BlueSecurity Fall-Out Reveals Larger Problem

mdrebelx writes "For anyone following the BlueSecurity story, sadly the anti-spam crusader has raised the white flag. Brian Krebs with the Washington Post is reporting that after BlueSecurity's announcement, Prolexic and UltraDNS, which were both linked with BlueSecurity through business relations came under a DNS amplification attack that brought down thousands of sites. While much of the focus about the BlueSecurity story has been centered on the question of what can be done about spam, I think a bigger question has been raised - is the Internet really that fragile? What has been going on is essentially cyber-terrorism and from what has been reported so far the terrorist clearly have the upper hand."

Comments

interesting question about fragile

[yagu]

There have been other outages, major, which have had significant impact. It's a good question: is the internet that fragile?

In many ways it probably is. At the same time, the infrastructure seems resilient enough. The world so far hasn't laced up life-and-death critical systems to the internet such that a failure could cause loss of life. Well, that is, if you don't include:

• phone service
• remote network monitoring
• systems support

Oh, wait, I guess people have started doing that.

What mechanisms exist for more than resiliency, i.e., instant self-healing? Could terrorists with a little knowledge and a few well-placed EMP generators disable major segments of the internet?

Unlike phones and the phone networks which were built with lots of oversight and regulation (Universal Service was a big driver for this (aside: now that everything is profit driven, don't expect phone service at that farm house at the end of that long country road anymore... noone HAS to provide it)), I'm not aware of what safeguards back up the internet. In my entire lifetime, I've not one time experienced a phone outage, not once! Power outages, etc., the phone companies have backups to backups to ensure service (though there is the occasional and hard to manage for ditch digging incident).

While large pieces of the internet are built upon the phone companies' infrastructure, other pieces aren't, and there are significant additional layers of complexity not in the phone companies' purview (switches, routers, coax cable from cable companies).

That question, "is the internet that fragile?", is probably the biggest reason I've never opted to switch my phone service to VOIP yet. I'd hate to be the one (tiny chance, I know) who needs to make that one 911 call and not be able to do so because the internet is unavailable (which happens occasionally here, which is also too often).

Re:interesting question about fragile

[FLEB]

Meh, don't make too much of it. I got a fast-busy the last time I tried to call 911... on a landline.

Re:interesting question about fragile

[DarkHelmet]

Doesn't being a terrorist imply terrorizing people?

The only kind of people a terrorist would terrorize by taking down the internet temporarily are people on slashdot.

Terrorists are interested in killing people to get their message across, not inconveniencing them.

Re:interesting question about fragile

[PatTheGreat]

Isn't the whole point of the internet that if one node goes down, you can still communicate through other nodes? Isn't that what made the internet useful?

Re:interesting question about fragile

[stfvon007]

I would think being dead would be a major inconvienence. Anyway with lives actually on the line if the internet goes out ( Such as a failure of a 911 call to go through when its needed via VOIP, or a doctor unable to access a patients medical information at another hospital to know a person has an allergy to a certain medication. People can die due to a DoS attack.

Re:interesting question about fragile

[Sinus0idal]

Yup and with BGP routes would swap over eventually if a link was broken. Unfortunately though, we rely too much on DNS which is a fairly fragile infrastructure to say the least.

Re:interesting question about fragile

[Original Replica]

Doesn't being a terrorist imply terrorizing people?
Traditionally yes, this might be "economic terrorism"(tm) according to the Dept. of Defense terroism is "the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives." This would seem to apply here.

Re:interesting question about fragile

[vanyel]

American Idol was a DDOS attack on the phone system in the early days. It's not limited to the Internet, it's just easier to implement attacks there. Even so, it's conceivable that someone could create a virus that would cause pc's to dial phone numbers somewhere to disrupt the phone system, and could have even been done back in the haydays of bbses. In fact in a minor local incident, I once had the sheriff show up at my door once many years ago when I misconfigured a uucp connection to dial a lawyer's home phone before the other end was ready for testing (thus masking the fact of the wrong phone number). I corrected it while he watched and that was the last I heard of it fortunately ;-)

Re:interesting question about fragile

[0xC2]

"Terrorists are interested in killing people to get their message across, not inconveniencing them." Totally wrong. Why do you think the most secure facilities in the world are the oil refineries? Terrorists absolutely love to take out pipelines, interrupt utilities, railroads, etc.. Look at the attacks on the Christian stores in Bagdad selling liquor. The affected people are also much more likely to blame the government for failing to protect services taken out by these attacks. For the money we have spent so far fighting "terrorists" we could have saved tens of thousands of lives, just by building safer, more expensive cars. from http://www.scienceservingsociety.com/p/141.htm : More than a million people are killed on the world's roads each year, the victims overwhelmingly young. In the United States more people die in a typical month in traffic crashes than died in the September 11 terrorist attacks. And for every fatality in a traffic crash, about 40 injuries occur, many of them severe. These traffic deaths and injuries include those among pedestrians and cyclists, as long as a motorized vehicle was involved. The number of traffic deaths worldwide continues to increase as more nations motorize. In the United States the number of traffic deaths has remained relatively constant at about 41,000 per year for the last decade. The economic impact of terrorism is much larger than its mortal impact.

Re:interesting question about fragile

[Morrigu]

Imagine the economic impact if you "broke the internet". Even just cutting off some vulnerable bits for a while could do a lot of monetary damage.

I wouldn't be so concerned with the 'Net as a primary target of terrorism or deliberate hostile acts, but I think it could be a viable secondary target. Coupled with attacks on physical bottlenecks (Panama or Suez canal, the straits of Gilbraltar, the Malacca Straits, the Bosporus, any of the top 5 major ports in the world) a small nation-state or well-funded terrorist group could have a huge economic effect.

Or it might be part of the collateral damage from a larger attack on a specific country. Taking out telecoms, underwater cable landing sites and satellite uplinks is part and parcel of damaging a country's C4I infrastructure. Any bits traversing those links (or neighboring ones which suffered damage as well) to or from the Internet would just be civilian casualties, in a matter of speaking.

Re:interesting question about fragile

[paedobear]

No, they are interested in terrorising people, that's why they're called terrorists not killorists.

Re:interesting question about fragile

[Rekolitus]

There's this program available for Windows called FastCache which has been more than handy when my ISP's DNS servers have gone down and so forth. You use it as a nameserver by setting your DNS addresses to localhost, and it caches entries for several days.

It's not something you typically thank every day, but when for whatever reason DNS fails for me, it's a lifesaver.

Does anyone know of equivalents of this on Linux/Mac?

Re:interesting question about fragile

[TubeSteak]

That question, "is the internet that fragile?", is probably the biggest reason I've never opted to switch my phone service to VOIP yet. I'd hate to be the one (tiny chance, I know) who needs to make that one 911 call and not be able to do so because the internet is unavailable (which happens occasionally here, which is also too often).

By law, any phone line has to be able to dial 911. Even if you have no telephone service.

If the phone line is connected to the box outside, you can get a dial tone & 911. If not... I'm sure there's a number in the phone book to call & get it sorted out.

Re:interesting question about fragile

[X0563511]

http://www.opennic.unrated.net/public_servers.html

Don't rely on your ISP's DNS.

Lots of times my ISP's DNS has gone down and opennic has saved the day. Of course, they can go down too, but usually ONE of the two work.

Re:interesting question about fragile

[evanism]

So... your whole sentence relies on the word "unlawful", so it would specifically preclude attacking a country such as Iraq?

Re:interesting question about fragile

[Anonymous Coward]

The trouble is, that - the availability of public recursive DNS servers, along with the easy spoofability of UDP and asymmetry of the response packets to the request packets - is the exact modus operandi of the DNS amplification attack.

Re:interesting question about fragile

[Anonymous Coward]

pdnsd works well for me for UNIX machines.

Of course, you could use BIND or any other full-blown nameserver, but pdnsd is pretty low-overhead to setup and administer.

Re:interesting question about fragile

[Eivind]

according to the Dept. of Defense terroism is "the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives."

But that "definition" is useless. If you use that then pretty much all violent crime is "terrorism". If I threaten to hit you on the nose unless you hand over your wallet, I'm clearly trying to coerce you by threathening use of unlawful force.

That's not congruent with the common use of the word. That definition of "terrorism" migth be convenient to the dept of defence, because it means that they can label pretty much anyone who oppose them a "terrorist".

I would argue that a necesary condition for labeling something terrorism, is that the action is intended to and suitable for inducing terror in groups of people. Dumping plutonium in the water-supply qualifies. Crashing a jet into a skyscraper qualifies. Smuggling a nuke into the superbowl qualifies.

Threathening to hit you on the nose, however, does qualify as a mugging. But not as terrorism.

Re:interesting question about fragile

[mcrbids]

I haven't used my ISP's DNS for years now. When I'm in a bind and need DNS, I just start named on my local system, and change /etc/resolv.conf so that my nameserver is 127.0.0.1.

Fedora has come with Bind preconfigured for caching DNS for a long time - just `yum install bind` and then start it.

Voila!

Why would I bother with the ISP? I don't even know what the IPs are.

