How to Own the Internet In Your Spare Time

xenofile writes "A chilling paper has recently been posted analyzing the various threats worms pose to the Internet, and the relative ease of exploiting say the 30,000,000 Kazaa hosts to completely cripple large portions of the net." Lots of good stuff in this paper. It sorta combines many things you've probably read, and demonstrates how the net could be seriously taken by someone who wants it.

Comments

actually its based on trust

[guest12]

the net, like business or anything else in society is based on trust.

Re:actually its based on trust

[RatOmeter]

Yes. And in business, we aren't all that trusting, so we have laws to regulate business behavior in order to improve or, at least, enforce the trustworthiness between business players. Do we need/want the same practices applied to the Internet? I say no, but I have this awful feeling of gloom. I think that, within 10 or 15 years (maybe even less) the business interests in the net will have convinced the lawmakers that we need to boost the trustworthiness of the net... by regulating the hell out of it.

I think we, as the techical force behind the net, can and must resolve the major issues that make the businesses nervous. If they can trundle blithely forward, enjoying the net without too many major hitches, they'll continue to pay our salaries and let us run it. One or two major exploits or outages with mega/giga dollar associated losses, and the lawmakers will clamp right down. Bye bye net, as we know (and love) it.

Re:actually its based on trust

[mesocyclone]

Why single out business? Society also has laws to regulate individual behavior.

It's all just human behavior, and human behavior leaves a lot to be desired.

Well

[shayera]

With the speed the RIAA gets these sharing networks to hunker down, perhaps the problem will go away on it's own...
On the other hand, perhaps pigs will fly, and a certain redmond company will once and for all wisen up and ensure their OS'es not by default make the world a happy place for worm writers..

Abstract

[Anonymous Coward]

To Appear in the Proceedings of the 11th USENIX Security Symposium (Security '02)

The ability of attackers to rapidly gain control of vast numbers of Internet hosts poses an immense risk to the overall security of the Internet. Once subverted, these hosts can not only be used to launch massive denial of service floods, but also to steal or corrupt great quantities of sensitive information, and confuse and disrupt use of the network in more subtle ways.

We present an analysis of the magnitude of the threat. We begin with a mathematical model derived from empirical data of the spread of Code Red I in July, 2001. We discuss techniques subsequently employed for achieving greater virulence by Code Red II and Nimda. In this context, we develop and evaluate several new, highly virulent possible techniques: hit-list scanning (which creates a Warhol worm), permutation scanning (which enables self-coordinating scanning), and use of Internet-sized hit-lists (which creates a flash worm).

We then turn to the to the threat of surreptitious worms that spread more slowly but in a much harder to detect "contagion" fashion. We demonstrate that such a worm today could arguably subvert upwards of 10,000,000 Internet hosts. We also consider robust mechanisms by which attackers can control and update deployed worms.

In conclusion, we argue for the pressing need to develop a "Center for Disease Control" analog for virus- and worm-based threats to national cybersecurity, and sketch some of the components that would go into such a Center.

Also in PDF optimized for reading online, PDF optimized for printing

Masters of the obvious

[wackybrit]

Wow, this paper really breaks new ground. Let's see:

If you can control a million hosts on the Internet, you can do enormous damage.

[..] you can access any sensitive information present on any of those million machines [..]

But for those who are truly thick and can't get the point:

In short, if you could control a million Internet hosts, the potential damage is truly immense [..]

It's good to see they're really targeting the 'brains' of the nation with these statements.

Luckily, things get a little more scientific as we move into the next section, but they actually say they're 'ignoring' certain important variables. Almost any mathetmatical theory works if you 'ignore' certain variables.

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.

But what about system level DOS attacks, you say? Firewalls were invented to solve these problems. Of course, firewalls were only invented because the original net code in Linux/Windows/etc hadn't anticipated DOS attacks, and couldn't fend them off themselves. I mean.. in 1994, who was flooding servers with 64kB ping packets?

