Ubuntu Desktop Computing Made Easy (Ubuntu 9.04)

This documentation is intended for folks that would like to add additional programs and applications to their Ubuntu Desktop installation making their overall experience similar to that of other well known operating systems (less the huge software expense).
Recommended: 1.3 GHz Pentium 4 or higher workstation with 1Gb physical memory, 256 Mb graphics card, 10/100 Ethernet card and 20+ Gb hard disk. If you install everything I've listed it takes up about 4 Gb on your hard drive (I use ext4 disk formatting but the default ext3 formatting is fine).

Multimedia functionality and collaborative applications are a big part of the Internet these days, this post is oriented towards installing useful codecs, plug-ins, programs and applications. Please keep in mind older computers may have video performance issues due to high CPU usage and increased memory requirements.

The easiest way to perform most of these installs is to copy and paste from this post into a terminal window (found in Accessories). I strongly suggest installing a few things at a time, testing each along the way.

• Start by going to System > Administration > Software Sources > Check the first four boxes(leave Source code unticked) under the Ubuntu Software and Updates tabs > Close and Reload

Get all the available Ubuntu updates at this point, look for the update notification icon on the task bar. Reboot after updating your system and then install as many of the following as you wish...again, I suggest installing a few things at a time, testing each along the way.

• If you're having slowness issues with the default repository go to System > Administration > Software Sources > Ubuntu Software tab > Download from: drop down menu > Other > click Select Best Server and when it finishes the query click Choose Server > Close and Reload.

Many of these installations require access to the Medibuntu Repository and enabling some additional software sources. Directions are on this site or if you have Ubuntu 9.04 "Jaunty Jackalope" simply do the following from a terminal window:

sudo wget http://www.medibuntu.org/sources.list.d/jaunty.list --output-document=/etc/apt/sources.list.d/medibuntu.list
sudo apt-get update && sudo apt-get install medibuntu-keyring && sudo apt-get update

Several codecs and plug-ins are needed for playing a variety multimedia formats correctly...(installing ubuntu-restricted-extras can sometimes be problematic, try this method if you've experienced issues).

sudo apt-get install gstreamer0.10-plugins-good
gstreamer0.10-plugins-bad gstreamer0.10-plugins-ugly
gstreamer0.10-ffmpeg gstreamer0.10-pitfdll
gstreamer0.10-plugins-bad-multiverse
gstreamer0.10-plugins-ugly-multiverse gstreamer0.10-fluendo-mp3
gstreamer0.10-gnonlin gstreamer0.10-plugins-farsight gstreamer0.10-sdl
gstreamer-dbus-media-service gstreamer-tools

Install these as well (some may be installed at this point, no worries)

$ sudo apt-get install realplayer w32codecs libdvdcss2 libxine1-ffmpeg
debhelper fakeroot libfftw3-dev jackd sidplay-base liblrdf0-dev
xsidplay mplayer avifile-divx-plugin avifile-xvid-plugin dh-make
g++-multilib g++-4.3-multilib gcc-4.3-doc libstdc++6-4.3-dbg cvs
gettext-doc jack-tools libjackasyn0 avifile-mad-plugin
avifile-mjpeg-plugin avifile-player avifile-utils avifile-vorbis-plugin
avifile-win32-plugin libcurl3-dbg libgcrypt11-doc libggi-target-emu
libggi-target-monotext libggimisc2 gnutls-doc gnutls-bin guile-gnutls
krb5-doc libraptor1-doc libstdc++6-4.3-doc mplayer-doc diff-doc

Last but not least...

$sudo apt-get install easytag faac faad ffmpeg ffmpeg2theora flac
gxine icedax id3tool id3v2 lame liba52-0.7.4-dev libavfilter0
libflac++6 libid3-3.8.3c2a libjpeg-progs libmozjs0d libmp4v2-0
libmpg123-0 libsox-fmt-alsa libsox-fmt-base libsox1 mpeg2dec
mpeg3-utils mpegdemux mpg123 mpg321 libamrnb3 libamrwb3 sox tagtool
toolame vorbis-tools gecko-mediaplayer

Install some fonts, Adobe Flash too…

sudo apt-get install msttcorefonts mplayer-fonts ttf-xfree86-nonfree xfs
sudo apt-get install flashplugin-nonfree

Install the latest Sun Java JRE

sudo apt-get install gsfonts-x11 java-common odbcinst1debian1
sun-java6-bin sun-java6-fonts sun-java6-jre sun-java6-plugin unixodbc

ATI and Nvidia Drivers and Desktop Effects

This requires some effort on the part of the user to know exactly what graphics card they have installed, use with caution and please read all applicable instructions or notes along the way.

The new Ubuntu 9.04 Jaunty Jackalope system comes with a Nouveau display graphic driver by default and the advanced effects cannot be used. If you've already tried to enable restricted Ubuntu drivers and ATI/nVidia cannot be found in the list try installing the ATI/nVidia driver with this tutorial:

1. Run Applications>Add/Remove
2. From the left menu choose System Tools
3. Next from the right menu, find and select for install: Desktop Effects (Compiz Setup) and ATI/Nvidia binary X.org Driver (nVidia could be version 173 or 177). Selecting the driver will get the list of supported graphics cards.
4. Click Apply Changes and after installation go to System>Administration>Hardware Drivers
5. The system will search for available drivers, choose the recommended option from the list and activate the driver by clicking Activate.
6. Restart your system and the new ATI/nVidia graphic display driver will be in use.

Unsupported updated versions of X.org drivers, libraries, etc. for Ubuntu https://edge.launchpad.net/~ubuntu-x...hive/x-updates

Note: Import the key and add the repositories for your specific distribution in System > Administration > Software Sources then run sudo apt-get update from a terminal window.

Compiz, Emerald and Screenlets

The default Ubuntu display setup lets you choose from None, Normal or Extra. Make it a lot more configurable with the CompizConfig Settings Manager...found in System > Preferences after installing the following:
sudo apt-get install compizconfig-settings-manager gnome-art usplash startupmanager compiz-fusion-plugins-main compiz-fusion-plugins-extra emerald screenlets librsvg2-common fusion-icon

Notes: Make sure you enable Visual Effects "Extra" (right click on your desktop, choose change Desktop Background and click on the Visual Effects tab) before adusting Compiz settings. Reset Compiz defaults by going into CCSM > Preferences > Profile & Backend > Click Reset to defaults.


Audacious is essentially a lot like WinAmp®.
sudo apt-get install audacious

Note: In order to open .m3u files with Audacious set Nautilus (preferences -> behavior tab) to always "view" the file and not ask.

Some folks like the Amarok player.
sudo apt-get install amarok

Esperanza has excellent sound quality but somewhat questionable features and functionality.
sudo apt-get install esperanza xmms2

Kaffeine is my favorite DVD player software. (install realplayer w32codecs libxine1-ffmpeg and libdvdcss2 first).
sudo apt-get install kaffeine

Notes: In Kaffeine be sure to verify the decoder references under Settings and xine Engine Parameters to reflect the correct paths to Realplayer, Win32 codecs and your DVD drive. I ran into a folder permissions issue in my home folder when launching kaffeine, if you experience this very carefully use these commands from a terminal window:
sudo chown -R username:username ~/.kde (put in your "username")
sudo chmod -R 700 ~/.kde

VLC media player is a highly portable multimedia player for many audio and video formats.
sudo apt-get install vlc vlc-plugin-esd mozilla-plugin-vlc

Ardour is a digital audio workstation. record, edit and mix multi-track audio.
sudo apt-get install ardour

soundKonverter converts a large variety of audio formats into ones that you desire.
sudo apt-get install soundkonverter

Jokosher is a complete application for recording, editing, mixing and exporting audio.
sudo apt-get install jokosher

LMMS can produce music including loops, synthesizing and mixing sounds, arranging samples, etc.
sudo apt-get install lmms

Gnutella is a lot like Limewire or Morpheus (see Firewalls and avast! sections below before using).
sudo apt-get install gtk-gnutella

Frostwire is similar to Gnutella (see Firewalls and avast! sections below before using).
http://www.frostwire.com/

Note: Your Java JRE is not broken and the Frostwire package is not corrupt but there is a known issue that causes the install to fail when using the Ubuntu GDebi Package Installer. The latest release of FrostWire requires that you install it from a terminal window sudo dpkg -i frostwire-4.18.1.i586.deb Be aware that the program installs as the root user, when the application launches complete the install process and then relaunch as the current user from Applications > Internet > FrostWire. You should have complete functionality now, customize as desired.

