Internet Based Attacks in a Physical World

scubacuda writes "In light of the /. backlash against Spam King, Alan Ralsky, (in which /.ers published his info online--including an overhead shot of his house--and signed him up for junk) Simon Beyers, Aviel Rubin, and David Kormann have written a report entitled Defending Against an Internetbased Attack on the Physical World. Bruce Schneier notes that there's no easy defence against such an attack, largely because companies want to make it easy for consumers to get their promotional information:'Subscribing someone to magazines and signing them up for embarrassing catalogs is an old trick, but it has limitations because it's physically difficult to do it on a large scale. But this attack exploits the automation properties of the Internet, the Web availability of catalog request forms, and the paper world of the post office and catalog mailings. All the pieces (that) are required for the attack to work.' But as Rubin and his colleagues point out, there's a real danger in this ploy, one that few people have likely thought about. 'A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.'"

Comments

That's an easy one:

[Anonymous Coward]

If you don't want to be attacked on a large scale from the Internet, don't piss off Slashdot readers!
It should be a no-brainer by now, and we have shown the effectiveness!

All we need

[OneArmedMan]

now, is a way for the internet to deliver a flaming bag of dog poo to the doorstep of your favourite enemy and life will be complete.

Re:All we need

[WeirdKid]

Ask and ye shall receive. Actually, I'm surprised nobody's sent this to the spammers already.

Re:All we need

[sporty]

You mean +1, Poop :)

Who trusts the US Mail anyway?

[efedora]

"A scenario could be imagined where an attacker would do this to delay the arrival of an important letter...."
I don't know about you but I haven't trusted an important letter the the USPS for many years. Tax returns etc. go Certified or Fedex only. The USPS is just not reliable any more when the mail item is important.

Re:Who trusts the US Mail anyway?

[HowlinMad]

I both agree and disagree. For $.37, if it is in fact important, then no, I would not use the standard option. But, the USPS does have other services available, i.e. Certified Mail, Registered Mail, Delivery Confirmation, Signature Required, etc. These all cost more money, but once again, if the package is important, it is well worht the small cost.

So basically I find the USPS to be reliable, if you pay for the proper service.

Re:Who trusts the US Mail anyway?

[jellomizer]

Like Spam can delay the arrival of an important email or even have it compleatly loss in the mass, filtering, or by accident. That is the real threat of Spam. The fact that an Import Message via E-mail gets cluttered with a bunch of spam. This makes the email difficult to find. It like those pieces of junk mail that look like they are bills so you have to open them up to make sure that they are not billinging you for something you didnt sign up for.
If Spam companies were really reptibual they would actually be working for their stuff to be easilly filtered like the ADD: to the subject line. Because there are some people who like Spam for some reason, and others who hate it, and the majority who dosent care. So by helping people filter out their own Spam give a less bitter taist in peoples mouth about the Spam. Also it helps controol their e-mail.

Re:Who trusts the US Mail anyway?

[Oswald]

This is wrong. The mail is not unreliable. In 25 years of paying my own bills, I cannot recall a single instance where somebody I owed money claimed not to have received the check I sent them. That's hundreds of pieces of important mail without a single loss or serious delay, going back to the late Seventies.

Mostly people bash the USPS because it's something they've heard others do, not because they've had bad experiences. Have you had trouble with your mail?

And what is Certified Mail if it isn't USPS?

Thirty-seven goddamn cents for three- or four-day delivery anywhere in the country. A couple bucks to send a book via Media Mail and have it arrive 5 days later (10 days sooner than the estimate). I don't know what you want.

dirty magazienes?

[corsec67]

Subscribing someone to magazines and signing them up for embarrassing catalogs is an old trick, but it has limitations because it's physically difficult to do it on a large scale.

Heh, I gotta rember this excuse. "No, I didn't sign up for these dirty magazienes. It is some internet conspiracy..."

That, and why is he complaigning?

Re:The Economist

[mlush]

I think The Economist has the easiest and cheapest answer to the problem of spammers. Charge large emailers per send.. the economic disadvantage of sending out wasted emails would then help reduce the number and encourage targetted sending...

You missed the point here. The problem is not spam email, its a DOS attack using snail mail which damages both the target and the bulk mailers.

Dupe attacks are similar

[worst_name_ever]

Tryint to get people to subscribe to Slashdot and making them read embarrassing dupes is an old trick. These attacks exploit the lazy properties of the editors as well as their unprofessionalism. All the pieces (that) are required for this attack to work. There's a real danger in this ploy, one that few people have likely thought about: "A scenario could be imagined where a story could be posted to Slashdot, and then the same story could be posted again a couple weeks later, to wreak havoc on the Internet for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the posting of a goatse link."