It's time to rewrite the netcode. DOS attacks aren't really any different to memory leaks in programs. They can be controlled and confined and cleaned up, if the code is good. How often do you get a 'Protection Error' in Linux these days? Hardly ever. It's time to apply all of the safeguards we use in regular programming to net code too!

And if you're scared of reinventing the wheel and writing new net code from scratch, then you have only yourself to blame.

Re:Masters of the obvious

[NonSequor]

Almost any mathetmatical theory works if you 'ignore' certain variables.

Physicists have been doing this for a long time.

Re:Masters of the obvious

[wackybrit]

The problem is crappy users.

I'm not so sure. The 'e-mail based social engineering worms' you talk of aren't actually triggered by users, but by flaws in Outlook Express. It's not like these 'Pass this onto 20 of your friends' mails, which are viral, but not viruses.

Microsoft allows OE to access too many API functions. I mean, look at how these viruses work. You download them from the POP3 server, and when you preview them in OE, a box comes up saying 'Open' or 'Save As'. Many users just click OK, and end up getting infected. However, this isn't the user's fault, as such.

OE should not automatically open attachments! It's Microsoft's crappy code that has allowed it to be hacked in this way. So.. I think the blame rests with the programmers, not the users. The programmers are meant to create an environment that's safe for users.

Blaming the users is like blaming voters for getting GWB into office. It wasn't their fault, it was the system's fault for allowing it to happen.

Re:Masters of the obvious

[0xA]

Firewalls were invented to solve these problems

So you're gonna stop a DOS attack with a firewall? If they're "Masters of the Obvious" I guess that makes you "Masters of the Impossible". A firewall is not going to save you from a saturated link, aka DOS attack.

It's time to rewrite the netcode. DOS attacks aren't really any different to memory leaks in programs. They can be controlled and confined and cleaned up, if the code is good.

uh huh. Don't do much of this "netcode" stuff do you. Why do I think I just fed a troll?

Re:Masters of the obvious

[cybermage]

There isn't "an internet". The whole deal about "owning the internet" is in-existent.

The story submitter did properly capitalize "Internet" when he says "the Internet".

An internet is any network that connects two or more networks.

The Internet is this goofy thing, started by DARPA, over which you have received this HTML page.

internet == concept
Internet == one instance of the concept, paradoxically loved and hated equally by those who know it best.

Your foobarnet, presuming it would interconnect networks, and not just hosts, would be an internet. This is the Internet.

Re:Masters of the obvious

[dieMSdie]

Crappy users are never going to go away. A company with some insight, and a desire to write decent Apps would realize this and program around it as much as possible!

Instead, we have Micro$oft, driven by marketing and Bill's hunger for power. Sure, it's easy to use, but it's easy to 0wn too. The we have Apple, hard to 0wn, easy to use, but nowhere near the installed base. And then there is Linux, much the same.

I lay the blame for these worms where it belongs, at the feet of Micros~1. They could disable a lot of their "features" and stop most of this nonsense.

Re:Masters of the obvious

[Rogerborg]

Very insightful post. One problem:

• http://www.wackybrit.com
• 
  Server Error
  The following error occurred:
  Could not connect to the server
  Please contact the administrator.
  

I'd be more inclined to listen to exhortations to write robust code from someone who can actually keep his web server up. Perhaps you could clean your own house first.

Re:Masters of the obvious

[matrix29]

Almost any mathematical theory works if you 'ignore' certain variables.

Physicists have been doing this for a long time.

I'm a theoretical physicist, at least I think I am. I cannot be certain. It is just a theory I have.

Re:Masters of the obvious

[dieMSdie]

Gunax lbh. V nz tynq lbh ner serr, sbe abj, naljnl.

Re:Masters of the obvious

[unitron]

"OE isn't considered to be still in beta, is it?"

Once you learn to regard any and every piece of software from MS as beta you aren't in for fewer nasty surprises, but it's more along the lines of not knowing when they will happen, rather than not knowing whether they will.

Re:Masters of the obvious

[big_hairy_mama]

If this were true, then 99.9% of the population shouldn't even be using a computer.

