How to Own the Internet In Your Spare Time

xenofile writes "A chilling paper has recently been posted analyzing the various threats worms pose to the Internet, and the relative ease of exploiting say the 30,000,000 Kazaa hosts to completely cripple large portions of the net." Lots of good stuff in this paper. It sorta combines many things you've probably read, and demonstrates how the net could be seriously taken by someone who wants it.

Comments

actually its based on trust

[guest12]

the net, like business or anything else in society is based on trust.

Re:actually its based on trust

[Anonymous Coward]

wrong - the net is based on pr0n. As long as this does not stop the pr0n from flowing, most of the net users will not care. Also, will this affect AOL chat groups? Because those are very important too.

Re:actually its based on trust

[RatOmeter]

Yes. And in business, we aren't all that trusting, so we have laws to regulate business behavior in order to improve or, at least, enforce the trustworthiness between business players. Do we need/want the same practices applied to the Internet? I say no, but I have this awful feeling of gloom. I think that, within 10 or 15 years (maybe even less) the business interests in the net will have convinced the lawmakers that we need to boost the trustworthiness of the net... by regulating the hell out of it.

I think we, as the techical force behind the net, can and must resolve the major issues that make the businesses nervous. If they can trundle blithely forward, enjoying the net without too many major hitches, they'll continue to pay our salaries and let us run it. One or two major exploits or outages with mega/giga dollar associated losses, and the lawmakers will clamp right down. Bye bye net, as we know (and love) it.

Re:actually its based on trust

[mesocyclone]

Why single out business? Society also has laws to regulate individual behavior.

It's all just human behavior, and human behavior leaves a lot to be desired.

Re:actually its based on trust

[hamshere]

I am oddly reminded of the great hoo-ha that went on over advertising on the net. The desire to keep it scientific and personal, the desire to keep it out of the hands of business and corporations. Look at it now - it has bloomed in to something you could never have imagined ten years ago.

Regulating these industries is the next step. Creating enforcable standards is the next step - especially when you are talking about the general public.

An analogy is due, I think: When saftey started becoming a big issue for cars, did everybody say "don't do that, you'll cramp our style" or did they say, "yes, that's sensible, less people will be hurt?" Well, this is a similar issue. If we regulate the net, attempt to narrow the security holes and make it a safer place to talk and play and do business, more people are going to use it and fewer people are going to get burned.

Seems like a good idea to me.

Re:actually its based on trust

[EpsCylonB]

I can't help thinking that a version of the net that we know and love will always exist (at least in the forseeable future). It may have to revert to the days of BBS's and the like but I don't think that people are going to stop using computers to communicate any time soon.

Maybe it will be a good thing, seperate versions of the internet, one for bussiness, one for movies and porn, etc.

Well

[shayera]

With the speed the RIAA gets these sharing networks to hunker down, perhaps the problem will go away on it's own...
On the other hand, perhaps pigs will fly, and a certain redmond company will once and for all wisen up and ensure their OS'es not by default make the world a happy place for worm writers..

Pinky and the Brain

[Alien54]

Why, oh Why does this remind me of something that I would see as a scheme on Pinky and the Brain?

another tool for budding mad scientists around the world. arghhhhh.

Re:Pinky and the Brain

[cybermage]

Why does this remind me of something that I would see as a scheme on Pinky and the Brain?

Pinky. Are you pondering what I'm pondering?

I think so Brain, but if we take over the net, how will the big boats catch any fish?

*bonk*

Not that kind of net, Pinky. The Internet: A global network of millions of computers; a network where music and pr0n are yours for the taking; a network where powerful tools like email and hypertext are used promote penis enlargement, pyramid schemes, and cheap drugs from the third world; a network where millions are left totally vulnerable by software given to them freely by the richest company in the world.

Ooooo, sounds nice, Brain. But Brain?

Yes, Pinky?

If you take it over, who's gonna share their pr0n with you?

Abstract

[Anonymous Coward]

To Appear in the Proceedings of the 11th USENIX Security Symposium (Security '02)

The ability of attackers to rapidly gain control of vast numbers of Internet hosts poses an immense risk to the overall security of the Internet. Once subverted, these hosts can not only be used to launch massive denial of service floods, but also to steal or corrupt great quantities of sensitive information, and confuse and disrupt use of the network in more subtle ways.

We present an analysis of the magnitude of the threat. We begin with a mathematical model derived from empirical data of the spread of Code Red I in July, 2001. We discuss techniques subsequently employed for achieving greater virulence by Code Red II and Nimda. In this context, we develop and evaluate several new, highly virulent possible techniques: hit-list scanning (which creates a Warhol worm), permutation scanning (which enables self-coordinating scanning), and use of Internet-sized hit-lists (which creates a flash worm).

We then turn to the to the threat of surreptitious worms that spread more slowly but in a much harder to detect "contagion" fashion. We demonstrate that such a worm today could arguably subvert upwards of 10,000,000 Internet hosts. We also consider robust mechanisms by which attackers can control and update deployed worms.

In conclusion, we argue for the pressing need to develop a "Center for Disease Control" analog for virus- and worm-based threats to national cybersecurity, and sketch some of the components that would go into such a Center.

Also in PDF optimized for reading online, PDF optimized for printing

Wow

[flatlineloc]

I got scared for a second, then did a google search for identified linux worms, thought about how many times I've never caught one, and promptly became glad my OS isn't mainstream.

Re:Wow

[SCHecklerX]

You miss the point. If the Internet gets congested with traffic, you will suffer too. Take, for example, the latency spike that occurred last monday around 2:00pm EST as the worm that attacked M$ SQL servers started doing its thing.

Re:Wow

[flatlineloc]

And an alternative point can be made as well, every time one of these worms goes rampant throughout the internet, it may affect us, but it should in theory hurt Microsoft more. I wouldn't be surprised if one of the reasons why a lot of companies are migrating away from NT is because of these ISS and VB holes. So while it may hurt us in the short term, it will hurt those who put out shoddy software more in the long term.

Re:Wow

[packeteer]

do you realize your saying "security through obscurity"?... i don thtink this is the way to continue... use an os becuase its good not becuase its obscure... gnu/linux/bsd/unix or whatever you wanna call it is a good start but dont hold on too so tight that your security slips away from you

Re:Wow

[packeteer]

security through obscurity is NEVER a good idea... the only time it WOULd work is if nobody knows your there or nobody else has your same OS... i assume that because you browse webpages ebviously SOME server knows your there... this creates a security threat... what if you isp was compromised... what if a cracker took a list of your isp's customers and tried to hack em all... see what i mean??? you CANT hide if your on the internet... and my second point is that Linux is NOT an obscure OS... there are ANY security holes known for linux and unless you compulsivly check bug fixes you ARE vulnerable... so i think that linux Is a fairly secure OS but dont hide behind you wall of "I USE LINUX EAT ME" bs...

Masters of the obvious

[wackybrit]

Wow, this paper really breaks new ground. Let's see:

If you can control a million hosts on the Internet, you can do enormous damage.

[..] you can access any sensitive information present on any of those million machines [..]

But for those who are truly thick and can't get the point:

In short, if you could control a million Internet hosts, the potential damage is truly immense [..]

It's good to see they're really targeting the 'brains' of the nation with these statements.

Luckily, things get a little more scientific as we move into the next section, but they actually say they're 'ignoring' certain important variables. Almost any mathetmatical theory works if you 'ignore' certain variables.

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.

But what about system level DOS attacks, you say? Firewalls were invented to solve these problems. Of course, firewalls were only invented because the original net code in Linux/Windows/etc hadn't anticipated DOS attacks, and couldn't fend them off themselves. I mean.. in 1994, who was flooding servers with 64kB ping packets?

It's time to rewrite the netcode. DOS attacks aren't really any different to memory leaks in programs. They can be controlled and confined and cleaned up, if the code is good. How often do you get a 'Protection Error' in Linux these days? Hardly ever. It's time to apply all of the safeguards we use in regular programming to net code too!

And if you're scared of reinventing the wheel and writing new net code from scratch, then you have only yourself to blame.

Re:Masters of the obvious

[Pike65]

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code.

According to Sophos (and I'd like to hope they know what they're talking about) the majority of the top ten viruses of April 2002 are e-mail based social engineering worms.

The problem is crappy users.

Re:Masters of the obvious

[NonSequor]

Almost any mathetmatical theory works if you 'ignore' certain variables.

Physicists have been doing this for a long time.

Re:Masters of the obvious

[gTsiros]

Yeah, but knowing *which* variables you "may" ignore is a very delicate art.

Anyway, this is offtopic...

Own "the internet" ? there is not "an internet". I could just set up my own network with friends and name it "foobarnet". Then others interested could come join us.

There isn't "an internet". The whole deal about "owning the internet" is in-existent.

Of course what i say sounds pretty naive, but i am sure you understand the main idea...

duh.

Re:Masters of the obvious

[wackybrit]

The problem is crappy users.

I'm not so sure. The 'e-mail based social engineering worms' you talk of aren't actually triggered by users, but by flaws in Outlook Express. It's not like these 'Pass this onto 20 of your friends' mails, which are viral, but not viruses.