DOS by lawsuits?

[joostje]

I've always thought that in a way, a lawsuit often serves like a DOS attack, especially if it's a big company filing against an individual.

Basically, the individual is swamped with requests s/he has to answer, and using up larges amount of resources (lawyer fees).

Very similar to a DOS attack where a server has to answer loads of requests, eating away in its resources (CPU/netwerk traffic).

Re:The Economist

[Timesprout]

Ths article is not about preventing spam. Its about how the postal serices, and probably a few others are vunerable to malicious disruption via abuse of internet capabilities

Guerrillas and gorillas...

[jkrise]

"Let's hope anti-spam, anti-marketing guerrillas can keep their perspective and priorities in order."

When the spam and other ass-orted gorillas get their perspectives in order - then let's talk of anti-spam guerrillas.

"A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter,"

Pure FUD and crap. How many times has spam stopped important mail? How many times anti-spam filters have deleted the 'wrong' mails? Apparently spammers have exclusive abuse rights on the 'system' while lesser users don't! Intriguing.

Re:Guerrillas and gorillas...

[dave_mcmillen]

"A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter,"

Pure FUD and crap.

Oops, I'm sorry . . . They've invoked the T-word ("terrorist"), so you are no longer allowed to express any doubts, reservations, or hesitation. Your Patriotic Duty(TM) is to wave a flag and go along with whatever they say. If you're not one of Us, you're one of Them.

They forgot a key tactic

[Anonymous Coward]

I always liked the idea of placing a classified ad for a mint 1978 Camero for $750 (b/c you're getting a divorce yadda yadda) and then listing your bud's phone number as the contact info. Best to use Auto Trader or the like because the ads run longer than newspapers and can't be cancelled in a day. Never done it, but sure have been tempted on occasion...

Re:stop terrorism paranoia

[tarogue]

If it's a rughead

So, if it is sent by William Shatner or Ted Danson it would be terrorism?

Idiot

[theLOUDroom]

or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.'

God damn. This just makes me want to punch him in the face. Why the fuck does everyone always have to bring terrorism into everything? Ever since 9/11 we have had idiots, making comments like this about EVERYTHING. I am so sick of it.

This guy's statement require ridiculous stretches of the imagination of one to even think of a way it might benefit a terrorist. I mean, seriously, use some common sense here. If you're trying to send someone a letter full of anthrax, you want it to actually get there.

Yes, terrorists could use cars too. Maybe we should ban cars! That way a terrorist can't get his hands on a car and start running people over. Just imagine how many people he could kill by driving down a busy sidewalk! We better hurry!

Then we'll have to ban chair-lifts too. Imagine how many people would be injured or killed if someone cut the cable! We can't have that, now can we?

Ya know, they used fertilizer to make that there Oklahoma City bomb. We better get rid of fertilizer too.

But wait! That still leaves arson! We better make matches a restricted item. Can't have a terrorist going around burning down houses, no can we?

This kind of moronic reasoning makes me want to get this guy alone and "exploit the automation properties" of a few choice power tools.

See! Power tools can be used for evil! Better get rid of those too. Never mind that the benefit they provide to society far outweighs the cost. Never mind that this is supposed to be a "free" society. Won't someone please think of the terrorists?

Re:Idiot

[brettlbecker]

I completely agree.

The culture of fear is just sickening, and the fact that the government and state agencies are exacerbating the 'terrorist' buzzword is repulsive. As if it wasn't bad enough, the major media outlets are constantly trying to one-up each other with hysterical reporting.

All of this serves to show how gullible, how willing most people are to accept all of this as fact. It brings out the frightened-herd metaphor in all of its glory. And it makes one wonder what happens when the world's greatest superpower is also the world's most terrified nation. What happens when animals are backed into corners?

This is not likely to end soon. Things are going to get worse before they get better... that is, if there is a chance for things to get better.

B

Re:Idiot

[curtisk]

This is not likely to end soon. Things are going to get worse before they get better... that is, if there is a chance for things to get better.

....elections are coming up before you know it....make 2004 count!

I'm a severe cynic as far as the election process goes, but if you don't even vote thats even more useless.

Good post and parent post BTW

Re:Idiot

[swordgeek]

Well since you're already modded up to 5 (i.e. I can't moderate it up anymore), I might as well post.

Agreed 100%. I keep hearing about the potential for "Terrorist attacks," mostly coming from US government officials or Concerned Citizens(tm). Do they forget that the anthrax attacks in the US, terrible as they were, were initiated by a born-and-raised American citizen? Or that they killed less people in total than are killed in the US by handguns every single day?