Re:interesting question about fragile

[jacksonj04]

Interestingly, same for mobiles even without SIMs. If the handset is capable of talking to any network, it should be able to dial emergency calls.

Re:interesting question about fragile

[Fred_A]

All of the Linux major distributions come with a prepackaged caching configuration of Bind. It can indeed come in handy. I used it for years before I switched to the full version.

Presumably it should be fairly easy to setup for MacOS as well (if it doesn't come with it already, I haven't checked).

Re:interesting question about fragile

[aybiss]

This is why any VOIP box falls back to a landline when it can't connect. One could argue this feature was added to keep businesses running rather than save lives, but either way we aren't quite THAT stupid.

Re:interesting question about fragile

[edxwelch]

Unfortunately Fastcache doesn't work on Windows 2000, becuase the network configuration dialog won't let you enter 127.0.0.1 for DNS server.

Re:interesting question about fragile

[bhiestand]

That question, "is the internet that fragile?", is probably the biggest reason I've never opted to switch my phone service to VOIP yet. I'd hate to be the one (tiny chance, I know) who needs to make that one 911 call and not be able to do so because the internet is unavailable (which happens occasionally here, which is also too often).

To begin with, I'd say there's more inherent redundancy in the internet than there is in PSTN. That being said, you don't need a phone line subscription to call 911. You can cancel your service, leave a big red phone plugged in, and use it to dial 911 at any time. The same should be true of cell phones, at least in the US. I'd also recommend keeping a WIRED phone plugged into your PSTN line. You're a bit more likely to need to use the phone for emergencies when the power is out due to things like tornados, strong storms, earthquakes, etc.

Re:interesting question about fragile

[mwlewis]

So what's the "political, religious, or ideological objective" involved in getting your wallet? Seems more financial to me. In practice, 'terrorism' is a slippery concept, but I think that's one of the better definitions I've seen. It's not just the act, but the motivation and desired end-state of the actor that makes something terrorism.

Re:interesting question about fragile

[Eivind]

The definition said "often" with a political, religious or ideological objective

I agree the definition would be marginally better if it removed that word, atleast standard muggings would no longer qualify. A definiton of terrorism which leads to all violent crimes being terrorism is useless. (unless you want to justify anything and everything as "war against terror")

Re:interesting question about fragile

[MikeB0Lton]

Do we need safer cars, or safer drivers? I'm convinced that if the crappy drivers get off the road, we wouldn't need safer cars to protect us!

Re:interesting question about fragile

[FireFury03]

Unfortunately though, we rely too much on DNS which is a fairly fragile infrastructure to say the least.

DNS is only fragile if the people running the authoratative servers are lacking in the clue department.

There are a lot of root nameservers and many of them are anycast addresses (so there are actually a lot more than there appear to be at first glance) - so the root nameservers are pretty robust, you'd struggle to take all of them out.

So then we come down to the TLD nameservers (e.g. the ones authoratative for .com, .co.uk, .org, etc.) - if the organisations responsible for running these put plenty of servers at a reasonable number of geographic locations then they are pretty safe.

The bigger problem is the people running the nameservers for the individual domains - too many people only have the mandatory minimum number of nameservers (2), and in many cases both of these servers are connected to the same piece of ethernet cable so it's not a great stretch of the imagination to imagine them both becoming unreachable. This problem is solvable - simply put in more, geographically spaced name servers. DNS was designed to allow this. Of course it costs a bit more money, but resilliance always does.

Re:interesting question about fragile

[jahudabudy]

His definition stated force or violence against individuals or property to coerce or intimidate governments or societies

Note that the force (or threat) is to individuals or property, but the goal is to coerce governments or societies. A mugger is only attempting to coerce the individual the threat is against. If I say "I will kill you if you don't do what I want", I am not a terrorist. If I publish a video of you bound and hooded, and say "I will kill this person if the US government doesn't do what I want", most people call that terrorism. The only real difference is in what I want, which determines who I have to coerce. If I want your wallet, I only have to coerce you. If I want American troops off of Saudi soil, I have to coerce Uncle Sam.

Re:interesting question about fragile

[grimwell]

But that "definition" is useless

Depends on what you wanted to do with said definition. By creating a broad definition of terrorism, politicians can gain popular support for new powers/laws to "fight terror" and then those powers/laws can used in a very broad way. i.e. the popular support's idea of terrorism is going to be narrower than what is actually being used.

Threathening to hit you on the nose, however, does qualify as a mugging. But not as terrorism.

Depends on how badly the gov't wants to screw you over. Maybe the act will earn you the "enemy combatant" label.

Re:interesting question about fragile

[richlv]

hmm. most if not all linux distributions come with a nameserver, usually - bind.
the functionality you describe is that of a very simple caching dns server, so - yes :)

Re:interesting question about fragile

[Da_Weasel]

It's newspeak...duh! That's why you can't peg down a meaning. It could mean anything. What ever is most convenient for Big Brother at the moment. I wonder if Guantánamo has a Room 101...?

Re:interesting question about fragile

[Proteus]

Don't rely on your ISP's DNS

Better yet, don't rely on any one organization's DNS. Configure your network connection to use multiple DNS servers from different organizations; or, even better, run your own caching nameserver (it's really not that hard) that turns to several different organizations for resolving unknown or old records.

For example, I have a simple BIND setup on my PowerBook (and my wife's iBook) that is caching-only, and resolves to my ISP's primary DNS and two alternates provided by geographically disparate organizations. My total set-up time was 20m for the first install, and then about 3 minutes for the second (cloned config instead of writing it).

On my home network, I use a special-purpose caching nameserver package on my Linux-based fileserver, and DHCP instructs machines on my network to use that server for DNS. It, too, has multiple DNS sources to resolve against.

Re:interesting question about fragile

[jamiesan]

That definition says Governments or societies. One person is neither a Government or a Society. If you attack/threaten one person for his wallet, that's not terrorism. That's just a mugging.

Re:interesting question about fragile

[h4ck7h3p14n37]

A good friend of mine works for a telephony company that offers call push services; if you're not familiar with the term, it involves calling a list of numbers and playing a pre-recorded message. Using an early implementation of their application, they managed to knock several small towns (and their 911 service) off of the phone network. The application didn't anticipate the possibilty of overloading a central office and just dialed the telephone numbers in order. The company actually had more bandwidth than some small towns, so they'd effectively tie up every line.

Re:interesting question about fragile

[Anonymous Coward]

I agree. definitions can be misleading. e.g., see http://snooks.urbanup.com/1302456

http://www.urbandictionary.com/define.php?term=sno oks

Re:interesting question about fragile

[Blakey Rat]

Could terrorists with a little knowledge and a few well-placed EMP generators disable major segments of the internet?

Terrorists with a single crate full of dynamite can take out the power grid of half the nation with a coordinated attack against rural high-tension lines. Most of those rural lines go weeks in-between inspections-- even a single terrorist with a cell-phone trigger could wire up a half-dozen towers in only a few days and set it off from Puerto Rico at their leisure. The odds of well-placed dynamite being noticed on those towers in the course of an average week is slim to none.

Worry about that. The internet relies on the power grid, not the other way around.

Re:interesting question about fragile

[Philosinfinity]

Your ability to stay off topic is remarkable.

Re:interesting question about fragile

[LunaticTippy]

I've wanted to destroy that company. Thanks for reminding me to get on that!

I got about 100 of them last election season, and I fear it will get a lot worse. You can't talk to anyone, you can't get off their list, and they are immune to the no-call list because they're non-profit or political.

Re:interesting question about fragile

[LunaticTippy]

Osama bin laden said that the 9/11 attacks were designed to harm our economy. How is that different from mugging?

Is a mugger not a mugger if he wants society to be different?

Re:interesting question about fragile

[LunaticTippy]

We can deduce that our society produces 41,000 unsafe drivers per annum.

If we could somehow accelerate the fatality rate we'd be able to reduce the death toll eventually. Plus, if unsafe driving has a genetic factor we may be able to reduce it permanently!

Re:interesting question about fragile

[hesiod]

> doctor unable to access a patients medical information at another hospital to know a person has an allergy to a certain medication

You SEVERELY overestimate the interconnectivity of hospitals. In fact, if they are not in the same Health System (same company), it's pretty rare to have patient information transferred over the Internet on-demand, ever. There are so many different Clinical Information Systems on the market, and few (if any at all) of them have a method for transferring data between them*. Some have WWW-based CISes, but if the doctor isn't a member of that facility, they can't log in to view the patient info. Information like that is usually faxed or spoken over the phone, if it isn't on file locally.

Even ignoring all of that, why the hell would a hospital have their network open like that to even allow the POSSIBILITY of a DoS reaching their PCs?

All in all, if a patient's life is put in any danger at all due to a network outage (besides sending Digital Images of MRIs, CATs, etc for offsite reading) they do not have sufficient staff on-site to call themselves a hospital.

* This doesn't consider HL7, which is not meant to transfer patient info like that.

Re:interesting question about fragile

[LunaticTippy]

Hm, so a non-cell person could keep a phone with no service handy for emergencies? Interesting indeed!

Re:interesting question about fragile

[legirons]

"Could terrorists with a little knowledge and a few well-placed EMP generators disable major segments of the internet?"

You misspelled "backhoe"...