It is true, because 99.9% of the population shouldn't be compiling, let alone running on a production box, Linux dev kernels. Read the context.

95% of the population should, however, be able to run Outlook Express without infecting their computers. Since OE is designed for that 95%, it should be OE that protects the dumbass users from hurting themselves.

For all the three year olds who are not oil rig professionals, OE is the closest they have to a padded room. A padded room with a gaping hole containing various sharp objects doesn't do much good!

Own the Internet like a Supervillian

[Navius Eurisko]

Want to be a Supervillian?

Don't have the body to fit in a costume?

Too out of shape to battle Superheros all over Champion City?

Think being a Supervillian is out of your reach?

Not anymore! Just like millions of other americans, the Internet has changed lives. Let it do the same...for YOU! With the "Rule the Internet like an Evil Overlord" plan, you can learn how to take advantage of this exciting new medium to spread choas and terror into the people the world around! Now you can work to inspire fear from the comfort of your own home!

Re:Own the Internet like a Supervillian

[IronChef]

But Navius -- isn't being a Supervillain expensive and time-consuming? I sure wish there was a way to become one quickly, inexpensively and from my own home.

Don't worry.

[oever]

It's illegal to distribute virusses. People can go to jail for spreading them. So, why worry. We're safe.

Massively parallel password cracking platform

[Subcarrier]

Very nice paper from Paxson.

On angle he neglects to mention is that the worm could only be the first wave of attack. The machines rapidly infected by a flash virus could easily be transformed into a massively parallel computing platform, into which a seconday attack program could be distributed in a matter of seconds. Such programs could then be used, for instance, to crack entry into strategically important machines that do not exhibit vulnerabilities directly exploitable by the first stage virus.

Scary. I've been wondering why someone hasn't done it yet.

Re:Massively parallel password cracking platform

[agentZ]

Scary. I've been wondering why someone hasn't done it yet.

If they were, do you think they would tell you?

Re:Massively parallel password cracking platform

[Beryllium Sphere(tm)]

>I've been wondering why someone hasn't done it yet.

A slow-burning worm designed for stealth, persistency and flexible remote control would be a magnificent tool for an intelligence agency.

Well, yes!

[agentZ]

The really scary thing is that somebody may try this. If you're objective is just to cause disruption and panic, why go through all of the trouble of sneaking past the INS, paying for flight school, buying expensive GPS receivers and losing 19 believers in your cause? Why not just hire some 31337 geeks, preferably young teenagers who want to show off their skillz without caring about what happens, to shut down the e-mail and telephone systems in your favorite target country. You can be at home drinking at MaiTai instead of getting your hands dirty.

Are we scared now? We should be.

Re:Well, yes!

[agentZ]

What if it wasn't a local ISP and what if it wasn't just a short attack. What about five people working together to destroy (read as rm -rf /) the e-mails servers of the Department of Justice and the Internal Revenue Service. Maybe trash a personnel computer too. People might not die, but it could cause some serious problems. If the tax refund checks of 50,000 people never got sent...

Just because nobody has done it before doesn't mean it's not a threat.

Re:Well, yes!

[sparcv9]

One would hope that any data so critical or irreplaceable that its loss would be catastrophic is backed up on-site and off-site, and has a well-designed disaster-recovery plan associated with it. No one's done it because it wouldn't have any long-term effect.

Re:Well, yes!

[Jace of Fuse!]

Not to mention all the smaller ISPs that would end up having to close, and that we would probably be forced into an Internet Access Monopoly.

But at least you'll get 700 FREE HOURS!

Re:Well, yes!

[Tackhead]

> What about five people working together to destroy (read as rm -rf /) the e-mails servers of the Department of Justice and the Internal Revenue Service. Maybe trash a personnel computer too. People might not die, but it could cause some serious problems. If the tax refund checks of 50,000 people never got sent...

...then somewhere on the Hill, a politician gets his wings? :-)

Sen. "Watch me block another tax cut bill" Daschle probably has wet dreams about your scenario.