Streamripper will allow you to download internet radio station broadcasts.
sudo apt-get install streamripper

Shoutcast is a good place to shop for internet radio stations. http://www.shoutcast.com/

Vuze can be handy for things not found with Gnutella (see Firewalls and avast! sections below before using).
sudo apt-get install vuze

AceoneISO2 is a CD/DVD image manipulator for Linux (used primarily with .iso files).
http://www.getdeb.net/search.php?keywords=acetoneiso

DeVeDe creates video DVDs and CDs (VCD, sVCD or CVD) from video files in formats supported by MPlayer.
sudo apt-get install devede

K9copy is a free open source DVD backup, copying, compression and authoring utility (requires libdvdcss2).
sudo apt-get install k9copy

AcidRip for converting videos into popular formats.
sudo apt-get install acidrip

K3b is a feature-rich and easy to handle CD/DVD burning application.
sudo apt-get install k3b

Various compression/extraction and encoding/decoding utilities...
sudo apt-get install unace rar unrar zip unzip p7zip-full p7zip-rar sharutils aish uudeview mpack lha arj cabextract file-roller

avast! makes a very good anti-virus product for Linux it can be downloaded free for home use from http://avast.com/eng/download-avast-...x-edition.html You'll need the home user free registration key (emailed to you from their site). The key can be pasted into a terminal window after you type avast at a terminal command prompt. The gui icon is located in Applications > Accessories. Update the program frequently and scan all questionable downloads.

Setup your Gmail, Yahoo, AOL, Hotmail accounts in Thunderbird (use POP port 1024)
http://webmail.mozdev.org/index.html

Thunderbird is a light weight and very popular email client.
sudo apt-get install thunderbird

Filter out spam email in Thunderbird with SpamAssassin.
sudo apt-get install spamassassin

Sunbird is one of the best open source calendars.
sudo apt-get install sunbird lightning-extension

Skype lets you talk and chat with friends all over the world.
sudo apt-get install skype

Note: You might have to configure your Options > Sound Devices > Sound In/Sound Out within Skype and test with the Echo/Sound test Service. I also had to enable and adjust my Ubuntu Volume Controls > Preferences > Mic and Mic Boost settings.

Fonts, fonts and more fonts...for use in a variety of word processing applications (pick and choose).
sudo apt-get install ttf-larabie-straight ttf-larabie-deco xfonts-terminus-dos xfonts-terminus xfonts-terminus-oblique xfonts-mona tv-fonts ttf-tuffy ttf-sjfonts ttf-georgewilliams ttf-fifthhorseman-dkg-handwriting ttf-essays1743 ttf-opensymbol ttf-mgopen ttf-freefont ttf-dustin ttf-dejavu-extra ttf-dejavu-core ttf-dejavu ttf-bpg-georgian-fonts ttf-bitstream-vera equivs ttf-sil-gentium gnome-specimen

Note: Postfix is related to some of these fonts, be careful not to modify your Postfix configurations if you're using it for email purposes, otherwise use the default settings if/when prompted.

I typically don’t use the Arabic and Asian fonts, to remove them from a terminal window type:
sudo apt-get remove ttf-kochi-mincho ttf-kochi-gothic ttf-arabeyes ttf-arphic-ukai ttf-arphic-uming ttf-baekmuk ttf-bengali-fonts ttf-devanagari-fonts ttf-gentium ttf-gujarati-fonts ttf-indic-fonts ttf-kannada-fonts ttf-kochi-gothic ttf-lao ttf-malayalam-fonts ttf-mgopen ttf-oriya-fonts ttf-punjabi-fonts ttf-tamil-fonts ttf-telugu-fonts ttf-thai-tlwg ttf-unfonts-core ttf-indic-fonts-core ttf-wqy-zenhei

Note: Add them by simply using install instead of remove.

HP printer driver issues? http://hplipopensource.com/hplip-web/downloads.html

Adobe still makes one of the best .pdf viewers.
sudo apt-get install acroread acroread-fonts

PDFedit is editor for manipulating PDF documents.
sudo apt-get install pdfedit

AbiWord is a fast and easy to use word processing program similar to Microsoft® Word.
sudo apt-get install abiword

gLabels is a program for creating labels and business cards for the GNOME desktop environment.
sudo apt-get install glabels

iSpell comes in handy when spell checking documents from a terminal window
sudo apt-get install ispell

Wordnet is a comprehensive word database maintained by Princeton University
sudo apt-get install wordnet

The web interface for Wordnet is http://wordnetweb.princeton.edu/perl/webwn

FBReader is an e-book reader for various platforms.
sudo apt-get install fbreader

Dia is similar to Microsoft® Visio.
sudo apt-get install dia

GanttProject is a tool for creating a project schedule with Gantt and resource load charts.
http://ganttproject.biz/download.php

Planner for Gant charts and project plans.
sudo apt-get install planner

Scribus is a desktop publishing application.
sudo apt-get install scribus

Inkscape for illustrations.
sudo apt-get install inkscape

Gimp is an incredible image editing application.
sudo apt-get install gimp gimp-data-extras gimp-gap gimp-plugin-registry

Xara Xtreme is a user friendly vector graphics drawing program.
sudo apt-get install xaralx

Blender is open source software for 3D modeling, animation, rendering, interactive creation and playback.
sudo apt-get install blender

webKam is simple webcam application http://code.google.com/p/webkam-kde4/downloads/list

Elltube is a YouTube downloader and converter http://elltube.sourceforge.net/download

A complete Web Authoring System for Linux desktop users to rival programs like FrontPage and Dreamweaver.
sudo apt-get install kompozer

If you program in C\C++ languages you’ll need Build-Essential packages.
sudo apt-get install build-essential

Geany is a fast and lightweight IDE for programming in various languages.
sudo apt-get install geany

Vim may come in handy for file editing (gedit works good too).
sudo apt-get install vim-full vim-doc cscope

Cream is add-on software for Vim that adds ease of use and functionality.
sudo apt-get install cream

Gedit (Text Editor in Accessories) is installed by default but the plugins are not...
sudo apt-get install gedit-plugins

Note: Enable Gedit plugins in Edit > Preferences > Plugins.
The Gedit wiki is at http://live.gnome.org/Gedit

jEdit is a java based full featured editor (make sure you have Sun JRE installed).
sudo apt-get install jedit

Meld is a visual diff and merge tool.
sudo apt-get install meld

gFTP is a generic FTP client (port 21 is typical and consider file permissions when uploading).
sudo apt-get install gftp

Convert .rpm files to .deb http://www.howtoforge.com/converting...deb_with_alien
sudo apt-get install alien

Htop is a process manager to view available memory and CPU usage or manage running processes.
sudo apt-get install htop

Sysinfo is a simple program which displays your computer's system information.
sudo apt-get install sysinfo

HardInfo displays info about the hardware, software, and can perform simple benchmarks.
sudo apt-get install hardinfo

Byzanz records your desktop and saves it to animated GIF files (viewable in a web browser).
sudo apt-get install byzanz

Note: Byzanz is a panel applet and not listed in Applications, add it by right-clicking the panel and selecting Add to Panel > Desktop Recorder. Desktop effects have to be turned off to use Byzanz. More information is available by typing man byzanz-record from a terminal window.

Fish (the applet, not the shell) is a fun animated panel applet that tells fortunes.
sudo apt-get fortune-mod fortunes-min librecode0

Note: Add the panel applet by right-clicking the panel and selecting Add to Panel > Fish.

