Slashdot Mirror
Internet Based Attacks in a Physical World
scubacuda writes "In light of the /. backlash against Spam King, Alan Ralsky, (in which /.ers published his info online--including an overhead shot of his house--and signed him up for junk) Simon Beyers, Aviel Rubin, and David Kormann have written a report entitled Defending Against an Internetbased Attack on the Physical World. Bruce Schneier notes that there's no easy defence against such an attack, largely because companies want to make it easy for consumers to get their promotional information:'Subscribing someone to magazines and signing them up for embarrassing catalogs is an old trick, but it has limitations because it's physically difficult to do it on a large scale. But this attack exploits the automation properties of the Internet, the Web availability of catalog request forms, and the paper world of the post office and catalog mailings. All the pieces (that) are required for the attack to work.' But as Rubin and his colleagues point out, there's a real danger in this ploy, one that few people have likely thought about. 'A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.'"
"A scenario could be imagined where an attacker would do this to delay the arrival of an important letter...."
I don't know about you but I haven't trusted an important letter the the USPS for many years. Tax returns etc. go Certified or Fedex only. The USPS is just not reliable any more when the mail item is important.
to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.
This is NOT terrorism, it IS a crime!
Basically, the individual is swamped with requests s/he has to answer, and using up larges amount of resources (lawyer fees).
Very similar to a DOS attack where a server has to answer loads of requests, eating away in its resources (CPU/netwerk traffic).
All credibility was lost with this scare tactic:
"to serve as a diversion for a terrorist act"
"Let's hope anti-spam, anti-marketing guerrillas can keep their perspective and priorities in order."
When the spam and other ass-orted gorillas get their perspectives in order - then let's talk of anti-spam guerrillas.
"A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter,"
Pure FUD and crap. How many times has spam stopped important mail? How many times anti-spam filters have deleted the 'wrong' mails? Apparently spammers have exclusive abuse rights on the 'system' while lesser users don't! Intriguing.
If you keep throwing chairs, one day you'll break windows....
I think that when a large number of people are willing to spend their time physically DoS attacking someone then maybe that person deserves it. I don't think that if an individual just had a grudge against the spam king that person would have been able to really do much damage, but obviously enough people felt the same way.
I see it kind of like picketing, one person doesn't really do that much harm, but if enough people are pissed off....
"Not knowing when the dawn will come, I open every door." - Emily Dickinson
or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.'
God damn. This just makes me want to punch him in the face. Why the fuck does everyone always have to bring terrorism into everything? Ever since 9/11 we have had idiots, making comments like this about EVERYTHING. I am so sick of it.
This guy's statement require ridiculous stretches of the imagination of one to even think of a way it might benefit a terrorist. I mean, seriously, use some common sense here. If you're trying to send someone a letter full of anthrax, you want it to actually get there.
Yes, terrorists could use cars too. Maybe we should ban cars! That way a terrorist can't get his hands on a car and start running people over. Just imagine how many people he could kill by driving down a busy sidewalk! We better hurry!
Then we'll have to ban chair-lifts too. Imagine how many people would be injured or killed if someone cut the cable! We can't have that, now can we?
Ya know, they used fertilizer to make that there Oklahoma City bomb. We better get rid of fertilizer too.
But wait! That still leaves arson! We better make matches a restricted item. Can't have a terrorist going around burning down houses, no can we?
This kind of moronic reasoning makes me want to get this guy alone and "exploit the automation properties" of a few choice power tools.
See! Power tools can be used for evil! Better get rid of those too. Never mind that the benefit they provide to society far outweighs the cost. Never mind that this is supposed to be a "free" society. Won't someone please think of the terrorists?
Life is too short to proofread.
The best way to defend from internet attack also works in the real world. Its called "Don't make large groups of people angry."
This seems like complaining that the internet allows collaboration of large numbers of like minded people. Yeah, thats the point. The failure of this article is to understand that it is not organized. Thats like saying that all the death threats the Dixie Chicks got all came from one organized structure.
Hundreds of thousands of people are not going to conspire to commit a single crime (Anthrax letter example). That's ridiculous.
To suggest that just because a large number of people are equally angry and respond in a similar way (through mailing etc), that the response is organized is stupid. People who want control set up straw man organization because they can't compete against 100,000 individuals. How many times have we heard "Those protests are completely organized by organization XYZ, they have buses that bring people in". Or in labor problems: "Its XYZ union that is causing the strike, most of the workers don't care" By using the tactic of combining the perception of voice down to a single entity, detractors can be more persuasive in gaining mindshare.
Imagine though, that instead of signing up just any plain individual with an ego problem, that you signed up a business for all of this junkmail.
Think about a company sabotaging its upstart competitor by saturating their mailbox with junk. The competitor starts missing bills, notices from vendors, etc.
Or even worse, imagine someone who has been screwed by the phone company one too many times decides to mailing list bomb their bill payment center. The costs of processing payments shoots up while mail peons have to separate the payments from the junk.
Congresspeople start getting cut off from their constituency.
etc...
And the worst part is that this is so hard to undo. Even if you take the effort to unsubscribe from every single mailing list you're on, it would take the attacker mere seconds to re-add you to all of them.
This is probably one of the most devastating non-violent denial of service attacks you can utilize today.
Moral of the story: don't piss people off.
You're a real ass. The postal workers union is about as useless as tits on a bull, and the government exempts itself from all sorts of labor laws.
Postal workers, particularly those in the sorting centers work very hard -- they don't have a choice or a teamsters union to lighten the load.
Conformity is the jailer of freedom and enemy of growth. -JFK