Slashdot Mirror
Is the Cyberterror Threat Credible?
Scott Pinzon writes "Is the idea that cyber terrorists might take down US networks or utilities realistic, or over-hyped? One of the authors of the Patriot Act and several Black Hat 2005 speakers debated the issue informally at WatchGuard's "Security and Beer Roundtable." Participants include Dan Kaminsky, Johnny "Google Hacker" Long, Tim Mullen, Sensepost penetration testers, a guy from Microsoft's ISA team, and others."
I don't know about a cyberterrorist, per se, but there sure are a lot of compromised machines out there. Anyone remember the article that quoted an estimated 200,000 zombies added every day?
2 /alan-cox.html:
Alan Cox said it best in this interview http://www.oreillynet.com/pub/a/network/2005/09/1
"We are still in a world where an attack like the slammer worm combined with a PC BIOS eraser or disk locking tool could wipe out half the PCs exposed to the internet in a few hours."
The DOD already operates a separate internet for classified material. It's known as the Secret Internet Protocol Router Network, or SIPRNet. So yes, an alternative "G-Internet" is more than feasible - it already exists.
The internet is fairly redundant, and would probably take a ridiculously large attack to completely destroy.
But taking out things like root servers and some major routers, and its efficiency will go down the tubes. Do you recall what the internet was like after 9/11? A lot of major sites were fubared, I had trouble with some emails... it was a pain. A lot of intenet traffic goes throught NYC.
I've seen lots about not probable or not possible but lets look at it this way, how big is the internet? next question how many possible methods of terrorism can exist? some I can think of are; air traffic control (die hard style); automated flood gate control (I've seen HPsUX computers that do this); what about the manipulation of satellites; and affecting train routes, collisions and subway disasters?
If you really think about it anything technological that requires a computer is at risk to "cyber"terrorism.
Now okay most of these services are not live on the internet and can't be done in some afghani basement, but on US shores with the proper utilisation of inside Intel of infrastructure, social engineering, etc.
Looking beyond the simple break down of the technical problems associated with such a threat look at the practical day-to-day ones..
Makes it a little bit more plausible.
This is correct and I doubt it has been fixed.
it was one of the 'nets darker secrets -- e.g. a handful (or more) of people knew about the security hole
Considering that my networking professor told the whole class about it, there are more than a handful of people that know.
For those that don't know, the issue arises out of the way the internet does routing. IPv4 uses a flat routing system. Every key router on the internet knows how many hops away it is from all of the other key routers and which direction the router is in. Consider (the dots are placeholders so slashdot will display my beautiful ASCII art properly):
Router D knows that it is one hop away from router E. B knows that it is two hops from E. How? Because D tells B that it is one hop away from E, so if B sends a packet to D, D can deliver it in one hop. C knows that it is three hops away.
Now suppose router B goes down. C knows that it can't reach E through its usual three hops, but when it talks to its neighbor to the right, it sees that F can reach E in three hops, so C is now four hops away from E. Now when C sees traffic headed for E, it sends the traffic to F.
How do you poison the system? If one of the key trusted routers, such as C, tells everyone that they are two hops from everywhere, large portions of the internet will try to route through C. If you can take control of a trusted router in each of several key locations, you can confuse the overwhelming majority of the internet into thinking you are offering the best route to their destination.
The short route won't make a big difference for nearby traffic, but traffic headed ten or twenty hops away will wind up going towards C when it should go someplace else.
The above-described mechanism for updating the routing tables is the key to the internet's ability to automatically route around cities that have been destroyed by a nuclear weapon.
Of course the people who maintain those routers are likely to know something is up and simply cut their link to the poisoned router, ruining all the excitement.
And Cunningham is a real hoot: just the kind of guy you'd want writing paranoid legislation like the Patriot Act. My favorite Cunningham quote:
To which one can only exasperatingly respond: "Yes, and I have not heard anyone say that it's not technically possible for aliens to land on the White House lawn tomorrow!"
RTFA and decide for yourself whether it was a waste of time. Putting 10 supposedly bright security programmers into a discussion is apparently impossible, since each attempts to fill the room with his own ego. Was there any single thread that started at a reasonable place and drove to a reasonable conclusion?
Some interesting points were made but that's all. This should have been reframed as a brainstorming session whose purpose was to compose as many ideas as possible at one sitting. To describe it as a "debate" or even a "discussion" would be wrong - everyone present was talking and no one was listening.
Do you recall what the internet was like after 9/11?