Re:interesting question about fragile

[petermgreen]

isn't 911 supposed to have dedicated rescources allocated to stop just that issue?

Re:interesting question about fragile

[petermgreen]

ultimately you are still relying on the root servers and then whatever servers like in the path to the authoritive server(s) for the name your interested in.

Cached info might buy you some time (which is an advantage to this method over running your own recursive resolver) but its not gauranteed to and your method carries a far higher risk of getting deliberately faked info than running your own dns recursive resolver.

Re:interesting question about fragile

[petermgreen]

and in many cases both of these servers are connected to the same piece of ethernet cable so it's not a great stretch of the imagination to imagine them both becoming unreachable

but if the only hosts in that domain are on the same peice of ethernet cable does it really matter if the dns goes down at the same time as the machines it points to?

Re:interesting question about fragile

[petermgreen]

I've not one time experienced a phone outage, not once!
then your damn lucky.

the big issue with POTS (and any service that uses POTS wiring such as ISDN and DSL) is if a big multipair gets severed it can take them a LONG time to fix. With mains you have a maximum of 5 connections to make in a severed cable (L1, L2, L3, neutral and earth). With cable TV networks you have to do a coax join. With pots wiring you may have to join HUNDREDS of cores which may not even be color coded depending on the age of the wiring requring engineers to put a test signal on one pair at a time (both from the exchange and from remote distribution points) that can be detected with equipment carried by the repair team.

DSL certainly goes out more than POTS though and at least in the uk its pretty well impossible to do anything about it you just have to wait until it comes back up again. I've no experiance with cable so i can't say if its better or worse.

Re:interesting question about fragile

[evanism]

Your ability to actually post nothing but criticism is even more remarkable.

Yes, the internet is that fragile

[drinkypoo]

It seems like every week there's a new issue with DNS. Why can't DNS be secured? Is it just inertia? Is BIND really that pathetic, or are they just not using it correctly?

Re:Yes, the internet is that fragile

[__aaclcg7560]

Like everything else in the computer world, you have to wait for the next great upgrade of the Internet called Web 2.0! Of course, I'm going to wait for SP1 to come out before jumping on the bandwagon.

Re:Yes, the internet is that fragile

[Anonymous Coward]

BIND when used correctly can foil/hamper these DNS attacks from occuring.
Any tool improperly used can possibly cause problems.
This a proper way to secure a Bind nameserver.
An example would be in your bind named.conf adding an acl section and adding to section options.

//add your trusted networks
acl "trusted_queries" { 127.0.0.1; 192.168.1.0/24; some.ip.network.outthere/8; };
acl "trusted_recursion" { 127.0.0.1; 192.168.1.0/24; some.ip.network.outthere/8; };

options {
allow-query ( "trusted_queries" };
allow-recursion { "trusted_recursion" };
version "no version"; //protect your nameserver version
};
//and for your zones just add allow-query any
zone "some.zone.com" IN {
type master;
file "pri/some.zone.com.zone";
allow-query { any; }; //allow legitimate nameservers to get host info
};

Re:Yes, the internet is that fragile

[Rix]

Web 2.1 is out and ready.

Re:Yes, the internet is that fragile

[BigCheese]

You are a sick man.

Follow the link and you'll know what I mean.

Re:Yes, the internet is that fragile

[Ichijo]

> Is BIND really that pathetic, or are they just not using it correctly?

Here's a performance comparison of the ubiquitous Apache web server with Yaws, an Erlang-based web server. (Erlang is a programming language and virtual machine designed for distributed processing.) To summarize, "Apache dies at about 4,000 parallel sessions. Yaws is still functioning at over 80,000 parallel connections." The author goes on to speculate that the reason Apache dies so quickly is due to limitations in the host operating system.

If Erlang can keep a web server going under nearly infinite load, imagine what it could do for DNS.

Re:Yes, the internet is that fragile

[Pheersome]

Why can't DNS be secured?

Why can't SMTP be secured? What's that you say? SMTP AUTH? That only prevents a specific subset of malicious behavior. Likewise with DNS. "Secured" is a very vague term. There are lots of attacks against different portions of the DNS (root and GTLD servers, authoritative servers for 2nd-level domains, local resolvers, and stub resolvers), and the security measures required are of course going to vary depending on what components you want to protect and from what flavors of attack.

Is BIND really that pathetic, or are they just not using it correctly?

The attack in question is orthogonal to the software running on the servers used in the attack. (I'm sure some of them were running BIND, though.) It's certainly a configuration problem, no matter what software is involved.

Re:Yes, the internet is that fragile

[Anonymous Coward]

To summarize, "Apache dies at about 4,000 parallel sessions. Yaws is still functioning at over 80,000 parallel connections." The author goes on to speculate that the reason Apache dies so quickly is due to limitations in the host operating system.

And he was right. (to summarize: 83,000 sustained parallel connections.).

Re:Yes, the internet is that fragile

[shish]

Those numbers would be much more impressive if they were collected realistically -- Apache is optimised based on assumptions of common usage, so it's no wonder it's less than optimal under their test conditions --> "Each session makes a very slow request to fetch a one byte file from machine 1. This is done by sending very slow HTTP GET requests (we break up the GET requests and send them character at a time, with about ten seconds between each character)."

Re:Yes, the internet is that fragile

[Anonymous Coward]

It's not DNS that's causing this. DNS multiplication attacks are just one way of generating traffic from many IPs to one IP. The underlying problem is inherent to the design of the internet: The internet is built on the premise that the network need not concern itself with flow control. Packets are routed to the target address regardless of the state of the recipient. If at some point there isn't sufficient bandwidth, packets are randomly discarded. The sender is responsible for throttling the stream of data when higher protocol levels indicate that the recipient or the network in between can't handle a higher rate. All packets are equally worthy of being transported and there is no way for the communication partners to instruct the net to allocate bandwidth to a connection. This design is called "dumb network, intelligent edge" and has worked well so far. The problem with this design is that it requires the cooperation of an "intelligent" sender. If the sender is dumb or malicious, the recipient can't control the flow of incoming data. The recipient can't tell the network to filter or deprioritize certain packets, not even at the next hop, but certainly not all the way towards the malicious/dumb sender. Interventions can only be performed manually, which means they are limited to special cases. The feasibility of defense depends on the number and type of senders. So, if you can cause a huge number of senders to behave in a dumb way, for example with DNS multiplication attacks, then the recipient can't automatically control the flow of incoming data and manual intervention becomes costly or even impossible if the target is supposed to stay on the net. In order to change this, one would have to fundamentally alter the way the internet works and it's not at all clear that there aren't equivalent attacks on "intelligent" networks.

Re:Yes, the internet is that fragile

[ynohoo]

If Erlang can keep a web server going under nearly infinite load

Hey, infinity is just around the next corner, I know it! We're nearly there!

Re:Yes, the internet is that fragile

[Stellian]

If Erlang can keep a web server going under nearly infinite load...

Great, the language troll. No, I'm not new here.

Nuclear Warheads are not Internet Appliances

[loose electron]

It is with deep hope that the federal government does not control our defense strategies over the internet.

Of course, with the open sourse strategy and all of its strengths, that might be an improvement.

Enough said...

Re:Nuclear Warheads are not Internet Appliances

[Anonymous Coward]

How about a nice game of chess, Professor Falken?

Re:Nuclear Warheads are not Internet Appliances

[Ohreally_factor]

Actually, Open Source Nuclear Weapons is an interesting idea. If every man, woman, and child could carry around their own personal nuclear warhead, I think we as individuals would become much more polite in short order. We'd also care a lot more about our fellow man, since we wouldn't want anyone to become too upset. Injustice would become a thing of the past.

Re:Nuclear Warheads are not Internet Appliances

[Ohreally_factor]

Oh, I forgot to footnote. The idea is stolen from a Bruce Sterling short story. ("The Sword of Damocles" in Globalhead)

Re:Nuclear Warheads are not Internet Appliances

[Random_Goblin]

If every man, woman, and child could carry around their own personal nuclear warhead,

Now timmy I know johnny took your toy truck, but that's no reason to go pressing the button? is it timmy? timmy?

motivation

[OffTheLip]

As much as Slashdot and other white hat leaning movements fight the good fight the motivation of the 'ememy', perceived as terrorists, spammers, greedy bastards or script kiddies test driving internet mayhem will continue to have the upper hand. The wild west metaphor often describing the lawlessness of the internet is real. As much as we hate the NSA and other invasive orginizations they impose structure and laws. Chaos is the alternative.

Re:motivation

[vertinox]

As much as we hate the NSA and other invasive orginizations they impose structure and laws. Chaos is the alternative.

Emperor Palpatine, is that you?

Re:motivation

[Rob T Firefly]

As much as we hate the NSA and other invasive orginizations they impose structure and laws.

No, they don't, because they can't. The world's governments can't control anything except what those under their own jurisdiction can and can't access of the real Internet outside, the extreme of which we see developing in China. If what you want is a nationwide Intranet under Government control with only superficial resemblance to the real thing and the appearance of "structure and laws," there's your business model.

Re:motivation

[Jah-Wren Ryel]

As much as we hate the NSA and other invasive orginizations they impose structure and laws. Chaos is the alternative.

