Slashdot Mirror

← Back to Stories (view on slashdot.org)

Is the Cyberterror Threat Credible?

Posted by ScuttleMonkey on from the nothing-to-fear-but-fear-itself dept.

Scott Pinzon writes "Is the idea that cyber terrorists might take down US networks or utilities realistic, or over-hyped? One of the authors of the Patriot Act and several Black Hat 2005 speakers debated the issue informally at WatchGuard's "Security and Beer Roundtable." Participants include Dan Kaminsky, Johnny "Google Hacker" Long, Tim Mullen, Sensepost penetration testers, a guy from Microsoft's ISA team, and others."

63 of 301 comments (clear)

  1. Re:Better safe than sorry by Ruff_ilb · · Score: 2, Insightful

    Considering that, as of now, we can just pull money out of nowhere and just increment our debt up, it looks like that'll be the case for a looong time.

    Yea, money's the real issue. With enough money, they can buy out enough hardware, encourage enough research, hire enough programmers, etc, to do almost anything. On the other hand, I'm sure that no matter what they do, their system will still have critical vulnerablilities, but that's just a fact of life.

    Anyway, when we spend a quarter of the money on cyber-counter-terrorism that we do on physical defense, then people can think about beginning to complain about costs. OTOH, it's not like we really know where that money's going anyway...

    --
    http://www.TheGamerNation.com/Forums
  2. Are critical systems on the internet? by ReformedExCon · · Score: 4, Insightful

    Who cares if the power company's website is defaced or their web server brought down? That won't lead to the lights going out.

    The question is not whether the threat from cyberterrorism (what a stupid term) is credible, but who in their right mind sees it necessary to put critical systems online?

    If you want to take out half the internet, you don't need hackers. A backhoe works just fine. So why in the world would anyone put such important things on a network that is easily disabled?

    --
    Jesus saved me from my past. He can save you as well.
    1. Re:Are critical systems on the internet? by Mawbid · · Score: 5, Interesting
      Are critical systems on the internet?

      If I'm reading this correctly, yes.

      Mullen: I once had grid resources through a Web application anonymously for a power company. Grid resource control, OK? SQL injection, hit that through an anonymous connection and I had grid resources for the State.

      The fact that an idea is really dumb doesn't mean it's never been implemented.

      --
      Fuck the system? Nah, you might catch something.
    2. Re:Are critical systems on the internet? by stienman · · Score: 2, Interesting

      who in their right mind sees it necessary to put critical systems online?

      The internet itself is considered a critical system. As valuable (perhaps more) as the telephone and electricity utilities.

      What is concerning to many is another Morris internet worm or a similar crash of the internet. Take the recent cisco bugs - these make up a significant portion of internet routing capability. Should someone succeed in developing a cisco worm that infects even 5% of the cisco routers (specifically the "big iron" type routers at major peering points) then the internet will instantly become fairly useless. It will take hours, days, and weeks to get it working well again.

      Such a hit to the internet would significantly affect the economy. Further, the entire internet would feel the effects of more stringent regulation.

      It's not the simple hacks that people are concerned about. Just like an earthquake, a significant event is going to occur without warning - how can it not happen? If you believe it won't happen, then one of the following must be true:
      1) You believe there are no significant enough security problems in routers/computers/etc to cause such a major fracture or
      2) You believe that those individuals and organizations who have the ability to target such security problems will choose not to do so.

      Can you safely make both assumptions? If so, I suspect you overestimate human nature.

      It may be useful to note that the US government will treat a catastrophic internet event in the same manner as they would a catastrophic attack on the telephone, electric, or even road infrastructure.

      The difference is that the internet is much, much more vulnerable. The point of penetration can be continents apart from ground zero - and homeland security isn't scanning packets for proper visas.

      -Adam

    3. Re:Are critical systems on the internet? by BoneFlower · · Score: 4, Informative

      The internet is fairly redundant, and would probably take a ridiculously large attack to completely destroy.

      But taking out things like root servers and some major routers, and its efficiency will go down the tubes. Do you recall what the internet was like after 9/11? A lot of major sites were fubared, I had trouble with some emails... it was a pain. A lot of intenet traffic goes throught NYC.

    4. Re:Are critical systems on the internet? by mestreBimba · · Score: 2, Interesting

      Yes they are on the internet kind of. They are on SCADA networks that are connected to corporate networks (through a firewall) so that the bean counters can maximize productivity...... General configurations include data stores with linkages through the firewalls, vendors that require some type of access to the SCADA systems and servers to perform maintenance and patching, and online help systems on the SCADA systems that use web based help systems (located on critical systems) that can call out to vendors sites, and basically any other wbe site.

      As a new IE exploit is out in the wild it is not hard to imagine that critical systems can become infected from client side attacks. A hacker has to get past (in general) two firewalls, then yes the critical systems are acesseble via the internet. As most attacks these days use a combination of social engineering/ client side attacks against the corporate LAN getting a foothold behind the first firewall is not too difficult.

      Basically power, oil distribution, water, sewer, gas piplines, communication systems, and most manufacturing processes use SCADA or digitsal control systems that in some way are connected to the internet.

      I am currently on a team at a DOE lab that has 20 very good researchers who spend all their time and energy hacking SCADA systems and performing pen testing of various vendor products and pen testing in production control systems at a lot of utilities.

      We have not performed and on site assesment in which we have not found access to the SCADA system (eventually) through an external internet connection.

      Thats not the half of it...... most of the RTU out in the world have unsecured dial up access......

      So the threat of cyberterrorism is very real. Economic impact from a well directed cyber attack could exceed billions of dolars.