Re:Well, yes!

[Knobby]

One would hope that any data so critical or irreplaceable that its loss would be catastrophic is backed up on-site and off-sit

You're right that critical data should be backed-up, but here's the problem. If I were a smart guy and wanted to wreak havoc on the economy, I wouldn't destroy any files. Destroying files is a dead giveaway that something's wrong and the back data should be used. Nope. What I'd want to do is corrupt the data in those files. Imagine the scandal that would ensue if some of the accounts in a particular bank were reduced by $1 and that money was donated anonymously to the republican presidential campaign. What would happen if the IRS database were hacked and the SSNs were scrambled.

These aren't the greatest examples, but they illustrate the problems that could arise from data corruption rather than data destruction.

Re:Well, yes!

[s390]

Just because nobody has done it before doesn't mean it's not a threat.

Don't look now, but narrowly targeted cracks are going down all the time. A few days ago it was reported that complete credit files on 13,000 wealthy Experian (TRW) customers were hijacked with stolen Ford Motors Credit authorization keys. Just yesterday it was news that over 200,000 State employees in California had their personal data lifted, right out from under the noses of the Teale Data Center (big place, several large mainframes, lots of smaller Unix and Wintel systems too). Major potential for mischief there.

Now use your imagination and ratchet it up a notch above merely criminal activity (identity theft and ordinary credit fraud). The paper doesn't go into it (excellent though it is), but what part of the modern first-world economy is most critical and yet most vulnerable? It's the financial system, which moves billions of dollars in the markets each and every business day - from Singapore, Taiwan, Hong Kong, Tokyo, and Seoul, through Vancouver, San Francisco, Los Angeles, Mexico City, Dallas, Chicago, Toronto, New York, to London, Paris, Berlin, and Geneva, etc. What happens when someone figures out how to game and disrupt that?

How many large banks, brokerages, companies, and/or big investors would one need to control in order to melt down the international financial markets? What if someone could unleash an orchestrated attack on the first world financial structure, meanwhile confusing and frustrating all efforts to reverse the damage by individuals and institutions with massive DDoS activity? What if someone was able to compromise lots of DNS servers and routers to enable attack traffic while denying all other requests? This is the sort of scary stuff the paper at hand lets glimmer without any explicit discussion.

We've already seen massive Puts on airlines just prior to 9/11 as well as high volumes of trading through WTC firms that morning. (Though those may have been US government insiders (CIA, etc.) just picking up some pocket change on the coat-tails of what Bush was going to play dumb about in order to justify his dynastic authoritarian imperial superpower agenda.) But the potential for some real harm caused by seriously hostile intentions for the international financial structure is huge. This is major scary stuff.

Re:Well, yes!

[s390]

These academics typically skirted around an obvious main point of their analysis: that the biggest threat to the world Internet community WILL be the NATO governments themselves -- first and foremost the U.S. government -- at any time they feel like 'taking down' some people's public Internet infrastructure.

Well, they skirted many points (and since they have obvious tight connections to US weapons labs, one might be a little surprised they were even permitted to publish - it's sort of like printing up the to-do list for all kinds of nasty people). I was just bringing up one set of issues where the First World might be vulnerable to such Internet mischief.

I don't disagree with you that the US and European countries are cynical enough to employ such tactics (it's been called realpolitik since the Kaisers' time, as carried forward by such criminal characters as Stalin and Kissinger). But I don't think they'd use such means against any developed country - that would be too obvious and easy to nail, with a minimal set of network infrastructure sophistication. But the Second World should be worried... meaning the Middle East, Africa, South and East Asia (except Singapore, Taiwan, Hong Kong, Japan, and South Korea). India, Pakistan, China, and North Korea are both likely targets and potential sources of such attacks. Such things have already happened (albeit in crude, amateurish ways), and fairly recently too. Mainland China has every right to be paranoid about this sort of thing; it's why they're going to Linux now.

