Subject: We had computer viruses. Now tumors?

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 24 Mar 2002 14:13:43 +0200

I saw in the linux-kernel mailing list the following fork-bomb mentioned
by Erik Tews:

	:(){ :|:&};:

(this runs in any shell, like zsh or bash).
I thought this was cool, so I promptly copied it to one of my signatures
(see at the end of this message).

Obviously, I had no intention of running this (I know what it does, so I didn't
need to prove it to myself), but I did intend to check that the syntax is
correct (especially whether the extra space is necessary - it is in bash, but
not in zsh). So I typed it in, without the ending invocation of ":", of course.

Little did I know that Zsh's default completion functions use the ":" (true,
or do nothing, builtin), so as soon as I typed TAB, the fork bomb got
rolling...

Very soon, my computer had load 200, no more processes could be run under my
user (though once in a few tries I was lucky enough to get one started).
What this thing does in practice is to do a DFS (depth first search) on a
binary tree with 200 (or something else, depending on your process and
memory limits) levels, so it will only finish after an astronomical (2^200)
number of forks are done.

Now came the hard part - getting rid of this monstrosity running on my
computer. It was too hard to kill all of them one by one (besides, it wouldn't
be too helpful, because it would just keep spawning new heads, like the hydra
in greek mythology. There's a mitigating factor here, that each process can
only divide one, but it's very hard to take advantage of that). Something
like "killall -1 zsh" would also kill all my other shells and windows along
with the crazy forkers.

This is where I thought of the tumor analogy. Like a tumor (in Hebrew: s'et,
gidul, sartan) in an living body, this fork bomb is composed of normal cells
(processes) of a certain type (zsh) that started dividing uncontrollably
taking up all the resources at the expense of other cells (processes).
How do you get rid of the tumor? Killing all the cells (processes) in the
body (computer) of that type is not an option, because there are plenty of
normal cells (processes) that need to be spared. Cutting out the tumor
(killing exactly the right processes) is very difficult, because you might
accidentally kill good cells (processes) or forget to kill one cell (process)
which will start dividing again.

By now you might be wondering how *did* I get rid of this menace. If I was a
Windows user, I would have just killed all my zsh processes (effectively
logging out) or even rebooted. But I'm not a Windows user :)

I decided to fight fire with fire. Just like there's an idea to fight HIV
or certain types of cancer by infecting a person with Malaria (a different
disease, terrible on its own right, but less terrible than the other two),
I decided to infect my computer with a different fork bomb, a more controllable
one, which will take all the resources the original fork bomb needed and
cause it to come to a griding halt. Consider this: if the original fork bomb
had 200 processes, but because of competition with another fork bomb now
only has less than 5 processes free at any time, it will quit after 200*2^5
forks - a small number.

So I just did the following: in a window I typed "ash" (another small shell)
a few times until I got the ash prompt. Then I did it again. And again (of
course, I automated that with a cut-and-paste). As I did that, the load
started to go down, until there were about 200 ash processes, at which point
the original fork bomb was dead. Then I pressed control-D continuously to
kill all the ash processes. My computer was healthy again :) And I was so
proud not to resort the the Windows-y way of reboot/logout :)

Here's a little perl (or whatever other language you prefer) excercise: write
a code that kills the original fork bomb by taking over its resources, like
I did but in a much simpler way.
Hint: in a loop, try to fork new processes (each new process just sleeps for,
say, 2 minutes, the original process continus to fork more children).

Note to self: next time I write "DO NOT run this" on a signature, I shouldn't
be running it either ;)

--
Nadav Har'El                        |       Sunday, Mar 24 2002, 11 Nisan 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |:(){ :|:&};: # DANGER: DO NOT run this,
http://nadav.harel.org.il           |unless you REALLY know what you're doing!

---

From: "Amir Abiri" <[email-masked]>
Date: Sun, 24 Mar 2002 14:31:05 +0200

From: "Nadav Har'El" <[email-masked]>

LOL
Nice one... Hercules...