I don't know where you got the idea that NSA's activities have done anything to "impose structure and law" on the Internet.

If anything, the NSA has been actively participating in the chaos by going ahead and doing their own thing with no regard to the law.

Re:motivation

[Anonymous Coward]

"As much as we hate the NSA and other invasive orginizations they impose structure and laws. Chaos is the alternative."

So, in your opinion, there are apparently only two choices in this world:

1) Chaos
2) "NSA and other invasive orginizations" [sic]

Ever heard of a "false dichotomy"? You definitely win the prize for that one.

Re:motivation

[TheRecklessWanderer]

The cost of freedom is eternal vigilence. They good guys have to win all the time. The bad guys only have to win once. It's sad, but it's true.

Re:motivation

[dbIII]

As much as we hate the NSA and other invasive orginizations they impose structure and laws.

I thought the idea of the NSA was that they don't have to obey the law.

Re:motivation

[ScrewMaster]

You're wrong. Lawmakers impose laws, not government agencies, and when they're doing their job properly they pass laws that keep dangerous organizations like the NSA in check. They've been rather lax in their duties lately ... certainly Congress has largely fallen down on the job. The problem is that too much of our current government has been infected by the disease of unaccountability. They do whatever the Hell they please in the name of "homeland security" or "antiterrorism", and there's nobody left to tell them to stop.

I would further submit that America was far less chaotic in the good old days when big government wasn't so big, wasn't so invasive and tended to leave its citizens alone. It isn't necessary to have a government that restricts and monitors its citizens to the degree that ours is doing for the purpose of achieving a stable society. In fact, the imposition of excessive control, coupled with erratic enforcement, creates instability! This is variously called "political unrest" or "social protest" or, when carried to the logical extreme, "rebellion". Furthermore, it is the kind of thing Americans do when they're pushed too far. At least, I hope it's still the kind of thing we do. It's about the only hope we have left. The way things are in D.C. nowadays, it's pretty obvious that while the lights are still on there's nobody home.

The Wild West aspect of the Internet, which seems to disturb you to some degree, is precisely what makes the Internet the greatest advance since the invention of fire, the wheel and air conditioning! The economic, scientific and cultural benefits of the Internet, as it is today, far far outweigh the dark side. Reducing the Internet experienced by ordinary people to a bland, "civilized" mix of email and heavily-filtered browsing would take away the power, freedom and utility so many people have come to expect and enjoy. It would also largely eliminate innovation and the development of new technologies, as no-one would be allowed to do anything not approved by the powers-that-be. Huh ... I think I just described AOL.

Re:motivation

[herbiesdad]

and what law is that? what law, specifically, has been broken?

Re:motivation

[Jah-Wren Ryel]

and what law is that? what law, specifically, has been broken?

Title III of the Electronic Communications Privacy Act -- also known as the Pen Register Act.

The Pen Register Act requires that law enforcement obtain a court order from a judge before using a pen register or trap and trace device for surveillance.

The terms "pen register or trap and trace device" refer to a device which records or decodes dialing, routing, addressing or signaling information transmitted by an instrument or facility from which a a wire or electronic communication is transmitted.

Re:motivation

[IAmTheDave]

The wild west metaphor often describing the lawlessness of the internet is real.

Not entirely. Back in the "lawlessness of the wild west" anyone caught doing anything like this would be strung up by the neck. Now when someone tries to do something about these sorts of attacks (like Lyco's screensaver) there is an uproar about stooping to the same low and "maybe" breaking some laws while doing so.

If years and years and years of war have taught us nothing, it is that nothing is free and fire must be fought with fire. Unless we go after those attacking us with the same tactics, we're powerless against them and BlueSecurity like closings will continue as cyber-terrorism continues unabated.

The fact that these guys won this battle will only embolden them to continue along the same path, and we all suffer.

It's anagolous to if we had sat on our hands and not declared war on Japan after Pearl Harbor. Stop bowing down and declare war already. They have, why won't we?

Re:motivation

[Anonymous Coward]

As much as we hate the NSA and other invasive orginizations they impose structure and laws. Chaos is the alternative.

Emperor Palpatine, is that you?

Sounds more like Mussolini. He did, after all, keep the trains running on time.

Re:motivation

[jforest1]

"I would further submit that America was far less chaotic in the good old days when big government wasn't so big, wasn't so invasive and tended to leave its citizens alone. It isn't necessary to have a government that restricts and monitors its citizens to the degree that ours is doing for the purpose of achieving a stable society."

What, like when Teddy R. starting shipping Japanese to camps, the gov. matched holiwood's stride in film-releasing by pumping out pro-war propaganda, and censored the media from airing anything that would give rise to negative opinions about the war; so that we could win no matter what? This is the level of sacrifice that those of the baby-boomer and post baby-boomer generation have not realized is necessary to uphold the freedom so lavishly offered since after WWII. We are in a war, both physically and culturally, and the sooner we realize it, the sooner we can win it and get back to our lavish lives.

Re:motivation

[ScrewMaster]

My point exactly. World War II, and the tremendous expansion of government powers that invoked, are most directly responsible for the current state of affairs. However, in my previous comment I was referring to the two hundred years prior to that conflict, where we were a relatively insular nation and hadn't yet experienced the dubious benefits of "big government". So I stand by my remarks.

Question

[Anonymous Coward]

I thought "cybersecurity" was a really big deal lately, right? Why isn't anything being done about this? Isn't this predicament the exact sort of thing that all these restrictive "cybersecurity" laws and enforcement groups are supposed to be dealing with?

Maybe I'm just cynical but somehow, I get the feeling that if this entire situation were a warez group punitively DOSing the MPAA offline, instead of a spam group punitively DOSing an anti-spam group offline, the federal government would have "dealt with" the problem already...

not terrorism

[Anonymous Coward]

you're mixing up something here. this has nothing do to with terrorism, this is ordinary crime.

Of Course

[Shadow Wrought]

It is far easier to tear something down than it is to build something up. Regardless of the Internet, that's just the way things work.

Re:Of Course

[Anonymous Coward]

So who is "Phramamaster" or whatever his name was, then? I seem to remember the last few spammers who ended up being posted on Slashdot finding reverse-spam surprisingly annoying when they were burried in catalogs and other such harmless pranks.

If this guy's anonymity were broken, I have to think that something could be done about him in true, distributed Slashdot fassion...

Re:Of Course

[Grrr]

It is far easier to tear something down than it is to build something up

Except debt.

Regardless of the Internet, that's just the way things work.

You're right, dang it. My "e-debts" are just as persistent.

<grrr />

Terrorism too strong a word

[muhgcee]

I don't think this quite falls into terrorism:

The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons. (http://dictionary.reference.com/search?q=terroris m)

Re:Terrorism too strong a word

[Joe U]

It's a little strong, but it does fall into the definition.

The use of force (taking down servers) by a group (spammers) against people/property (blue & others) with the intention of intimidating socieities (blues users) for ideological (financial too) reasons.

Re:Terrorism too strong a word

[Ant P.]

Um, that definition looks like a completely accurate description of it to me.

Re:Terrorism too strong a word

[Cheapy]

How does that not?

It's a specific group against another specific group to intimidate the first group into not doing something they believe in.

Re:Terrorism too strong a word

[IamTheRealMike]

You're right. This is just plain old organized crime. And like all criminals, the "free ride" only goes on so long.

Re:Terrorism too strong a word

[Anonymous Coward]

I think that a slightly better deffinition of it would be

"The use of any extranormally violent act, by a group, designed to induce fear in a group which is larger than the immediate victims for the purpose of influencing that group to bring about political goals"
 
... I recently wrote 5000 words on this for my degree so I thought I might as well use it for something useful (it does take into account all the main theories matter)

Re:Terrorism too strong a word

[vux984]

It's a specific group against another specific group to intimidate the first group into not doing something they believe in.

Gotcha - of course by that definition:

al quaeda = terrorists
pro-life protestors = terrorists
school bullies = terrorists
NSA = terrorists
George W. Bush = terrorist
FBI = terrorists
PETA = terrorists
Greenpeace = terrorists
Patent trolls = terrorists
China = terrorists
Microsoft = terrorists
UN = terrorists
MPAA/RIAA = terrorists

Re:Terrorism too strong a word

[Cheapy]

Exactly!

In all honesty, I see your very valid (and true) point.

Re:Terrorism too strong a word

[MightyYar]

Whether or not it could fall into that definition, there is a better word to use: extortion. This is just an electronic version of what the mafia does. Most people don't watch "The Godfather" and think, "Terrorists!".

Re:Terrorism too strong a word

[Feyr]

you nailed it right in, lets add a few more though

MADD= terrorists
Unions= terrorists
Governments= terrorists

Re:Terrorism too strong a word

[DavidTC]

It's only extortion if they demand money to stop, or not start it.

Terrorism, however, is when you commit apparently random illegal acts against 'supporters' of something, in hopes they will influence it to stop. The key is that you cannot possibly harm everyone, or even enough people to change anything...instead, you are hoping they will become so afraid of you in that they will demand the changes you request are made, or at the very least stop supporting the entities you dislike.

