concept of the internet to people who have trouble walking and chewing gum at the same time, tech supporters will be able to simple say, "Yes."
Mod me down and I will become more powerful than you can possibly imagine!
they certainly are dooing their ?best? to give the hobbyist dogooders (aka HACKERS) the full phonIE FUDgIE, with va lairIE/robbIE's ?help?
try using the words 'tinker with', & see if you can now understand what's going on/gnu?
I actually think this would make a nice little project... Ceratinly not worth US$ 5 million, though, unless you intend to install a huge number of machines.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
they'll need exchange...IIS...
perhaps some huge bandwidth...
powdered donuts, guarana(beats the hell outta Mt. Dew), and (with machine to make said drink), and all the neato little geek trinkets and apparrel.
"Just Smile and Nod." --Huck
-worms and viruses
-discovering flaws in protocols not specific to particular implementations
I'm not sure how they plan to "model" the internet, but I would argue that the internet is its own best model. Anything else will lack some exloits present in the "real" net while have other exploits absent in the real net (bugs in the model's software).
I would take the $5.5 million and divide it up into $5000 prizes that are payable to any hacker that demonstrates and documents a hack on the real net. The profs and grad students could ajudicate the prize giving. They would find at least 1100 exploits this way (fewer if they have to pay those pesky grad students or usurious university accounting department overhead rates).
If letting hackers profit from hacking the actual internet is too scary/illegal, then the university could create a small publically exposed network running a variety of apps, OS, etc.
Two wrongs don't make a right, but three lefts do.
Iowa State has a similar project funded with a $500,000 grant from the U.S. Department of Justice.
Iowa State Computer Security Lab
For the last few years I've been developing software systems for law enforcement, so occassionally I pick up interesting bits of information about how government funding works. If you didn't hear about it - and not many people did - the Dept. of Homeland Security made a sort of "open call" (via the Dept. Of Justice, if I remember correctly) about a year or so ago. It was - more or less - an open invitation for vendors to propose innovative ideas to the DHS about fighting terrorism within the United States. The really interesting thing about the open call was that it was specifically worded to encourage "innovative" and "new" approaches. I joked at the time that I actually felt good about the open call...it seemed like the guys at the DHS were acknowledging that they didn't have a clue what to do and where looking for expert help on making things radically better.
I'd be interested to find out if the "model internet" was a proposed idea. In terms of government funding, $5 million isn't all that much, so I wouldn't be surprised to see if this was an idea pitched by people at UCB and USC during the open call. I'd heard that big names asking for reasonably small amounts of money were getting through pretty easily.
I tried to convince my company to pitch a variant of our crime analysis/trendspotting tools. Include a reference per recorded crime that indicates political or religious bias as the motive of the crime. Get a concentration of those - even if they are "lesser" crimes like vandalism or simple assualt - and you've got "smoke". And where there's "smoke"...
My sigs always suck.
Is a good ole fashioned Slashdotting!
What about routers, switches, etc? If it is doing to be the Internet, two switches connected via a crossover cable won't cut it. I bet they need LOTS of routers, running BGP/etc, to simulate things like DDoSes (and their detection and tracing).
Hopefully the switch over to IPv4 will go smoothly.
I wanted to seperate my ranting from my somewhat more constructive post, but the lack of business and common sense in the industry has really been getting to me lately. Dont get me wrong, I have seen some stupid moves by managers, but the extent to which engineers think they know the one true way to do everything and that they and only they understand what someone is REALLY trying to ask has just been pissing me off. Managers got there for a reason, and its not because of their holier than thou attitudes. Sure, some get lazy and dont keep up w/ the technology, but most do.
Issues are not all black and white, Linux is not necessarily the best thing for all or even most users, regardless of price. MS is not necessarily an evil company in every respect. This general hostile attitude really needs to change. The lack of interpersonal skills has long been noted in the industry, but I really think its time that something be done about it. Just take a friggen second to try and see the other person's point of view, understand where they are coming from, why they see their decision as best, then try to argue against it. Storming out of a meeting calling your manager and coworkers idiots isnt going to get you out of that cramped 3 walled cube.
Too bad that 6 hours after they turn it on, all those model mailboxes will be overflowing with spam.