      --
      Fly Fish? Participate in our forum
    5. Re:Are critical systems on the internet? by burns210 · · Score: 2, Interesting
      "Oh and one more thing. What exactly did you mean that half the internet can be taken down with a backhoe?"

      Many 'fat' internet connections share a single tunnel. Long haul fiber outages and what not can have a huge sweeping blow to thousands of websites if properly planned. Yes, there are redundant links, but if you cause a large enough chunk of traffic to be routed through alternate paths, you will cause those paths to get flooded and DOS not only the originally effected sites, but also the sites that WERE using the alternate paths but now have to share.

      It isn't a single backhoe, though I don't doubt certain peering points could be FUBARed with a single snip, that we should be worried about. But a small coordinated attack on a couple (2, 3?) peering points, well planned, and you could take down much of the internet in a chain reaction.

    6. Re:Are critical systems on the internet? by InfoRaptor · · Score: 3, Insightful
      Keep in mind that a cyberterror attack does not have do be something that is big and splashly to be effective.

      Terrorists are political animals first and foremost. They attempt to disrupt the exisiting political order in order to substutite their own.

      This means that they don't really have do something major in terms of deaths or physical destruction. All terrs have to do is disrupt. All they have to do is create enough chaos to force society to give in.

      How about the economic impact of shutting down the stock exchanges for few hours? Perhaps only a few Wall Streeters would really suffer. But think of the panic.

      Consider the effect of transportation and deliveries. The restock time for grocery stores in most cities is 3 days. Keep the trucks, trains and airplanes from coming in and in three days you have food riots.

      Also, we need to consider how most people react. We here at Slashdot are problem-solvers. To us, figuring out complex and difficult problems is routine. Can you say that for the general public?

    7. Re:Are critical systems on the internet? by Simon+Garlick · · Score: 4, Insightful

      It may be useful to note that the US government will treat a catastrophic internet event in the same manner as they would a catastrophic attack on the telephone, electric, or even road infrastructure.

      By what, doing nothing? Two words: New Orleans. The US government can't even defend its citizens and infrastructure against BAD WEATHER.

      --

      -----
      PGP Key ID 0xCB8FF658
    8. Re:Are critical systems on the internet? by Tim+C · · Score: 2, Informative

      Do you recall what the internet was like after 9/11?

      Here in the UK, everything was fine. Sure, the news sites were dog slow in the immediate aftermath, because they were having trouble handling all the traffic. Other than that, it was fine.

      Localised strikes can only do localised damage. The rest of us will barely notice, unless we happen to be trying to send traffic into/through the affected area. Unsurprisingly, most of my London-based traffic never gets routed through New York.

      --
      It's official. Most of you are morons.
  3. No - none of that manipulative cyberlip by dbIII · · Score: 3, Insightful
    No - robots with bombs are in short supply so there is no threat from cyberterrorism.

    Criminals that use computers for fraud and other crimes should be described by a less stupid and emotive term than cyberterrorism.

    1. Re:No - none of that manipulative cyberlip by colonslashslash · · Score: 2
      No - robots with bombs are in short supply

      Not for long man:

      X-45 J-UCAS Unmanned Combat Air System

      --
      She's built like a steak house, but she handles like a bistro....
  4. Re:No by Proaxiom · · Score: 3, Insightful
    "It's just a way to make the federal government feel justified in paying CISSPs $1000 an hour for pen testing."

    Even if it's not credible, it doesn't mean it's okay to leave networks unsecured. Having consultants do security analysis is probably a good idea (although I don't personally know to what extent the federal government deliberately gets ripped off by those consultants, as you contend).

    The threat of cyberterrorism has more to do with whether we should spend money analyzing threats to electronic infrastructure, and planning responses to potential attacks on it. Not the sort of thing you hire pen-testers for.

  5. like '%Cyber%' by NineNine · · Score: 5, Insightful

    Personally, I don't feel in any way threatened by any word, phrase, or sentence with the prefix "cyber" in it. Cyber*, to me, means a way for non-geeks to explain something that they don't in any way understand.

    1. Re:like '%Cyber%' by Wisgary · · Score: 3, Insightful

      What about Cyber-sex?

  6. Cyber? by ScaryFroMan · · Score: 3, Insightful

    Frankly, I think most terror threats aren't credible. My philosophy is that in most cases, if you're on the ball enough to understand a threat, it's not threatening. The real terrorism are the attacks (cyber and...um...Analog?) that come from behind.

    --
    In Soviet Russia, backwards is everything.
  7. Re:No by ArmedLemming · · Score: 2, Interesting

    Yes, there is a threat posed by cyberterrorism.

    I had an old friend/acquaintance (who was very well placed in the networking community) once tell me he could bring the internet to its knees in a matter of half an hour with some poisoned routing tables or somewhat similar at the router/peering points. Granted this was years ago, but as I recall being told it was one of the 'nets darker secrets -- e.g. a handful (or more) of people knew about the security hole, but it was baked into how things were being done within the IOSes of the routers that the peering points used. Perhaps this hole has been fixed by now, but I seriously doubt that people with enough dedication couldn't find another similar type of hole.

    Unfortunately, I don't think the end user/consumer is able to much about it because this pertains to the provider/peering level.

    --
    Two fish swim into a wall, one turns to the other and says, "Dam".
  8. Keep the govt out. Decentralize security. by Anonymous Coward · · Score: 5, Insightful

    The Bush administration has been warning of a digital Pearl Harbor for years.

    However, their desire to collect and to centralize information on government computers for 'homeland security' purposes makes such a threat more dangerous, not less dangerous.

    If their proposals for government-accessible backdoors for all encryption were actually to become reality, then a single successful hacker could compromise millions of secure computers and documents in a single attack.