Wink creates advanced tutorials and presentations.
sudo apt-get install wink

Glipper is a clipboard manager for the GNOME panel.
sudo apt-get install glipper

Note: If Clipboard manager does not appear in the panel applet menu, in a terminal window cd /usr/lib/glipper then run ./glipper It should allow you to add it as a panel applet at this point. The keyboard shortcut is c

GNOME Commander is a "two-pane" graphical filemanager for the Gnome desktop environment.
sudo apt-get install gnome-commander

Add some useful features to nautilus...
sudo apt-get install nautilus-actions nautilus-gksu nautilus-image-converter nautilus-open-terminal nautilus-script-audio-convert nautilus-script-collection-svn nautilus-script-manager nautilus-sendto nautilus-share nautilus-wallpaper

NTFS Configuration Tool mounts NTFS drives (2000/XP/2003/Vista).
sudo apt-get install ntfs-config
gksudo ntfs-config

Note: Found in System > Administration.

luckyBackup...a powerful, fast and reliable backup & sync tool http://luckybackup.sourceforge.net/download.html

Partimage system backup, instructions can be found at: http://www.psychocats.net/ubuntu/partimage
sudo apt-get install partimage

KDE Partition Manager allows you to manage your disks, partitions and file systems:
sudo apt-get install partitionmanager

GParted is the GNOME partition editor for creating, reorganizing and deleting disk partitions.
sudo apt-get install gparted

Note: Documentation can be found at http://gparted.sourceforge.net/

Reconstructor will help you create your own Ubuntu based distribution http://www.reconstructor.org/index.p...tpage&Itemid=1

Defrag (or fidefrag I should say)

sudo apt-get install bzr python-psyco
bzr branch lp:fidefrag
cd fidefrag/src
sudo python fidefrag.py -d /

Note: It's not a good idea to defrag your whole system, some directories won't react very well. I typically defrag /usr (this one takes a long time), /var, /lib, /home, /etc, /bin and /sbin

Google Earth install: http://tombuntu.com/index.php/2009/0...h-5-on-ubuntu/

Show wallpaper or background color while logging in to Ubuntu: http://ubuntuforums.org/showthread.php?t=753261

Rainy days or a lot of time to kill?
sudo apt-get install frozen-bubble

Kids in the house?
sudo apt-get install gcompris gcompris-sound-en tuxpaint gnucap


Firewalls

Internet security is important these days and firewalls can be quite complex, hopefully the following will help...use only one of these two applications and please read all of the documentation first. Most people are already behind a broadband router configured to give you "TruStealth" protection on the internet...check your current protection at the Sheilds Up! link below before being too concerned.

ufw ("uncomplicated firewall" included with Ubuntu), by default is set to "allow" all network traffic, the wiki instructions are at https://help.ubuntu.com/community/Un...d_Firewall_ufw then sudo ufw enable the firewall at system startup.

Personally I would rather use the gui interface for ufw...
sudo apt-get install gufw

Firestarter is quite easy to configure https://help.ubuntu.com/community/Firestarter
sudo apt-get install firestarter

Load Firestarter at startup: http://www.ubuntugeek.com/firestarte...u-desktop.html
Note: In nano the ^ is the Ctrl key on most keyboards http://mintaka.sdsu.edu/reu/nano.html

Check your firewall protection at Sheilds Up! (click Proceed and use the All Service Ports option).
https://www.grc.com/x/ne.dll?bh0bkyd2

Wireshark is a full featured network protocol analyzer.
sudo apt-get install wireshark


Simple file encryption using GnuPG

From a terminal window in the directory where the file is stored:
gpg -c (encrypts, prompts twice for pass-phrase, creates )
gpg (decrypts, prompts for pass-phrase)

Notes: The source file can be deleted or moved after encryption. Sometimes when decrypting the pass-phrase prompt will pop-up behind the pinentry window. Type man gpg from a terminal window for more options. If you would like more advanced file encryption with keys and signatures visit http://www.gnupg.org/documentation/howtos.en.html for more information.

Advanced file encryption with GNU Privacy Assistant (use with caution and knowledge)
sudo apt-get install gpa


The Jaunty wiki can be found here http://ubuntuguide.org/wiki/Ubuntu:Jaunty

Ubuntu 8.10 (Intrepid Ibex) How-To http://www.funnestra.org/ubuntu/intrepid/

The UNR (Ubuntu Netbook Remix) wiki is here https://wiki.ubuntu.com/UNR

The Ubuntu Pocket Guide can be found at http://www.ubuntupocketguide.com/download_main.html

Ubuntu Desktop Essentials http://www.techotopia.com/index.php/...top_Essentials

Best 100 Open Source Applications http://ubuntulinuxhelp.com/top-100-o...-applications/

Best 50 Ubuntu Opensource Applications For Design And Developing http://www.emmaalvarez.com/2007/12/t...pensource.html

GetDeb software site for Ubuntu and Debian http://www.getdeb.net/

Gnome Desktop software site http://www.gnomefiles.org/

KDE-Apps.org http://www.kde-apps.org/

Cool wallpaper and more http://www.kde-look.org/


Procedure to enable WPA Wireless in Ubuntu

Sometimes wireless adapters (usually internal ones) don’t want to work right after the initial Ubuntu operating system install, even if the system recognises the hardware. The following should help if you’re in that situation.

If you have wired Internet connectivity update the software sources list sudo apt-get update

sudo apt-get install wpasupplicant (may already be installed)

sudo apt-get install network-manager-gnome network-manager (may already be installed)

sudo gedit /etc/network/interfaces Comment out the lines without “lo” entries (using #) and save the file, if you have just installed Ubuntu this may not be necessary.

Create a file by: sudo gedit /etc/default/wpasupplicant, add entry ENABLED=0 and save the file.

sudo touch /etc/default/wpasupplicant

Reboot your system.

When prompted to connect to a wireless network, select the desired one and enter in the key if necessary.


Maximus Issues (windows always maximize when an application is launched)

If you have a Netbook and auto maximize windows is driving you crazy try this from a terminal window: type gconf-editor then go to Apps > Maximus > check no_maximize


If Firefox windows open off screen or are too large to use, you may need to reset Firefox's controls and toolbars.

1. Close down Firefox completely: On the Firefox window, click the File menu then select Exit.
2. From a terminal window type: firefox -safe-mode
3. Firefox should start up with a Firefox Safe Mode dialog with options.
4. Check mark Reset toolbars and controls.
5. Click Make Changes and Restart to restart Firefox


Get your Trash Can and other desktop icons back...

The default for new installed Ubuntu is clean desktop. So, for example, if you want to get your Trash Icon back you need to change the default setting.

Step 1. Run Desktop Configuration Editor

Open Application > Accessories > Terminal and type gconf-editor.

Step 2. Change the value for trash_icon_visible

After the Desktop configuration Editor is displayed, open apps > nautilus > desktop and click the value for trash_icon_visible. This also works for your computer, home and network icons.


Setup Samba peer-to-peer with Windows http://ubuntuforums.org/showthread.php?t=202605

Install Samba stuff
sudo apt-get install samba samba-common samba-tools smbclient swat samba-doc samba-doc-pdf smbfs libpam-smbpass libsmbclient libsmbclient-dev winbind samba-dbg libwbclient0

Once Samba is installed you can setup a very basic shared folder as follows:

You’ll need to create Samba passwords with this command:

sudo smbpasswd -a USERNAME

Make a backup copy of the original smb.conf file, in case you make an error:

sudo cp /etc/samba/smb.conf ~

Add a share to the very end of the file:

sudo gedit /etc/samba/smb.conf

[mystuff]
path = /home/USERNAME/mystuff
available = yes
valid users = USERNAME
read only = no
browsable = yes
public = yes
writable = yes

(There should be no spaces between the lines, and note also that there should be a single space both before and after each of the equal signs.)

Save the file and restart samba with this command:

sudo /etc/init.d/samba restart

Use this command from a terminal window to check that your smb.conf doesn’t contain any syntax errors: testparm

Don't forget to create your shared folder and modify the permissions as needed. You may also have to allow specific IP address TCP/UDP access through your firewall as well. Keep in mind if security is an issue to read up a lot more on the topic.


How to setup remote access http://www.techotopia.com/index.php/..._Linux_Desktop


Web based workstation and application administration

webmin and usermin can be found at http://www.webmin.com/usermin.html


CommuniGate Pro

CommuniGate Systems' goal is to consolidate all forms of Internet Communications into one address space, making the single address for email, IM, VoIP and video calling, more productive, portable, and independent of tariffs and tolls of closed network topologies. https://www.communigate.com/forms/cg...re_you_buy.php


Alternative shells for Linux...

C, K, T, Z & Fish shells
sudo apt-get install csh ksh tcsh zsh fish

Bash Reference Manual http://www.gnu.org/software/bash/manual/bashref.html

chmod calculator http://www.javascriptkit.com/script/...chmodcal.shtml


Adding a Personal Package Archive (PPA) to your Ubuntu repositories

Adding a PPA to Ubuntu takes no more than a couple of minutes.

Step 1: Copy the lines from the apt sources.list entries section of the PPA overview page. For example:

deb http://ppa.launchpad.net/ubuntu-wine/ppa/ubuntu jaunty main
deb-src http://ppa.launchpad.net/ubuntu-wine/ppa/ubuntu jaunty main

Step 2: On your Ubuntu computer, open System > Administration > Software Sources.

Step 3: Click the Third Party Software tab.

Step 4: Click the Add button.

Step 5: Paste the individual lines copied in step 1 by clicking the Add Source button.

When prompted, reload the software sources information. Don't worry if you see a warning about unverified software sources; we're going to fix that next.

Adding the PPA's key to Ubuntu

Now Ubuntu knows about the PPA. It also needs to know how to check the software hasn't changed since Launchpad built it.

Note: This is not an endorsement of any of the software in PPAs. You must make sure you trust the PPA owner before installing their software.