This would be a very cool project to get involved with. Imagine building the internet from scratch knowing what we know now. I bet that this project will be able to resovle many of the large problems associated with the public internet. Latenancy, DDOS, Spam, Virus'. If even one of these things could be effectively resolved think of the millions it would save businesses in the future.
rejected (19) accepted (0)
Is there a psychological term related to getting your stories rejected on slashdot?
[donning tinfoil hat]
... Microsoft wants to replace TCP/IP with a proprietary protocol--a protocol owned by Microsoft--that it will tout as being more secure. Actually, the new protocol would likely be TCP/IP with some of the reserved fields used as pointers to proprietary extensions, quite similar to Vines IP, if you remember that product from Banyan Systems. I'll call it TCP/MS.
Does anyone remember a Cringely column back in August, 2001? (search for "The Death of TCP/IP") In it, he says:
Now, doesn't this make a perfect test-bed to refine such a protocol? To make sure that it will play on existing infrastructure? And all built at taxpayer expense!
[doffing tinfoil hat]
ISU is launching a similar project. I wonder if they will connect their non-outside connected qwasi internets?
/ cptrsecurity.shtml
http://www.iastate.edu/~nscentral/releases/03/oct
You know, if they exclude all of the pr0n and blogging from the model, I bet they could do it for half that cost.
Let Berkely build it - then let MIT hack it!
Cheers
I'm a Graduating Senior at GA Tech and a professor here is already doing this! He has created a class called Network Security that focuses on mimicing the Internet in a completely unconnected network of systems. This allows for the students to learn how to use rootkits, honeynets, viruses, worms, buffer exploits, etc. The goal of the class is that if you explain how all this stuff works, you can also explain how to defend against it all in the real world. The nice part is that we are encouraged to try and break everything (not physically) with the understanding that if we do, we have to explain it later on. The class is only in it's 2nd semester and has only received a $100,000 grant from Cisco but it's definitely shaping up nicely. You can check it out some more by viewing HERE
So they're building a model of the internet to hack, so they can better deal with threats. Is the government really that much at risk that they need to do this? Surely they could just hire some really good hackers at ludicrous salaries to protect themselves?
Or is this really more war on terror stuff? Do they think that terrorist groups are operating over the internet and are they actually setting up some sort of training ground for an elite anti-terrorism unit to stop Osama Bin Laden getting his email or something?
Seems a bit sus to me...mini-internet
;)
but to have a proper model of the internet then it's going to need plenty of porn and spam, and i'd be more than willing to sell them all that i have
I was thinking perhaps I've come up with a solution to all the security problems. Everyone should be forced to uninstall windows. Good idea right?!
Here is a news link about this grant.
My guess is that this isn't just some tests to hack different servers and get the results one day. This is going to be over years. They are also not going to be using off the shelf parts. It's funded by the government, they are going to be buying huge switches and datalines, putting mainframes or whatever they got connected to the current internet.
They are going to be testing what happens if someone destroys parts of the backbone. Monkeys get loose in the server room, weird stuff like that.
My hope is that they test if anything happens to their model if a backbone server gets hit with EMP or one of those microwave thingys in a recent post.
Unfortunatly with the whole terrorist thing, most the tests are going to be kept secret so they don't give the terrorists any ideas.
The story is by the media, my bet is that they focused on hacking because it makes it newsworthy. Saying that the government is making a network to test "network infrastructure reliability in the information age" is not going to draw eyes.
all this speculating on what's involved, but the project is described in pretty good detail over at the ISI web site. (and so, its apparently not USC specifically but the usc information sciences institute):
http://www.isi.edu/stories/70.html
excerpt:
"The DETER testbed will consist of approximately 1,000 computers with multiple network interface cards, located off the actual Internet. Three permanent hardware clusters, or nodes, at UC Berkeley and at ISI's Southern California and Virginia facilities, will serve as the core of the system.
"This isolated mini-Internet will serve as a shared laboratory where researchers from government, industry and academia can test existing and new security technology, using a wide variety of attack techniques."
I can spell.
Since one of the schools is Berkeley, it is a safe bet that they are using BSD.
They won't be able to hack into it.