Attacking a single antispammer can't and won't do anything. However, it will make people hesitant to support them, it will make hosting companies hestitant to host them, and it has the undertones 'And maybe if you oppose us, we'll come after you next'.

This is the defination of terrorism. This is the lynching of one black man who voted, this is the beating of one man who didn't pay off his bookie, this is trashing one store that refused to pay protection money, this is the blowing up of one building, this is the sniper picking off one collaberator. The act alone is almost completely negligable, but the intent is to scare people into not doing or supporting what that entity did. Terrorism.

Re:Terrorism too strong a word

[DavidTC]

Actually, government are terrorists when they 'make an example' out of a criminal. That's kinda the whole point.

Terrorism's gotten a rather bad rap these days. It's just a tactic. It's used 'legitimately' against occupying armies, for example.(1) Don't try to wipe them out...just scare people into not supporting them by killing a few people who do. And don't go after the soldiers...go after the policy makers and leaders. They can always get more soldiers, but if you kill every single person who occupies a certain position, soon no one will want to do that.

1) Depending, of course, on whether or not you think the occupying is legitimate or not.

Re:Terrorism too strong a word

[DavidTC]

I would argue that the word 'random' or at least 'apparently random' should be in there. And instead of 'political goals' I would say 'policies'...there have been religious terrorists. Religious in the sense of 'Change the tenants of our religion', or 'Don't you dare change the tenants of our religion', I mean. (The Inquistion was basically 'organized terrorism'.)

In fact, you can argue that Al Qaeda isn't solely looking for political goals, per se. Yes, yes, they want no support for Israel, but some of it is they don't agree with some parts of 'western civiliation' and would like us to change our philosophy.

Re:Terrorism too strong a word

[barefootgenius]

"What has been going on is essentially cyber-terrorism and from what has been reported so far the terrorist clearly have the upper hand."

WTF! Its all terrorism people! Graffiti, spammers, littering, smashing a window. Where does it stop. I hope to hell the poster isn't an American, because I would consider overthrowing a country with no evidence and then murdering tens of thousands of people to establish your military dictatorship a hell of a lot more terrorist than Blue security finding themselves in a position of surrender.

Why don't Blue Security, if they are having such a problem with it, trace what attacks they can and force whichever legal authority that is supposed to deal with it, to deal with it. If they won't deal with it, then send them a nice letter saying that you will be redirecting all evidence of future attacks straight to them. Whilst you are at it, collect all the ip addresses of the computers sending the attacks, and start suing people. That will get you some media coverage at least. For the oversea's botnet's, play the homeland security card. American companies are under attack! Defend the economy!

Sorry muhgcee, that wasn't directed at you, it just seemed the right thread to say it in.

Re:Terrorism too strong a word

[identity0]

Ahh, finally I can put my class skillz to good use! :)

I've been actually taking a class on terrorism, from a guy who's very right-wing. One of the criteria for regular terrorism is that it must be by a "non-state actor", for political/religious or other "non-criminal" reasons, and usually must be through unlawful means. There is a separate definition of "state terrorism", which must be judged on a different criteria.

So on your definitons:

al quaeda = yes, obviously.
pro-life protestors = some of them clearly are.
school bullies = no, unless there is a political, religious, or racial motivation.
NSA = no, though they might be going over the line as far as the law is concerned.
George W. Bush = a popular sentiment, but no. As head of state, he has the power to go to wage war.
FBI = no.
PETA = no, though their friends in the Animal Liberation Front are.
Greenpeace = no, though their friends in Earth Liberation Front are.
Patent trolls = no, they're just taking advantage of your stupid legal system.
China = no. Calling a whole country 'terrorist' usually is incorrect. Perhaps parts of their government, but state terror is somewhat different.
Microsoft = no.
UN = no.
MPAA/RIAA = no. I have heard some of their actions might violate the RICO act, but they are still unprosecuted.

Re:Terrorism too strong a word

[Anonymous Coward]

I agree - it's criminal extortion, purely based on financial reasons, no matter how close what the spammers say about "anti"s comes to being considered a "hate crime".

Re:Terrorism too strong a word

[Fengpost]

That is why Ghandi preached civil disobidience!

Re:Terrorism too strong a word

[MarkByers]

MPAA/RIAA = no. I have heard some of their actions might violate the RICO act, but they are still unprosecuted.

So if you aren't prosecuted you can't be called a terrorist?

Re:Terrorism too strong a word

[Eunuchswear]

Rubbish. The second word of the definition is wrong.

Re:Terrorism too strong a word

[Eunuchswear]

Your guy who's very right-wing is full of shit. Ask him where the word comes from, what it's original use was. He has decided to redefine the word for his own politcal reasons. In NewSpeak bad words can't refer to party actions.

Re:Terrorism too strong a word

[Eunuchswear]

I would argue that the word 'random' or at least 'apparently random' should be in there.

Why? Any randomness in the behaviour of real terrorist groups is caused by lack of means rather than deliberate policy. When the IRA placed a bomb they knew what the target was, even if the people actualy killed looked random. When the RAF firebombed Dresden they knew what the target was, even if they didn't know the names of the individual germans killed.

Re:Terrorism too strong a word

[mike2R]

The use of force (taking down servers) by a group (spammers) against people/property (blue & others) with the intention of intimidating socieities (blues users) for ideological (financial too) reasons.

I disagree that these reasons are ideological - the motive is money, even if intimidation is being used. If Al Quida or whoever started trying to bring down the internet, that would be terrorism, but this isn't.

I'm not saying that a criminal can't terroise someone, but I don't think that makes them a terrorist. Terrorists (the ones we have all these new laws to protect ourselves from) are people who believe in a cause, people who have supporters that believe they are freedom fighters. They are far more dangerous than normal criminals, because their cause is larger than them, and even if you kill one you make a martyr who helps recruiting the next.

Maybe we need stronger laws to catch these kinds of criminals, but if so a case should be made for it on the merits. Labling suspected criminals as terrorists and then using existing anti-terrorism legislation to go after them is a very slippery slope IMO.

Re:Terrorism too strong a word

[Fred_A]

It's not extortion since they never asked for anything. It's retribution (or revenge if you like, or intimidation, or making an example).

And I'm not even a native English speaker. Sheesh...

Re:Terrorism too strong a word

[gbjbaanb]

absolutely. In the UK, we have animal rights protestors being moved into the 'definitely terrorist' category after some quite shocking behaviour. Damn right too - terror isn't just about Johnny Foreigner being beastly to us (as one of your other repliees has intimated), buit about anyone who uses terror tactics to achieve some self-obsessed goal.

Re:Terrorism too strong a word

[Just-A-Buck]

It's a little strong, but it does fall into the definition. The use of force (taking down servers) by a group (spammers) against people/property (blue & others) with the intention of intimidating socieities (blues users) for ideological (financial too) reasons.

The use of force (fist in stomach) by a group (school bullies) against people (me, for example) with the intention of intimidating societies (nerds) for ideological (nerds suck) reasons.

Falls into the definition, too, eh?

Re:Terrorism too strong a word

[awehttam]

Anyone who breaths and has a temper...

Re:Terrorism too strong a word

[Hercules Peanut]

Aside from the fact that you left out "Unlawful", this site and an aweful lot of its posters would have agreed with most, if not all, of these. Sadly, the only one that probably doesn't belong i your list is China and maybe the UN. I'm not sure they have broken any of their own laws.

Now that might put the rest into some sort of perspective.

Then again, Americans have always had a history of breaking laws they don't like rather than just changing them.

-- If tomorrow morning the Bundestag adopted a 100-kilometer or 62-mile-an-hour speed limit, virtually every German would obey it the next day. Of course, at the next election they would massacre the current generation of politicians and they would elect The No Speed Limit Party. My understanding is that the American cultural response to the challenge of speed limits is substantially different from the German cultural response. In most of America, a speed limit is a benchmark of opportunity.
N.G.(Full name withheld for fear of being negatively modded on /. for quoting someone politically unpopular with the current modding regime)

Re:Terrorism too strong a word

[14CharUsername]

I guess the definition of terrorism is different from person to person. To me Terrorism is a form of extortion, one that threatens many people and asks for political or social change as payment. George Bush's definition is anyone who isn't on "our side".

I think this can qualify as terrorism since it is threatening many people and demanding that people just accept spam and not fight back. But some people might say that to be terrorism it has to involve a violent act, which this does not.

At any rate they are uising the same methodology as terrorism.

Re:Terrorism too strong a word

[14CharUsername]

They are asking for something. They want people to just accept spam and not try to fight back.

Re:Terrorism too strong a word

[jonwithoutanh]

http://www.google.com/search?q=define%3ATerrorism
http://www.google.com/search?q=define%3AState+Spon sored+Terrorism

Terrorism is defined by the U.S. Department of Defense as "the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives."

The criteria of unlawfulness would generally rule out the prospect of terrorism being practiced by a government as it is the government that makes the laws. It may be practiced by individuals or groups within the government, if their actions are unlawful. Likewise you may believe that the laws enacted by your government are immoral or "evil"; however it does not fit the definition of terrorism. A government's actions may fit the definition of state terrorism or state-sponsored terrorism which as stated by the OP are separate concepts.

