| Index | Recent Threads | Unanswered Threads | Who's Active | Guidelines | Search |
 |
World Community Grid Forums
Category: Support
Forum: BOINC Agent Support
Thread: About safety/security |
| No member browsing this thread |
|
Thread Status: Active Total posts in this thread: 10
|
|
| Author |
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
Hi everybody,
I've been inviting people to join the WCG a lot and one of the most common concern people mention is about safety/security. This is specially common when I'm inviting companies to join. I don't know how bad it is around the world, but here in my country hackers are way too active. SCAMs, trojans, spywares, backdoors, national viruses, you name it - with generalized fear as an obvious consequence. In fact, when I say that a small software is needed to participate, I can almost hear an "ouch!". I started looking for any kind of documentation that could give me arguments. I guess an official and technical article would be better than my intuition-oriented explanations. So I searched WCG's website and forums as well as I could but, surprisingly, I found nothing (maybe the issue is not that bad all around.. or maybe I just missed it). Does anybody know where can I find a solid documentation about this matter? Thank you, Fabio. São Paulo, Brazil. |
||
|
|
JmBoullier
Former Community Advisor Normandy - France Joined: Jan 26, 2007 Post Count: 3716 Status: Offline Project Badges: 
|
Hi Fabio!
----------------------------------------Reasonable people who work(ed) with IBM could tell you that security is a permanent major concern in everything they do. Less reasonable people would even say they are paranoid about it. Knowing this it is no surprise that WCG is the only grid which uses secure communication between the clients and the servers. Obviously people you want to convince are not obliged to believe you (or me). In that case that could be a consolation for you to know that even IBM executives have great difficulty to convince their counterparts in big companies or organizations. When people are subject to fear they are far less receptive to sensible words. Good luck and keep trying. Jean. |
||
|
|
twilyth
Master Cruncher US Joined: Mar 30, 2007 Post Count: 2130 Status: Offline Project Badges: 
|
One problem you should be aware of is the fact that one of the boinc component programs (don't remember if it's boinc or boincmgr) generates loopback "traffic" once a second. Some firewall software - like Zone Alarm - reports this as internet traffic when in fact it isn't. I've never liked this aspect of boinc but there are legitimate reasons for it. Supposedly the newest version of Zone Alarm allows you to ignore loopback traffic (packets sent to and from 127.0.0.1) but I have the latest paid version and haven't been able to find it. Unfortunately this is a permanent feature of boinc so when you tell people about the program, be sure to warn them that this behavior is harmless albeit annoying.
----------------------------------------  |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
IBM do everything they can to make World Community Grid safe to use.
----------------------------------------The first question, then, is "Can I be sure IBM really run World Community Grid?" Here is the latest press release from IBM about World Community Grid: http://www.ibm.com/ibm/ibmgives/news/african_climate_home.shtml World Community Grid isn't merely funded by IBM - it is managed and run by IBM staff. The second question you may have is "Can I trust the software?" This is a good question, and breaks down into two parts: can I be sure the software is what it says it is, and can I be sure the software has no known vulnerabilities? Can I be sure the software is what it says it is? All the World Community Grid software is digitally signed. The BOINC software is signed by the University of California. Can I be sure the software has no known vulnerabilities? IBM do regular security audits of the software. This includes the agent software that you download, and the project software written by the scientists. The BOINC software is open source, so security bugs are usually found very quickly. Finally, you will be asking "How is the grid kept safe from hackers?" The World Community Grid servers are located in a secure IBM data center. Their physical security is as good as it gets. All the communication between World Community Grid and your computer uses SSL. This is the same level of encryption used by websites for online shopping and banking. The last part is up to you. You need to keep your own computer secure and up to date, running the latest firewall and antivirus software. edit: typo [Edit 1 times, last edit by Former Member at Jan 15, 2008 4:41:35 AM] |
||
|
|
Sekerob
Ace Cruncher Joined: Jul 24, 2005 Post Count: 20043 Status: Offline |
If ultra concerned over safety you can add <suppress_net_info>1</suppress_net_info> to the <options> section of the BOINC cc_config.xml file. This is the description in the wiki:
----------------------------------------<suppress_net_info> If enabled, don't send this host's IP address and domain name to servers. Otherwise, this information is sent to, and stored on, servers. It is visible to you (but not other users) via the web. New in 5.10 After applying this, my device name changed on WCG My Device Statistics and Result Status pages to just show the Device ID assigned by WCG like 123456. This number is different for each project attached to, so x-corellation is further hampered for the outsider. IP addresses were never visible at WCG, but at other projects the result is indeed that these disappear. e.g. IP address (same the last 168 times) External IP address xx.xx.xxx.xxx Domain name Local Standard Time UTC +1 hours As can be seen the internal net IP and Domain name are gone. The ISP IP address is dynamic anyway for most, so though it shows it's only valid for as long as not refreshed/renewed. As for firewalls mentioned, I've added BOINC.exe to a rule with the IP addresses of the projects I'm attached to. e.g. WCG is IP 129.33.89.133+134 (in addition to the loopback localhost address 127.0.0.1). This way, if ever a project moves or goes rogue or a hacker were able to steal the url and redirect, would it have an added problem to overcome (unless the dns server would get poisoned too). Recommended is to only use BOINC downloaded from a trusted source, speak the WCG download page or directly from Berkeley developers. Added: Note that this "suppress" feature disables the recognition of the host when reinstalling a client!