Microsoft allows OE to access too many API functions. I mean, look at how these viruses work. You download them from the POP3 server, and when you preview them in OE, a box comes up saying 'Open' or 'Save As'. Many users just click OK, and end up getting infected. However, this isn't the user's fault, as such.

OE should not automatically open attachments! It's Microsoft's crappy code that has allowed it to be hacked in this way. So.. I think the blame rests with the programmers, not the users. The programmers are meant to create an environment that's safe for users.

Blaming the users is like blaming voters for getting GWB into office. It wasn't their fault, it was the system's fault for allowing it to happen.

Re:Masters of the obvious

[0xA]

Firewalls were invented to solve these problems

So you're gonna stop a DOS attack with a firewall? If they're "Masters of the Obvious" I guess that makes you "Masters of the Impossible". A firewall is not going to save you from a saturated link, aka DOS attack.

It's time to rewrite the netcode. DOS attacks aren't really any different to memory leaks in programs. They can be controlled and confined and cleaned up, if the code is good.

uh huh. Don't do much of this "netcode" stuff do you. Why do I think I just fed a troll?

Re:Masters of the obvious

[cybermage]

There isn't "an internet". The whole deal about "owning the internet" is in-existent.

The story submitter did properly capitalize "Internet" when he says "the Internet".

An internet is any network that connects two or more networks.

The Internet is this goofy thing, started by DARPA, over which you have received this HTML page.

internet == concept
Internet == one instance of the concept, paradoxically loved and hated equally by those who know it best.

Your foobarnet, presuming it would interconnect networks, and not just hosts, would be an internet. This is the Internet.

Re:Masters of the obvious

[dieMSdie]

Crappy users are never going to go away. A company with some insight, and a desire to write decent Apps would realize this and program around it as much as possible!

Instead, we have Micro$oft, driven by marketing and Bill's hunger for power. Sure, it's easy to use, but it's easy to 0wn too. The we have Apple, hard to 0wn, easy to use, but nowhere near the installed base. And then there is Linux, much the same.

I lay the blame for these worms where it belongs, at the feet of Micros~1. They could disable a lot of their "features" and stop most of this nonsense.

Re:Masters of the obvious

[Rogerborg]

Very insightful post. One problem:

• http://www.wackybrit.com
• 
  Server Error
  The following error occurred:
  Could not connect to the server
  Please contact the administrator.
  

I'd be more inclined to listen to exhortations to write robust code from someone who can actually keep his web server up. Perhaps you could clean your own house first.

Re:Masters of the obvious

[matrix29]

Almost any mathematical theory works if you 'ignore' certain variables.

Physicists have been doing this for a long time.

I'm a theoretical physicist, at least I think I am. I cannot be certain. It is just a theory I have.

Re:Masters of the obvious

[borud]

you don't seen to have the faintest idea what sort of problems need to be solved in order to counter the kinds of DoS attacks. do you really think it is as simple as "applying safeguards we use in regular programming to net code too"?

here's a challenge for you: show me what safeguards used in regular programming that will make my TCP/IP stack immune to being pounded by a million "flood agents". (since you are obviously not a technical person we will ignore the fact that the link will be saturated for now and assume a pipe of infinite bandwidth to the machine in question).

I don't think the article was aimed at people like you. I think it was aimed at people with at least some technical background.

as for the moderators: what have you been smoking?

Re:Masters of the obvious

[Anguirel]

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.

Actually, while it may be about crappy code in the end, you can't use this to bash MS whilst sparing the competition. Eudora did spread viruses at one time... when it was in common usage. It still does now, but we don't hear much about it because it doesn't have the same market coverage that Outlook / Outlook Express does.

It's all about numbers. It is more than likely possible to create a virus that could use to spawn new copies. In some cases it may be exceptionally difficult, but more than likely some small hole will always remain. However, it isn't worth trying it against a Eudora user if you're out to hit as many people as possible. The number of Eudora users is probably equal to or less than the number of people who have every address in a Outlook (Express) account's address book being another Outlook (Express) user. This is simply a case of MS having too much market penetration and therefore being the one every single person is hammering against. Were Linux to top the usage charts, you can be sure that viruses that found Linux / Linux server app. exploits would start appearing (though probably harder to create and be quashed, likely, much faster) but at that time your argument could be turned around to say 'No one attacks MS boxes, they must have better code...'

I agree with your sentiments about poorly written netcode being the ultimate problem, but don't add in unneeded attacks against MS. It's a problem shared by nearly all the netcode ever written until all the easy bugs have been found and patched...

Re:Masters of the obvious

[kz45]

I'm not so sure. The 'e-mail based social engineering worms' you talk of aren't actually triggered by users, but by flaws in Outlook Express. It's not like these 'Pass this onto 20 of your friends' mails, which are viral, but not viruses.

Microsoft allows OE to access too many API functions. I mean, look at how these viruses work. You download them from the POP3 server, and when you preview them in OE, a box comes up saying 'Open' or 'Save As'. Many users just click OK, and end up getting infected. However, this isn't the user's fault, as such.

OE should not automatically open attachments! It's Microsoft's crappy code that has allowed it to be hacked in this way. So.. I think the blame rests with the programmers, not the users. The programmers are meant to create an environment that's safe for users.

Blaming the users is like blaming voters for getting GWB into office. It wasn't their fault, it was the system's fault for allowing it to happen.

this is complete bullshit.

A friend of mine updated his linux kernel awhile back (I believe the kernel, at the time, was in beta). He lost all his important data because of a bug.

Should he blame linus? The programmers that worked on the latest release? Or should it be his own fault for using a beta release of a kernel on important data?

He was given many warnings not to use a beta version of the kernel, just like the many millions of users that are told every day by their sysadmins not to open attachments.

This argument sounds as stupid as a smoker that tries to sue the big-bad companies when they get cancer, when they have been told about this fact for the last 30 years.

People need to take responsibility for their own stupidity.

Re:Masters of the obvious

[wackybrit]

A friend of mine updated his linux kernel awhile back (I believe the kernel, at the time, was in beta). He lost all his important data because of a bug. Should he blame linus? The programmers that worked on the latest release? Or should it be his own fault for using a beta release of a kernel on important data?

If you're enough of a techie to be trying development (beta) kernels, then you know full well what the risks are.

A regular user using an e-mail client, simply expects to read mail. An e-mail client should allow them to do this without infecting their computer with a virus!

It's users fault if they open attachments by choice.. but when OE has a bug that allows attachments to open by themselves, IT'S THE SOFTWARE'S FAULT.

Re:Masters of the obvious

[dieMSdie]

Gunax lbh. V nz tynq lbh ner serr, sbe abj, naljnl.

Re:Masters of the obvious

[pommiekiwifruit]

Almost any mathematical theory works if you 'ignore' certain variables.

Physicists have been doing this for a long time.

I especially like the one where they put in a bodge factor for the cosmological constant of 10^100. Yup, out by a factor of a googol. That puts my -1 bodge at the end of a loop into perspective!

Re:Masters of the obvious

[kz45]

If you're enough of a techie to be trying development (beta) kernels, then you know full well what the risks are

If you are smart enough to check your e-mail, you should be smart enough to know that a 1K .vbs file named mypics is a virus.

It's users fault if they open attachments by choice.. but when OE has a bug that allows attachments to open by themselves, IT'S THE SOFTWARE'S FAULT

according to this reasoning, it's the fault of the linux programmers. There was no real way to stop the loss of data, other than not installing the update at all.

Re:Masters of the obvious

[wackybrit]

Your analogy is ridiculous. Linux development kernels are not designed for simpletons. Outlook Express is.

You need to have a bit of context.

An oil rig is a very dangerous place, but they get on okay, because the rig guys are professionals and know their work. If they screw up, it might well be their fault.

If you took a 3 year old kid to an oil rig and let them run about, they'd probably get killed/injured in no time. So, it's the kid's fault? No, oil rigs are not designed for kids, and you should not be taking them there.

Same with the software. Development kernels are not for the clueless.. whereas OE is supposed to be a safe environment for collecting e-mails. Totally different.

Re:Masters of the obvious

[kz45]

Your analogy is ridiculous. Linux development kernels are not designed for simpletons. Outlook Express is.

A software flaw has nothing to do with a user's intelligence.

Im trying to point out that the developers of linux have just as much responsibility as a compnay such as microsoft.

If you took a 3 year old kid to an oil rig and let them run about, they'd probably get killed/injured in no time. So, it's the kid's fault? No, oil rigs are not designed for kids, and you should not be taking them there.

If this were true, then 99.9% of the population shouldn't even be using a computer.

Re:Masters of the obvious

[freaq]

{1}
good to see that i'm not the only member of the congregation at our lady of unwarranted assumption.
being smart enough is a red herring. i did not deduce how to check email using my massive intellect, i learned how. ok, i was taught, sorry for fibbing mom. similarly, i learned what a .vbs file is. the two events had NOTHING to do with each other, and could have happened in any order.