Perhaps you want to define terrorism differently; in any case if you want to have a dialogue about something, you first have to clearly agree on the definitions of the words you're going to use, and use the correct words to describe what you're talking about.

Re:Terrorism too strong a word

[MightyYar]

I still think you are stretching. Most people associate terrorism with violence. You are using a broader definition of the term than what is common. In contrast, "extortion" fits what is being done perfectly - especially since the real motivation (for the spammer) here is financial and not ideological.

Re:Terrorism too strong a word

[MightyYar]

You aren't a native English reader either, apparently - TFA says that the spammer had been in contact with Blue via ICQ. He wanted them to stop their activity, or else.

But you are correct that he is also seeking revenge and making an example out of them. I can't possibly know what his ultimate motive is, but I'd bet that it was ultimately financial... that is why I think extortion is a better word. It's the exact same thing that the mafia does - even the revenge and intimidation parts. And unlike the mafia, the spammers haven't used any violence against Blue. Like I said, not many people consider the mafia to be terrorists - most would say they are extortionists.

I just find the word "terrorism" very hard to swallow when there hasn't even been any violence. Even patent litigation would be classified as terrorism if you broaden the definition that far.

Re:Terrorism too strong a word

[shrikel]

Whether or not it could fall into that definition, there is a better word to use: extortion.

I disagree. The spammers here were not asking BlueSecurity for money, they wanted them dead. Gone. Off the net. It's not exactly extortion to say "Die or I'll take care of it for you."

Re:Terrorism too strong a word

[rmerrill11]

Actually, I think that using your (US Defense Dept's) definition of terrorism, George, Bush, the NSA and CIA can be classified as "Terrorists", as the grandparent post posits.

" Terrorism is defined by the U.S. Department of Defense as "the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives."
>"The criteria of unlawfulness would generally rule out the prospect
> of terrorism being practiced by a government as it is the government that
> makes the laws. It may be practiced by individuals or groups within
> the government, if their actions are unlawful. Likewise you may believe that
> the laws enacted by your government are immoral or "evil"; however it does
> not fit the definition of terrorism."

I think that is the point in identifying the NSA, CIA and George Bush as "terrorists" - in that they are engaging in actions that are NOT legal when engaging in domestic spying without a warrant, torturing prisoners, etc. as these activities are not within the law.

The government has the theoretical power to make the activities legal, but Bush and Co. have specifically acted to prevent the larger government from reviewing their actions, and Congress from amending laws to clarify the bounds of legality: According to Bush, EVERYTHING they do is legal, even if it against the written law. According to them, Bush as wartime president supercedes the "law".

For those who interpret the law and American Costitution as written, what they are doing IS NOT legal, therefore it fits under the definition of terrorism.

To sum up - just because a "government" does something, it does NOT make the action "legal". To be legal, it must be done in accordance with the laws written by the legislative branch and reviewed and approved by the judical branch.

Capisce?

Re:Terrorism too strong a word

[Anonymous Coward]

Amen brother!

GreenPeace is and always will be a terrorist organization! "Save a hippie, club a seal today!"

Re:Terrorism too strong a word

[Eunuchswear]

So here we have a word invented to describe the official policy of a state - the French "terror" - which a state has decided to redefine to exclude official state actions and you think we should accept that?

Since when does the U.S. Department of Defense decide what a word means?

Try the third definition Google throws up:

"use of terror, especially the systematic use of terror by the government or other authority against particular persons or groups; a method of opposing a government internally or externally through the use of terror"

Re:Terrorism too strong a word

[DavidTC]

Ah, okay, let me clarify. It's random from the POV of the people being terrorized. Obviously the terrorists would be knowing what they're doing.

Re:Terrorism too strong a word

[DavidTC]

Terrorism is really, somewhat, a form of extortion, it's just a very very indirect form.

Instead of 'Do X or we'll illegally do Y', it's 'If this group of people doesn't do X in general, we will individually do Y to random members of that group, regardless of whether or not that specific person is doing X'.

So in a sense, it's not extortion, as no one can specifically modify their behavior to be safe. (Safe as in 'not considered a target'. Obviously, they can be 'safer'.)The intent isn't to make someone do X, it's to produce pressure on everyone to get everyone to do X.

It is, I guess, societal extortion. The society must do X, or the society will have Y illegally happen to it.

Re:Terrorism too strong a word

[Joe U]

Actually, yes. But we tend to call that harassment.

The difference between the two is pretty much how much fear you are causing the victim.

Yes this was cyberterrorism

[jmorris42]

> What has been going on is essentially cyber-terrorism and from what has been reported so far the terrorist
> clearly have the upper hand.

Yup, and I'd have loved to have seen the US gov use this as a perfect 'live fire' exercise. After all, if they can't stop a few punk spammers how can we have any confidence they could stop a determined attack by the usual terrorist suspects?

Perfect opportunity to test all the phases of response, from tracking the responsible parties all the way to eliminating them. Ok, in this case a SEAL team would probably have to be tasked to capture em instead of just dropping a few bombs on their sorry asses. Or if, as I suspect, the ringleaders are in the US or other western representive nations, just have em all arrested.

Re:Yes this was cyberterrorism

[ScentCone]

Yup, and I'd have loved to have seen the US gov use this as a perfect 'live fire' exercise. After all, if they can't stop a few punk spammers how can we have any confidence they could stop a determined attack by the usual terrorist suspects?

My first reaction is to agree with you, partly just because I'd like to see the full might of our larger teams of spookier cyber-folks brought to bear on the spammers... but I'm thinking that this might be one of those things that would squander the public debut of some of those capabilities. I'd rather that we save such visible displays for when it matters (more). This matters, but perhaps not as much as deliberate attack on larger or more public pieces of the infrastructure.

Re:Yes this was cyberterrorism

[jmorris42]

> I'd rather that we save such visible displays for when it matters (more). This matters, but perhaps not as much as
> deliberate attack on larger or more public pieces of the infrastructure.

No reason to reveal sources & methods just that we DO have the ability to track the asshats back to their mansion/lair/cave/etc. Announce afterwards that while we aren't promising that level of protection to everyone everywhere, that we do intend to pick a few out for future tests AND to make some examples. Be right up front on the making examples angle. Put some fear into em up front and we might not ever have to endure a deliberate attack on major infrastructure. Remember that the best defense is often a good offense.

Re:Yes this was cyberterrorism

[knowl]

Actually if this were aimed at a bigger company I'd be surprised if the current US administration didn't want to jump in to protect the business. Of course they'd hype it as a live fire test and play down the business side.

I don't think the US govn't was ready for this though.....they would need much more warning to do anything useful I suspect, and there's a good chance their idea of useful might be pulling the plug on some of the untrusted foreign networks.

Re:Yes this was cyberterrorism

[ScentCone]

Actually if this were aimed at a bigger company I'd be surprised if the current US administration didn't want to jump in to protect the business. Of course they'd hype it as a live fire test and play down the business side.

Well, gee, we sure wouldn't want to be seen protecting US businesses from foreign attack. That would be unseemly! After all, they're just made up of US citizens, providing jobs, fueling the stock market and millions of people's family investments. Much better to what... convey the impression that government should leave business targets to fend for themselves in the face of a demonstrable attack from overseas? Acting under such circumstances is easier (than acting in deal with a wave of spam from thousands of bots pointed at thousands of mail servers), it goes farther to signal to everyone involved that the economy as a whole is not a workable target.

Pulling the plug on foreign network access is probably not the solution though... but massive DoS against targets ON those networks sure is. Just stop up their pipes so that they can't interact usefully with their botnets.

Re:Yes this was cyberterrorism

[Jedi Alec]

No reason to reveal sources & methods just that we DO have the ability to track the asshats back to their mansion/lair/cave/etc. Announce afterwards that while we aren't promising that level of protection to everyone everywhere, that we do intend to pick a few out for future tests AND to make some examples. Be right up front on the making examples angle. Put some fear into em up front and we might not ever have to endure a deliberate attack on major infrastructure. Remember that the best defense is often a good offense.

A little show of force then? Showing 'm what happens if you mess around with the wrong people? Instill some fear in those chaps. Funny now, that's *exactly* what these guys just did...

Re:Yes this was cyberterrorism

[Eunuchswear]

So you think the US should commit acts of war on the territory of a nuclear armed state in order to stop a DDos attack. Brilliant.

All the guesses about where this is coming from point to the Russian Mafia.

Re:Yes this was cyberterrorism

[Eunuchswear]

It's an Israeli company.

Re:Yes this was cyberterrorism

[IgnoramusMaximus]

All the guesses about where this is coming from point to the Russian Mafia.

Actually, all that would be required is some diplomacy and international cooperation as the Russian authorities, contrary to some insinuations in the West, have no great love of their criminals either. I think maybe even an extradition process could be effective here.

Then on the other hand, I just realized what I am saying: diplomacy? international cooperation? Bush administration?

Oh forget it.

Re:Yes this was cyberterrorism

[ScentCone]

It's an Israeli company.

