Great whitepaper on the coming "superworm" — something I've been predicting for a year or two — from Brandon "Freenet" Wiley. We did a panel last year at SXSW about the near-inevitability of a superworm — a worm that coordinates it actions among infected hosts and launches a massive distributed denial of service attack on any hosts it can't infect using those it can — and the doomsday scenario ended up frightening even us. Brandon's whitepaper explains just how such a worm — dubbed "Curious Yellow" — could operate.
Interestingly, the problem of efficiently organizing worm instances into a network which can act globally but which has reasonable coordination costs for each node is very similar to problems found in peer-to-peer networks. The particular task of the division of the task space among all of the currently active worms is very similar to the problem addressed in distributed hash tables (DHT) designs. One popular contemporary DHT design is called Chord. In Chord, each node is assigned a portion of the task space such that the space is divided evenly and randomly among all nodes. Chord has some useful properties. First, each node in the network is reachable from each other node in the network with a maximum of O(log N) intervening nodes. Additionally, each node only needs to maintain knowledge of O(log N) other nodes, thus keeping coordination costs down to a reasonable level. What this means in simple terms is that in a network of one million nodes each node only has to keep track of approximately 20 other nodes and for one node to send a message to another node in the most distant part of the network it would take at most 20 intervening nodes. Similarly, for a network of ten million nodes, each node has to keep track of approximately 23 other nodes and it will take at most 23 intervening nodes to reach from one side of the network to the other. There are advanced variants of the Chord architecture which layer additional properties on top of the guarantees provided by the basic Chord design. Anonymous Chord (Achord) adds the property that it is very difficult for any node to find out the identities of all of the other nodes in the network. This makes it more difficult for an attacker to disable the network by discovering the identities of nodes. By having worms form an Achord network, a global framework for division of the space to be attacked can be created with reasonable coordination costs.
(via Aaron Swartz)