WCG
----------------------------------------Please help to make the Forums an enjoyable experience for All! [Edit 1 times, last edit by Sekerob at Jan 15, 2008 5:08:03 PM] |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
For me, I trust BOINC (open source) and WCG (IBM audited). What I have mild reservations about is the project software that runs in BOINC. Java has a relatively tight sandbox for running apps on a client machine.
I have not done the research, but I assume BOINC is also running the workunits in a kind of sandbox, so I SHOULD feel safe. My only concern then is how to lock down the BOINC service, so that a new project is not added, and malicious workunits run on my machine. As I said, I would trust WCG, and Seti@Home for instance, but many "micro" projects exist, and some may exploit BOINC vulnerabilities before they can be closed... |
||
|
|
Sekerob
Ace Cruncher Joined: Jul 24, 2005 Post Count: 20043 Status: Offline |
There's on option to stop the new attaching of projects.
----------------------------------------Added: This <disallow_attach>1</disallow_attach> is the <options> line to add to the cc_config.xml to block any additions or re-attaching
WCG
----------------------------------------Please help to make the Forums an enjoyable experience for All! [Edit 1 times, last edit by Sekerob at Jan 16, 2008 11:51:18 AM] |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
Just for curiosity, when would this kind of attaching possibly happen? I mean, if WCG begins a new research, would that be a project attaching?
I'm still looking for the best information resource on WCG's and BOINC's safety and still couldn't find some really good article. I'm also still surprised by the lack of a bigger effort on showing people how safe this really is. A computer savvy will just know it. I'm reasonably experienced with computers and somehow I feel this grid is fine. However there's a huge group of people who do not deal very well with computers - the majority, actually - that would only join if supported by some good information on security. I've been inviting companies around here. As a typical example there's this advocacy company that is willing to participate. However they deal with confidential files all the time... how can I assure them that installing BOINC all around won't compromise their safety? The search goes on... |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
We are discussing two kinds of projects. World Community Grid projects, and BOINC projects. The entire World Community Grid is a single BOINC project.
Within that single BOINC project, WCG have a number of active research projects. They have all been security audited by IBM, and have all the security features that World Community Grid provide. Other BOINC projects come in all shapes and sizes, and can be started by anyone. Some are from respected institutions, others are just started by some guy somewhere. They have varying levels of security, and I fully respect companies that want to block such projects entirely. BOINC projects can't attach themselves, but unless BOINC is installed properly, it may be possible for your users to add other BOINC projects that weren't authorised by the company. The option Sekerob described is for this situation. |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
fabiopb, if you want to know more about World Community Grid's security practices, then ask the companies that you are talking with to contact WCG directly and enquire about the Partnership scheme. Someone from IBM can call them, and they are likely to get more information than they know what to do with. World Community Grid will also share the relevant security documentation, so they can make their decisions based on complete information.
But the first step is the Become A Partner page. Remember, just filling in the form won't commit them to anything. |
||
|
|
|