    The best solution is to go back to the policies of Clinton's presidency. Let us, the people, take care of our own security without government intrusion, as is our natural right and privilege.

  9. Hah!y by flamesrock · · Score: 3, Insightful

    We live in a culture of fear.


    First it's anthrax (anyone remember that?)

    Then it's suitcase nukes..

    Then it's bird flu..

    Suddenly terrorists are going break into our computers?!


    All of these are existant 'problems' blown WAY out of proportion. I'm counting the days before termites are found in the whitehouse, thus becoming the next terrorist threat.

  10. Agreed by lheal · · Score: 4, Interesting

    Cyberterrorism is a stupid word.

    But beyond that, there are easier targets.

    Railroads carry tanks full of lovely chemicals like SO4 and HCl. For commercial efficiency, they often put all the tank cars together. For historical reasons, the railroads, state highways, and interstates often run close together and intersect. Not far from where I am now is an intersection of two interstate highways, two state highways, two US routes, and a railroad.

    Take out the tank cars and drive away in any direction.

    --
    Raise your children as if you were teaching them to raise your grandchildren, because you are.
    1. Re:Agreed by BoneFlower · · Score: 4, Interesting

      About a year and a half ago, a tanker truck exploded on a bridge in Bridgeport CT on the I-95.

      The bridge was out of action completely for about a week. It didn't collapse, but the damage was severe enough to basically destroy it. The northbound lanes were out of action for another week after that. And this was with an extremely huge effort to get it running again, they expected even temporary repairs to take about a month. I don't think they've gotten it properly replaced even now.

      The shit really hit the fan when this happened. That stretch of I-95 was(and still is) undergoing heavy construction as it was, so it was backed up already. Traffic got really screwed up, there were lots of detours onto the 15 and the local roads. Commercial traffic was even sent on the 15, that NEVER happens, it is normalyl outright banned.

      This was a single, smallish tanker truck that got winged by a passenger car. Early morning too, so traffic was light. A deliberate attack using a larger truck during rush hour... I don't want to imagine. Dozens(for this bridge, potentially hundereds with the right bridge) would be killed and there would be serious economic disruption. That bridge is probably one of the most important in Fairfield County, especially the coastal region.

      They did have some antiterrorist type people on scene... it was obviously an accident, but they went there to get a better idea of just what would happen if terrorists did go after a major bridge and how to best recover quickly. Good thing they got a demonstration like that without the death toll an actual attack would have caused.

    2. Re:Agreed by rolfwind · · Score: 3, Insightful
      Cyberterrorism is a stupid word.


      The combination is quite deliberate to spread FUD.

      If you ever watch the news on TV, they constantly want to portray the Internet as this newfangled thing (still) that vague and murky and might bite you at any second. I think that's simply out of touch for most people (actually I think the TV industry is just jealous) but the FUD must play well with some of them because the mechanics of it isn't so easy to grasp as say any other appliance, like a blender or how TV generally works.

      Combined with the vogue word of this decade, terrorism, voila: a whole new genre for the powers that be to terrorize, er, I mean inform others with propaganda.

      It's the same old shit (SOS) put in a new dress.
  11. Oh boy by QuantumG · · Score: 4, Insightful

    The broader question: is the treat of terrorism credible? Considering that politicians made up the whole concept of "the terror network" from disinformation planted in european newspapers and then failed to listen to the CIA when they told them the Soviet Union was not funding terrorist groups and in-fact it was the CIA that was planting the propaganda, how can we possibly believe that terrorism is capable of any more than the few isolated incidents that have befallen the world in the last dozen years? We're talking about a total number of deaths less than a year of ordinary people driving cars on the national highways. The chances of becoming a victim of terrorism are less than the chances of being hit by falling space debris.

    --
    How we know is more important than what we know.
    1. Re:Oh boy by patio11 · · Score: 2, Insightful
      The chances of becoming a victim of terrorism are less than the chances of being hit by falling space debris.
      Falling space debris doesn't kill 5 Israeli civilians and several dozen Iraqis on a quiet week, and several hundred to thousands on a bad day. Falling space debris also isn't actively trying to fall more frequently and harder.

      how can we possibly believe that terrorism is capable of any more than the few isolated incidents that have befallen the world in the last dozen years?
      Terrorism has been going on for significantly longer than the last dozen years, and the "few isolated incidents" model is exactly the *wrong* way to understand the threat. Ask Brits or Israelis if the IRA or Hamas incidents were either few or isolated. No, they were part of long-term campaigns which occurred (and, in Israel, occur, this morning in fact) precisely to make life so unlivable as to force a desired political goal. And when terrorists are comparitively ignored or treated as a minor nuisance like particularly nasty street-crime (see, for example, Al Qaeda before their second, successful attempt to take down the World Trade Centers -- everyone forgets about the first one, which was an isolated incident like their attack on the USS Cole was an isolated incident and their embassy bombings in Africa were isolated incidents and...) the frequency and severity of their "isolated incidents" tends to rise.

      --
      Help poke pirates in the eyepatch, arr.
    2. Re:Oh boy by gobbo · · Score: 2, Insightful
      how can we possibly believe that terrorism is capable of any more than the few isolated incidents that have befallen the world in the last dozen years?

      You know, I was a pretty ordinary nerdy teenager, but I hung out with some less savoury characters. We wreaked some pretty fine havoc from a vandalism point of view. Their ideas, of course! ;-)

      All the while, I was thinking, "what if we decided to do this somewhere serious?" There were traffic light boxes to mess up, power stations, train controllers, high-rises, and of course the airport...

      Not that I would have ever taken initiative, but I was an avid reader of novels featuring violence. Being engaged in some minor mayhem showed me that given some precautions and minor planning, a half-smart bunch of hooligans can raise some real hell.