But the biggest (and oh-so diplomatically unsaid) conclusion of this paper is that companies, institutions, and individuals are _stupid_ to buy into the software monoculture of Microsoft systems. All their examples are of vulnerabilities in Microsoft crap (primarily IIS). The conclusion cries out to be drawn, but they don't say it. Typical academic "detachment" so as to avoid possibly offending a potential source of grant funding. Ultimately, the paper is gutless, both in it's conclusions and in it's grant-begging solutions.

Re:Well, yes!

[HiThere]

The reason for ... was a hatred... .

That much I can agree with. The rest seems speculation. While I know what the official line is, I don't really have any convincing evidence that I haven't been lied to. Remember, those presenting the evidence are also those deciding who to proclaim guilty. This is not an impartial hearing in any sense of the term. And if you can't think of immediate reasons to question their ethics and impartiality, then you haven't been reading your daily news papers. (Plus more basic evidence about the sturcture of the entire episode that was blatantly exposed all along ... but not enough to do more than justify questions.)

Also...
If I follow your projections, it seems that the villians that we should be expecting would, perhaps, wear double breasted suits. As they say, "Cui bono?"

Benefits of Owning the Net

[donnacha]

...and demonstrates how the net could be seriously taken by someone who wants it.

So, would owning the net mean that my ISP would be obliged to give me some sort of discount on what I'm paying them every month?

Re:Benefits of Owning the Net

[karlm]

So, would owning the net mean that my ISP would be obliged to give me some sort of discount on what I'm paying them every month?

Kinda... I hear the net acess is free in "federal pound-me-in-the-ass" prisons, so you could think of it as a 1000% rebate on $0, after they figured out who 0wn3z the net and locked you up.

No cola?

[agentZ]

Odd... They don't mention Pitr Cola once in the whole paper. Are they overlooking the obvious?

Most programmers write crappy code

[Subcarrier]

It's called the normal distribution. The worst programmers can't write networking code at all. Normal programmers write crappy code and the best coders get all frothy about all the crappy code out there.

Sad but true. Quality takes time, money, and good people. All scarce resources.

Re:Most programmers write crappy code

[cybermage]

Quality takes time, money, and good people. All scarce resources.

Or put another way:

a) Cheap
b) Fast
c) Good

Pick any two.

It was already pretty bad, and it isn't going to get better soon. Now that the bubble has burst for finding capital, try this:

Cheap [selected]
b) Fast
c) Good

Pick one.

Since everyone want to be the first to market, try this:

Cheap [selected]
Fast [selected]
c) Good

ERROR: Sorry, your choices are up.

Re:diversity

[WildBeast]

If I shoot a person and she dies. Should people sue God because of his buggy code? If the terrorists hit a plane in a building and the building collapses, should I sue the architects? If some cracker, uses a Trojan on my OS, should I blame my OS?

Re:Wow

[SCHecklerX]

You miss the point. If the Internet gets congested with traffic, you will suffer too. Take, for example, the latency spike that occurred last monday around 2:00pm EST as the worm that attacked M$ SQL servers started doing its thing.

Re:Internet Security Upgrade Plan

[jedie]

Until the majority starts using linux and virus creators focus on linux instead of MS.
And don't gimme that crap on how linux is invulnerable to virus/worm attacks... It's just more interesting for virus writers to focus on MS, as it's products have the biggest share on the desktopmarket. "It's a bigger kick" ;)

World Legalism

[totallygeek]

I am just wondering that since now in the US it can be a terrorist offense to wreck networks or create DDOS attacks, are other countries jumping on this bandwagon? I mean, what can you do about things coming from .no, .nl, .jp, etc?

Re:diversity

[WildBeast]

I'd rather be using right now a somewhat insecure Windows XP instead of an extremely secure Windows 3.1.

Look at Israel, due to the environment they live in, they most probably have the best security yet they're unable to stop many of the terrorist attacks.

Which reminds me, I noticed a few days ago that some guy is using my email address to send viruses via Sendmail's SMTP. I don't think he's even using a password. I notified my hosting company. But according to you, I should be suing Sendmail?

