Chapter 525: Frustration
Back in his seat, although Xiao Yuan got Smith's approval, out of prudence, he still unplugged the network cable before analyzing the network data, so that his computer was completely physically cut off from the network.
After disconnecting from the network, Xiao Yuan turned on the computer, and did not habitually log in with the root account as before, but logged in to the computer as an ordinary user, under the strict permission management of FreeBSD, unless the worm used the ability to crack his root permissions, otherwise even if it destroyed all the data of this user, Xiao Yuan only needed to log in to the root account, and all the data could be recovered with one command.
After doing this, Xiao Yuan spent a certain amount of time, assuming two windows98 virtual machines and two feonix virtual machines on the workstation, one of which was also configured with a graphical environment, and then formed a virtual LAN with these four virtual machines, and then he wanted to use this virtual LAN to observe the network propagation characteristics of the worm, from the perspective of the integrity of the system, the virtual machine was much better than the virtual layer he didn't know last time, and the worm should not find out that this was virtual again.
After forming a virtual LAN, Xiao Yuan assumed a series of strict monitoring procedures and protection procedures outside of these four virtual machines, and strived to achieve 360 all-round monitoring and protection without dead ends, so to speak, this time he set up a net for the worm, if in this case, the worm can still escape his monitoring, he feels that he really has nothing to say.
After all this was done, an afternoon had passed unconsciously, Xiao Yuan went to pick up Xia Jiuying for dinner, and after sending her back to the business school, he returned to the laboratory.
Plugging the floppy disk into the floppy drive on his computer, Xiao Yuan made a copy of the network data Rubin had given him, then converted it into a binary data stream again, and sent it to a Feonix virtual machine on a virtual LAN through a tool.
The reason why he chose the Feonix host, he first wanted to see if the worm could still be released and run on non-Windows systems.
After the data is sent, the feonix system processes these data is also unpacked now, and then because there is no program to receive these data, the unpacked data will be directly discarded, because it is a virtual LAN simulated inside the same machine, and the workstation has a very strong ability to process data, so the whole sending process is very short, and the result is the same as Rubin said, all the monitoring software shows that the worm has not been released.
"There is a question, does the release mechanism of the worm need to rely on Windows, or does the worm itself not be able to leave Windows?"
Xiao Yuan had such a question, so he decided to do another experiment, and now the network connection between the two Windows system virtual machines was disconnected, only the connection between Windows and Feonix systems was retained, and then the network data was released to the Windows virtual machine.
A dialog box pops up, and there are some small squares and garbled characters in it, which are caused by Xiao Yuan not installing the Chinese environment in the virtual machine system and cannot recognize the Chinese in the dialog box.
To Xiao Yuan's surprise, the appearance of this dialog box indicates that the worm has been released, but the monitoring software he set up is useless, and none of them can find out how the virus is released, but fortunately, these software intercepted a lot of data and left it for Xiao Yuan to analyze.
After this dialog box appeared, it disappeared quickly, and then Xiao Yuan saw a program called imthin from the monitoring software sending a connection request to Microsoft's website.
"This worm is really going to automatically download the Chinese package from the Internet, but this time he is afraid that he will miscalculate, I don't know what will happen if he finds that the Chinese package cannot be downloaded." Xiao Yuan thought in his heart, concentrating on observing every move of this virus.
After the worm sent 16 connection requests and failed, it stopped, and then Xiao Yuan saw that the CPU utilization rate of this virtual machine had become much higher than just now, and at the same time, the CPU utilization rate of the imthin process in the monitoring software reached 160%, which lasted for about ten seconds, and when the CPU utilization rate dropped, a dialog box popped up, but the language used this time was English.
"Where is it at this time, suffocated, and the language is not understood, I want to go out?" It complained, and sure enough, as Xiao Yuan expected, it didn't find that this was a virtual machine.
After this dialog box appeared, Xiao Yuan noticed that Imthin began to scan the network ports of the system, and soon it discovered the connection between the system and the Feonix system, and began to send data to Feonix, which was intercepted by the monitoring software set up by Xiao Yuan.
This data is very precious to Xiao Yuan, but he didn't analyze it right away, because he wanted to analyze it after he had a comprehensive understanding of this worm.
This data is received by the Feonix system located at the other end of the virtual network, processed as a normal packet, and returns some data according to the data protocol it carries.
The data is returned to the Windows system, and as soon as it is accepted by the process Imthin, a dialog box pops up.
"Damn linux, I hate you, when my master learns linux, it will upgrade me, and then, hum!"
"Hehe, this guy's owner must be a little fat man." Xiao Yuan saw this dialog box, laughed, and made a judgment, and at the same time looked forward to what the little fat man's work would do next.
The worm failed to escape, and after a dialog box popped up, another scan was started, and after discovering another Feonix system connected to this system, it was again found that the opposite was not Windows, so such a dialog box popped up.
"Alas, there's no internet here, I can't live, I'm dead, unlucky thin man."
As this dialog box appeared and disappeared, the windows virtual machine automatically shut down, and after starting it again, Xiao Yuan found that the process was gone, and after a comprehensive check of the system, the worm disappeared completely.
"This guy committed suicide this time, if I turn on both Windows consoles, will it still kill itself?" Xiao Yuan thought to himself.
Another Windows virtual system that was originally disconnected intervened in the network, and the worm virus was released again, this time the worm behaved the same as before, but first wanted to download the Chinese language pack, after the failure began to scan the network, the feonix system failed to infect, and the Windows system was successfully infected.
What made Xiao Yuan feel very funny was that the worms on the two Windows hosts actually had a simple conversation, and after discovering that the environment in which they appeared was just a local area network, they committed suicide together.
"This kind of design is not the design idea of worms at all, worms have a dialog box that pops up at every step to tell others what to do next, so, strictly speaking, this is just a toy designed by a child, and it is not a worm at all." Xiao Yuan suddenly thought of this.
"Let's see how this guy was unleashed." Xiao Yuan finally focused on this problem, releasing the worm several times and letting the worm run freely in the virtual machine, the monitoring software he had set up before had already intercepted a large amount of monitoring data for him, which would become the first-hand material for his analysis work.
Analyzing data is not a very brain-power-consuming and time-consuming work, it requires analysts to be bold and careful, bold and divergent, dare to think about what others dare not think, boldly assume, and verify, and be careful, to be good at finding some clues from a large number of complex data that others can not find, and these clues often become the key to solving the mystery.
Xiao Yuan is far from lacking in these two items, so before he started to analyze, he was full of confidence, but the result caused him a lot of blows, because after repeated analysis, all the details of all the activities of the worm in the system, he was able to use those data to analyze it, but he didn't find out how this virus came into existence from scratch, and finally understood why Rubin found so many masters, why he still found nothing.
"Hell, it looks like that one million isn't easy to take." Xiao Yuan muttered, and decided to pause for a while, to relax his somewhat drowsy brain, maybe suddenly inspiration came, or he could remember some key points that he had overlooked.
It's time to leave again, Xiao Yuan packed his things, came out of the laboratory with his bag, and looked up at the sky, the dark sky was dotted with stars, blinking at him constantly, extraordinarily deep and attractive, fascinating.
"There is a sky outside the sky, there are people outside the world, this little fat man really gave me a big problem." Retracting his gaze from the sky, Xiao Yuan smiled and rode his bicycle to find Xia Jiuying.