--
http://abiri-e.com/
"God is a programmer".

---

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 24 Mar 2002 15:41:14 +0200

> disease, terrible on its own right, but less terrible than the other two),

Oh, and I hope no-one is actually taking medical advice from this list ;)
I tried looking on the Internet for any reference to curing other diseases
with Malaria (I don't remember where I got that idea from), and I found
in http://www.aegis.com/pubs/beta/1996/BE962808.html the following:

	AIDS Fraud
	Bulletin of Experimental Treatments for AIDS, No. 28; March, 1996 
        "...The AIDS epidemic has produced its share of fraudulent treatments
        and questionable healthcare strategies. The current gamut of HIV/AIDS
        treatment quackery runs from drinking amaroli (one's own urine) to
        deliberately infecting oneself with malaria, a strategy championed by
        the otherwise credible Harry Heimlich, MD..."

http://www.ralphmoss.com/html/coley.pdf has:
	"In the eighteenth and nineteenth centuries it was repeatedly observed
         that following serious infections cancer patients sometimes
         experienced "spontaneous remissions" of their malignancies. The
         diseases usually linked in this way to cancer were tuberculosis,
         malaria, and syphilis."

But I have no idea how credible either of these references are (especially
the second, which looks a bit quacky).

-- 
Nadav Har'El                        |       Sunday, Mar 24 2002, 11 Nisan 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |I want to be a human being, not a human
http://nadav.harel.org.il           |doing -- Scatman John

---

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 24 Mar 2002 16:15:27 +0200

> number of forks are done.

Oops, I keep replying to myself :(

Actually, on second thought, this is *not* a DFS. It starts off more like
a BFS (a parallel one), but can later turn into something much wierder.
The total number of forks before this program naturally quits seems to be
a bit random: in the worst (best?) case, it can quit after 200 (in case of
200 free processes) divisions: when only "leafs" remain in the graph and
they all fail to divide, and only then they all exit. But in the best
(worst?) case, the division can continue indefinitely (e.g., consider the 200
leaves above, 199 fail to divide and exit, and one leaf is left with 199 free
processes, and starts dividing just like the first process that started it
all).
The common case is probably closer to the "indefinitely" side. That is,
unless it is fighting against a second fork bomb :)

-- 
Nadav Har'El                        |       Sunday, Mar 24 2002, 11 Nisan 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |A Nobel Peace Prize? I would KILL for one
http://nadav.harel.org.il           |of those.

---

From: "Nadav Har'El" <[email-masked]>
Date: Mon, 25 Mar 2002 18:29:59 +0200

On Sun, Mar 24, 2002, Nadav Har'El wrote about "[hackers-il] We had computer viruses. Now tumors?":
>..

Ok, nobody stood up to the challenge, so here's an example answer, written
in zsh (for example):

	while (sleep 100 &!) do; done

What this one-liner does is to repeatedly start "sleep 100" processes in
the background. The "&!", instead of "&", tells zsh not to do job-control
on this background process. the extra parantheses causes zsh not to stop
the while loop when the fork fails, but rather continus the loop.

This antedote really works. If you manage to get a shell running, that
is ;) On my computer it "won" in about a minute.

-- 
Nadav Har'El                        |       Monday, Mar 25 2002, 13 Nisan 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |If you choke a Smurf, what color does it
http://nadav.harel.org.il           |turn?

---

From: "Orna" <[email-masked]>
Date: Mon, 25 Mar 2002 18:41:17 +0200

I'd suggest adding the cure to your "don't run this" sig, or would you
prefer the random way? (i.e., putting it in another sig, and hoping one
notes both of them)
Orna.
----- Original Message -----
From: "Nadav Har'El" <[email-masked]>
To: <[email-masked]>
Sent: Monday, March 25, 2002 6:29 PM
Subject: Re: [hackers-il] We had computer viruses. Now tumors?

> [email-masked]
|-----------------------------------------
> To unsubscribe from this group, send an email to:
> [email-masked]
>
>
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>
>