Re:Internet Security Upgrade Plan

[SuiteSisterMary]

Like magic, the whole internet becomes more secure.

It's because of thinking like this that the Internet is inherently insecure.

Re:diversity

[zangdesign]

99% of Slashdot readers would be fighting MS execs to be the lead frothers and bitching because MS doesn't know how to froth properly.

There would be an RFC about proper frothing etiquette, and another about frothing efficiently.

30 minutes after the riot started, there'd be at least four schisms within the Slashdot frothing community, each claiming that their froth was better than all the others.

Somebody would start %. so that other frothers could get in the action.

MS would find that the one thing no one really wants is a frother, so they would refuse to embrace and extend frothers.

Frothdotters would get really upset about that and froth even more.

Yadda yadda yadda ...

Re:Pinky and the Brain

[cybermage]

Why does this remind me of something that I would see as a scheme on Pinky and the Brain?

Pinky. Are you pondering what I'm pondering?

I think so Brain, but if we take over the net, how will the big boats catch any fish?

*bonk*

Not that kind of net, Pinky. The Internet: A global network of millions of computers; a network where music and pr0n are yours for the taking; a network where powerful tools like email and hypertext are used promote penis enlargement, pyramid schemes, and cheap drugs from the third world; a network where millions are left totally vulnerable by software given to them freely by the richest company in the world.

Ooooo, sounds nice, Brain. But Brain?

Yes, Pinky?

If you take it over, who's gonna share their pr0n with you?

Re:Internet Security Upgrade Plan

[Tony-A]

Like magic, the whole internet becomes more secure.

It's because of thinking like this that the Internet is inherently insecure.

Installing Linux causes Microsoft worms? ???

There are no magic bullets, but Linux and moreso the BSDs have the attitude that the user should be in control and know what is going on. Maybe not secure yet, but enough is being done with jails and sandboxes and such that before long I should be able to run unpatched exploitable code with impunity. The only significant difference between the current Microsoft wormage and the UNIX Honor Virus is the user's awareness of just what is going on.

Re:Internet Security Upgrade Plan

[Tony-A]

It's just more interesting for virus writers to focus on MS, as it's products have the biggest share on the desktopmarket.
More important, it's so much easier to find holes in Microsoft.

Re:Uh-oh, someone has a superiorty complex.

[Moonshadow]

But many connections != DOS attack.

No, that would be a DDOS, ala the /. effect.

:D

Interesting

[fusion812]

This, if anything, shows the need for (as stated in the paper) a need to have a central system for recovery and research of what was described. The obvious double edged sword of this document, and documents similar, in my opinion show the need for a head strong security movement. I, like many Linux users, are constantly amused and entertained by the 'average' individuals lack of know how in this field, however, I am not amused or entertained at their ignorance to security in general. It would seem that part of the blame could be the software companies lack of forwarding information to the customer on the issue, and part of the blame in the customers hands themselves. I am not pointing fingers or blame, just simply saying they are not educated enough to control the security of their own system(s). In my opinon, this is dangerous and there should be much more education given to the hands of the end user. Obviously an 80 year old woman with a background in knitting is not going to be able to secure her home PC, so I am not speaking of extreme change. However, I am speaking of individuals, who move from mom and pop stores to ecommerce means. So often I see individuals start an ecommerce site, and then are startled why their site was owned when they are using outdated forum software, cart software, or other software, and a password that consists of 'changeme'. Maybe a dumbed down security manual referred to by ecommerce providers would do the trick, maybe not. I don't know, I'm not a security executive, so I dont have the solution (...yet, lol). But just something, anything, to show the end user some basic means of boosting security and authentication may be enough to get the ball rolling. - Ross Smith

Worms, etc.

[mindstrm]

Well, I disagree. It IS the users fault they clicked on okay. It is the user who is in control of the machine, and the user who is responsible for what they do. When you click on something, you are allowing something to happen.