Step 1: On the PPA's overview page you'll see the PPA's OpenPGP key id. It'll look something like this: 1024/12345678. Copy it, or make a note of, the portion after the slash, e.g: 12345678.

Step 2: Open your terminal and enter:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 12345678

Replace 12345678 with the key id you copied in step 1.

Step 3: Finally, tell Ubuntu to re-load the details of each software archive it knows about:

sudo apt-get update

You're now ready to install software from the PPA, using a tool such as apt-get in the Terminal or Synaptic.


Collection of useful commands...
---------------------------------------------------------------
Searching for Packages: apt-cache search some_string
Show Package Info: apt-cache showpkg xxx
Show Package Dependencies: apt-cache depends xxx
Install: apt-get install xxx
Re-Install: apt-get --reinstall install xxx
Remove: apt-get remove xxx
Remove All (configs too): apt-get remove --purge xxx
Upgrade: apt-get -u upgrade
Show Upgrades: apt-show-versions -u
Show All Installed Packages: dpkg --list
Find Package by File Name: apt-file search /bin/ping
Find filenames in a Package: apt-file list xxx
Updating the apt-file Cache: apt-file update
Info on Installed Package aptitude show xxx
System Hardware Info sudo lshw > hardware.txt

Linux Command Directory http://www.oreillynet.com/linux/cmd/

Linux Commands - A practical reference http://www.pixelbeat.org/cmdline.html

Linux Newbie Administrator Guide http://linux-newbie.sunsite.dk/

Clean up your system and free up space with sudo apt-get clean and sudo apt-get autoremove

If you're curious (like me) or have the need to know uname -a && cat /etc/*release in a terminal window will tell you the kernel version and release date, the distro id/release/codename/description.


Ok, about wine...in most cases a free Linux program will work just as well (and in many cases better) as apps on that other well known operating system...but then again there are a lot of folks that use wine...this wiki should help https://help.ubuntu.com/community/Wine

Three Ways to Install Latest Wine in Ubuntu 9.04 Jaunty Jackalope http://www.wine-reviews.net/wine-rev...ope/print.html

Wine Application Database (AppDB) http://appdb.winehq.org/

The World of WORMS

Highlights

....of many computer enthusiasts, people fascinated with the world of a
machine—call them hackers if you wish—who, even though most of them
would never admit this, walked a thin line between ambition and humility,
imagination and reality, and the law and a common crime, people who would
often find themselves on different sides of the barricade because of blind luck
or sheer chance and not because of fundamental differences in how they perceived
their world. For many, this world was the network.

...The revolution is not coming,
but we are starting to comprehend that simplicity can give a serious
advantage, we are starting to learn, from some seemingly uninteresting incidents,
how complex and surprising the dynamics of a worm ecosystem are
and how they change because of a virtually irrelevant difference in a target
selection algorithm or worm size.Worm authors are beginning to notice that in a world that slowly but constantly obtains better defense systems and becomes more
coordinated in its response against new threats, their developments must be
smarter and better prepared. We have enough data and understanding to observe
the marvels of worm dynamics as they happen. For enthusiasts, the field is
becoming a fascinating subject again; for professionals, the defense against
worms is becoming more of a challenge.

With the increasing migration toward a network-centric computing model, threats to all computers grow in severity.The communications between various systems on a network or the Internet offer great potential to their use for work and research. The emergence and acceptance of networking standards from various engineering groups have helped to create the communications infrastructure we have come to rely on for much of our daily work lives. These same infrastructure components and networking standards can be abused by attackers to create widespread
damage as well. This can be capitalized on by malicious software
to very quickly lead to large scale problems.

Internet-based worms, such as Code Red, Sapphire, and Nimda, spread from their introduction point to the entire Internet in a matter of days or even hours. The speed with which defenses need to be established only grows as time goes on. Code Red reached its peak a day or two after its introduction, and by then many sites knew how to detect its signature and began filtering the hosts and traffic associated with the worm. Sapphire, however, hit its peak in under 5 minutes. There was little time to raise the barriers and withstand the attack. Sites typically were knocked off-line but were back on-line within a few hours, filtering the worm’s traffic. There is typically little time to implement a well-thought-out solution during a worm outbreak.

Simply using what works as an initial step suffices for many. In some cases this means coarse filters in their mail or Web servers. In others, this means a protocol and port level filter on their routers. Once this initial measure is in place, a more complete solution can be deployed, such as desktop virus protections, more selective content filtering,
and compromised host isolation.

Because worms act only to spread from system to system, they bring security concerns to everyone using the Internet. No system can hide from an aggressive worm. However, many of the characteristics of a worm can be used to defeat it, including its predictable behavior and telltale signatures. This is in contrast to individual attackers, who change their tactics every time, even if only subtly, and who have usually chosen a particular target
for some clear reason.

Just as vulnerabilities have a window of exposure between the release of information about the vulnerability and the widespread use of exploits against them, worms have an interval of time between the release of the vulnerability and the appearance of the worm. Some worms are fast to appear, such as the Slapper worm (with an interval of 11 days), while others are much slower such as the sadmind/IIS worm (with a minimum internal of 210 days). Nearly any widespread application with a vulnerability can be capitalized on by a worm.

Assumed background
Is expected you have a good grasp of operating system concepts, including processes and privileges. A knowledge of both UNIX and Windows NT systems will go a long way toward understanding this material. An understanding of TCP/IP networking is assumed, as well as an understanding of Internet scale architecture. Last, an understanding of Assumed background security priciples, including vulnerabilities and how they are exploited, is required (Only working knowledge of these concepts is all that is needed, not mastery).

Why worm-based intrusions?
Given the relative stealth of a good manual intrusion and the noise that most worms generate, this is a very good question to ask. Worms continue to be generated for four main reasons:

• Ease. In this area, automation cannot be beaten. Although the overhead associated with writing worm software is somewhat significant,it continues to work while the developers are away. Due to its nature of propagation, growth is exponential as well.
• Penetration. Due to the speed and aggressiveness of most worms, infection in some of the more difficult to penetrate networks can be achieved. An example of this would be an affected laptop being brought inside a corporate network, exposing systems normally behind a firewall and protected from such threats. This usually happens through serendipity, but could, with some work, be programmed into the worm system.
• Persistence. While it is easy to think that once the attack vectors of a worm are known and patches for the vulnerabilities are available, networks would immunize themselves against the worm, this has been proven otherwise. Independent sources have shown that aggressive worms such as Code Red and Nimda have been persistent for longer than 8 months since their introduction date, despite well-known patches being available since the rise of these worms.
• Coverage. Because worms act in a continual and aggressive fashion, they seek out and attack the weakest hosts on a network. As they spread through nearly all networks, they find nearly all of the weakest hosts accessible and begin their lifecycle anew on these systems. This then gives worms a broad base of installation from which to act, enabling their persistence on the Internet because they will have a continued base from which to attack for many months or even years.
  

These are the main benefits of using a worm-based attack model, as opposed to concerted manual efforts. They futurely will continue to be strong reasons to consider worm-based events as a high threat.

The new threat model
Until recently, network security was something that the average home user did not have to understand. Hackers were not interested in cruising for hosts on the dial-up modems of most private, home-based users. The biggest concern to the home user was a virus that threatened to wipe out all of their files (which were never backed up, of course).

Now the situation has changed.

• Broadband technologies have entered the common home, bringing the Internet at faster speeds with 24-hour connectivity.
  
• Operating systems and their application suites became networkcentric, taking advantage of the Internet as it grew in popularity in the late 1990s.
  
• And hackers decided to go for the number of machines compromised and not high-profile systems, such as popular Web sites or corporate systems.
  

The threat of attack is no longer the worry of only government or commercial sites. Worms now heighten this threat to home-based users, bringing total indiscriminacy to the attack. Now everyone attached to the Internet has to worry about worms. The aggressiveness of the Code Red II worm is a clear sign that compromise is now everyone’s worry. Shortly after the release of Code Red, a study conducted by the networking research center CAIDA showed just how large scale a worm problem can be.

Their estimates showed that nearly 360,000 computers were compromised by the Code Red worm in one day alone, with approximately 2,000 systems added to the worm’s pool every minute. Even 8 months after the Code Red worm was introduced several thousand hosts remained active Code Red and Nimda hosts.

A new kind of analysis requirement
Prior information security analysis techniques are not effective in evaluating worms. The main issues faced in worm evaluation include the scale and propagation of the infections. These facets typically receive little attention in traditional information security plans and responses.

Worms are unlike regular Internet security threats in several ways.