Give it a rest folks! There will always be some way for psychopaths to kill people, possibly en masse. All that regulating every aspect of life does is annoy people, and make it impossible to live normally anymore.

Re:stop terrorism paranoia

[Divide By Zero]

Depends on the perpetrator.

Depends more on the date.
Before 11 Sept 2001: a crime (harassment)
After 11 Sept 2001: a vicious terrorist act orchestrated by Osama bin Laden, and supported by Saddam Hussein's totalitarian regime to undermine the Homeland Security of the US (and justify the existence of Tom Ridge)

Bombing a building is terrorism. Gassing a subway is terrorism. Holding hostages is terrorism. These acts inspire terror.

Getting too much mail is just a pain in the butt. Maybe a crime, but mostly a pain in the butt. If getting too much mail is a crime, and mail is comparable to email, then getting too much email is a crime and we need to call out the feds on spammers. Maybe not a bad idea.

Try it with a Harley

[maddogsparky]

A few years ago, some of my dad's coworkers posted an add for a brand new Harley-Davidson motorcycle in one of those trader magazines. They listed their plant manager's number and stated that he worked evenings, so the best time to call was between 1-4 AM.

Apparently, he started getting calls from several states away from irate bikers who were pissed at HIM when he told them he wasn't selling one (he never owned a motorcycle).

Utter Nonsense

[ePhil_One]

A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter.

What a load of self serving crap. Which of course is completely shocking coming from such a community oriented guy such as a Spammer.

When I read this, I expected it to be about something a bit more substantial, such as using the internet to have someones electricity turned off, or altering a sattelite tragectory to include someones house in its path; or maybe even taking over Dr Evil's Moon Laser to burn nasty messages in someones lawn.

But really, taking out the postal service with a series of mass mailings? What kind of fool thinks that an attack that works on one person will scale large enough to take out the post office, or hinder any sort of criminal investigation?

Re:Give me a break.

[Schezar]

I believe that this "slash-period" is a haven for terrorists, and I believe that they have weapons of mass destruction. It is therefore my duty, as the president of the great nation, to eliminate this threat to our freedom. In the next 12 hours, a campaign of "shock and awe" will be undertaken, the likes of which have never been seen. Nasty emails will be sent in unprecedented numbers. Trolls will abound, and will overcome the enemy.

The pentagon has recently developed a new weapon, a kind of super-goatse, and this new weapon will be used to great effect.

But, remember that this war is not against the people of "slash-period," but is against their terribly regime. CowbowNeal and his associate, Commander Taco. are the enemies here. Our targetted trolling will not be directed at the innocent and oppressed ACs of "slash-period" We are liberators, not conquerors.

Thank you, and goodnight.

(I'm not sure if I was trying to be funny, or if I'm just bored at work..)

Re:stop terrorism paranoia

[kubrick]

William Shatner is...... already guilty of... acts of... terrorism...... against. TheEnglishLangauge.

Re:usps doesn't help things, but that's the way it

[bofkentucky]

Spam and Periodicals actually use more efficent methods to deliver mail, those fancy bar codes make their mail easily routable, your scriblings on the envelope require human eyes to sort to the correct address, human's cost money...and postal workers are some of the most expensive, the added inefficency of union workers and gov't workers makes for very little work.

Executable script-kiddies?

[Potor]

It's their view that a small program could be written, such as an easy-to-execute "script kiddie," that could effortlessly scan millions of sites on the Internet, detect which ones have free online subscription or information request forms, and fill out the forms with a victim's name and address.

what's your favourite way to execute a script-kiddy?

Info: related attacks

[jtheory]

Newsflash: the evil spammers are fighting back and hitting slashdot where it hurts, by submitting stories to the slashdot site that have already been posted and discussed.

These stories are known in the slashdot community as "dupes", and the practice (now becoming well-celebrated in the spammer community) is called "duping the nerds".

Stay tuned for more details in the next posted article, (and again next week, ...and probably again a few days after that, if a new newspaper article is written about it).

Don't make the mob mad.

[Ironpoint]

The best way to defend from internet attack also works in the real world. Its called "Don't make large groups of people angry."

This seems like complaining that the internet allows collaboration of large numbers of like minded people. Yeah, thats the point. The failure of this article is to understand that it is not organized. Thats like saying that all the death threats the Dixie Chicks got all came from one organized structure.

Hundreds of thousands of people are not going to conspire to commit a single crime (Anthrax letter example). That's ridiculous.

To suggest that just because a large number of people are equally angry and respond in a similar way (through mailing etc), that the response is organized is stupid. People who want control set up straw man organization because they can't compete against 100,000 individuals. How many times have we heard "Those protests are completely organized by organization XYZ, they have buses that bring people in". Or in labor problems: "Its XYZ union that is causing the strike, most of the workers don't care" By using the tactic of combining the perception of voice down to a single entity, detractors can be more persuasive in gaining mindshare.