{2}
OE isn't considered to be still in beta, is it? from jargon file 4.3.0:

beta /bay't*/, /be't*/ or (Commonwealth) /bee't*/ n.
1. Mostly working, but still under test; usu. used with `in': `in beta'. In the {Real World}, hardware or software systems often go through two stages of release testing: Alpha (in-house) and Beta (out-house?). Beta releases are generally made to a group of lucky (or unlucky) trusted customers.
2. Anything that is new and experimental. "His girlfriend is in beta" means that he is still testing for compatibility and reserving judgment.
3. Flaky; dubious; suspect (since beta software is notoriously buggy).

oh. right.
i'm not sure how your response relates to whackybrit's apparently justified condemnation of outlook. also, he was speaking of a development kernel, not an update.

Re:Masters of the obvious

[unitron]

"OE isn't considered to be still in beta, is it?"

Once you learn to regard any and every piece of software from MS as beta you aren't in for fewer nasty surprises, but it's more along the lines of not knowing when they will happen, rather than not knowing whether they will.

Re:Masters of the obvious

[SectoidRandom]

Firewalls were invented to solve these problems

So you're gonna stop a DOS attack with a firewall? If they're "Masters of the Obvious" I guess that makes you "Masters of the Impossible". A firewall is not going to save you from a saturated link, aka DOS attack.

Yes it is a little vague, firewalls only do a part of the job, routers do a lot, and rest is done by the administrator. (last part being the security patches) Most DOS/DDos attacks should be non-existant, except for the huge number of idiot administrators out there who dont understand simple concepts such as; Ingres filtering and bug-traq. (or for the non-administrator type that annoying button called "Windows Update")

Re:Masters of the obvious

[big_hairy_mama]

If this were true, then 99.9% of the population shouldn't even be using a computer.

It is true, because 99.9% of the population shouldn't be compiling, let alone running on a production box, Linux dev kernels. Read the context.

95% of the population should, however, be able to run Outlook Express without infecting their computers. Since OE is designed for that 95%, it should be OE that protects the dumbass users from hurting themselves.

For all the three year olds who are not oil rig professionals, OE is the closest they have to a padded room. A padded room with a gaping hole containing various sharp objects doesn't do much good!

Re:Masters of the obvious

[n3rd]

This is absolutely the worst bunch of drivel I have ever heard!

It's good to see they're really targeting the 'brains' of the nation with these statements.

What you quoted was a summary of the article, which is common is most scientific papers. They are telling you the reason they are writing the paper, and then presenting the facts to backup their assertions.

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.

Evidently, you didn't read the paper, at all. Not once is Outlook mentioned, however the various IIS worms are talked about in-depth. You're simply using a discussion about security to take a cheap shot at Outlook.

Also, you are using terms that are far from correct. This paper is speaking of worms, not viruses. Yes, there is a large difference. Also, a DOS is much different than a DOS. The extra "D" means Distributed, where many hosts are involved. It's one thing when I use my T1 to try and flood your cable modem, but and much different thing when I use 50 T1's (Hint: I'll probably succeed).

But what about system level DOS attacks, you say? Firewalls were invented to solve these problems. Of course, firewalls were only invented because the original net code in Linux/Windows/etc hadn't anticipated DOS attacks, and couldn't fend them off themselves. I mean.. in 1994, who was flooding servers with 64kB ping packets?

More balther! I'll only say this once, so read carefuly: Firewalls do not stop DDOS attacks!. Using my example above, what happens if you have a firewall on your cable modem and I max out 50 T1 lines sending packets to your cable modem? Will the hosts behind your firewall be harmed? Not directly, no. However, you will have no Internet connectivity since litterally all of your bandwith is being used. When all of the bandwidth on your line is being used you can't get out, and in the case of commercial organizations, your customers can't get to your web site.

This is what makes DDOS attacks so leathal. All you have to do is sit down and do the math. If crackers can own enough T1s, T3s and higher, they can bring down cnn.com, even if it does have an OC48 (or whatever it really has).

It's time to rewrite the netcode. DOS attacks aren't really any different to memory leaks in programs. They can be controlled and confined and cleaned up, if the code is good. How often do you get a 'Protection Error' in Linux these days? Hardly ever. It's time to apply all of the safeguards we use in regular programming to net code too!

This is a double edged sword, and there is no right answer. What if you get rid of ICMP (ping) with no repurcussions? Then people would just use SYN floods, which cannot be stopped on the client end. You can use a firewall to filter all outgoing SYNs to port 80, sure. That will stop your systems from participating in DDOS attacks on web servers, but then again your users can't connect to any web sites.

As for you statement about "Protection Errors" I assume you are referring to the Ping of Death that Windows machines were vulnerable to. It happened, it was fixed, get over it. I'm far from a Microsoft advocate, but Linux has had some nasty bugs too (the one where you could remotely read memory comes to mind). If I'm incorrect in my assumption, feel free to correct me.

The only point I do agree with you on is the "safeguards" statement. Problems such as the Ping of Death should never have happened, but as you know, all software (Open and Closed source) has bugs. They are found, fixed and forgotten.

And if you're scared of reinventing the wheel and writing new net code from scratch, then you have only yourself to blame.

And I'll watch the change logs for your TCP stack updates. ;)

Re:Masters of the obvious

[lateral]

The problem is crappy users.

I disagree with this. Certainly user education would help but I don't think we can rely upon it, continuous re-education of hundreds of millions of users is not a realistic proposition.

Most of the people using computers are using them as a tool to facilitate whatever task it is they want to perform; hold a conversation, look at naked people, find out some information etc. Their focus is not the computer, the application or how either works.

We have to build applications that reflect the *actual*, real world behaviour of users and the tasks they want to perform. Anything else is poor design.

Re:Masters of the obvious

[kz45]

It is true, because 99.9% of the population shouldn't be compiling, let alone running on a production box, Linux dev kernels. Read the context.

95% of the population should, however, be able to run Outlook Express without infecting their computers. Since OE is designed for that 95%, it should be OE that protects the dumbass users from hurting themselves.

For all the three year olds who are not oil rig professionals, OE is the closest they have to a padded room. A padded room with a gaping hole containing various sharp objects doesn't do much good!

Outlook is free.

Software that is free shouldn't have a liability attached...

Exposure....

[MortisUmbra]

Alot of these virus authors do it for exposure. The more the issue is pushed to the fore the more rewarding it is to do it.... Why not focus on "how to secure the internet in your spare time"?

Re:Exposure....

[tomatobasil]

I'd bet that the writer(s) of the Kazaa killer got big bucks, though how and/or from whom we may never know. I'd also bet that the makers of anti-virus software probably write many of the viruses just to keep sales up ..

Own the Internet like a Supervillian

[Navius Eurisko]

Want to be a Supervillian?

Don't have the body to fit in a costume?

Too out of shape to battle Superheros all over Champion City?

Think being a Supervillian is out of your reach?

Not anymore! Just like millions of other americans, the Internet has changed lives. Let it do the same...for YOU! With the "Rule the Internet like an Evil Overlord" plan, you can learn how to take advantage of this exciting new medium to spread choas and terror into the people the world around! Now you can work to inspire fear from the comfort of your own home!

Re:Own the Internet like a Supervillian

[IronChef]

But Navius -- isn't being a Supervillain expensive and time-consuming? I sure wish there was a way to become one quickly, inexpensively and from my own home.

Don't worry.

[oever]

It's illegal to distribute virusses. People can go to jail for spreading them. So, why worry. We're safe.

Re:Don't worry.

[Kyeo]

Not if Tom Cruise has anything to say about that.

Global Village

[green pizza]

30,000,000 Kazaa hosts

Jippity! That's a lotta users... more than 25 times the entire population of the state I live in!

Re:Global Village

[zaffir]

Odd, i see less than 2,000,000 online right now. Where do they get these figures - the number of times the app has been downloaded?

Massively parallel password cracking platform

[Subcarrier]

Very nice paper from Paxson.

On angle he neglects to mention is that the worm could only be the first wave of attack. The machines rapidly infected by a flash virus could easily be transformed into a massively parallel computing platform, into which a seconday attack program could be distributed in a matter of seconds. Such programs could then be used, for instance, to crack entry into strategically important machines that do not exhibit vulnerabilities directly exploitable by the first stage virus.

Scary. I've been wondering why someone hasn't done it yet.

Re:Massively parallel password cracking platform

[agentZ]

Scary. I've been wondering why someone hasn't done it yet.

If they were, do you think they would tell you?

Re:Massively parallel password cracking platform

[Subcarrier]

Good point. What I meant to say is, I've been wondering why somebody hasn't been caught using it yet. ;-) Who knows how many sleepers are embedded in the installed Windows base, silently waiting for the attack command, or crunching away at somebody's password every night.

Re:Massively parallel password cracking platform

[Beryllium Sphere(tm)]

>I've been wondering why someone hasn't done it yet.

A slow-burning worm designed for stealth, persistency and flexible remote control would be a magnificent tool for an intelligence agency.