      So: where are they? Sure, there are inept and insane suicide bombers peppering Tel-Aviv bus riders with horror. But where is the real mayhem? A single incredibly complex and (if you ask commercial airline pilots and structural engineers) nigh-impossible feat, never properly explained, just isn't convincing that the network is out there. Most crimes go unsolved, and therefore serious vandalism should be relatively easy. What, you scoff--have you no feral imagination?

      Yes, there ARE terrorists out there, but they're nearly all engaged in struggles with occupiers, mostly on their home turf. Sure, there are some terrorists and nasty 'liberation movement' types floating around north america... but if they were serious, they'd be pulling stuff off regularly.

      --
      Damn those pesky terrorists
    3. Re:Oh boy by exekewtable · · Score: 2, Insightful

      The goal of the Christian fanatics is to subject everyone to their perception of their religion and its laws. Anyone who is not of their persuasion is a terrorist, who must be either made to obey or be eliminated. There may not be a single person or organiziation that drives this goal, but there is this common religious Christian philosophy. The Muslims and their protectors are seen as the number one enemy. This sentiment was seen in the news reports of the speeches of the leaders of the USA.

    4. Re:Oh boy by orion41us · · Score: 2, Insightful

      When someone straps a bomb to thier arse and blows it in a crowded market - that's terrorism.

  12. And the answer is.... by Karl+Cocknozzle · · Score: 4, Insightful

    Maybe. But probably not. If terrorists use a computer to do something that kills people, its regular terrorism. If somebody screws with my computer, that person is not a "cyber-terrorist," he is just a regular criminal (and also, likely, a douchebag.)

    So maybe what I mean is... no, it isn't remotely credible.

    --
    Who did what now?
  13. Realistic, I'd say. by alphafoo · · Score: 3, Informative

    I don't know about a cyberterrorist, per se, but there sure are a lot of compromised machines out there. Anyone remember the article that quoted an estimated 200,000 zombies added every day?

    Alan Cox said it best in this interview http://www.oreillynet.com/pub/a/network/2005/09/12 /alan-cox.html:
    "We are still in a world where an attack like the slammer worm combined with a PC BIOS eraser or disk locking tool could wipe out half the PCs exposed to the internet in a few hours."

    1. Re:Realistic, I'd say. by Tony+Hoyle · · Score: 2, Insightful

      It's actually extremely easy to wipe the BIOS on most PCs if you can get to ring 0 (not too hard under Windows). Alternatively just write garbage to nvram... same effect on a lot of bioses (especially if you manage to enable the password with a garbage value). Joe public is not savvy enough to recover from this..

      OTOH a virus that did this wouldn't propogate very far because it's destroying its host. There's more to be gained by keeping the host running and infecting other machines. eg. Delete NTLDR and your box will keep working, but won't boot next time around.

  14. One phrase by Billosaur · · Score: 2, Insightful

    Y2K - Nuff said.

    --
    GetOuttaMySpace - The Anti-Social Network
  15. Re:Better safe than sorry by dogwelder99 · · Score: 4, Insightful

    There's something a little strange about spending hundreds of billions to create a missile shield on the off chance the terrorists are smart enough to build a viable nuclear weapon AND deliver it on target via ICBM from thousands of miles away... but too dumb to figure out how to trigger a cascading failure with a DDOS attack.

    Truth is, if the raids on strongholds in Iraq are any indication, they can barely figure out how to upgrade to Windows 98. I'd be more worried about my government bankrupting me than anything the evil terrorists could pull off.

  16. Re:Keep the govt out. Decentralize security. by Ph33r+th3+g(O)at · · Score: 4, Insightful
    The best solution is to go back to the policies of Clinton's presidency. Let us, the people, take care of our own security without government intrusion, as is our natural right and privilege.

    I'm not sure that's really what you want. IIRC, the attempts to make key escrow mandatory with Clipper were on Clinton's watch. The sooner we quit believing that one party or another is interested in freedom, the sooner we have a chance to preserve the dwindling amount of it we have left.

    --
    I too have felt the cold finger of injustice.
  17. Re:Chinese by Mr2cents · · Score: 2, Funny

    We just want to print one page...

    --
    "It's too bad that stupidity isn't painful." - Anton LaVey
  18. Firewall against Asian bird flu too by EmbeddedJanitor · · Score: 4, Insightful
    While you're getting paranoid...

    Fear is a fantastic way to control people and get big dollars into big lobbiests pockets. It is also a good way to divert focus from real issues.

    Unfortunately these measures only give a false sense of security. All the aircraft carriers can't stop a few punks with box cutters from hijacking a plane or whatever.

    Huge security measures in the internat will be equivalent to airport security. Pain in the ass (in more ways than one), queues, loss of service etc for Joe Average and ineffective.

    --
    Engineering is the art of compromise.
  19. The Nightmare worm by 3ryon · · Score: 4, Interesting

    I don't know if it will happen from what we think of as terrorists, but I'll go on record saying that we'll eventually have a Nightmare worm.

    It could have already happened, but perhaps the worm writers had a conscious. There will be a worm that 0-day exploit that compromises a common MS Windows service and isn't so polite as SQL-Slammer. Slammer infected almost every vulnerable host in the world within 10 minutes. I would call Slammer a 'polite' worm as it did no harm other than flooding networks.

    It's certainly possible to write an impolite worm. One that doesn't just spread itself, but after 20 minutes of attempting to spread itself decides to stop all of your services and then wipe the data off your hard drive. If a computer isn't directly affected, it will probably be affected downstream by the network traffic or reliance on Windows network services. Those that managed to survive may have a hard time finding other surviving resources.