Yes, some worms spread automatically, wihtout user intervention, via holes in OE. I daresay these same holes could have been exploited by a slightly modified worm for Eudora. Eudora uses the MS viewer by default.. exactly the same thing OE uses.

The number of worms that spread because morons click on an attachment to open it even though they have been told DIRECTLY, a HALF DOZEN TIMES, NOT TO OPEN ATTACHMENTS IF YOU DONT KNOW WHAT THEY ARE is staggering. This, by far, is where the vast majority of worms come from.

Now.. I don't want to believe all these people are that stupid.. it's just a fundamental lack of understanding about how a computer works.

Re:Worms, etc.

[Jeremi]

Now.. I don't want to believe all these people are that stupid.. it's just a fundamental lack of understanding about how a computer works

The whole point behind Windows is to make a computer usable and useful to someone who doesn't understand how a computer works. If the user needs to understand how the computer works just to read his email, he might as well learn to use the command line for everything. Such a requirement is simply too much to ask of the average user.

Also, keep in mind that it isn't enough for the user to understand how a computer works. The user could know everything about the computer, and it wouldn't help him, because he still wouldn't know which of his helper/viewer apps contain security holes which can be exploited by email attachments -- he can't know, because he doesn't have the source code to them.

The only conclusion is: if attachments cannot be made safe, then they should not be made easy to open. The best solution would be to run attachments in some sort of 'sandbox' (Java style) so that they literally cannot do any damage to the machine. The next best (and still not very good) solution would be to put a big fat "WARNING -- VIRUS HAZARD" notice up whenever the user tries to open an attachment; one that is very hard to get past without reading it.

Oh come on now....

[kyletinsley]

Perhaps papers like these should actually focus on the real reason that DOS attacks are so easy. Crappy code. Since when did Eudora or Pegasus start spreading viruses? It's all Outlook Express.
----
They should just rename VB Support HIV, same effect on a computer immune system.

Oh come on now, I think the benefits of being able to embed an Active X control in an email message and have it automatically run when the recipient views it MORE than outweigh the negative consequences... How else would we be able to send cutesy little Flash animated greeting cards to everyone we know??

Re:the truth about virii

[llywrch]

> In essence it really isn't the bad or buggy OS you run or how good your damn anti-virus software is. It all comes down to
> the end-user: if someone is stupid enough to open "myNakedWife.bmp.exe" they kinda deserve being bitraped by a damn
> virus or a worm.

And will you still think this if it happens to you or someone you care about?

Something like this happened to my wife: she received an email with an image attatchment with a return address from someone she knew. She tried to open the attachment, found nothing there, thought it was odd.

Her acquaintence was online later, & several people asked her about this email. ``What email?" At that point my wife called on me.

(Note: yes my wife runs Win98. That's because she's an accountant & uses a lot of software that runs on Windows.)

We downloaded a virus checker, & I sweated while I waited for it to do it's thing: I knew just how easily her system could get corrupted by a virus, & that we'd have to wipe & reinstall her system -- & spend hours reconfiguring it. Fortunately I insisted on her using Eudora as her mail client for this very reason, & the virus she had recieved was inert.

In short, the viruses are getting ever craftier, & even knowledgeable Windows users are getting bit. Unless you're willing to argue that anyone using Microsoft software deserves this result for selecting inferior software, you can't dump the entire responsibility onto the end users.

Geoff

Just don't tell Pitr

[Cylix]

We had better keep this little tid bit under raps, me thinks Pitr from http://www.userfriendly.org may use it to his diabolic desires.

It's bad enough he took over both the Pepsi and Coca Cola corporations.

Pitr Cola, it just feels right.

Re:Kazaa Hosts at Large University

[forkboy]

Keep in mind that not everyone leaves Kazaa connected all the time and many folks don't share anything out. The number is quite probably much higher than 5800.

Dynamic firewalling again

[wackybrit]

The simple flood always works

Not always. There are systems that implement a process that I call 'dynamic firewalling' (if someone knows the real name, let me know!).. which means if they receive too many packets (or irrelevant packets) in a certain amount of time, they block that host for a while.