• First, they propagate automatically and quickly. By the time you have detected and started responding to the intrusion, the worm has moved on scanning for new hosts and attacking those it finds. Depending on the speed of the worm, the length of this process can be more than one cycle of infection by the time an intrusion is even noticed.
• Second, the automatic propagation of worms means that because a single host on a whole network becomes infected, a network may become an unwilling participant in a large number of further attacks. These attacks may include denial-of-service (DoS) attacks or additional compromises by the worm program, or even secondary compromises caused by the back door that the worm introduces. This may make a network legally and financially liable, despite the lack of direct participation in the attack. While attackers typically use a compromised network as a stepping stone to other networks or as DoS launchpads, worms inevitably cause the affected network to participate in the attack.
• Third, the persistent nature of worms means that despite best efforts and nearly total protection, any weakness in a network can lead to total compromise. This is especially aggravated by “island hopping,”(In the computer security and intrusion detection field island hopping is the act of entering a secured system through a weak link and then "hopping" around on the computer nodes within the internal systems) whereby the worm favors attacks against local networks. This can lead to propagation of the worm behind firewalls and network address translation (NAT) devices, which has been observed in Nimda and Code Red II infections.
• Lastly, the Internet as a whole suffers in terms of performance and reliability. The spread of worms leads to an exponential increase in traffic rates and firewall state table entries. This can choke legitimate traffic as the worm aggressively attacks the network. A single Sapphire worm host, for example, was able to congest several megabits per second of bandwidth from within a corporate network, disrupting service for everyone. These consequences of spreading worms are well beyond the planned for scenarios of manual attackers.
  

They require careful consideration of network design and security implementations, along with an aggressive strategy for defense on all fronts.

The persistent costs of worms
Often discussed but rarely investigated are the financial costs associated with the continual presence of worms on the Internet. Worms by their very nature continue to work long after their introduction. Similar to the scenario faced by populations battling diseases and plagues, worms can be almost impossible to eliminate until long after the targets are removed from the Internet. This continued activity consumes resources and causes an increase in operational costs. Some quick “back of the envelope” calculations from Tim Mullen illustrate the scale of the problem.

In their work on the persistence of Code Red and Nimda, Dug Song et al. counted approximately 5 million Nimda attempts each day. For each GET request sent by the worm that generated an answer, approximately 800 bytes were transferred across the network. This corresponds by quick estimation to about 32 gigabits transferred across the Internet per day by Nimda alone. In their study, Song et al. found that Code Red worms send more requests per day at their peak than Nimda worms did due to more hosts being infected over 6 months after the introduction of the worms. This calculation ignores the labor costs associated with identifying and repairing affected systems, attacks that disrupt core equipment, and attempts at contacting the upstream owners of affected nodes. However, it does illustrate how much bandwidth, and thus money, is consumed every day by worms that persist for months after their initial introduction.

Clearly the automated and aggressive nature of worms removes bandwidth from the pool of available resources on the Internet.

Intentions of worm creators
While the intentions of those who write and release worms are difficult to report without a representative sampling, much can be gathered based on the capabilities of the worms they create. These intentions are important to study because they help reveal the likely futures of worms and how much of a defense investment one should make against them.

By examining the history of worms, one can understand the basic intentions of early worm writers. There appear to be three overriding purposes to worms in their early incarnations.

• Some worms, such as the Morris worm, seem to have an element of curiosity in them, suggesting that the authors developed and released their worms simply to “watch them go.”
  
• Other worms, like the HI.COM worm, appear to have an element of mischievous fun to them because it spread a joke from “Father Christmas.”
  

Each of these two are understandable human emotions, especially in early computer hackers.

• The third intent of worm authors appears to be to spread a political message automatically, as displayed with the WANK worm. For its authors, worms provided an automated way to spread their interests far and wide.
  

The intentions of worm users in the past several years can also be gathered from the capabilities and designs found in the wild.

• With the advent of distributed denial of service (DDoS) networks and widespread Web site defacement, worms seem to have taken the manual exploit into automated realms. The Slapper worm, for example, was used to build a large army of DDoS zombies. Code Red and the sadmind/IIS worm defaced Web sites in an automated fashion. Various e-mail viruses have sent private documents out into the public at large, affecting both private individuals and government organizations. Hackers seem to have found that worms can automate their work and create large-scale disruptions.
  

These intentions are also important to understand as worms become more widespread. An army of DDoS zombies can be used to wage largescale information warfare, for example. Even if the worm is discovered and filters developed to prevent the spread of the worm on some networks, the number of hosts that the worm has affected is typically large enough to create a sizable bot army. This was seen with the Deloder worm, which created armies of tens of thousands of bots that could be used to launch DDoS attacks. This is considerably more sizable than what would have been achievable by any group of attackers acting traditionally. Even after it was
discovered, thousands of compromised hosts remained on the bot network for use. To that end, defenses should be evaluated more rigorously than if the worm were to simply spread a single message or was the product of a curious hacker.

Worms Vs Viruses

Either have different properties and capabilities. An important distinction to make in developing detection and defense mechanisms. In some cases these differences are subtle, and in others they are quite dramatic. Although many of the features of each are similar, worms differ from computer viruses in several key areas:

• Both worms and viruses spread from a computer to other computers. However, viruses typically spread by attaching themselves to files (either data files or executable applications). Their spread requires the transmission of the infected file from one system to another. Worms, in contrast, are capable of autonomous migration from system to system via the network without the assistance of external software.
• A worm is an active and volatile automated delivery system that controls the medium (typically a network) used to reach a specific target system. Viruses, in contrast, are a static medium that does not control the distribution medium.
• Worm nodes can sometimes communicate with other nodes or a central site. Viruses, in contrast, do not communicate with external systems.
  

When we speak of computer worms we are referring to both the instance of a worm on a single system, often called a node on the worm network, and the collection of infected computers that operate as a larger entity. When the distinction is important, the term node or worm network will be used.



A formal definition
From the 1991 appeal by R. T. Morris regarding the operation of the 1988 worm that bears his name, the court defined a computer worm as follows:

In the colorful argot of computers, a “worm” is a program that travels from
one computer to another but does not attach itself to the operating system of the computer it “infects.” It differs from a “virus,” which is also a migrating program, but one that attaches itself to the operating system of any computer it enters and can infect any other computer that uses files from the infected computer.

This definition, as we will see later, limits itself to agents that do not alter the operating system. Many worms hide their presence by installing software, or rootkits, to deliberately hide their presence, some use kernel modules to accomplish this. Such an instance of a worm would not be covered by the above definition. For our purposes here, we will define a computer worm as an:

independently replicating and autonomous infection agent, capable of seeking out new host systems and infecting them via the network.

• A worm node is the host on a network that operates the worm executables, and
  
• a worm network is the connected mesh of these infected hosts.

The five components of a worm
Nazario et al. dissected worm systems into their five basic components. A worm may have any or all of these components, though a minimum set must include the attack component.

• Reconnaissance. The worm network has to hunt out other network nodes to infect. This component of the worm is responsible for discovering hosts on the network that are capable of being compromised by the worm’s known methods.
• Attack components. These are used to launch an attack against an identified target system. Attacks can include the traditional buffer or heap overflow, string formatting attacks, Unicode misinterpetations (in the case of IIS attacks), and misconfigurations.
• Communication components. Nodes in the worm network can talk to each other. The communication components give the worms the interface to send messages between nodes or some other central location.
• Command components. Once compromised, the nodes in the worm network can be issued operation commands using this component. The command element provides the interface to the worm node to issue and act on commands.
• Intelligence components. To communicate effectively, the worm network needs to know the location of the nodes as well as characteristics about them. The intelligence portion of the worm network provides the information needed to be able to contact other worm nodes, which can be accomplished in a variety of ways.
  

The phenotype, or external behavior and characteristics, of a worm is typically discussed in terms of the two most visible components, the vulnerability scans and attacks the worm performs. While this is typically enough to identify the presence of a static, monolithic worm (where all components are present in a single binary), the reduction of worms to these components shows how easy it would be to build a modular worm with different instances having some of these components and not others, or upgradable components.

Not all of these components are required to have an operational worm. Again, only basic reconnaissance and attack components are needed to build an effective worm that can spread over a great distance. However, this minimal worm will be somewhat limited in that it lacks additional capabilities, such as DDoS capabilities or a system level interface to the compromised host. These five worm components and the examples next illustrate the core facets of network worms.



Finding new victims: reconnaissance
As it begins its work, the worm has to identify hosts it can use to spread. To do this, the worm has to look for an identifying attribute in the host. Just as an attacker would scan the network looking for vulnerable hosts, the worm will seek out vulnerabilities it can leverage during its spread. Reconnaissance steps can include active port scans and service sweeps of networks, each of which will tell it what hosts are listening on particular ports. These ports are tied to services, such as Web servers or administration services, and sometimes the combination can tell an attacker the type of system they are examining.