Here in the UK, everything was fine. Sure, the news sites were dog slow in the immediate aftermath, because they were having trouble handling all the traffic. Other than that, it was fine.
Localised strikes can only do localised damage. The rest of us will barely notice, unless we happen to be trying to send traffic into/through the affected area. Unsurprisingly, most of my London-based traffic never gets routed through New York.
It's official. Most of you are morons.
Viri is not a word, neither in English, nor in Latin. Virus, in Latin, means something that is already a plural, like 'sand' or 'water'. A plural form does not exist. Please use 'viruses', which is correct English.
Ok, maybe flamebait but here goes.
Yes there are critical systems on the internet. For those of you who think you're so smarty pants, "who would put crit systems out there", what about email? Or B2B? Or electronic trading on NYSE, NASDAQ, etc? Or, or, or.....
According to a study I read a couple of years ago, and unless this has changed in the last couple years, and I hope it has, there are only about 4 buildings in the US that need to go away and the internet would be virtually gone until they could be replaced.
A coordinated attack on these facilities could effectively remove all net communications in the US for who knows ho long. I imagine the recovery would take quite a long time.
Considering that my networking professor told the whole class about it, there are more than a handful of people that know.
For those that don't know, the issue arises out of the way the internet does routing. IPv4 uses a flat routing system. Every key router on the internet knows how many hops away it is from all of the other key routers and which direction the router is in. Consider (the dots are placeholders so slashdot will display my beautiful ASCII art properly):
[cute but erroneous diagram clipped to avoid lameness filter]
Router D knows that it is one hop away from router E. B knows that it is two hops from E. How? Because D tells B that it is one hop away from E, so if B sends a packet to D, D can deliver it in one hop. C knows that it is three hops away.
Now suppose router B goes down. C knows that it can't reach E through its usual three hops, but when it talks to its neighbor to the right, it sees that F can reach E in three hops, so C is now four hops away from E. Now when C sees traffic headed for E, it sends the traffic to F.
How do you poison the system? If one of the key trusted routers, such as C, tells everyone that they are two hops from everywhere, large portions of the internet will try to route through C. If you can take control of a trusted router in each of several key locations, you can confuse the overwhelming majority of the internet into thinking you are offering the best route to their destination.
The short route won't make a big difference for nearby traffic, but traffic headed ten or twenty hops away will wind up going towards C when it should go someplace else.
The above-described mechanism for updating the routing tables is the key to the internet's ability to automatically route around cities that have been destroyed by a nuclear weapon.
Oh good god, what complete and utter BS. Lest anyone believe this is actually how transit routing works:
All public ipv4 transit networks in existence use a routing protocol called BGP4 (Border Gateway Protocol v4 - rfc1771). BGP is an "inter-autonomous system" routing protocol. That means, as a whole, it has no network awareness of individual routers, links, specific static addresses or locations. Essentially, all it knows is that a set of ip networks comprise an Automous System (labeled via an ARIN/RIPE/APNIC assigned Autonomous System Number). When a bgp router in one AS has an established bgp session with a router in a different AS, it tells the other router all the foreign ASNs that the network is willing to take traffic for and prepends its own ASN to the front of the list. The same is done for networks that originate within the local AS (i.e. the ASN is appended to "nothing" and is thus respresents the final destination AS) [there is also an origin ASN field, but ignoring that for the sake of simplicity]. This list is known as a bgp path. Thus, to find a route(s) to any accessible ipv4 address, a bgp router need only look at all the paths that contain the destination ASN, and the shortest path is generally the best route (although certainly not always). The actual job of routing packets is handled on a per-AS basis; i.e. each network is responsible for knowing, internally, how best to move packets to all the AS' that are connected to it.
You will note, however, that the core problem you describe continues to exist in this model, simply not on a per-router basis. If AS999 sends a path such as "9999 701" to all neighboring ASes, they'll believe that a viable route for traffic destined to AS701 is via AS9999, which, given a large major network, could be extremely distruptive.
However, in reality, this has not been a grave concern for a number of yea
The last comment is right on, and in fact the Clipper project illustrates quite well that neither party can be trusted. The Clipper chip was actually a Bush I administration project -- initiated and developed before Clinton came into office. It was pretty much a done-deal, and it was announced a few months after Clinton took office. So it was developed by one party, it could have been stopped or at least questioned somewhat by the other party, and both parties pushed it forward.
And the scariest part of it all is that the "voice of reason" at the time was actually John Ashcroft. Yikes.