    Hopefully the business world has backups, but can you imagine the global disaster that would follow? In 30 minutes almost every computer in the world is down. Airlines will be grounded, you may lose electricity, you might not be able to order a mocha frappancino(tm) at your favorite fourbucks.

    (Not to be judgemental, but in today's world if it doesn't target Windows it's not the Nightmare worm)

    --
    Kind thoughts do not change the world
    1. Re:The Nightmare worm by dhasenan · · Score: 3, Insightful

      And have it flash the BIOS with 0's as its first action, then force reboot after spreading. That's data loss and hardware loss. Unless we start hot-swapping motherboards.

    2. Re:The Nightmare worm by Anonymous Coward · · Score: 2, Informative

      Viri is not a word, neither in English, nor in Latin. Virus, in Latin, means something that is already a plural, like 'sand' or 'water'. A plural form does not exist. Please use 'viruses', which is correct English.

    3. Re:The Nightmare worm by Redwin · · Score: 2, Interesting

      The worms you are thinking of are Warhol worms and flash worms, first published in a paper by Staniford and Weaver which use hitlists to find targets and can spread to 95% of vulnerable hosts in about 15 minutes or under 30 seconds for a flash worm. A varient of the flash worm also proposed by Weaver in a later paper in 2004 and had a theoretical flash worm spread in 510ms, unfortunately I can't find the paper at the moment.

      I would call Slammer a 'polite' worm as it did no harm other than flooding networks.

      Thats quite a generous optinion of the slammer worm considering it basically ground sections of the internet to a holt by the amount of traffic it generated.

      It's certainly possible to write an impolite worm. One that doesn't just spread itself, but after 20 minutes of attempting to spread itself decides to stop all of your services and then wipe the data off your hard drive.

      I've always wondered why peoples immediate thought of a worst case senario is loss of data. There are far worst things you could do if you had access to someones machine: stealing confidential information for blackmail, sending out emails in that persons name from their machine damaging that persons reputation, downloading kiddie porn to the machine, removing yourself and then informing the authorities.. data can be recovered by various mechanisims but reputations or finances are a lot harder to rebuild.

      --
      Warning, comments may not have been passed by the sanity department of my brain.
  20. Slashdot effect... by ktakki · · Score: 3, Insightful

    Mullen: But I think this is important -- is the United States communication infrastructure a critical part of a terrorist attack? Not because of taking it out, but because of keeping it up. Right? You know what happened to the CNN Web site on 9/11?

    Harrison: It was like Slashdot hooked to it.


    I was working at home on 9/11, and yes: CNN was down until they put up a no-graphics static page. Slashdot was up and running just fine.

    Anent to the article, I think the so-called cyberterror threat is not so much Al Qaeda as it is Eastern European organized crime, and the threat is more centered towards e-commerce (Amazon, eBay, gambling sites) than public infrastructure.

    Al Qaeda wants to perform acts that make people afraid to go to work, not acts that keep them from bidding on Beanie Babies or playing Texas Hold-em. DDos-ing Amazon or Partypoker.com isn't the sort of deadly blow against the infidels that gets them out of bed in the morning. Yuri and Vladimir, on the other hand...

    But the real "cyberterror" threat is the potential US Government overreaction towards any potential threat, real or imagined. Since the early '90s, the government has viewed the Internet as something big, scary, and untamed. COPA, DMCA, you name it, they'll regulate it. Even now, look at the way the Federal Election Commission has been eyeballing political blogs: free speech or political contributions?

    If there's a threat, it'll be from Capitol Hill or 1600 Pennsylvania Avenue, not some cave on the Afghani-Pakistani border.

    k.

    --
    "In spite of everything, I still believe that people are really good at heart." - Anne Frank
    1. Re:Slashdot effect... by thermopylae300 · · Score: 2, Insightful

      I was working at home on 9/11, and yes: CNN was down until they put up a no-graphics static page. Slashdot was up and running just fine.

      Slashdot traffic ranking: 800
      CNN traffic ranking: 24

      During a big news event slashdot's traffic might quadruple, but CNN's would be off the chart. CNN could slashdot slashdot (and most other sites).

      Of the top ten google searches on 9/11 the only one that beat World Trade Center was CNN. 6000 users per minute were using google to find CNN.
      Effects of 9/11 on Google

      --
      Before the invention of eruptions, lava had to be carried down the mountain by hand and thrown on sleeping villagers.
    2. Re:Slashdot effect... by ktakki · · Score: 2, Insightful

      I really wasn't trying to compare Slashdot's and CNN's network infrastructure. I was just trying to make a simple observation. It's obvious that CNN had at least an order of magnitude more HTTP requests than Slashdot did on that day. Same with bbc.co.uk and msnbc.com on 9/11/2001.

      But you have to consider that in 2001 Slashdot's network infrastructure was smaller than that of CNN, the BBC, or MSNBC. And it handled its request load better than the aforementioned web sites.

      I'm just sayin'.

      k.

      --
      "In spite of everything, I still believe that people are really good at heart." - Anne Frank
  21. You're right, but not quite on-point. by clark625 · · Score: 4, Interesting

    Yes, I know that deaths due to terrorism is low statistically-speaking. Honestly, it's not something that I spend awake nights worried about. Overall, I'm probably a lot like you in feelings about the terrorist threat. Statistically speaking, it's so far into the noise that maybe it should be ignored.

    The problem with this way of thinking, though, is that most ordinary people believe that terrorism is not an act of God, and that it is, in some way, a preventable issue. When it comes to auto accidents, ordinary folks want to put controls on those items that can lower the risk of death (preventing DUIs, speed limits, mandatory seat belt laws, etc). It's the same with other deadly issues--like how people want McD's to have healthy choices on their menus because heart disease is so prevalent (now, whether people make good choices is another issue...). Or smoking--how much energy/money has been spent on getting people to stop?