Re:Massively parallel password cracking platform

[lient]

Kazaa did something like this, IMHO. They installed spyware (I consider spyware a virus). The also took control of your processor to use it for who knows what. Good thing they went down. That was probably the most evil filesharing client I have seen.

Darwinism

[southpolesammy]

Personally, I think that Darwinism will rear its head in this case. Those that don't appreciate what it is or what it takes to run a computer safely and successfully will be subject to the bugs and malware of others that they blindly accept.

Caveat emptor, and this is no exception.

Re:Darwinism

[HiThere]

You are neglecting the spin that will be applied by governments and corporations. And the "lobbying" efforts that will ensure that the form of the prescribed remedies is of benefit to the "appropriate parties".

The corner cop may be my friend, as the sheep dog is to the sheep, but the U.S. government has been acting more similar to a meat packing plant.

diversity

[mocktor]

and hasn't it always been this way? Zillions of insecure routers, servers and hosts out there for the taking? Only difference is that now there's less diversity than ever before. In ye olden days there were so many different architectures/os-en/programs that causing serious damage to the 'net by subverting one or two was pretty impossible. Now we have massive networks of nodes running on identical code ('doze, kazaa, even redhat in the linux world) - enough identical nodes for worms to do serious damage.

So whats the way forward? Having software thats popular with the unwashed masses *and* secure just isn't going to happen (unclued users, no incentive for authors, etc etc)...

Perhaps the only solution is liability - lets hold commercial entities responsible when their buggy code wreaks havoc on the net.

Hah. yeahright, like thats ever going to happen.

Re:diversity

[WildBeast]

If I shoot a person and she dies. Should people sue God because of his buggy code? If the terrorists hit a plane in a building and the building collapses, should I sue the architects? If some cracker, uses a Trojan on my OS, should I blame my OS?

Re:diversity

[mocktor]

So your saying haxx0rs should be responsible for their actions. I agree entirely, but what about the people who create beasts so huge and vulnerable for them to control? At least some of the buck should stop with kazza, MS et al for shipping insecure code when they know what it could cause.

Trouble is this won't stop until someone forces them to be responsible for the things they create. Or until 30 million kazaa users become clueful.

Re:diversity

[Subcarrier]

If I shoot a person and she dies. Should people sue God because of his buggy code?

No, but the people might sue the gun manufacturer and demand tighter gun control laws.

In fact, if computers were declared weapons, a bunch of trigger happy Americans would probably rise to the barricades, Microsoft executives in the lead, and vehemently defedt their God given constitutional right to bear computers.

Re:diversity

[WildBeast]

I'd rather be using right now a somewhat insecure Windows XP instead of an extremely secure Windows 3.1.

Look at Israel, due to the environment they live in, they most probably have the best security yet they're unable to stop many of the terrorist attacks.

Which reminds me, I noticed a few days ago that some guy is using my email address to send viruses via Sendmail's SMTP. I don't think he's even using a password. I notified my hosting company. But according to you, I should be suing Sendmail?

Re:diversity

[zangdesign]

99% of Slashdot readers would be fighting MS execs to be the lead frothers and bitching because MS doesn't know how to froth properly.

There would be an RFC about proper frothing etiquette, and another about frothing efficiently.

30 minutes after the riot started, there'd be at least four schisms within the Slashdot frothing community, each claiming that their froth was better than all the others.

Somebody would start %. so that other frothers could get in the action.

MS would find that the one thing no one really wants is a frother, so they would refuse to embrace and extend frothers.

Frothdotters would get really upset about that and froth even more.

Yadda yadda yadda ...

Re:diversity

[mocktor]

> But according to you, I should be suing Sendmail?

not at all:

(a) sendmail is free, hardly fair for them to be liable when they give the thing away. On the other hand MS, kazaa et al profit from the software they ship.

(b) config issue - who's responsible for this copy of sendmail, your hosting company? Their server is setup wrongly if its letting some kiddie impersonate you. Sendmail is not a mass-market product - its fair expect its users to be people who understand computer security issues. XP is - userbase of millons of people who don't even know what a buffer overflow is. Result is that sendmail users are usually responsible about the software they run and the effects it could have on others and kazaa users don't have the faintest idea.

Tangent to this: sendmail is open source, so the person running it has every opportunity to fix problems. You don't see people doing that with XP).

Re:diversity

[kz45]

a) sendmail is free, hardly fair for them to be liable when they give the thing away. On the other hand MS, kazaa et al profit from the software they ship

Why should this be an issue?

Sendmail chooses not to profit from the software they release.

Remember, sendmail is used in businesses that DO make money, just like outlook express (given away for free as well). They should be just as liable as microsoft.

Re:diversity

[kz45]

This doesn't mean open source is bad.

no it doesn't. just liable

If you could code and cared about the subject,you might learn programming and review sendmail code then alert the dev community and tell them what's up.

Sorry, I use Qmail. (but im not even going to get into that)

You can't and won't of course.

Won't, yes. The main reason I wouldn't contribute to any open-source project, is because of the relentless zealotry.

Have you EVER actually looked at the sendmail source code? It's a nightmare, mostly due to the excessive use of gotos, and sloppy code.

Everyone here knows that sendmail can be secure. You couldn't make it secure though. You don't know what sendmail does, besides 'send mail'

heh

Who is 'they'? 'They' provide code that you can pick up free and use. It is 'free' and 'free'. There are no strings attached. You use it or not. Isn't there someone in your High school imaginary company that could do some research and see if this 'sendmail' works?

yes there are strings attached, it's called the GNU license.

no strings attached = public domain

Re:diversity

[Subcarrier]

Well, my post was intended to be vaguely humorous, a fact which none of the moderators appeared to notice. I totally agree with you that responsibility should rest with those who do the deed.

However, I ask you, why do you have the kind of crime rates in USA that you do?

I live in a small country with a population of about 5 million people. There are 2 million registered guns here. Yes, that's four guns for every ten people. Yet, death by shooting is extremely rare.

Why? Because the "right to bear arms" is different from the "right to own guns". In my country it is illegal to carry a weapon in public. Use of weapons is srictly restricted to hunting and sports.

Sure, the bad guys will get hold of guns anyway. However, the nutcakes, the weirdos, chicks with PMS, and the gray haired grannies on a REALLY BAD DAY will not. A fist in the face is unlikely to kill. A gun drawn out in anger, on the other hand, is often fatal.

The point here is that, if guns are readily available and carried for the express purpose of using them on other people (i.e. self-defence), there is a good probability that someone will do so. If you carry a gun for self-defence it means that you have already mentally prepared yourself to use it on a human being.

Just something to think about.

Well, yes!

[agentZ]

The really scary thing is that somebody may try this. If you're objective is just to cause disruption and panic, why go through all of the trouble of sneaking past the INS, paying for flight school, buying expensive GPS receivers and losing 19 believers in your cause? Why not just hire some 31337 geeks, preferably young teenagers who want to show off their skillz without caring about what happens, to shut down the e-mail and telephone systems in your favorite target country. You can be at home drinking at MaiTai instead of getting your hands dirty.

Are we scared now? We should be.

Re:Well, yes!

[gTsiros]

> You can be at home drinking at MaiTai
> instead of getting your hands dirty

Bin Laden didn't get his hands dirty.

What you describe is already what is happening.

Re:Well, yes!

[Mike1024]

Hey,

Why not just hire some 31337 geeks, preferably young teenagers who want to show off their skillz without caring about what happens, to shut down the e-mail and telephone systems in your favorite target country.

Because it wouldn't really do anything other than annoying people. Every so often, I'll dial up my ISP and they won't answer. I'll wait a few hours, try again, and things will have cleared themselves up. There are no deaths. There is no permanant damage that will take months to clear up. There are no massive fires, or explosions. It's just a little bit annoying for the country involved.

I don't seee why people are always going on about 'cyber-terrorism'. A physical attack on a major data center would be far more damaging, and would be much harder to rectify.

Michael

Re:Well, yes!

[agentZ]

What if it wasn't a local ISP and what if it wasn't just a short attack. What about five people working together to destroy (read as rm -rf /) the e-mails servers of the Department of Justice and the Internal Revenue Service. Maybe trash a personnel computer too. People might not die, but it could cause some serious problems. If the tax refund checks of 50,000 people never got sent...

Just because nobody has done it before doesn't mean it's not a threat.

Re:Well, yes!

[jcoy42]

Why not just hire some 31337 geeks, preferably young teenagers who want to show off their skillz without caring about what happens, to shut down the e-mail and telephone systems in your favorite target country.

Because it wouldn't really do anything other than annoying people. Every so often, I'll dial up my ISP and they won't answer. I'll wait a few hours, try again, and things will have cleared themselves up. There are no deaths. There is no permanant damage that will take months to clear up. There are no massive fires, or explosions. It's just a little bit annoying for the country involved.

Surely you jest. The reason for 9/11 was a hatred of capitalism.

The whole dot-com era had the effect of driving all the major (and minor) companies to the Net, and now many exist solely on the Net. Many more depend upon it as thier main source of income.