Not all of the worm’s efforts are directed to the network, however. A scan of the local file system’s contents can be used to identify new targets. This includes worms which affect messaging and mail clients, which will use the contacts list to identify their next targets, or hosts that are trusted by the local system, as was done by the Morris worm. Additional information can be used to determine which attack vector to use against the remote system.

The worm network follows the same steps an attacker would, using automation to make the process more efficient. A worm will seek out possible targets and look for vulnerabilities to leverage. If the resulting host services match the known vulnerabilities the worm can exploit, it can then identify it as a system to attack.
The criteria for determining vulnerabilities are flexible and can depend on the type of worm attacking a network. Criteria can be as simple as a well-known service listening on its port, which is how the Code Red and Nimda worms operated. All Web servers were attacked, although the attack only worked against IIS servers. In this case, the worm didn’t look closely at targets to determine if they were actually vulnerable to an attack, it simply attacked them.

Alternatively, the reconnaissance performed can be based on intelligent decision making. This can include examining the trust relationships between computers, looking at the version strings of vulnerable services, and looking for more distinguishing attributes on the host. This will help a worm attack its host more efficiently.

The above methods for target identification all rely on active measures by the worm. In the past few years, passive host identification methods have become well known.

Methods for fingerprinting hosts include IP stack analysis or application observation.

By doing this, the worm can stealthfully identify future targets it can attack. Passive reconnaissance has the advantage of keeping monitoring hosts nearly totally silent from detection. This is in contrast to worms such as Code Red and Ramen, which actively scan large chunks of the Internet looking for vulnerable hosts.



Taking control: attack
The worm’s attack components are their most visible and prevalent element. This is the means by which worm systems gain entry on remote systems and begin their infection cycle. These methods can include the standard remote exploits, such as buffer overflows, cgi-bin errors, or similar, or they can include Trojan horse methods. An example of the latter would be the use of an infected executable being sent to an e-mail client by a worm as one of its attack vectors.

This component has to be further subdivided into two portions:

• the platform on which the worm is executing and
  
• the platform of the target
  

This attack element can be a compiled binary or an interpreted script, which utilizes
a network component from the attacking host, such as a client socket or a network aware application, to transfer itself to its victim.

A main factor of the attack component is the nature of the target being attacked, specifically its platform and operating system. Attack components that are limited to one platform or method rely on finding hosts vulnerable to only this particular exploit. For a worm to support multiple vectors of compromise or various target platforms of a similar type, it must be large. This extra weight can slow down any one instance of a worm attack or, in a macroscopic view, more quickly clog the network.

Other attacks include session hijacking and credential theft (such as passwords and cookies) attacks. Here the attack does not involve any escalation of privileges, but does assist the worm in gaining access to additional systems. These attack elements are also most often used in intrusion detection signature generation. Since the attack is executed between two hosts and over the network, it is visible to monitoring systems. This provides the most accessible wide area monitoring of the network for the presence of an active worm. However, it requires a signature of the attack to trigger an alert.
Furthermore, passive intrusion detection systems cannot stop the worm, and the administrator is alerted to the presence of the worm only as it gains another host.


Passing messages: communication
Worms exist only on computer networks composed of individual hosts. For a worm to utilize its collective intelligence and strength, worm nodes need some mechanism to communicate with each other. This communication mechanism can be used to interface to the compromised system or to transfer information between nodes. For example, if worm nodes are participating in reconnaissance actions, their network vulnerability and mapping information must be passed through to other nodes using some mechanism. The communication module provides this mechanism.

These communication channels are sometimes hidden by the worm using techniques similar to ones adopted by hackers. These can include process and network socket hiding techniques (typically via kernel modules or monitoring software subversion) or the use of covert channels in existing network elements. Communication channels can be both

• server sockets, which accept inbound connections, and
  
• client sockets, which make outbound connectionsto another host.
  

Furthermore, these channels can be over a variety of transport protocols, such as ICMP or GRE packets, or in non continuous connections, such as e-mail.
Communication channels can be created from a variety of media. A TCP session, such as a Web connection, is one method, but others can include ICMP or UDP-based communication mechanisms, where messages are sent in a single packet. The Slapper worm used such a system to communicate between nodes, with UDP packets being sent between nodes. Electronic mail can also be a communication channel, although a slow one at times.

Several worms have used this technique, including the Ramen worm. Alternative communication channels can include nonsocket-based communication channels. Signals can be sent to the worm via a crafted packet that is not accepted by a listening socket on the host but instead observed on the wire by a “sniffer,” listening promiscuously to the traffic seen by the host. This signal delivery method can be efficient and stealthy, allowing for signals to hide in the noise of the normal network traffic.

Furthermore, covert communications between worm nodes may occur in places such as Web pages and Usenet messages. These are then viewed and acted on by an infected computer. Such a signal may include directions on where to attack next or to delete files on the infected system. By affecting the client application, such as a Web browser, the worm can piggyback its way through the Internet with the system’s user, while continuing communication with the rest of the worm network.



Taking orders: command interface
Having established a system of interconnected nodes, their value can be increased by means of a control mechanism. The command interface provides this capability to the worm nodes. This interface can be interactive, such as a user shell, or indirect, such as electronic mail or a sequence of network packets. Through the combination of the communication channel and the command interface, the worm network resembles a DDoS network. In this model, a hierarchy of nodes exists that can provide a distributed command execution pathway, effectively magnifying the actions of a host.

Traditionally, hackers will leave some mechanism to regain control to a system once they have compromised it. This is typically called a back door because it provides another route of access, behind the scenes, to the system. These mechanisms can include a modified login daemon configured to accept a special passphrase or variable to give the attack easy access again. Code Red, for example, placed the command shell in the root directory of the Web server, allowing for system-level access via Web requests.

The command interface in a worm network can include the ability to upload or download files, flood a target with network packets, or provide unrestricted shell-level access to a host. This interface in a worm network can also be used by other worm nodes in an automated fashion or manually by an attacker.



Knowing the network: intelligence
As worms move along and gather hosts into the worm network, their strength grows. However, this strength can only be harnessed when the nodes in the system can be made to act in concert. Doing this requires knowledge about the other nodes, which includes their location and capabilities. The intelligence component of the worm network provides this facility. When the worm network gains a node, it is added to a list of worm hosts. This information can be used later by the worm network or its controllers to utilize the worm system. Without this information, finding and controlling the nodes in the system are difficult tasks to manage. The information repository held by the worm network can be either a tangible list, such as a list of hostnames or addresses, or a virtual list. One example of a virtual list would be a private chat channel controlled by the worm’s author. Hosts that are affected by the worm join the channel, which in turns is the database of worm hosts. This intelligence database can be developed using several mechanisms.

An actual list of nodes in the worm network containing their network location
(IP address), possibly along with other attributes, such as host type, network
peers, and file listings, would be in one or more files on worm hosts or with an attacker. This database can be created by worm nodes sending an e-mail upon infection with their node information, by sending specially crafted packets to a central location, or by other similar mechanisms. Alternatively, for a virtual database of worm nodes, their subscription to some service for worm nodes, such as an IRC channel or the like creates this list. Worm nodes join the channel and register themselves as active worm hosts. All of these methods have been used by widespread worms in the past and still continue to be effective techniques.

The intelligence database can be monolithic, where the whole database is located in one place, or made from a distributed collection of databases. The former type can easily be created by using a notification system made from electronic mail or a packet-based registration system. This type of database, used by worms such as the Morris worm and the Linux-infecting Ramen worm, is easily gathered but also easily compromised, as is discussed later.

The second type of database, a distributed listing, can be formed in a variety
of ways. A mesh network of worm hosts could be used by worms, with some nodes containing pieces of information about various subnetworks within the larger worm system. Worms would register with their closest database node. When seeking out a node to contact, the requesting host or person would query these local centers, with the appropriate one returning the information needed to establish an answer.
An alternative mechanism that can be used to generate such a distributed database is the use of the parent-child relationship between worm nodes. As they move along and infect additional hosts, the parent node develops a list of infected children. The worm node would then have limited knowledge about the whole worm network, but enough information to contact one of its children.

At first glance, the resilience to compromise or attack is higher with the distributed intelligence database. Another attacker, an investigator, or unexpected outages only affect a small portion of the worm network. This resilience incurs a significant setup penalty, as well as overhead, in gathering information. At some level the connectivity of the nodes needs to be maintained, which provides a point of vulnerability for an attacker or an investigator. Furthermore, it is vulnerable to injection attacks by an investigator or an attacker who wishes to slow down or subvert the worm network.