Great, then screw 'em, all the more so. Of all people, the Israelis should know better than to harbor that sort of trash on their local infrastructure. I have no problem using a little pressure to remind them why they should put a thousandth of the energy they put into tracking down Hamas-financed suburban missle attackers and stamp out the local spam twits. That is, if they want to maintain their image as the primary bastion of democracy, rule of law, and more-or-less sensibility in the middle east.

Re:Yes this was cyberterrorism

[Anonymous Coward]

Yay! then they can send Mossad after them, there'd be a good chance they'd actually blow up the right spammer :-)

Re:Yes this was cyberterrorism

[Anonymous Coward]

Um, Blue Security (the target of the attacks) is an Isreali company. The best guess as to their attackers is that they were Russian mafia.

Re:Yes this was cyberterrorism

[ScentCone]

Um, Blue Security (the target of the attacks) is an Isreali company. The best guess as to their attackers is that they were Russian mafia.

All right then, screw THEM, instead! I'm actually NOT surprised that the Israelis' own security apparatus would leave this in a hands-off mode, since the last thing they want is more people harboring conspiracy theories about them wanting to take over the internet, blah blah. The (sub) thread was really about the US inte/counter-terror types trotting out (or not) countermeasures against people like the Russians you mention... and whether that would "feel" right or not when the target is a particular company versus, say, public infrastructure.

Re:Yes this was cyberterrorism

[Eunuchswear]

Nah, they'd just pop some innocent waiter with a russian accent.

weakest link

[brenddie]

well the internet is as strong as the weakest link, and guess what OS that link is..
None of those attacks (DOS) could have been done without the use of thousands of zombie machines.
I guess the only way of stoping the attakers is by taking their weapons (zombies) from them and thats left as an excersise for the survivors.

Re:weakest link

[CashCarSTAR]

Any non-Read Only OS is vulnurable to malicious software. Each OS has enough "security holes" (Otherwise known as features), to allow auto-running of malicious software without the knowledge of the average user.

Re:weakest link

[rmallico]

I think you missed the part where they mention the attackers take over poorly configured DNS servers on the internet to send bogus requests to/through...

Re:weakest link

[lpret]

Actually, the beauty of the internet is that it _isn't_ as strong as it's weakest link. The idea is that there are many links that create a...web, so if the weakest one fails another link can be established.

The problem is not that there is a weakest link, it is that none of the links are terribly strong and are vulnerable in their current state.

Re:weakest link

[saleenS281]

that would be your favorite flavor of *nix then. The attack was carried out by misconfigured BIND servers. Last time I checked, BIND isn't the primary nameserver used by Windows, which is what I assume you were insinuating. These weren't windows zombies, this was drdos via *nix machines. Back to the drawing board on that one my good man.

Re:weakest link

[rastos1]

Can you, please, briefly explain how a poorly configured DNS server generates more requests upwards then it gets from it's clients? My understanding of TFA is highier level DNS servers can't distinguish bogus DNS requests because they are comming from legitimate lower-level servers - it's sort like IP spoofing, but on a highier level. But vast amount of zombies are required in my opinion and GP is right. Huge amount of poorly maintained machines on the Internet is a problem.

Re:weakest link

[rmallico]

You want it spelled out? RTFA... I simply stated what was in the article...

Re:weakest link

[itsthebin]

the zombie machines are owned by maybe half a dozen different techniques. Those suffering the DOS attack have the ip adresses of thousands of these machines - pick 10 - remotely examine those 10 machines to determine the process used to own them. yes brute force the exploit till you own the machine. from the machines find out the ip of the chat server or what ever the marshalling machine is. Dos that machine off the internet - if they cannot control the botnet they cannot cause havoc with it. botnet control has not yet reached the stage of peer to peer it is still centralised.

Re:weakest link

[noamt]

None of those attacks (DOS) could have been done without the use of thousands of zombie machines.

So basically, if people use modern operating systems like Linux, instead of DOS, we'll be safer?

Re:weakest link

[Anonymous Coward]

Do you know what BIND is? Windows had nothing to do with this attack.

"Left as an exercise to the reader"? Your zeal is only surpassed by your idiocy, and you are an embarrassment to us all.

Re:weakest link

[everflow]

The attack was carried out by misconfigured BIND servers.

i didnt read that in the article so how do you know? besides, last time i checked UltraDNS uses non-BIND name server software.

Re:weakest link

[Anonymous Coward]

yeah, you're an idiot.

it's the bind machines out on the intarweb that were sent queries that were amplified and redirected back to the site under attack... It doesn't matter what the attacked website runs.

Maybe they pay more for a tiered solution....

[colinbg]

Seems to me maybe the solution is a tiered internet where spammers pay more to use the bandwidth... oh wait, sorry wrong discussion.

Re:Maybe they pay more for a tiered solution....

[Biff Stu]

The spammers don't pay for their bandwidth, the zombie owners do. Of course, if they noticed their internet bill go up, they might do something about it. However, with a large enough network of zombies, the individual computers could be used sparingly enough that the owners would never notics.

Re:Maybe they pay more for a tiered solution....

[colinbg]

Of course zombie owners are the ones paying for it (in more ways than one). The question really is, is there a solution to the spam delima that doesnt require some retailitory response? I dont beleive at the moment one has presented itself due to the limitations of OS and deleviry methods. Of course our ISP have a solution such as a tax or something where we pay more and they promise that they can fix it. I beleive that has worked well in the past with the same companies that provide cell service... "just pay us more and we will provide better service" I remeber that one, that worked out great!

Re:Maybe they pay more for a tiered solution....

[surprise_audit]

The spammers don't pay for their bandwidth, the zombie owners do. Of course, if they noticed their internet bill go up, they might do something about it.

Aren't the majority of the zombies on always-on broadband connections?? That's usually a flat-rate charge, at least on the ones I've used. You wouldn't notice any difference in your Internet bill.

Re:Maybe they pay more for a tiered solution....

[Biff Stu]

OK, you are the second poster that didn't quite seem to follow the thread. Maybe I wan't clear.

What you said is correct. However, the parent suggested (somewhat tongue in cheek) that the problem could be solved if spammers were to pay for actual bandwidth use. So, following the parent, I was exploring whether there would be any effect if home broadband were not to be a flat rate. Supporters of the money grubbing telecoms might think that this would inspire the zombie owners to clean up their computers. However, I doubt this is the case. If the spam load is distributed over enough zombies, the zombie users wouldn't see any increased charges. Therefore, we are all best off with the current flat rate broadband charges.

Re:Maybe they pay more for a tiered solution....

[lon3st4r]

in my company, a linux box got zombied. it was sending ~150,000 mails a day through our corporate mail servers. we had quite a headache locating that machine. how it got zombified is still a mystery - as it was not on the public network. it was running rh8 though, which makes it an easy target.

Re:Maybe they pay more for a tiered solution....

[bhiestand]

in my company, a linux box got zombied. it was sending ~150,000 mails a day through our corporate mail servers. we had quite a headache locating that machine. how it got zombified is still a mystery - as it was not on the public network. it was running rh8 though, which makes it an easy target.

You mean rooted? Unless your company employs a spammer who's just dying to get caught, it's quite obvious it was accessible from the net somehow. Well, that or some malicious code, but that should be fairly easy to locate on the system with such a volume of traffic being generated, and it shouldn't really be likely on a well-administered network.

Hesitant to out source

[dave562]

It sort of makes one hesitant to out source IT operations to a place like India. Hmmmm... maybe it's time to DDoS India and bring those jobs back to the US. If the Indian's are such technology mavens, maybe they'll find it in their best interests to resolve the DDoS / DNS Amplification issue and then we can all welcome our new, outsourced Indian overlords. =)

Re:Hesitant to out source

[Anonymous Coward]

brilliant!

Fragile Internet? No...

[fbg111]

I think a bigger question has been raised - is the Internet really that fragile?

No, the Internet is robust and redundant. What is fragile are the tens of thousands of pwn3d Windows PC's that are being used without their owners' knowledge to perpetrate these massive DDOS attacks. If I were a lawyer for Blue Security, Yahoo, or anyone else who has been hit recently, I would be seriously looking in to the merits of a lawsuit against MS for gross negligence or something similar.

DNS is still a mess

[Joe U]

It's time we started thinking up an alternative to the current DNS setup.

DNS in its current state is:
Easy to break.
Easy to use to break other systems.
Tied too tightly into SMTP. (Think about it)
Tied in to the whims of ICANN and whoever tells them what to do.
Tied in to the whims of Verisign.

DNS is the Achilies Heel of the Internet. (One of several apparently, but that's another article)

The message is clear!

[THE MESSAGE IS CLEAR]

SMTP has FAILED!

To get in front..

[CashCarSTAR]

Of all the common comments...

#1. Don't blame Windows. Most botnets spread through software downloaded installs. 99.999% of computer installs today are vulnurable. The exception, of course, is the LiveCD type OS run directly from a CD in a read-only format. Your choice of OS is no protection. If you run malicious software, your computer is a zombie. Period.

#2. The problem is E-mail. Don't want spam? Don't use e-mail. That seems harsh, but it's true. E-mail is an open protocol, and as such, is ripe for such abuses. It's about time to come up with a new type of server based messaging. I'm not saying let the spammers win. What I'm saying is remove their audience.

Re:To get in front..