If people can't get online, they can't spend money on the net. Then they don't fund these ventures. Every day the internet is inaccessable that's another day of lost revenue. If the internet were to be taken down for say, 30 days, the effect would be horrible.

Think about it, online only businesses could very well be made to suffer enough that they would close. Major businesses would be able to fall back to more traditional outlets, but would certainly take a huge loss as well.

In short, a well orchestrated sustained DOS could absolutely crush the economy. Like it really needs to get any worse.

Not to mention all the smaller ISPs that would end up having to close, and that we would probably be forced into an Internet Access Monopoly.

And that would suck.

Re:Well, yes!

[sparcv9]

One would hope that any data so critical or irreplaceable that its loss would be catastrophic is backed up on-site and off-site, and has a well-designed disaster-recovery plan associated with it. No one's done it because it wouldn't have any long-term effect.

Re:Well, yes!

[Jace of Fuse!]

Not to mention all the smaller ISPs that would end up having to close, and that we would probably be forced into an Internet Access Monopoly.

But at least you'll get 700 FREE HOURS!

Re:Well, yes!

[PacoTaco]

Keep in mind that most of the worms that made it into the wild so far haven't had much of a payload. If they knew how to harvest passwords, private keys and credit card numbers, we'd have serious problems.

I think the scariest thing the article mentioned was the potential for modular worms, which would allow new exploits and payloads to be added dynamically to already infected hosts. Given enough time, the author will figure out a nasty use for all of those zombies...

Re:Well, yes!

[peddrenth]

No, the worrying thing is that even academics are taking their "this is how a worm works, oooh, pretty!" papers and changing them into "Panic! Panic! This is a terrorist threat to national infrastructure! Give us money to combat it now!" papers.

It's unfortunate but unsurprising that everyone is jumping on the homeland-defense bandwagon trying to get money for their pet schemes, regardless of how nutty they were previously considered.

And it's unfortunate that people with a "Are we scared now? We should be" attitude like AgentZ's are egging them on with "I'm scared, protect me, whatever it takes" type of comments.

illustration

Don't like it? Don't run the same operating system as 100 million other people. Monocultures get destroyed by viruses, that's natural.

Re:Well, yes!

[Tackhead]

> What about five people working together to destroy (read as rm -rf /) the e-mails servers of the Department of Justice and the Internal Revenue Service. Maybe trash a personnel computer too. People might not die, but it could cause some serious problems. If the tax refund checks of 50,000 people never got sent...

...then somewhere on the Hill, a politician gets his wings? :-)

Sen. "Watch me block another tax cut bill" Daschle probably has wet dreams about your scenario.

Re:Well, yes!

[Knobby]

One would hope that any data so critical or irreplaceable that its loss would be catastrophic is backed up on-site and off-sit

You're right that critical data should be backed-up, but here's the problem. If I were a smart guy and wanted to wreak havoc on the economy, I wouldn't destroy any files. Destroying files is a dead giveaway that something's wrong and the back data should be used. Nope. What I'd want to do is corrupt the data in those files. Imagine the scandal that would ensue if some of the accounts in a particular bank were reduced by $1 and that money was donated anonymously to the republican presidential campaign. What would happen if the IRS database were hacked and the SSNs were scrambled.

These aren't the greatest examples, but they illustrate the problems that could arise from data corruption rather than data destruction.

Re:Well, yes!

[s390]

Just because nobody has done it before doesn't mean it's not a threat.

Don't look now, but narrowly targeted cracks are going down all the time. A few days ago it was reported that complete credit files on 13,000 wealthy Experian (TRW) customers were hijacked with stolen Ford Motors Credit authorization keys. Just yesterday it was news that over 200,000 State employees in California had their personal data lifted, right out from under the noses of the Teale Data Center (big place, several large mainframes, lots of smaller Unix and Wintel systems too). Major potential for mischief there.

Now use your imagination and ratchet it up a notch above merely criminal activity (identity theft and ordinary credit fraud). The paper doesn't go into it (excellent though it is), but what part of the modern first-world economy is most critical and yet most vulnerable? It's the financial system, which moves billions of dollars in the markets each and every business day - from Singapore, Taiwan, Hong Kong, Tokyo, and Seoul, through Vancouver, San Francisco, Los Angeles, Mexico City, Dallas, Chicago, Toronto, New York, to London, Paris, Berlin, and Geneva, etc. What happens when someone figures out how to game and disrupt that?

How many large banks, brokerages, companies, and/or big investors would one need to control in order to melt down the international financial markets? What if someone could unleash an orchestrated attack on the first world financial structure, meanwhile confusing and frustrating all efforts to reverse the damage by individuals and institutions with massive DDoS activity? What if someone was able to compromise lots of DNS servers and routers to enable attack traffic while denying all other requests? This is the sort of scary stuff the paper at hand lets glimmer without any explicit discussion.

We've already seen massive Puts on airlines just prior to 9/11 as well as high volumes of trading through WTC firms that morning. (Though those may have been US government insiders (CIA, etc.) just picking up some pocket change on the coat-tails of what Bush was going to play dumb about in order to justify his dynastic authoritarian imperial superpower agenda.) But the potential for some real harm caused by seriously hostile intentions for the international financial structure is huge. This is major scary stuff.

Re:Well, yes!

[grokk]

We've already seen massive Puts on airlines just prior to 9/11 as well as high volumes of trading through WTC firms that morning. (Though those may have been US government insiders (CIA, etc.) just picking up some pocket change on the coat-tails of what Bush was going to play dumb about in order to justify his dynastic authoritarian imperial superpower agenda.) But the potential for some real harm caused by seriously hostile intentions for the international financial structure is huge. This is major scary stuff.

These academics typically skirted around an obvious main point of their analysis: that the biggest threat to the world Internet community WILL be the NATO governments themselves -- first and foremost the U.S. government -- at any time they feel like 'taking down' some people's public Internet infrastructure.

Re:Well, yes!

[s390]

These academics typically skirted around an obvious main point of their analysis: that the biggest threat to the world Internet community WILL be the NATO governments themselves -- first and foremost the U.S. government -- at any time they feel like 'taking down' some people's public Internet infrastructure.

Well, they skirted many points (and since they have obvious tight connections to US weapons labs, one might be a little surprised they were even permitted to publish - it's sort of like printing up the to-do list for all kinds of nasty people). I was just bringing up one set of issues where the First World might be vulnerable to such Internet mischief.

I don't disagree with you that the US and European countries are cynical enough to employ such tactics (it's been called realpolitik since the Kaisers' time, as carried forward by such criminal characters as Stalin and Kissinger). But I don't think they'd use such means against any developed country - that would be too obvious and easy to nail, with a minimal set of network infrastructure sophistication. But the Second World should be worried... meaning the Middle East, Africa, South and East Asia (except Singapore, Taiwan, Hong Kong, Japan, and South Korea). India, Pakistan, China, and North Korea are both likely targets and potential sources of such attacks. Such things have already happened (albeit in crude, amateurish ways), and fairly recently too. Mainland China has every right to be paranoid about this sort of thing; it's why they're going to Linux now.

But the biggest (and oh-so diplomatically unsaid) conclusion of this paper is that companies, institutions, and individuals are _stupid_ to buy into the software monoculture of Microsoft systems. All their examples are of vulnerabilities in Microsoft crap (primarily IIS). The conclusion cries out to be drawn, but they don't say it. Typical academic "detachment" so as to avoid possibly offending a potential source of grant funding. Ultimately, the paper is gutless, both in it's conclusions and in it's grant-begging solutions.

Re:Well, yes!

[HiThere]

The reason for ... was a hatred... .

That much I can agree with. The rest seems speculation. While I know what the official line is, I don't really have any convincing evidence that I haven't been lied to. Remember, those presenting the evidence are also those deciding who to proclaim guilty. This is not an impartial hearing in any sense of the term. And if you can't think of immediate reasons to question their ethics and impartiality, then you haven't been reading your daily news papers. (Plus more basic evidence about the sturcture of the entire episode that was blatantly exposed all along ... but not enough to do more than justify questions.)

Also...
If I follow your projections, it seems that the villians that we should be expecting would, perhaps, wear double breasted suits. As they say, "Cui bono?"

Re:Well, yes!

[freaq]

Surely you jest. The reason for 9/11 was a hatred of capitalism.
whoah. ease up on the pipe. fact: the us president's secret service detachment allowed him to stay at a well-advertised location when they knew there were at least two hijacked planes in the air, yet they have drilled this scenario for a number of years. fact: the vice president's detachment followed procedure to the letter and forcibly escorted him to a designated 'secure' location.
conjecture: the president's team knew that what they were doing would not endanger the president.
conjecture: the vp's secret service team wasn't let in on the joke.
{cynicism}
sorry to ruin your day, but i don't think your president bush hates capitalism. the proles, on the other hand...why do we even let them vote? oh, right, because we don't have to actually count their votes.
{/cynicism}

hmm Notice that MS is mentioned

[linuxislandsucks]

I am curious..

What year, level, or course is the technique of avoiding buffer voerflows in C, C++, Java, or C# taught?