Assembly of a complete worm node
Figure shows the pieces as they would be assembled in a full worm. For example, the reconnaissance component sends information to the attack module about where to launch an attack. It also sends this information to an intelligence database, possibly using the communication interface. This communications interface is also used to interface to the command module, calling for an attack or the use of the other capabilities against a target.

Note that the arrows can point through the communications and command interfaces to another worm node, such as for intelligence updates or calls for attacks against nodes.

Ramen worm analysis
Using this described worm structure, we can map the components of the Ramen worm which appeared in late 2000 to early 2001, and characterize this instance. Max Vision has written an excellent dissection of the Ramen worm (actually not foundbut see here), including the life cycle, which should also be studied. In mapping these components to a worm found in the wild, we can see how they come together to form a functional worm.

Ramen was a monolithic worm (Vs Modular worms), which is to say that each instance of an infected host has the same files placed on it with the same capabilities. There exists some flexibility by using three different attack possibilities and by compiling the tools on both RedHat Linux versions 6.2 and 7.0, but each set of files (obtained as the tar package “ramen.tgz”) is carried with each instance of the worm.

The reconnaissance portion of the Ramen worm was a simple set of scanners for the vulnerabilities known to the system. Ramen combined TCP SYN scanning with banner analysis to determine the infection potential of the target host. It used a small random class B (/16) network generator to determine what networks to scan. The specific attacks known to Ramen were threefold:

• FTPd string format exploits against wu-ftpd 2.6.0
• RPC.statd Linux unformatted strings exploits, and
  
• LPR string format attacks.
  

The command interface of the Ramen worm was limited. No root shell was left listening, and no modified login daemon was left, either. The minimal command interface was reduced to the small server “asp”, which listened on port 27374/TCP and dumped the tarball “ramen.tgz” upon connection.

Communication channels were all TCP-based, including the use of the text-based Web browser “lynx,” which issued a GET command to the Ramen asp server on port 27374/TCP, the mail command to update the database, and the various attacks, which all utilized TCP-based services for attack. Aside from DNS lookups, no UDP communication channels were used. No other IP protocols, including ICMP, were directly used by the worm system. All communication between the child machine and the parent (the newly infected machine and the attacking machine, respectively), along with the mail communication to servers at hotmail.com and yahoo.com were fully connected socket-based communications.

The system’s intelligence database was updated using e-mail messages from the system once it was infected to two central e-mail addresses. The e-mail contains the phrase “Eat Your Ramen!” with the subject as the network address of the infected system. The mail spool of the two accounts was therefore the intelligence database of infected machines. Unused capabilities can be summarized as the other two exploits not used to gain entry into the system, which allow for some flexibility in targeting
either RedHat 6.2 or 7.0 default installations. Ramen did not contain any additional attack capabilities, such as packet flooding techniques, nor did it contain any file manipulation methods.

In analyzing the complexity of the Ramen worm the author has cobbled together several well-known exploits and worm components and as methods utilizing only a few novel small binaries. Examination of the shell scripting techniques used shows low programming skills and a lack of efficiency in design. These findings have two ramifications.

1. First, it shows how easy it is to put together an effective worm with minimal coding or networking skills. Simply put, this is certainly within the realm of a garden variety “script kiddy” and will be a persistent problem for the foreseeable future.
   
2. Second, it leaves, aside from any possible ownership or usage of the yahoo.com and hotmail.com e-mail accounts, very little hard evidence to backtrack to identify the worm’s author.

Worm Traffic Patterns

Because of its continual growth and typical repetitive nature, worm traffic can be readily characterized. Although it is relatively easy to build a signature for a detection engine, typically used on a network intrusion detection system (NIDS).

Unless otherwise stated, the assumption is that the worms under study are spreading from host to host, are active on all hosts they enter, and continue to be active, because this is the pattern of most worms.



Predicted traffic patterns
Because they resemble living systems in some fashion, it is possible to model the growth and reproduction of network worms. Their growth patterns are governed by the rate of infection and the number of vulnerable hosts at any given point. Similarly,
their traffic patterns, in their scans and attacks, are determined by the number of active worms at any time and the amount of traffic per node.



Growth patterns
The worm network actively seeks new hosts to attack and add to the collection nodes in the network. As it finds hosts and attacks them, the worm network grows exponentially. This growth pattern mimics patterns seen for communities occurring naturally, such as bacteria and weeds.

Worm infections can grow in an exponential pattern, rapidly at first and then slowing as a plateau value is reached. This is a typical kinetic model that can be described by a first-order equation:

Nda = (Na)K(1− a)dt (3.1)

It can then be rewritten in the form of a differential equation:

da/dt =Ka ( 1− a ) (3.2)

This describes the random constant spread rate of the worm. Solving the differential equation yields

a= (e^K(t-T))/ [1+(e^K(t-T))] (3.3)

where

• a is the proportion of vulnerable machines that have been compromised,
• t is the time,
  
• K is an initial compromise rate, and
  
• T is the constant time at which the growth began.
  

Rate K must be scaled to account for machines that have already been infected, yielding e^K(t-T) .

This equation, known as the logistic growth model, is at the heart of the growth data seen for network worms. While more complicated models can be derived, most network worms will follow this trend. We can use this model to obtain a measure of the growth rate of the worm. Some worms, such as Nimda and Code Red, have a very high rate constant K meaning that they are able to compromise many hosts per unit of time. Other worms, such as Bugbear and SQL Snake, are much slower, represented in the smaller rate constants for growth. Figure shows a simple graph of (3.3) using several values of K. The equation shown in this figure is the sigmoidal growth phase of a logistic growth curve. The initial phase of exponential growth and the long linear phase as the worm spread scan be observed. As the worm saturates its vulnerable population and the network, its growth slows and it approaches a
plateau value.

These equations are highly idealized, because the value of N is assumed to be fixed. This assumes that all hosts that are connected at the outset of the
worm attack will remain attached to the network. This constancy assumes
that hosts will remain vulnerable and patches will not be applied. Furthermore, the model assumes a similar amount of bandwidth between hosts which also remains constant during the worm’s life cycle.

In the real world, not all hosts have the same amount of connectivity, and bandwidth is quickly consumed by the worm network as it grows to fill the space. Despite this, these equations provide a good representation of the observed data for a reasonably fast moving worm.

At the peak of its rate of spread, Code Red v2 was able to compromise more than 2,000 hosts a minute. In just under 2 hours, the rate jumped more than fourfold to this maximal value, demonstrating the exponential growth of the worm. After this point, the rate of infection slowed but did not return to 0 until long after the initial introduction of the worm.




Traffic scan and attack patterns
Similar to the growth rate of the worm network, the traffic seen for the
reconnaissance and attack activities by the worm networks is also sigmoidal in nature. It is typically multiples of the number of active and infected hosts on the network, taking into account that each host will scan a large portion of the network space and repeat this scan. For hosts that repeat this scan indefinitely, this traffic grows at a rate that is much faster than the spread of the worm.



Disruption in Internet backbone activities
Not entirely unexpected, as worms move, they are increasingly saturating the network on which they reside. Worms are typically indiscriminate in their use of networks and work to aggressively scan and attack hosts. This saturation can have consequences on the network infrastructure and use. As described below,

• Internet routing updates
  
• network use, and
  
• intranet servers
  

are all affected by worms during their life cycles.



Routing data
The Internet is a collection of networks with the backbone consisting of autonomous systems. These autonomous systems are routed to each other, with this routing data typically contained in the border gateway protocol (BGP; see RFC 1771 [2]). Cowie et al. have analyzed a subset of their Internet instability data to measure the impact of major worms on BGP routing stability. Their historical data allow them to observe differences in the instability of the Internet backbone routing infrastructure and discern signals above the noise.

The damage to the global BGP routing infrastructure brought about by Code Red and Nimda results from several factors. First, the volume of traffic is enough to disrupt the communication networks between routers, effectively choking some routers off of the Internet. When this occurs, the routes to the networks serviced by these routers are withdrawn. Route flap, the rapid announcement and withdrawal of routes, can occur when these routers recover from the load and reintroduce themselves to the outside world and then are quickly overwhelmed again. Routing flap can propagate
through the Internet unless dampening measures are in effect, affecting global routing stability. Route flap was made significantly more prominent due to the activity of Code Red and, even more so, by Nimda, which acts far more aggressively and sends higher traffic rates.