I wonder if this new model will have a version of SiteFinder hijacking the DNS servers.
hum so new network with new acess to the internet. nice for those there ehhe. About the 5mil humm yeah nice new hardware for them but if is to test hacking tec whats the ideia for new pcs.. to test some honeypots. well as i use to say "hey its their money and their story"
Wouldn't you think that a company like Cisco or Juniper, etc. who make hardware, network operating systems, implementations of routing protocols like BGP, etc, don't build models and try to wreck them on routine basis? And their test labs are probably way more advanced than anything professors can come up with on a 5.5mil budget.
grisha.org
I want to be a CEO on the berkleynet. Hmm... what would be a good company, something like DewFetch.com: order MountainDew without the inconvience of leaving your terminal and have it develivered to your door within 30 minutes.
Opening the bag of marshmellows now, for when I begin to crash and burn.
Will spam be simulated in this model as well?
How are they going to replicate the clueless secretary that just gives away passwords to an intelligent sounding caller?
Do the words "Cyber-Armageddon" mean anything to you?
Yes, I would never suggest rewarding or encouraging hackers to create real damage, only encourage them to document what is possible. But perhaps you are right, the prize represents a very dangerous inducement for people to play with fire.
The bigger issue is the potential for flaws in the methodology. I was pointing out a big versimilitude problem with the model vs. real internet. This problem is on two levels. First are the scale issues -- a network might be robust with a 1000 nodes, but fail utterly with 1,000,000 nodes. Second are the implementation issues -- the internet may contain flaws associated with using X version of IE on Y version of Windows when accessing/processing Z-type of content. Small models lack both the scale and heterogenity needed to surface many of the flaws.
But the bigger point is that a small group of researchers, regardless of their brilliance, will probably fail to think up all the exploits created by a much larger group of hackers. I was only trying to propose a mechanism that leverages the hacker population.
I imagine they'll be dealing more with network structural problems than cracking problems.
That's too bad because it seems that most internet disruptions to date arise from exploits of specific OS and software flaws. I'm sure that some aspects of the core structure and standards have built-in limitations, but I suspect it is the diverse implementations of the standards that contain the greatest population of flaws that threaten internet stability.
Perhaps I'm suggesting approaches to research that they don't really want to do. While the grant may be restricted to studying specific theoretic constructs (e.g., Warhol worms) in an idealized network, I am suggesting research into the breadth of actual flaws in the current implementation of the internet.
Two wrongs don't make a right, but three lefts do.
The FBI puts a warrant out on the students of UC berkeley for "risking national security", if caught, they will be facing 60 years in prison.
*jab at the lamo situation*
It's good to see that the UCB is still in business, even after their show got cancelled. It makes me wonder if this project is somehow related to their Bucket of Truth project.
You're only as smart as your brain.
This is one case where using Microsoft Windows software might provide a better Return on Investment than any other competing software, assuming that the goal is to successfully hack into the system.
It was an attempt at humor, albeit a weak one.
What if everybody used IPv6?
What if you had to prove your id to send mail?
What if a Curious Yellow -like worm were realeased?
What if.... well you get my point.
It's so odd that the caffeine-shock drink originally advertized as something for very active, sexy people playing around outdoors in the mountains ended up as the mascot drink of one of the most sendentary class of professionals...
OK, or maybe it's not so odd...
This Like That - fun with words!
http://www.isi.edu/deter/
Good to see that the Upright Citizens Brigade is back in business.
Iowa State University recently received a grant to do basically the exact same thing. http://www.iastate.edu/~nscentral/releases/2003/oc t/cptrsecurity.shtml
Now when they're done, they can use all their practise on the real thing and cause some real mayhem!
Karma: It's all a bunch of tree-huggin' hippy crap!
Of course, this is a simulation of the internet, so it will have a simulation of Slashdot, and thus we are all now simulations somewhere in a computer in California, simulating the Slashdotting of simulated small, interesting web sites. Wow, I now have an avitar
I'M ON TO YOU ROBOT! You may think we don't know that you are actually the computer you speak of but some of us have tinfoil hats and a keen sense of smell.
Thats the only way they could ever get anything meaningful from this. It would have to be a trust-based initiative to get any real findings from it. I can't see them getting a result set AFTER the fact, it has to be during.
