All About Articles

A new tool allows entire networks to be scanned efficiently for infection.

On April 1, a computer worm called Conficker, which has already infected millions of machines worldwide, is expected to do something bad, though no one knows exactly what. Some experts fear that an army of infected machines could be ordered to launch a coordinated attack or send out a barrage of spam. But a tool released today could help lessen the impact by allowing big companies and institutions to quickly weed out infected machines by scanning entire networks for signs of infection.
Analysis of the Conficker worm has previously revealed that infected computers will "phone home" on April 1 to receive a new set of instructions. It is already possible to detect the worm by scanning machines individually, but this is a relatively time-consuming process. It's also possible to detect the bug by watching for outgoing communications sent across a network, but the latest version of Conficker is designed to stay silent until April 1.
Dan Kaminsky, director of penetration testing for the Seattle-based security company IOActive, helped create the new scanning tool and says that it can identify an infected machine by recognizing the way it presents itself to the wider network. This makes it quick and easy to scan for the worm remotely and does not require any special access to machines. "It's like driving through a neighborhood looking for houses with big signs on their doors," Kaminsky says.
The tool was created after Tillmann Werner and Felix Leder, members of an independent research organization called the Honeynet Project, asked Kaminsky to review their research on Conficker. The pair had figured out that the worm changes the way a machine appears on a network. Kaminsky seized on this, suggesting that the researchers create a tool that uses this information to find infected machines. The researchers built such a tool and worked through the weekend to get it ready for broad distribution to suppliers of other security software. "Whatever vulnerability scanner a company is using, it should have support for this by the end of the day," Kaminsky says.
Bruce Schneier, chief security technology officer at BT Counterpane, says the new tool's ability to seek out the virus remotely should be useful, since it will let people scan a huge number of machines very quickly. This is important, Schneier says, because the worm is such a nasty pest. "Conficker is an extremely well-written, extremely well-designed, extremely well-executed worm," says Schneier. "It really is an impressive piece of work, and there's someone really smart behind it." But Schneier adds that it's important for computer users and administrators to protect their machines against a variety of malware, not just a single threat.
"If you've been running a good environment, you shouldn't be worried about this," says Rich Mogull, founder of the security-consulting company Securosis, who helped connect the Honeynet researchers and Kaminsky with network-security vendors over the weekend. Mogull notes that Microsoft has already released several patches that block the vulnerability that Conficker uses to infect a machine. However, he says that companies worried about Conficker should start scanning for it right away, after checking to see if their network-security tools have been updated.
Kurt Rohloff, a scientist who studies Internet worms at the research and development company BBN Technologies, says that the tool could prove useful, though he doubts that there's time to find and neutralize every computer infected with the worm. Rohloff says that the new scanner could be used to take preventive action by identifying infected hosts and removing them from the network, though he admits that this approach is "drastic, because you're removing connectivity."
Kaminsky notes that the tool is intended for organizations with large networks. For individuals, he says, the best approach is to make sure that the latest security updates are installed and up-to-date antivirus software is running. Since Conficker blocks a computer from accessing certain security websites, users could test for the worm by trying to visit those sites, Kaminsky says. Werner and Leder plan to release a paper within the next day, describing the technical details of their discovery.

By Erica Naone

A chip developed by European scientists simulates the learning capabilities of the human brain.

An international team of scientists in Europe has created a silicon chip designed to function like a human brain. With 200,000 neurons linked up by 50 million synaptic connections, the chip is able to mimic the brain's ability to learn more closely than any other machine.
Although the chip has a fraction of the number of neurons or connections found in a brain, its design allows it to be scaled up, says Karlheinz Meier, a physicist at Heidelberg University, in Germany, who has coordinated the Fast Analog Computing with Emergent Transient States project, or FACETS.
The hope is that recreating the structure of the brain in computer form may help to further our understanding of how to develop massively parallel, powerful new computers, says Meier.
This is not the first time someone has tried to recreate the workings of the brain. One effort called the Blue Brain project, run by Henry Markram at the Ecole Polytechnique Fédérale de Lausanne, in Switzerland, has been using vast databases of biological data recorded by neurologists to create a hugely complex and realistic simulation of the brain on an IBM supercomputer.
FACETS has been tapping into the same databases. "But rather than simulating neurons," says Karlheinz, "we are building them." Using a standard eight-inch silicon wafer, the researchers recreate the neurons and synapses as circuits of transistors and capacitors, designed to produce the same sort of electrical activity as their biological counterparts.
A neuron circuit typically consists of about 100 components, while a synapse requires only about 20. However, because there are so much more of them, the synapses take up most of the space on the wafer, says Karlheinz.
The advantage of this hardwired approach, as opposed to a simulation, Karlheinz continues, is that it allows researchers to recreate the brain-like structure in a way that is truly parallel. Getting simulations to run in real time requires huge amounts of computing power. Plus, physical models are able to run much faster and are more scalable. In fact, the current prototype can operate about 100,000 times faster than a real human brain. "We can simulate a day in a second," says Karlheinz.
While it may sound implausible, neurons are actually very slow, at least compared to computers, says Thomas Serre, a computational neuroscience researcher at MIT. "The reason why computers seem much slower is that they are serial machines, while our brains run in parallel," he says.
FACETS is not the only group taking this approach. Researchers at Stanford University have also been creating neuronal circuits and the Defense Advanced Research Projects Agency recently started funding a similar project.
"Where FACETS is ahead of anybody else is that they use these complex synapses," says Markram. While the neurons are quite simple, he says, the synapses are designed to use a very powerful distributed algorithm--developed by Markram--called spike-timing dependent plasticity, that allows the device to learn and adapt to new situations.
Building such complex circuits has required close collaboration with neurobiologists, says Markram. In fact, the project, whose current budget is €10.5 million (US$14.1 million), relies upon the contributions of 15 scientific groups from seven different countries. Among the challenges they face is recreating the three-dimensional structure of the brain in a 2-D piece of silicon, he says.
Despite efforts to make the chips as biologically plausible as possible, Markram admits they are still crude compared to what can be achieved in simulation. "It's not a brain. It's a more of a computer processor that has some of the accelerated parallel computing that the brain has," he says.
Because of this, Markram doubts that the hardware approach will offer much insight into how the brain works. For example, unlike Blue Brain, researchers won't be able to perform "in silico" drug testing, simulating the effects of drugs on the brain. "It's more a platform for artificial intelligence than understanding biology," he says.
The FACETS group now plans to further scale up their chips, connecting a number of wafers to create a superchip with a total of a billion neurons and 1013 synapses.

By Duncan Graham-Rowe