The second source of routing instability is also caused by the volume of traffic generated by Internet worms and directly affects routers as well. The traffic volume increases several fold over the normal traffic on a link, leading to high CPU and memory usage on the routers. This load is only aggravated when flow export (i.e., Cisco NetFlow) is used for accounting, performance measurements, and network security monitoring. Again, as the routers suffer from the load, they collapse, leaving the network and leading to the cycle of route flap.

The third source of routing instability is a result of attacks on routers themselves. Some modern routers contain HTTP-based console management ports, facilitating their administration. Because the worms are indiscriminate about the hosts they attack, attempting to attack every host to which they can connect to port 80/TCP, they will invariably attack routers listening on this port. The sustained connection from many worm sources is enough to raise the load on the routers to high levels, causing the routers to crash in many instances.

The consequences of this increased instability on the Internet were felt for several days, in proportion to the size of the instability introduced by the worm. While the Internet has been modeled and shown to be resilient to directed attacks at most of its core components, the magnitude of the load on the Internet, in addition to the directed attacks at core routers, led to instability. However, the Internet was still functional overall.



Multicast backbone
In early 2001, as the Ramen worm was spreading, multicast networks started to see storms and spikes in the number of multicast announcement messages for each source. Multicast networks use a point-to-multipoint message delivery mechanism, allowing for a single source of data to be received by many hosts across the Internet (see here). Popular uses of the multicast network include audio streams of academic presentations and data streams from sources with wide interests.

n an open letter to the Linux community, Bill Owens described the effect of worms on the multicast backbone network:

The worm has a sloppily written routine to randomly choose a /16 network
block to scan. That routine can choose network prefixes in the range
224.0.0.0 — 239.255.2255.255, a set of addresses reserved for multicast traffic. Each scan packet then causes the generation of a Multicast Source Distribution Protocol (MSDP) Source Availability message. Unfortunately
the scanner being used is very efficient and can cover a /16 in about 15 minutes, generating 65000 SA messages. The SA messages are flooded throughout the multicast backbone and the resulting load on the routers has caused degradation of both multicast and unicast connectivity.
The worm had the effect of disabling a good portion of the multicast network backbone through its leak into the multicast reserved space.
The effects of this were dramatic. It effectively led to a few hosts being
able to disable a significant portion of the multicast network by overwhelming connected routers with traffic. As noted by Owens [6], in his memo, this affected not just multicast traffic but also unicast, or traditional traffic, as these routers collapsed under the load.

Infrastructure servers
Whereas large portion of the Internet is affected when very large worms hit, smaller worms can affect a local network in much the same way. Local networks, such as corporate or university networks, typically have resources for electronic-mail distribution, file sharing, and internal Web servers. All of these elements are affected by network worms. Worms that spread using electronic mail, such as one of the Nimda propagation vectors, can overwhelm mail servers with messages, because
each one sends an attack via a mail message. When medium or large address books are in use by even a modest number of infected machines, the mail storm can be overwhelming to servers. The rate and volume of mail delivery will choke out other, legitimate messages much as worm traffic will overtake a network on the Internet link. Furthermore, if the server performs scans of the messages as they pass through, this additional bottleneck can aggravate the stress on the mail server.

Similarily, local Web servers can feel the brunt of a worm attack. When locally biased scans are used by worms, such as is found in Nimda and Code Red II, the local Web servers feel the burden quickly and can collapse under the load.




Observed traffic patterns
Having laid out a theoretical framework for the growth and spread of the worm populations, we can now look at actual data on networks to see if the observations match the predictions. We will examine three sources of data, first from large network monitors which have measured the scans and attacks of worms on /16 networks. The second set of data is from a black hole monitor. The third set of data is from a single host on a large network which logged IIS worm attempts for nearly 1 year.




From a large network
We begin our look at measured and observed traffic statistics for the onset and continuation of Internet worms by looking at a large network. This network, a representative class B network, kept detailed statistics for Code Red hosts as they attempted to access the network. As shown in Figure right, a sigmoidal approach is seen for the per-hour sources of Code Red scans during the first 36 hours of the worm’s onslaught, as predicted by the above modeling. After an initial steady-state phase, the number of scans seen per hour begins to diminish as infected machines are cleaned up and removed from the Internet.


It is even more interesting to see the data in Figure left. In this figure, the number of unique sources, based on IP address, are plotted as a function of time. The x axis of the graph runs from approximately October 2001 until May 2002, showing the activity of Code Red hosts against a /16 network. This time period represents 3 to 10 months following the introduction of the Code Red worm to the Internet. The striking features of the graph in Figure are as follows:

• The cycles of scans and quiescence are clearly visible. There is some tailing of the data due to clock skew on various systems, but the general trend is still visible.
  
• The maximum values reached are increasing with each month, by more than 2,000 unique hosts from November 2001 to May 2002.

What these data clearly show is the persistent life of the Code Red worm despite the continual release of information and patches for system fixes. Once infected with a malicious worm, much of the Internet is not rid of it. These scans and activities became the background noise of the Internet in the months following the Code Red and Nimda attacks.



From a black hole monitor
Black hole monitoring, or the use of an unallocated network to measure the random data that get put into it, has been very useful in the measurement of large cross sections of Internet trends. Black holes are typically very large networks, such as /8, representing 1/256 of the IPv4 address space on the Internet (and even more of the actual, allocated space). As such, a very accurate picture of actual Internet traffic can be gained. Furthermore, since no actual hosts exist within the space, it is unaffected by outbound data requests.

Figure right shows the results of Nimda and Code Red measurements by a black hole system. Similar to what we saw earlier for the production class B
network, the cycles of scans and dormancy by Code Red are immediately visible. What is novel about this is that Nimda values are also represented in this graph, although no such trends for Nimda scans and attacks can be detected. The relative prevalence of continued Nimda and Code Red hosts can be measured. More than 6 months after each worm’s introduction, there are more Code Red hosts than Nimda hosts.






From an individual host
The individual host analysis shown in Figure left is for a globally advertised Web server running on a single homed /32 (a globally unique host). The Web server runs Apache and resides on an educational network in the United States. The surrounding network is a /16. Using the Apache server software, worm requests were logged and analyzed within a 2-year period of Web server traffic. The Apache suite is unaffected by the methods used by the Code Red and Nimda worms to attack IIS servers. However, the attacks are captured and logged, which allows for monitoring. The network on which this host sits has been aggressively identifying and blocking Code Red and Nimda hosts at the edge or at the nearest subnet device. No filtering of worm-affected hosts was performed on this server. The data here give us a measure of the effectiveness of these measures on a production network that is, taking active measures to stem the tide. This positioning of the host is important because of the “island hopping” that Code Red 2 and Nimda do.

In the analysis of the data, it is important to recall that Code Red 1, 2, and II each have one attack request, while Nimda has seven unique attack requests. Thus any one host infected by Nimda would have seven times as many attacks logged per attack instance than a Code Red attack. Data were culled from Apache logs from approximately July 1999 until May 18, 2002. This represents approximately 10 months of Code Red 1 and 2 traffic, more than 9 months of Code Red II traffic, and approximately 8 months of Nimda attacks. Figure shows the number of hosts detected for each type of attack per day. The immediate observation is that Code Red 1 and 2 took a bit to “ramp up” the number of hosts used for attacks. The number of Code Red 1 and 2 hosts reaches a maximum a few days after the initial observation before dropping off dramatically. Code Red II, in contrast, shows an immediate onset with a pronounced persistence in the number of hosts seen. Nimda shows this, as well, but it is noticeably more dramatic. The first day the worm was seen shows a marked upsurge in infected hosts, almost 60, before dropping off quickly due to filtering. In further analyzing the data in Figure , we can measure the “noise” any one infection typically makes on the network. In the cases of Code Red 1, 2 and II, the number of hosts mirrors the number of attacks logged by the server. Nimda hosts, however, do not show this mirroring. While there is a noticeable spike in the number of Nimda hosts seen on September 18, 2001, this number quickly drops off. The number of Nimda requests seen, however, does not drop off as quickly. This suggests that the Nimda worm is noticeably more “noisy” than Code Red, above its seven fold number of requests made during an attack compared to any of the variants of Code Red. Last, we can observe the heavy tailing in the figure for both Nimda and Code Red 1 and 2. Code Red II, and the version that used a heavy local bias in its scanning, was quickly eradicated from the network. Despite also using island hopping, Nimda has continued to thrive for more than 8 months in this setting. This is most likely due to the aggressive nature of Nimda when compared to Code Red. The prevalence of Code Red 1 and 2 over the course of 10 months is most likely due to its completely random jumping from network to network. As such, it is possible for a host from a distant network to scan for possible victims despite local measures to clean up Code Red hosts.