It's "cracking", not "hacking", dammit!
I expect this from mainstream media, but not here.
Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
They have a pointer to http://www.isi.edu/stories/70.html article at USC ISI.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
If they build a shub-Internet it won't have the same scaling as the real thing, but they can at least model lots of real-world misbehaviour, and use virtual operating systems to fake out large numbers of lower-speed attackers as well. (More fun than a barrel full of zombies!)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
But suppose you go beyond that and look at what the problems are like if you take them seriously and if it's your job to protect the US government's infrastructure and perhaps society's as well. We played a game at CFP a few years ago looking at "suppose you had a hundred suitcase bombs - where would you put them to cause maximum disruption to US society?". While there were a wide variety of answers, all of them pretty much came down to "unfortunately, it's way too easy to do this." Question 2 - suppose it was your job to _stop_ these sorts of attacks, what would you do. [expletive deleted]! It's really really [expletive-deleted] hard. (And the important answers "Be thankful that most people aren't evil" and "Get the government to stop encouraging people to hate us" are both out of scope....)
They might be paranoid, but people really _are_ out to get them. The Internet is a place where people apparently routinely acquire an army of half a million zombies just to send out ads for Viagra, and have fun using them to take down anti-spammer sites and teenage boys can do billions of dollars of damage just having fun impressing their friends with what an 31337 h4xx0r they are. The commercial and volunteer world works on problems of how to protect the Internet in free society, but the government also has legitimate concerns about people attacking them, and the attackers may have more skill, more resources, stronger motivations, and more focus than the attacks on the public. It's not surprising they'd want to work on how to protect themselves.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I'm sure that most of the work that'll be done with this project is defensive, but is some of it really going to be offensive as well? Most of the time it's going to be modelling different methods of attacking network interconnection and different methods of defending against it, but when you've got a thousand machines with heavy-duty cracker tools located a few dark-fiber meters away from several Internet2 routers and just down the road from the San Francisco and DC area internet junction points, it's got to be real tempting to not only mail out CDs of crackerware to the military's cyberwarriers, but also to occasionally jack in to the real Internet and go pound some target, or upload a few hundred thousand copies of Zombieware N.2 to their public-side counterparts.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
You buy IBM mainframes which run multiple virtual PC machines in them, so one $250k server, could run/sim probably say 25,000 Win98 boxes with 64m ram each running at 250mhz or something. Have another server simulation say 100,000 linux boxes running at 100mhz.
Add a few of these , name each one a different continent or ISP. Give all these machines emails addr, and spam them away. Simulate timezones and activity usage and you have a mini simmatrix of the net to learn how worms spread fast etc...
Basically its a matrix for the worms and they never know it.
Liberty freedom are no1, not dicks in suits.
The problem with their "model" is that something as complex as the current Internet as it exists today can't really be modeled, at least not very well. It's a huge chaotic system thats constantly changing and growing, so when you try to model it your model is going to be out of date before you can do anything useful with it. I really don't think $5 million can buy even a small representation of what the Internet is today. Think of the OSI layers and all the different software, hardware, protocols, methods, systems and manufactures in place at each layer. Each of those has its own set of vulnerabilities, holes, etc. and keep in mind there are many different versions of each of those running at the same time across different networks.
This complexity is precisely what makes tracking and solving problems with today's Internet so hard.
I am curious as to what they expect to study and find from this model. Today's problems with the Internet and networking in general are largely social, economic, or political. Figuring out some neat new protocol isn't going to make backbone provider X update their entire network. Worms and the such are also the bain of a social problem. As long as we have smart programmers with free time, there will be worms and exploits of the system no matter what procedures are in place or how smart the network is; The fix for said worms are timely patches and updates, however most users won't and don't do this, hence the epidemics.
This might make some great academic research and a neat new toy for the University but I fail to see how it can find applications in the real world where the problems are much harder than the technical ones this project (presumably) hopes to solve.
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
So many pompous nerds waiting for everyone else to make a mistake, they're not ready to see the person might be doing a segue, rather than missing the point.
We're gonna [simulate] hack[ing] the Gibson!
My other car is a 1984 Nark Avenger.