    People can accept deaths. It's a normal fact of life, and it sucks when it hits close to home. It sucks even more when those deaths could have been prevented with simple measures. If a party got out of control and a guy that was totally blitzed got behind the wheel and kills your wife/husband/mom/sis/friend/etc, you'd be pretty darned pissed and that incident would leave a hole inside you that might not ever heal completely. That's reality. Also, you, being a responsible citizen and registered voter, would be so upset and hurt that you just might demand more steps be taken to prevent others from feeling how you do. So, you call your local politian.

    Economically speaking, no deaths are without consequenses. If it's preventable, then it can be calculated how much the solution would cost and how many deaths it would prevent. Those "non-dead" people earn incomes and pay taxes. If those expected taxes are greater than the proposed solution, then we have a winner. Of course, not all decisions are made based on pure economics. Many people are simply willing to pay higher taxes in favor of more safety, just because we like not having to go to our loved one's funerals.

    I do understand what you're saying, and the rational part of my brain agrees. The part that hates going to funerals, though, tells me that if a death can be prevented, maybe we should go out of our way a bit to prevent it.

    --
    Long, cute, or funny Sigs are just another form of over compensation, used by geeks, nerdz, etc.
    1. Re:You're right, but not quite on-point. by Foolhardy · · Score: 2, Insightful
      Economically speaking, no deaths are without consequenses. If it's preventable, then it can be calculated how much the solution would cost and how many deaths it would prevent. Those "non-dead" people earn incomes and pay taxes. If those expected taxes are greater than the proposed solution, then we have a winner. Of course, not all decisions are made based on pure economics. Many people are simply willing to pay higher taxes in favor of more safety, just because we like not having to go to our loved one's funerals.
      Great post. I agree that people's lives should be worth more than what can be calculated, at least for the reason that we can't calculate the total value of a person, even in gross income. People are too complicated for that. People are a critical resource in today's world, and there should definitely be money spent on their safety.

      Once there is a budget for saving lives, the next question is how can it be spent to maximize the amount of lives saved/dollar. Since terrorism is so low on the causes of death, and it's so expensive and difficult to fight, I can't imagine a program of heavy counter-terrorism getting a very good return: not compared to medical research or sanitary infrastructure or even safer car designs. There should be more research on just how effective various government programs that are designed to make people safer, as far as cost per person saved/helped.

      I know it's hard to put things in terms of how many people weren't killed because a certain program prevented it, but that really depends on the individual program: some have easy to measure results and some don't. We should be spending most of the budget on programs that are known to work. Lack of data isn't a reason to put more trust in something; only actual results are. I'm not seeing any real information about how many lives are being saved by counter-terrorism programs either domestic or abroad, by invading Iraq, or by invasive laws like the Patriot Act. I mean, that's the supposed reason for all these things; to make us safer, right? There are real results from new and improved medical treatments, car designs and many other programs. These successful programs are losing the funding that could be saving lives at a higher (and much more predictable) rate to programs that cater to fear.
    2. Re:You're right, but not quite on-point. by shmlco · · Score: 4, Insightful
      "People can accept deaths. ...could have been prevented with simple measures."

      I disagree with that statement. How many times has the "If but one death could be prevented..." mantra been passed around? Too many people expect EVERYTHING to be risk free, and often propose and avdvocate extreme measures to gain that certainty. No matter how absurd the measure might be for the majority of the people. And if CHILDREN are involved? Oh my god.

      Look at all the handwaving currently going on regarding video game violence, dispite the fact that teen violence levels are at the lowest they've been in decades. But no, SOMETHING caused Columbine, and that something must be eliminated.

      And if it can't be eliminated one way, they'll try another. A "defective" product? Sue the company. An unforeseen drug interaction? It's class action time. Some kid jumps off a bridge because a character in a game did so? Obviously, it's time to ban all games.

      We demand perfection, every time, all the time. And if it's not perfect, then someone, obviously, is to blame.

      --
      Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
  22. SIPRNet by GileadGreene · · Score: 4, Informative
    With the resources available to the government, would an alternative "G-Internet" have been infeasible?

    The DOD already operates a separate internet for classified material. It's known as the Secret Internet Protocol Router Network, or SIPRNet. So yes, an alternative "G-Internet" is more than feasible - it already exists.

    1. Re:SIPRNet by Kagura · · Score: 2, Informative

      I've got no idea what you're trying to argue in your last few sentences, but I can assure you that the classification system is not, itself, classified. The meaning of NOFORN (a 'caveat' telling you not to release this information to foreign nations) and any other of the numerous caveats are not classified.

    2. Re:SIPRNet by Ruff_ilb · · Score: 2, Funny

      Gone? Hahahaha.

      That's just what they WANT you to think.

      --
      http://www.TheGamerNation.com/Forums
  23. Computer security is one thing by oztiks · · Score: 2, Informative

    I've seen lots about not probable or not possible but lets look at it this way, how big is the internet? next question how many possible methods of terrorism can exist? some I can think of are; air traffic control (die hard style); automated flood gate control (I've seen HPsUX computers that do this); what about the manipulation of satellites; and affecting train routes, collisions and subway disasters?

    If you really think about it anything technological that requires a computer is at risk to "cyber"terrorism.

    Now okay most of these services are not live on the internet and can't be done in some afghani basement, but on US shores with the proper utilisation of inside Intel of infrastructure, social engineering, etc.

    Looking beyond the simple break down of the technical problems associated with such a threat look at the practical day-to-day ones..

    Makes it a little bit more plausible.