How many times is MS going to get caught on buffer overflow erros on its production servers before admitting that its programmers are fragged?

Would you trust a new P2P applicaiton from MS? Search on theri research lab site..its there but has not been released as a commercial product.

Re:hmm Notice that MS is mentioned

[flatlineloc]

The concept of buffer overflows - 3rd Semester, 2nd year, CS 221 - Data Structures was when I learned it. Maybe they should force every CS major to complete hackersquest. The majority of that teaches you how to avoid seriously bad coding. Not that it takes bad coding to disrupt a system, viruses/worms can always take advantage of the ignorance of (l)users, and we can't get rid of that. Attachments in email/etc. combined with most of the holes in the HIVs of the computing world (ISS, VB, Windows Scripting Host, Lookout Express) seem to currently be the platform of choice. They're easy to exploit, so why go after the *nix systems? Code Red, Nimda, both took advantage of shoddy coding in the MS Platform.

Earlier I came off as a bit of a troll, but us Linux/BSD people aren't immune to being subverted for a DDOS. At a place I used to work, the management forced the system admins to put a (l)user suggested IRC daemon on our webhost box. That daemon, IRCu, is subject to all sorts of exploits, including one which effectively gives the exploiter root access. We found out this barely monitored box had been compromised (it was our just for play server, ran apache, tripwire, php, perl, ssl and irc) when we recieved a notice of ban from dalnet. Checked the box found an eggdrop that had been installed and then went into the channel it was configured for. Saw a good hundred or so of these bots each one a box that the kiddie had nailed. I'm assuming most of them were *nix, but at least our flaws are from dumbass moves on the part of administrators, and not every admin makes mistakes now and then (I hope).

Re:hmm Notice that MS is mentioned

[flatlineloc]

err I'm on crack, that link was supposed to be to hackerslab, not hackersquest... guess I need sleep. I coulda ended up at a porn site.

Benefits of Owning the Net

[donnacha]

...and demonstrates how the net could be seriously taken by someone who wants it.

So, would owning the net mean that my ISP would be obliged to give me some sort of discount on what I'm paying them every month?

Re:Benefits of Owning the Net

[karlm]

So, would owning the net mean that my ISP would be obliged to give me some sort of discount on what I'm paying them every month?

Kinda... I hear the net acess is free in "federal pound-me-in-the-ass" prisons, so you could think of it as a 1000% rebate on $0, after they figured out who 0wn3z the net and locked you up.

No cola?

[agentZ]

Odd... They don't mention Pitr Cola once in the whole paper. Are they overlooking the obvious?

Internet Security Upgrade Plan

[jlrowe]

This takes care of most of the problems, and makes fixing the rest easier.

1. Insert Linux Boot CD, Install.
2. Begin Install
3. Delete all NTFS, Fat32, FAT partitions
4. Continue install. Set up firewall and normal Linux security stuff.

Like magic, the whole internet becomes more secure.

Re:Internet Security Upgrade Plan

[jedie]

Until the majority starts using linux and virus creators focus on linux instead of MS.
And don't gimme that crap on how linux is invulnerable to virus/worm attacks... It's just more interesting for virus writers to focus on MS, as it's products have the biggest share on the desktopmarket. "It's a bigger kick" ;)

Re:Internet Security Upgrade Plan

[jlrowe]

No. it is not the same. For instance: Windows, all varieties, virtually demand that the user be 'local administrator'. A lot of software doesn't work correctly unless that is so. Rather than fight it, that is what is done. So anything the local user executes happens to the machine. Software holes are fixed only when MS gets around to it, after they admit there is one to begin with. It is really easy to write a worm/virus for Windows. The 'I love you' virus was a single page of plain text, very simple to accomplish.

OTOH, Linux and other Unices, the administrator (root) is strongly discouraged to be the 'user'. And the 'user' has no direct access to the machine. He can hurt himself, but not the machine. And since it is open source, the fixes are much more likely to come sooner and be better done.

Re:Internet Security Upgrade Plan

[SuiteSisterMary]

Like magic, the whole internet becomes more secure.

It's because of thinking like this that the Internet is inherently insecure.

Re:Internet Security Upgrade Plan

[Tony-A]

Like magic, the whole internet becomes more secure.

It's because of thinking like this that the Internet is inherently insecure.

Installing Linux causes Microsoft worms? ???

There are no magic bullets, but Linux and moreso the BSDs have the attitude that the user should be in control and know what is going on. Maybe not secure yet, but enough is being done with jails and sandboxes and such that before long I should be able to run unpatched exploitable code with impunity. The only significant difference between the current Microsoft wormage and the UNIX Honor Virus is the user's awareness of just what is going on.

Re:Internet Security Upgrade Plan

[Tony-A]

It's just more interesting for virus writers to focus on MS, as it's products have the biggest share on the desktopmarket.
More important, it's so much easier to find holes in Microsoft.

Re:Internet Security Upgrade Plan

[nil_null]

OTOH, Linux and other Unices, the administrator (root) is strongly discouraged to be the 'user'. And the 'user' has no direct access to the machine. He can hurt himself, but not the machine.

Still, once you compromise a user on the system, its sometimes trivial to acquire root access. Also, with Linux/UNIX there are daemons/services running as root which can be exploited. Maybe security has gotten a little better over the years, but just 5 or 6 years ago, UNIX and Linux were hackers playgrounds of sorts. There were many many exploitable systems out there. Of course a lot of this was admins who left holes open and were slow in applying patches. I haven't been into security since then, so I can't really say what the state of UNIX/Linux security is. All I can say is that it wasn't always very secure. Linux used to be well known for being full of vulnerabilities, a new one being discovered every week it seemed.

And since it is open source, the fixes are much more likely to come sooner and be better done.

Very true... This is what makes the difference. 5 or 6 years ago I didn't hear much of Windows machines getting cracked (maybe because I wasn't interested in Windows security). This may be because of "security through obscurity." While people were looking at GNU/Linux's source and exploiting the crap out of it, the Windows vulnerabilities were hiding out, hoping that no one would discover them. Linux ended up getting a very thorough security inspection, and thus resulted in a more secure OS (in theory anyhow). Still, I don't believe in absolute security and believe there are plenty of holes in Linux yet to be discovered (and some new ones that may be created later).

I can't really say whether Linux and UNIX are more secure than Windows. We can only speculate. However, open source is a huge advantage in terms of maintaining security.

Re:Internet Security Upgrade Plan

[nil_null]

5 or 6 years in LinuxLand is a LONG time. Check out a current Linux distro and then post back.

Well, I do use current Linux distros, I just don't pay much attention to security, because I'm no longer an admin. However, looking at recent CERT advisories, looks like not much has changed. The only difference is they report many more Windows vulnerabilities than before.

Most programmers write crappy code

[Subcarrier]

It's called the normal distribution. The worst programmers can't write networking code at all. Normal programmers write crappy code and the best coders get all frothy about all the crappy code out there.

Sad but true. Quality takes time, money, and good people. All scarce resources.

Re:Most programmers write crappy code

[cybermage]

Quality takes time, money, and good people. All scarce resources.

Or put another way:

a) Cheap
b) Fast
c) Good

Pick any two.

It was already pretty bad, and it isn't going to get better soon. Now that the bubble has burst for finding capital, try this:

Cheap [selected]
b) Fast
c) Good

Pick one.

Since everyone want to be the first to market, try this:

Cheap [selected]
Fast [selected]
c) Good

ERROR: Sorry, your choices are up.

Re:Most programmers write crappy code

[plumby]

Normal programmers write crappy code and the best coders get all frothy about all the crappy code out there.

In my experience, most of the normal programmers also get all frothy about everyone elses crappy code, without realising how bad their own is.

How would Anti Virus firms react?

[Albanach]

So what role for anti-virus firms, like symantec and sophos - how would they feel if a publicly funded angency were producing effective countermeasures to worms?

I can see commercial interests taking priority over those of the internet at large. Could there also be in increase in complacency amongst users to not use appropriate system security or anti-virus measures if they think there's a "control centre" waiting to bail them out from any misfortune they experience as a result of their own failures?

The idea seems attractive, I'm just unsure about the other implications.

Very cool study

[BlueFall]

Yes, many of you will say "duh!" when it comes to the conclusions of this paper, but what is great about this study is that it provides empirical evidence for the stuff that we've "known" for some time. In particular, look at the graph of Code Red Iv2 traffic. Even after all the hubbub, it comes back every month. Moreover, this paper gives some very good models for showing how these things spread.

Potential problem?

[skunkeh]

OK, I know that security through obscurity sucks but is anyone else worried that right now thousands of script kiddies and black hat crackers are hard at work making the suggestions from that document a reality? I know if I was a worm author I would be treating the information in that document as a gold mine - it describes in pretty comprehensive terms some very effective ways of writing worms that can quickly grab a large number of hosts.

Re:Potential problem?

[BlueFall]

This paper doesn't say anything new about how these worms work, rather it provides empirical evidence and models on how they spread. All of the information about these worms was already available elsewhere.