'But(!)', you say, 'that doesn't mean the data isn't still coming down your pipe and sucking up your downstream bandwidth!' This is true, but I have seen routers that also implement similar systems.. so if all routers had dynamic firewalling, packets would be blocked right back from the source router, meaning the Internet, as a whole, does not suffer from an attempted attack.

DDOS root name servers - how bad?

[SiliconEntity]

So what would happen if someone managed to maintain a DDOS attack from say 10 million compromised systems against the root name servers? Would all the caches eventually go bad and get wiped, so nobody could connect to any hosts and the net was dead? Or would the cached data stick around, so that people could still connect to existing systems, but updates would no longer propagate? Or something else? Thanks!

my boss allready does

[linuxbert]

He allready owns the internet. he carries it arround on a floppy disk in has back pocket.

He had an IT guy download it last week for him.

(its a joke, laugh)

Re:Darwinism

[HiThere]

You are neglecting the spin that will be applied by governments and corporations. And the "lobbying" efforts that will ensure that the form of the prescribed remedies is of benefit to the "appropriate parties".

The corner cop may be my friend, as the sheep dog is to the sheep, but the U.S. government has been acting more similar to a meat packing plant.

Sysadmins, reconfigure your firewalls

[geirt]

The obvious solution:

Many sysadmins understand that they need to put their servers behind a firewall, protecting the servers from malicious inbound traffic from the internet. Now is the time to educate these sysadmins that they need to configure the firewalls to also block outbound access from the servers to the internet.

For instance, a web server don't need outbound access to the internet at all, you are not going to use the server to browse the internet, so please block all outbound traffic from the web server. If this server get infected by a new worm, the worm can't spread to other hosts trough http. Simple.

I have read a lot about firewalls lately, most focus on securing the inbound traffic, a few talks about egress filtering to stop address spoofing, but none writes about blocking outbound access from the servers, to stop worms from spreading from your server.

On why we aren't more scared.

[mindstrm]

Yes, it's possible to cause massive disruption. It has been for a long, long time.

I recall the FBI stating that it was not some ddos attack that scared them, but hte fact that so many young kids controlled so many computers and DIDN'T do anything with it.

So we ask ourselves, what if this were in the hands of someone who actively wanted to exploit it?

Who are we kidding? Most of the kids that control tons of computers for their ddos attacks for taking over irc servers are not geniuses. If someone had a reason to take over many, many cmoputers and use them for financial gain, they would do it. Plain and simple.

The fact is, owning tons of bandwidth and cycles for a brief amount of time (because that's all you are going to get) is not all that useful long term. How are you going to cash in on it?

Re:Uh-oh, someone has a superiorty complex.

[MadWilli]

Why further the problem.

Check out this link to begin learning about denial-of-service attacks. Here's another if your appetite for self-education has been whet.

Re:Uh-oh, someone has a superiority complex.

[wackybrit]

No thanks. Watching you get pissed off over something that doesn't even matter is entertainment enough! :-)

actually coming up with a real and working solution is pretty hard and *way* beyond what you seem capable of.

Actually it's beyond what the best programming brains in the world have been able to come up with too.. so I don't think I'm doing so bad.

Re: rwx + chown

[fferreres]

I think we are reinventing the weel. Windows was based not only on the idea that a computer should be usable by Joe and Jane but also on the premise that it should be admninistered by those Joe and Jane's.

It think that was a wrong choice. To make the choice worst, they decided that it should allow you to do everything easily (no learing neeeded) and if something was a bit complicated, then it should be stripped off.

The day they realize things should be "owned" and "permisioned" we'd be ok. I don't fear executing whatever in my linux, as long as i use a non important account to execute it (you also need to have all the permisions right or...).

Everyone should be able to use computers, administering is another thing. They can provide a default install that is ok and secure. Of course, there will be some things Joe will not be able to do. And that's a good thing (he can learn a bit if he really wants to change them).