  24. Don't piss off others! by drewzhrodague · · Score: 2, Insightful

    For starters, not pissing off other countries, by having abusive/manipulative policies. I'm sure there are other ways to ward off an attack of any sort, and the easiest way is to not have that enemy in the first place!

    --
    Zhrodague.net - I do projects and stuff too.
  25. Re:Better safe than sorry by Trigun · · Score: 5, Interesting

    No, staying technologically superior makes a lot of sense. Even if it is to fight an enemy that does not exist yet.

    Staying technologically superior is also a form of corporate welfare. Same with war. Without going into the obvious politics of war, was the $30 Billion Shock and Awe phase of the war needed? We could have done just as much damage dropping $10 million worth of diesel fuel and nitrate in 50 gallon drums from cargo planes. But who would that have helped out? Not GE, Lockheed, Boeing, or anyone else who makes high precision implements of death.

    Call me an idealist, call me a purist, but if we rewarded technology for the sake of technology, not for how many people it can accurately kill, then maybe people wouldn't want to attack the U.S. Don't believe that "They hate our freedom" line, it's a lot more complicated than that. If a country acted benevolent, didn't cowtow to corporate interests, and took a leadership role, both in its own society as well as in global matters, as well as (and not just) a moral compass, then do you think that country would be the target of attacks? If the U.S. said that they were going to develop a cure for aids, paid for that, and then licensed out the manufacture of the pharmaceuticals, then do you think that there would be a pissing match with African nations over patent controls?

    Everyone says that technology is not a panacea, but even still, we've yet given an honest attempt to prove them right. We're still all stuck on that greed thing.

  26. What is SCADA? by Anonymous Coward · · Score: 2, Interesting
    What is SCADA?

    Wikipedia article on SCADA

  27. I want my cookie by 920714 · · Score: 2

    357c3435686430372052757c3335 (A cookie for anyone who decodes that.)

    5|45hd07 Ru|35

    And for those that don't speak 1337 - Slashdot Rules

    --
    english is way to easy
  28. So will I by js92647 · · Score: 2, Interesting

    That's another word for the filter, "Cyberterrorism."

    I wonder how this stuff makes news anyway. Soon we'll have these pompeous dicks addressing games like WoW as "Cyber-cocaine," attempting to make it sound as if its addictive as the drug itself. Honestly who the hell comes up with these crappy titles? I mean, these are the same assholes who pulled that "Y2K" scam on everyone, people no different from making "Y2K compliant" appliances, and now, here we are again except we jumped from an alphanumeric word, into a strictly "Cyberterroristic" notion. Let me guess, "This computer is Cyberterror compliant?" Pfft, what a bunch of bs. Even judging from what other people on /. are saying, this stuff shouldn't even be in the news.

    Another thing, what the hell is up with a "Digital Pearl Harbour" ? Last time I checked Pearl Harbour was deliberately planned by the US so they can get back at Japan. Not a hint or anything but these journalists (not to be confused with bloggers) have too much time on their hands when they try to convey what they think is going to happen and accidently forget to read up on history of World War 2. I'll be expecting "Trojan Airplanes" soon enough.

    Nice 0-day "Nightmare" exploit, sounds so fun I might as well run my unix on a backup generator. Great change from September 11, 2001 assholes. You took a regular word and added "Terror[-ism]" to it. Real smooth.

  29. Nightmare Worm already Exists... by woolio · · Score: 2, Funny

    ..."Internet Explorer" by thy name.

    What other application could update itself weekly and be so intergrated with the OS that a complete removal would render the OS inoperable. Makes that Win32 virus that associated EXEs with itself look like child's play.

    Hot-Swapping motherboards??? ROTFL. ROTFL!

  30. Yes, there are critical systems on the Net! by ami-in-hamburg · · Score: 2, Informative

    Ok, maybe flamebait but here goes.

    Yes there are critical systems on the internet. For those of you who think you're so smarty pants, "who would put crit systems out there", what about email? Or B2B? Or electronic trading on NYSE, NASDAQ, etc? Or, or, or.....

    According to a study I read a couple of years ago, and unless this has changed in the last couple years, and I hope it has, there are only about 4 buildings in the US that need to go away and the internet would be virtually gone until they could be replaced.

    A coordinated attack on these facilities could effectively remove all net communications in the US for who knows ho long. I imagine the recovery would take quite a long time.

    1. Re:Yes, there are critical systems on the Net! by The_Mr_Flibble · · Score: 2, Informative

      And there's only one in the uk (which myself and other people have joked about)
      It's in a semi blast resistant building.
      The security guards check your car (sometimes) on the way in and you have to go through security tubes to get in the main building, unless you have a load of large boxes that won't fit through then you can get security to open the lift for you.

  31. Re:Issue arises from flat routing and trusted rout by Floody · · Score: 2, Informative
    it was one of the 'nets darker secrets -- e.g. a handful (or more) of people knew about the security hole

    Considering that my networking professor told the whole class about it, there are more than a handful of people that know.

    For those that don't know, the issue arises out of the way the internet does routing. IPv4 uses a flat routing system. Every key router on the internet knows how many hops away it is from all of the other key routers and which direction the router is in. Consider (the dots are placeholders so slashdot will display my beautiful ASCII art properly):

    [cute but erroneous diagram clipped to avoid lameness filter]

    Router D knows that it is one hop away from router E. B knows that it is two hops from E. How? Because D tells B that it is one hop away from E, so if B sends a packet to D, D can deliver it in one hop. C knows that it is three hops away.

    Now suppose router B goes down. C knows that it can't reach E through its usual three hops, but when it talks to its neighbor to the right, it sees that F can reach E in three hops, so C is now four hops away from E. Now when C sees traffic headed for E, it sends the traffic to F.