As for security through obscurity, look at the target of all of these worms...

World Legalism

[totallygeek]

I am just wondering that since now in the US it can be a terrorist offense to wreck networks or create DDOS attacks, are other countries jumping on this bandwagon? I mean, what can you do about things coming from .no, .nl, .jp, etc?

Re:World Legalism

[Anonymous Coward]

"I mean, what can you do about things coming from .no, .nl, .jp, etc?"

You can get kidnapped by the FBI on your next holiday to the US.

Right, that's it

[eet23]

I'm not going to wait until they get me, I'm disconnecting righ-

Re:Right, that's it

[rapidweather]

Now that's funny. If some of that comes true, I guess one morning when I cannot connect to the internet I need to turn on the TV and see if someone evil now owns the internet.

Re:I could do the world a favor...

[ecc0]

You mean, so the world has to wait even LONGER for pages to load because their browsers try contacting doubleclick.net for 30 seconds or so on every page with DC banners? Excellent idea!

Re:30,000,000 Kazaa hosts

[ecc0]

I hope you don't actually think all 30,000,000 hosts are online at the same time?

ROTLFMAO

[wackybrit]

That's actually pretty damn funny. But I'm accessing it fine, and it hasn't been down for ages. I do not run the server though, my ISP does.

However, my ISP has major DNS issues and many ISPs cannot see any of the hosts on it.

Simple DoS attack

[Marcho]

You don't need any worm, just post the URL to Slashdot :-)))

Re:the truth about virii

[RetroGeek]

if someone is stupid enough to open "myNakedWife.bmp.exe"

Except that Windows by default hides the extension, so the user really sees "myNakedWife.bmp". And pictures are safe, right?

Re:the truth about virii

[jedie]

then the user should be smart enough to say "hey wait a minute?! normally I don't see any extensions, hocome I'm seeing one here? and why does it have another icon?"
1 + 1 = 2
malicoous code + stupid user = bad

Re:the truth about virii

[sam0ht]

Rubbish.

Any decent mail attachment worm executes as soon as you look at the text of the email, you don't have to run an executable attachment.

Also, this article isn't primarily about mail virii, but server exploits that could be used be a worm.

Finally, if the whole net get ddos'd due to a worm, you won't be feeling quite so smug and intelligent when you can't read your email.

Uh-oh, someone has a superiorty complex.

[wackybrit]

here's a challenge for you: show me what safeguards used in regular programming that will make my TCP/IP stack immune to being pounded by a million "flood agents". (since you are obviously not a technical person we will ignore the fact that the link will be saturated for now and assume a pipe of infinite bandwidth to the machine in question).

My my, seems someone got out of the wrong side of bed this morning. I'm guessing you're not au fait with IPv6 which solves many of these DOS problems.

You're assuming that routers are not configured to detect misuse. In the 'ideal world' I've described (and, indeed, in an IPv6 environment), routers would manage data more effectively. TCP was developed to ensure packets get from one place to another without fail, but this isn't always practical.

Sure, a million clients connecting to a server can bring it down. But many connections != DOS attack. Google accepts millions of connections a day, but it has the power and bandwidth to deal with them. In the main, a DOS attack is when someone/something makes a server deal with more information than it is meant to. Decent netcode and firewalling can solve this problem.

A common exploit is to send packets to a machine, that make the machine respond with more packets than were sent (commonly used tactic on IRC, with CTCP floods). Intelligent netcode would not generate more data than it could handle, and it would also recognise where the data is coming from, what format it is in, and would 'ignore' it for a certain amount of time. It's called dynamic firewalling.

Yes, I might be living in a bit of an idealistic fantasy world. But why shouldn't I? Protected Mode is meant to solve memory sharing problems, yet.. Windows still comes up with 'Protection Error' every now and then. Why? Cuz of crappy code. In an ideal world with perfect code, everything would work perfectly. I think the only way to go forward is to improve our code, and that's all I suggested in my post.. (This is exactly what happens in Linux kernel development)

I don't think the article was aimed at people like you. I think it was aimed at people with at least some technical background.

I'd say 'Touché' but my whole point is that the article is scant on technical details and instead focuses on pointless mathematical theories.

(I hope you get your superiority complex sorted out soon, kthxbi. Oh, and post your newlines properly in future..)

Re:Uh-oh, someone has a superiorty complex.

[Moonshadow]

But many connections != DOS attack.

No, that would be a DDOS, ala the /. effect.

:D

Re:Uh-oh, someone has a superiorty complex.

[borud]

"superiority commplex"? so now it is my problem that I know something about DoS-attacks and you obviously have no idea? I'm the bad guy here for pointing out that your naive view of the world is not exactly correct?

get real.

come back when you've learned the difference between implementational flaws and design problems. come back when you can tell me how to distinguish valid traffic from traffic generated for the purpose of overloading a service. come back when you have some experience and some real knowledge, because any idiot on slashdot can point out that something is wrong, but actually coming up with a real and working solution is pretty hard and *way* beyond what you seem capable of.

Re:Uh-oh, someone has a superiorty complex.

[MadWilli]

Why further the problem.

Check out this link to begin learning about denial-of-service attacks. Here's another if your appetite for self-education has been whet.

Kazaa Hosts at Large University

[imnoteddy]

Slightly off topic, but...

There were 5,800 distinct university KaZaA hosts during this time.

A typical large U.S. university has a student + faculy + staff population of 50,000 to 100,000. This suggests that 5 to 10 percent of university people are into file (music?) sharing.

Re:Kazaa Hosts at Large University

[forkboy]

Keep in mind that not everyone leaves Kazaa connected all the time and many folks don't share anything out. The number is quite probably much higher than 5800.

Re:Kazaa Hosts at Large University

[m3000]

Well that's only on campus file sharing from the people who live in dorms or professors who download stuff in their offices. So 5,800 sounds about right.

Tool of Evil

[Shant3030]

Maybe Kazaa was developed by a terrorist organization to cripple weak american minds and destroy our computers...

Interesting

[fusion812]

This, if anything, shows the need for (as stated in the paper) a need to have a central system for recovery and research of what was described. The obvious double edged sword of this document, and documents similar, in my opinion show the need for a head strong security movement. I, like many Linux users, are constantly amused and entertained by the 'average' individuals lack of know how in this field, however, I am not amused or entertained at their ignorance to security in general. It would seem that part of the blame could be the software companies lack of forwarding information to the customer on the issue, and part of the blame in the customers hands themselves. I am not pointing fingers or blame, just simply saying they are not educated enough to control the security of their own system(s). In my opinon, this is dangerous and there should be much more education given to the hands of the end user. Obviously an 80 year old woman with a background in knitting is not going to be able to secure her home PC, so I am not speaking of extreme change. However, I am speaking of individuals, who move from mom and pop stores to ecommerce means. So often I see individuals start an ecommerce site, and then are startled why their site was owned when they are using outdated forum software, cart software, or other software, and a password that consists of 'changeme'. Maybe a dumbed down security manual referred to by ecommerce providers would do the trick, maybe not. I don't know, I'm not a security executive, so I dont have the solution (...yet, lol). But just something, anything, to show the end user some basic means of boosting security and authentication may be enough to get the ball rolling. - Ross Smith

Worms, etc.

[mindstrm]

Well, I disagree. It IS the users fault they clicked on okay. It is the user who is in control of the machine, and the user who is responsible for what they do. When you click on something, you are allowing something to happen.

Yes, some worms spread automatically, wihtout user intervention, via holes in OE. I daresay these same holes could have been exploited by a slightly modified worm for Eudora. Eudora uses the MS viewer by default.. exactly the same thing OE uses.

The number of worms that spread because morons click on an attachment to open it even though they have been told DIRECTLY, a HALF DOZEN TIMES, NOT TO OPEN ATTACHMENTS IF YOU DONT KNOW WHAT THEY ARE is staggering. This, by far, is where the vast majority of worms come from.

Now.. I don't want to believe all these people are that stupid.. it's just a fundamental lack of understanding about how a computer works.

Re:Worms, etc.

[Jeremi]

Now.. I don't want to believe all these people are that stupid.. it's just a fundamental lack of understanding about how a computer works

The whole point behind Windows is to make a computer usable and useful to someone who doesn't understand how a computer works. If the user needs to understand how the computer works just to read his email, he might as well learn to use the command line for everything. Such a requirement is simply too much to ask of the average user.

Also, keep in mind that it isn't enough for the user to understand how a computer works. The user could know everything about the computer, and it wouldn't help him, because he still wouldn't know which of his helper/viewer apps contain security holes which can be exploited by email attachments -- he can't know, because he doesn't have the source code to them.

The only conclusion is: if attachments cannot be made safe, then they should not be made easy to open. The best solution would be to run attachments in some sort of 'sandbox' (Java style) so that they literally cannot do any damage to the machine. The next best (and still not very good) solution would be to put a big fat "WARNING -- VIRUS HAZARD" notice up whenever the user tries to open an attachment; one that is very hard to get past without reading it.

Oh come on now....

[kyletinsley]

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.
----
They should just rename VB Support HIV, same effect on a computer immune system.