Think about what this can do to companies..

[defile]

Imagine though, that instead of signing up just any plain individual with an ego problem, that you signed up a business for all of this junkmail.

Think about a company sabotaging its upstart competitor by saturating their mailbox with junk. The competitor starts missing bills, notices from vendors, etc.

Or even worse, imagine someone who has been screwed by the phone company one too many times decides to mailing list bomb their bill payment center. The costs of processing payments shoots up while mail peons have to separate the payments from the junk.

Congresspeople start getting cut off from their constituency.

etc...

And the worst part is that this is so hard to undo. Even if you take the effort to unsubscribe from every single mailing list you're on, it would take the attacker mere seconds to re-add you to all of them.

This is probably one of the most devastating non-violent denial of service attacks you can utilize today.

Moral of the story: don't piss people off.

Re:Think about what this can do to companies..

[stephenbooth]

Congresspeople start getting cut off from their constituency.

If politics in the US is anything like it is in the UK then junk mail bombing is not required, it's already happened. Politicians are already cut off from the electorate; isolated behind walls of secretaries, PAs and special interest group contributions.

Maybe things are better in the states? But here in the UK it's rare to find someone who can name their MP or local councillor, let alone remember any of their election promises. I've been eligable to vote for 15 years now, I've written to my MP about once every 18 months on average (5 different MPs) about various local and national issues. So far I've received only one reply, and that tried to dodge my questions.

Stephen

The solution is with the mailers

[mlush]

It would be very simple for a company to defend against being used in a scripted mail DOS attack.

• Move the order forms to another location and slap a robots.txt on them to try and keep them out of Google et al
• Some simple question/answer system to demonstrate the user is human
  • What is this a picture of? (multiple choice)
  • Enter the word in this picture
  • Could you type the company name in backwards (for lynx users)
  • etc
• Use obscure names for the CGI paramaters
• Perhaps some sort of tripwire paramater called 'postcode' that actually holds the phone number, if a postcode is entered it causes the submission to fail

With a bit of imagination the authentication could be turned into a compatition...

250,000+ catalog forms? Try 839.

[rednox]

I don't think this invalidates their conclusions, but there is one "fact" that is not actually true. The Star article states:

Schneier discovered that by typing "request catalog name address city state zip" into Google, a person gets links to more than 250,000 sites containing subscription and request Web forms.

Sure, Google says that it found "about 259,000" search results. However, paging through the results themselves reveals that it only found 839. Including the omitted, very similar pages, there are still only 997.

I think that the web has a huge number of automated forms that could be used for this kind of attack, but you would have to do a little more digging for them than the article implies.

Time-Delayed Dupe

[t0ny]

wow, this is the exact same subject that was posted a few weeks ago, but it has more links.

Someone should write a white paper detailing ways to get Slashdot to post dupes, and how it could potentially be used to do malicious things, like delaying the posting of real news.

Chris Crawford and Terrorism

[Jeremy Erwin]

In his book Balance of Power (1986, the game designer Chris Crawford describes Terrorism thusly:

Terrorism: The first step [in the development of an insurgency] comes when some hothead carries out an act of violence against the government. It is neccesarily rather puny; after all we can't expect every hothead to have much military power at his disposal (thank heaven!). This act serves to galvanize opposition. Once people realize that there are others willing to fight back, they gravitate towards each other, and the insurgency begins to take shape, During this early stage, the insurgents will lack any real military power. They operate as part-time rebels, living during the day as regular citizens, but plotting their revolution in secrecy and making occasional strikes.

It's a little dated, but it's a straight definitiom. Terrorists strike at target of opportunities in urban areas. The goal of their attacks is usually not to go after military targets--in most cases the're too well defended (although see Beirut, Khyber Towers, Pentagon and if you're willing to split hairs. the King David Hotel) but to inspire confidence in those who would support them ("We can win this struggle!") and inspire fear in their enemies ("They came out of nowhere. How could we let this happen?").

Many terrorist organizations don't have a sufficiant grasp of political reality to transform their terrorist activities into an effective opposition. Al Quada's goal was something along the lines of "worldwide Islamic Revolution"-- something that can probably be characterized as "pure fantasy." Although bin Laden's "simultaneous , multiple target" signature may have won him respect from other terrorist organizations, his tactics did little, if anything, to secure his stated political goals, and have instead (deservedly so) marked him as a mass murderer.

Christopher Hitchens defined terrorism as the tactic of demanding the impossible, and demanding it at gunpoint. It's a interesting definition, but, of course it all depends on what one views as impossible.