    How do you poison the system? If one of the key trusted routers, such as C, tells everyone that they are two hops from everywhere, large portions of the internet will try to route through C. If you can take control of a trusted router in each of several key locations, you can confuse the overwhelming majority of the internet into thinking you are offering the best route to their destination.

    The short route won't make a big difference for nearby traffic, but traffic headed ten or twenty hops away will wind up going towards C when it should go someplace else.

    The above-described mechanism for updating the routing tables is the key to the internet's ability to automatically route around cities that have been destroyed by a nuclear weapon.

    Oh good god, what complete and utter BS. Lest anyone believe this is actually how transit routing works:

    All public ipv4 transit networks in existence use a routing protocol called BGP4 (Border Gateway Protocol v4 - rfc1771). BGP is an "inter-autonomous system" routing protocol. That means, as a whole, it has no network awareness of individual routers, links, specific static addresses or locations. Essentially, all it knows is that a set of ip networks comprise an Automous System (labeled via an ARIN/RIPE/APNIC assigned Autonomous System Number). When a bgp router in one AS has an established bgp session with a router in a different AS, it tells the other router all the foreign ASNs that the network is willing to take traffic for and prepends its own ASN to the front of the list. The same is done for networks that originate within the local AS (i.e. the ASN is appended to "nothing" and is thus respresents the final destination AS) [there is also an origin ASN field, but ignoring that for the sake of simplicity]. This list is known as a bgp path. Thus, to find a route(s) to any accessible ipv4 address, a bgp router need only look at all the paths that contain the destination ASN, and the shortest path is generally the best route (although certainly not always). The actual job of routing packets is handled on a per-AS basis; i.e. each network is responsible for knowing, internally, how best to move packets to all the AS' that are connected to it.

    You will note, however, that the core problem you describe continues to exist in this model, simply not on a per-router basis. If AS999 sends a path such as "9999 701" to all neighboring ASes, they'll believe that a viable route for traffic destined to AS701 is via AS9999, which, given a large major network, could be extremely distruptive.

    However, in reality, this has not been a grave concern for a number of yea

  32. Re:Threat or Not Doesn't Matter by Alioth · · Score: 2, Interesting

    It's not just Tom Clancy who wrote about it - a 9/11 style hijacking actually happened for real in 1994 (using a FedEx DC-10 cargo plane rather than a passenger airliner). The crew managed to overcome their attacker though. There is a very good article about the attempted attack here:

    http://www.avweb.com/news/profiles/182918-1.html

    --
    Oolite: Elite-like game. For Mac, Linux and Windows
  33. Re:Keep the govt out. Decentralize security. by NewToNix · · Score: 2, Interesting
    "The sooner we quit believing that one party or another is interested in freedom, the sooner we have a chance to preserve the dwindling amount of it we have left."

    This has my vote as the best comment ever made on /.

    It's people, not political parties that need to protect freedom - political parties only protect the power of that party - whichever it is.

    I can never decide what sig to wear... so I don't go out much.

  34. Re:Keep the govt out. Decentralize security. by Dr.+Blue · · Score: 2, Informative
    IIRC, the attempts to make key escrow mandatory with Clipper were on Clinton's watch. The sooner we quit believing that one party or another is interested in freedom, the sooner we have a chance to preserve the dwindling amount of it we have left.

    The last comment is right on, and in fact the Clipper project illustrates quite well that neither party can be trusted. The Clipper chip was actually a Bush I administration project -- initiated and developed before Clinton came into office. It was pretty much a done-deal, and it was announced a few months after Clinton took office. So it was developed by one party, it could have been stopped or at least questioned somewhat by the other party, and both parties pushed it forward.

    And the scariest part of it all is that the "voice of reason" at the time was actually John Ashcroft. Yikes.

  35. A simple question: by JPriest · · Score: 2, Insightful
    "Hi I am Joe user and I want to protect myself and my computer on the internet so my system is not used to DDoS critical infastructure. Where can I find a simple easy to understand guide to walk me through securing my Windows box and helping me avoid getting a virus or worm"

    Requirements:
    1. It must be easy for them to understand.
    2. It must be something they will follow (lots of pictures), and not a white paper.
    3. It must be colorful
    4. It must have a goal of educating the user and not taking their money.
    5. I prefer it be securemypc.com rather than joe.blog.com/files/02/05/security101.htm

    I have seen guides with this in mind but they are mostly all crap. The task is not hard and I see people clearly explain it over and over to people on web boards but I have yet to see a _good_ website where I can just say to them "go here http:"

    Certianly if people can spend billions of dollars and have hundreds of orginizations to clean up the damage these systems cause than someone can write a simple to follow guide for the end users that do care...right?

    --
    Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
  36. Re:Keep the govt out. Decentralize security. by patternjuggler · · Score: 2, Insightful

    The sooner we quit believing that one party or another is interested in freedom, the sooner we have a chance to preserve the dwindling amount of it we have left.

    I agree in principle - but it's also kind of unproductive to take the 'long view' and always claim precedent for everything bad going on right now. We don't have time machines, we can't change history- you have to focus on the present and the people who are perpetrating bad things right now. As far as two party politics go, if the elected official does bad enough, then you vote them out, you don't play games with trying to predict the future with what the opposing candidate might do, you focus on punishing the people in office right now who are screwing up right now. If you keep punishing both parties that way long enough, if every official is only there for one term, maybe they'll learn better eventually, or a third party will pop up.

    The other thing is the more examples from history you point out, the further back you go, the more someone is going to think that it all turned out mostly all right so there's nothing to get excited about (even though the reason things did turn out all right back then was because people did get excited and took up arms and fixed it).