Oh come on now, I think the benefits of being able to embed an Active X control in an email message and have it automatically run when the recipient views it MORE than outweigh the negative consequences... How else would we be able to send cutesy little Flash animated greeting cards to everyone we know??

Re:the truth about virii

[llywrch]

> In essence it really isn't the bad or buggy OS you run or how good your damn anti-virus software is. It all comes down to
> the end-user: if someone is stupid enough to open "myNakedWife.bmp.exe" they kinda deserve being bitraped by a damn
> virus or a worm.

And will you still think this if it happens to you or someone you care about?

Something like this happened to my wife: she received an email with an image attatchment with a return address from someone she knew. She tried to open the attachment, found nothing there, thought it was odd.

Her acquaintence was online later, & several people asked her about this email. ``What email?" At that point my wife called on me.

(Note: yes my wife runs Win98. That's because she's an accountant & uses a lot of software that runs on Windows.)

We downloaded a virus checker, & I sweated while I waited for it to do it's thing: I knew just how easily her system could get corrupted by a virus, & that we'd have to wipe & reinstall her system -- & spend hours reconfiguring it. Fortunately I insisted on her using Eudora as her mail client for this very reason, & the virus she had recieved was inert.

In short, the viruses are getting ever craftier, & even knowledgeable Windows users are getting bit. Unless you're willing to argue that anyone using Microsoft software deserves this result for selecting inferior software, you can't dump the entire responsibility onto the end users.

Geoff

Just don't tell Pitr

[Cylix]

We had better keep this little tid bit under raps, me thinks Pitr from http://www.userfriendly.org may use it to his diabolic desires.

It's bad enough he took over both the Pepsi and Coca Cola corporations.

Pitr Cola, it just feels right.

those three words

[trelaneopn]

trust in computing

Dynamic firewalling again

[wackybrit]

The simple flood always works

Not always. There are systems that implement a process that I call 'dynamic firewalling' (if someone knows the real name, let me know!).. which means if they receive too many packets (or irrelevant packets) in a certain amount of time, they block that host for a while.

'But(!)', you say, 'that doesn't mean the data isn't still coming down your pipe and sucking up your downstream bandwidth!' This is true, but I have seen routers that also implement similar systems.. so if all routers had dynamic firewalling, packets would be blocked right back from the source router, meaning the Internet, as a whole, does not suffer from an attempted attack.

Sandra Bullock ...

[SmartAs]

... to appear in new show about crazy new networking concept, that really isn't that crazy. Very simple exploits are to be dramatized in doomsday like scenario were by Napster-like pier-2-pier program owned by big ass corporation will threaten the existence of humanity. Millions of ignorant people will then associate hackers with crackers all over again spreading Fear-Uncertainty and Disinformation about MP3 sharing criminals and the record companies will be able to maintain their iron grip on the distribution of artistic expression. ... End sarcasm rant.

DDOS root name servers - how bad?

[SiliconEntity]

So what would happen if someone managed to maintain a DDOS attack from say 10 million compromised systems against the root name servers? Would all the caches eventually go bad and get wiped, so nobody could connect to any hosts and the net was dead? Or would the cached data stick around, so that people could still connect to existing systems, but updates would no longer propagate? Or something else? Thanks!

my boss allready does

[linuxbert]

He allready owns the internet. he carries it arround on a floppy disk in has back pocket.

He had an IT guy download it last week for him.

(its a joke, laugh)

Come on...

[lostchicken]

I remember someone's wise answer to why time-travel to the past will be impossible: If it was possible, we would have millions of time-travellers snapping billions of holo-photos of our parking lots.

And if anyone could 'own' the internet if they wanted to, they would have done it. Sure, most of those who could take out the net wouldn't, but all it takes is one, and I don't see the entire internet failing all that often, you?

Sysadmins, reconfigure your firewalls

[geirt]

The obvious solution:

Many sysadmins understand that they need to put their servers behind a firewall, protecting the servers from malicious inbound traffic from the internet. Now is the time to educate these sysadmins that they need to configure the firewalls to also block outbound access from the servers to the internet.

For instance, a web server don't need outbound access to the internet at all, you are not going to use the server to browse the internet, so please block all outbound traffic from the web server. If this server get infected by a new worm, the worm can't spread to other hosts trough http. Simple.

I have read a lot about firewalls lately, most focus on securing the inbound traffic, a few talks about egress filtering to stop address spoofing, but none writes about blocking outbound access from the servers, to stop worms from spreading from your server.

On why we aren't more scared.

[mindstrm]

Yes, it's possible to cause massive disruption. It has been for a long, long time.

I recall the FBI stating that it was not some ddos attack that scared them, but hte fact that so many young kids controlled so many computers and DIDN'T do anything with it.

So we ask ourselves, what if this were in the hands of someone who actively wanted to exploit it?

Who are we kidding? Most of the kids that control tons of computers for their ddos attacks for taking over irc servers are not geniuses. If someone had a reason to take over many, many cmoputers and use them for financial gain, they would do it. Plain and simple.

The fact is, owning tons of bandwidth and cycles for a brief amount of time (because that's all you are going to get) is not all that useful long term. How are you going to cash in on it?

And the payload (which is the really scary bit)???

[Anonymous Coward]

Although the paper seems to be concerned about network loading as a problem, I feel this is only the tip of the iceberg. In summary what they are stating is that it would be possible to infect either most of the vulnerable servers or (even worse) most PC's running P2P software. With the latter case this covers many more machines and many of these machines contain *data* that is totally crucial to running their businesses, both small and huge.

I wonder how these people would feel if they found out after a little while that at some time in the past , a silent trojan had gone through their *.xls files and choosen 1% of the fields formatted as financial and not calculated (ie typed in values) and changed them by a random +/- 0->10%.After doing this the trojan removed all traces of itself? Whose company financial records would *you* trust??

Now I'm sure I'm not the first to think of this (and I'm sure there are other nasty things that can be done) but could someone please explain the flaws in the scenario? It's been bugging me for the last 8 years and I'd like some confidence it *can't* happen.

So?

[NickRob]

The ability for large net damage to be caused is hardly new, every day new threats metabolize and get ready to fight their damage. Worms can be fixed, holes can be patched. Life will continue.

Re:Uh-oh, someone has a superiority complex.

[wackybrit]

No thanks. Watching you get pissed off over something that doesn't even matter is entertainment enough! :-)

actually coming up with a real and working solution is pretty hard and *way* beyond what you seem capable of.

Actually it's beyond what the best programming brains in the world have been able to come up with too.. so I don't think I'm doing so bad.

Re: rwx + chown

[fferreres]

I think we are reinventing the weel. Windows was based not only on the idea that a computer should be usable by Joe and Jane but also on the premise that it should be admninistered by those Joe and Jane's.

It think that was a wrong choice. To make the choice worst, they decided that it should allow you to do everything easily (no learing neeeded) and if something was a bit complicated, then it should be stripped off.

The day they realize things should be "owned" and "permisioned" we'd be ok. I don't fear executing whatever in my linux, as long as i use a non important account to execute it (you also need to have all the permisions right or...).

Everyone should be able to use computers, administering is another thing. They can provide a default install that is ok and secure. Of course, there will be some things Joe will not be able to do. And that's a good thing (he can learn a bit if he really wants to change them).

Worms and biology

[Mulletproof]

I'll venture out on a limb by mentioning that "denial of usage" is far from "owning" or "taking" the net. This worm is just the product of someone with way too much spare time on his hands (or on the RIAA payroll as somebody mentioned). Actually, these fools are useful. Somebody described these idiots as being similar to the way the body fights off an infection-- A virus pops up, the community adapts and puts it down before before it becomes life-threatening. That way when the real shit hits the fan (say, the first real internet war), the community will be able to combat it... Hopefully.

Re:Uh-oh, someone has a superiority complex.

[borud]

not too long ago it was just a matter of putting in some safeguards according to you. now all of a sudden it is nearly impossible.

at least you seem to have understood that your original posting was clueless. that at least is an improvement.

Using worms for security

[jwillem]

What if microsoft wrote worms to close security holes in their software?
They could write a worm like they can write a service pack, but with the advantage that people who don't frequently check for service packs, also are protected against future attacks.

The worm's instructions could be:
- download security patch (however this could take down the security-patch-server)
- apply security patch
- spread
- kill self (after some time, or after all possible ip's are scanned, or ...)

While it is the system administrator's duty to keep the server secure, this method could secure the server when he is getting a nap, or some coffee. Especially since the paper describes attacks in less than 15 minutes.

It could be implemented using a "yes, I want that service"-box, so that one who doesn't like this can opt out of the security check.

Also, one could use some registration check, so that only people that payed for it, can get this service.

Re:Uh-oh, someone has a superiority complex.

[wackybrit]

I see you're still struggling with the concept of proposing an idea and actually implementing it. Go learn about IPv6. Most of my points are catered to within the IPv6 standard.

Anyway, I've gotta keep you talking.. I might double the teeny amount of posts you've made to Slashdot if I keep going.