BOINC FAQ: Security
From Unofficial BOINC Wiki
[edit] How do I know whether BOINC is for real or a virus?
BOINC itself is for real:
- Gomes, Lee. "Wanted: Your PC's Spare Time." The Wall Street Journal (Eastern edition)., June 19, 2006, page R14
- Oleck, Joan. "Getting More from a PC's Spare Time." The New York Times [late edition (East Coast)], Sept. 11, 2003, page G5
- Sanders, Robert (University of California, Berkeley, Ofc. of Public Affairs). "Climate prediction goes BOINC." Press release, retrieved from http://www.berkeley.edu/news/media/releases/2004/09/15_BOINC.shtml
- Sanders, Robert (University of California, Berkeley, Ofc. of Public Affairs). "Search for ET to look again at 150 signals." Press release, retrieved from http://www.berkeley.edu/news/media/releases/2003/03/10_search.shtml
- University of Texas Medical Branch at Galveston. "UTMB and IBM enlist aid of global computer grid to find cures for dengue, West Nile and hepatitis C diseases." Press release, retrieved from http://blog.utmb.edu/newsroom/?p=2286
- Wilson, Elizabeth K. "Science by and for the people." Chemical & Engineering News, Apr. 2, 2007, pages 62-66.
There are two scholarly journal articles that, according to a recent forum posting on the World Community Grid website, use BOINC-derived results:
- Max W. Chang, William Lindstrom, Arthur J. Olson, and Richard K. Belew. "Analysis of HIV Wild-Type and Mutant Structures via in Silico Docking against Diverse Ligand Libraries." J. Chem. Inf. Model., May-June 2007, pages 1258-1262.
- Malmström L, Riffle M, Strauss CEM, Chivian D, Davis TN, et al. "Superfamily Assignments for the Yeast Proteome through Integration of Structure Prediction with the Gene Ontology." PLoS biology, April 2007, page e76.
However, in order for BOINC to work, it has to download and execute science applications, which are produced independently. It is possible that somebody could put up a web site that hosts malware disguised as a science application, or that somebody might hack into a legitimate science application project server, but it's more likely that a science application may simply contain errors or be written badly. That's why it is important for users to attach the BOINC client software only to projects that are trusted.
BOINC uses code signing to provide accountability for the authors of science applications, as a safeguard for users (see below), but is not designed to be run on computers that are used for life-safety applications such as emergency communications.
[edit] How can I be sure BOINC or one of the projects hasn't been hacked in order to distribute viruses?
Projects won't get many participants if they are seen to be risky.
Several security mechanisms are implemented in the BOINC system:
- BOINC uses digital signatures to sign executable files (applications) and their dependencies to ensure that the file has not been modified during transfer or by other activities (such as cracking into project's web server). The only possible option to sign the file correctly is to have the private code sign key that isn't available publicly. The public code sign key (Digital Signature) is sent to the client when it attaches to the project. See Recommended Code-Signing Practice for more technical information.
- Non-executable files, such as work unit data is secured by computing the MD5 hash for it. MD5 ensures the data integrity. It is nearly impossible to create malicious file with the same MD5 hash as the original. Also, in order to distribute malicious data with work units, the web server must be cracked and all generated work units and/or work generator must be modified. See MD5 for more technical information about MD5 algorithm.
- BOINC client also checks for the size of downloaded files. The size must be exactly equal to the size defined in the XML files for the file to be used.
[edit] Does running BOINC mean ports are left open on my computer?
No. All communications are initiated from your computer. In this way, ports do not have to be left open to allow communication from the servers to your computer.
[edit] What data do I give you to register?
In order to take part in a Project, you have to create an account using the project's web site. Just supply your name and email address. Country and postcode are optional. Your name can be real or anything you choose.
[edit] Why do I have to provide an email address?
An Account ID will be sent by email which will act as a password. Version 5 changed this behaviour. It is possible to attach to a project using the wizard. If you provide a fake email address with version 5, it should work. However a geniune email address is recommended in case there is some need to contact you.
The User Name and Account ID will identify you for the purposes of downloading your specific project's Science Application and Work Units as well as for the purposes of interacting with the portal and message boards. It is also necessary to have some identity to allocate credit to the correct people.
[edit] Will they sell my email address or other data?
This needs to be addressed to the relevant project.
For example, Climateprediction’s answer is:
“Never! We're interested in your email address only so we can contact you when the climateprediction.net client is ready for distribution and to keep you informed of the project's progress. We shall use your User Name only to customise the information on our website, User Portal and in various statistics.”
[edit] disclaimer
This FAQ is unofficial, is provided on an "as-is" basis with no warranty of any kind, and should not be construed as representing the views of BOINC project administrators or scientists. (In fact the pages here can be edited by nearly anybody with an Internet connection, so it is plainly self-evident that there is no guarantee that the version of this FAQ you are reading on any particular day and time is accurate.) All users should practice good security practices at all times; therefore, please use the BOINC software only in conjunction with projects that you trust.
BOINC and its science applications, like most software, are neither designed nor intended to be installed on any computer that performs safety-critical functions.