[PDXNerd]

Your choice of OS is no protection. If you run malicious software, your computer is a zombie. Period.

Really? I looked around and can find no links through google for malicious zombie downloads on linux that will run on all flavors. Please post the link to one or a link to an article that disects one.

I'm not making the argument that linux can't be hacked - it can and I've seen the results of root kits. How many linux zombies are there? Is it proporational to the number of linux vs. windows machines? (Assuming Linux desktops and servers total 2% of desktops, 2% of spam zombies should be Linux, right? Where are the 4% of OSX zombies?)

It's about time to come up with a new type of server based messaging.

For every lock, there is a new way to pick it. For every type of security, there is a new way to hack it. This is a band-aid. The real problem is the fact that there is money to be made from this.

Re:To get in front..

[AuMatar]

To do #2, you lose one or more of the things that makes email valuable

1)Its free- you only pay for bandwidth

2)Its universal, anyone can get an account

3)Its open, no company can block a user from email

4)Its possible to send email to anyone, even someone you don't know, if you have their email address.

All of these are extremely important and make email the useful tool it is today. Take any away, and the usefulness plummets. Spam is annoying, but the benefits of the four above points far outweigh it.

Re:To get in front..

[Musteval]

With regard to #1, Windows is partially at fault, for two reasons:

1) The incredibly nondiverse OS environment environment at the moment means that only Windows executables are distributed, by and large, and affect something like 95% of computers. If the OS market were split evenly between, let's say, OSX, Linux, Windows, and, um, BeOS, any given executable would only run on one platform, so people would be vulnerable to only 1/4 as many attacks (assuming that 1/4 of attacks are targeted at Windows, 1/4 at OSX, etc). The lack of diversity is Microsoft's fault to a degree - although they aren't to blame for being dominant per se, their unethical techniques with regard to OEMs and leveraging their monopoly to make it as hard as possible to switch away from Windows (not to mention the whole stabbing-IBM-in-the-back thing) have contributed greatly to the current state of affairs.

2) Windows' security, as of right now, works under the "the user wouldn't run anything they didn't want ot have full admin privileges" model, as opposed to the far more secure "make sure the user wants to install a rootkit and delete all their files" model that other OSes do. Under Vista, it seems that it will be replaced by a "pester them with popups often enough that they are ignored and it ends up the same as doing anything the executable wants" model.

Re:To get in front..

[Anonymous Coward]

are you freakin serious? Don't blame Windows????? You need a belting with the clue stick... M$ puts profits before all else & this is the result.
 
fuxing Winblows apologist

Re:To get in front..

[Vancorps]

The answer is Yes Linux machines are often turned into zombies.

As the parent poster stated "if you run malicious software, then your computer is a zombie." I won't hazard to state the proportions but last I checked the number of Apache servers hacked in a given year outnumber IIS hacks. Of course there are far more Apache servers out there so that's really not saying that much.

As for email, I don't think it is near as broken as people seem to think. It's amazing how people just want to throw the whole thing out when something as simple as DKIM and SPF can stop it all pretty much cold. Of course both are depending on DNS so that will need to be secured before the email issue can be put to rest. A further move towards secure updates needs to be pushed for DNS and amplifications attacks need to be stopped. It seems as though we need a DNS server registration process much like that of domain names with the exception that you actually do need to verify your identity before your server it declared a valid DNS server. That seems a lot more likely than replacing DNS with something completely new.

Re:To get in front..

[CashCarSTAR]

I couldn't find any either. But I don't see a special technical reason why you couldn't install one on Linux. I know that you can get things such as various types of security and scanning software that will run in the background...how is this any different from an invisible IRC client? It's not.

While it's true that Windows machines are overwhelmingly the ones affected, this is simply a factor of marketshare.

Once OS X gets a good marketshare, you'll see a ton of little aps that have zombie clients attached to them.

Re:To get in front..

[Have Blue]

The usefulness of email is already plummeting. Sooner or later those 4 points are going to be outweighed by sheer volume. Is 50% spam too much? How about 95%? When your line is saturated for several minutes at a time downloading useless email? When a good percentage of your own messages are counted as false positives by aggressive automated spamblockers and never reach their destination?

Re:To get in front..

[Original Replica]

3)Its open, no company can block a user from email
Why not? Why can't Verisign and friends blacklist problem users or domains or servers so their traffic doen't pollute the internet? Would it really cause more of a disruption than the DDoS in the article?

Re:To get in front..

[Anonymous Coward]

The problem is that blacklisting the problem IPs on the net would result in killing connectivity for millions of normal, everday computers; meanwhile the spammers just find millions of more unpatched boxes on the net to use.

----------
Too lazy to log in...

Re:To get in front..

[surprise_audit]

It seems as though we need a DNS server registration process much like that of domain names with the exception that you actually do need to verify your identity before your server it declared a valid DNS server.

The botnets would just send out regular DNS requests, which would still flood the registered DNS servers.

As it is right now, you can send a DNS lookup request to any DNS server - a couple of guys at work here won't use their own ISP's DNS because it's flaky. The botnet traffic could be cut if the ISPs would block outgoing DNS requests that *don't* originate from their own servers. Instead of shooting DNS lookups off to some DDoS target, the zombies would have to send the query to the ISP's DNS, which would then forward them on. At some point, the ISP's DNS is flooded and breaks down, cutting the zombies off. This accomplishes two things - it shuts the zombies out of the DNS amplification attack, and it lets the ISP know they're hosting a botnet...

Re:To get in front..

[Anonymous Coward]

Really? I looked around and can find no links through google for malicious zombie downloads on linux that will run on all flavors. Please post the link to one or a link to an article that disects one.

Are you really that dumb? The point is that if you can get users to download and run arbitrary code you can turn any machine, regardless of OS, into a zombie. It just so happens that Windows is most popular with clueless users, and thus criminals write zombie code for Windows. There is in fact zombie code that runs on Linux, but even if there weren't it would be irrelevant. The point is that such code could easily be written (if you don't believe me then you simply know nothing about programming, or Linux for that matter) if there was a substantial enough user base. This has nothing to do with Windows or Linux per se, but with their respective user bases.

You could have figured this out yourself if you had taken, oh, ten seconds to think. But you didn't, did you? You just spouted your religious idiotic anti-M$ zeal like you always do. Business as usual around here, I guess.

Re:To get in front..

[gsslay]

You simply can't compare the prevalence of Windows zombies to that of Linux. The weak link is the user, as it is the user who either foolishly permits the malware to install on their computer or doesn't keep their virus definitions and patches up to date.

Now, keeping in mind the current market for Windows and Linux, which set of users do you think is most likely to be negligent with maintenance? The Linux user, who usually has a specific interest in computers, or the Windows user, who mostly doesn't care?

Make no mistake about it. If Linux was the mass-market OS of choice, installed on Joe Public's computer there would be just as large a percentage of Linux zombies. Why? Because Joe Public doesn't care. Joe Public is not going to spend 5 mins ensuring that their OS is up to date. Joe Public isn't going to think twice about installing software someone emailed them. And any OS can do as much as it can to stop it, but as long as Joe Public is clicking "Yes - Install 'Cute Puppies Screensaver'" zombies are going to be created.

The creator of a zombie network knows their target. It is the mass market, clueless Joe Public. They know that the average Linux user is not going to be half as easy to fool, so why bother attempting when there are so many easier targets?

Re:To get in front..

[dtsazza]

To do #2, you lose one or more of the things that makes email valuable

I'm not convinced... seems like the main problem with email is that it's nigh-on impossible to authenticate the source of the email accurately. If there was a simple, watertight trace back to who it was that sent the email, then spammers would very very quickly get blacklisted and be unable to spam any more.

The problem today is that there isn't an effective way to say "You're a spammer, therefore we won't handle any more emails from you". There are some cute workarounds in place, but the protocol makes it nigh-on impossible to handle this properly. Some kind of immunity to sender spamming, and possibly more explicit authentication of MTAs would at least make the information available to take action.

Re:To get in front..

[Anonymous Coward]

It's about time to come up with a new type of server based messaging.

    For every lock, there is a new way to pick it. For every type of security, there is a new way to hack it. This is a band-aid. The real problem is the fact that there is money to be made from this.

---
So It's about time to come up with something else than money :)

Re:To get in front..

[gbjbaanb]

And you cannot also say that its only desktop machines running the bots. Look on any webhosting forum and you'll see loads of 'server admins' saying they've been hacked, or asking how to configure mail/web/script/etc security.

If hosting control panels were secure by default, even if it made the 'one click and you're working' type install break, then that would be a good thing.

Re:To get in front..

[Anonymous Coward]

you jest, nicht?

to make a 'zombie', all that is needed is to begin with a remote administration tool, then you work out a way to hide the process (hiding the binary might also be advisable). After that, your on the quest to get people to install your hidden remote administration tool.

running a posix compliant OS does not make one immune to being 'pwn3d'.

Re:To get in front..

[Phroggy]

My Slackware box was turned into a zombie not too long ago. I created a temporary account that I wanted to play with briefly, with the intention of deleting it as soon as I was done. I foolishly set the username to "temp" and the password to "temp123". I forgot to delete the account, and about two weeks later got a spam complaint from my ISP.

I strongly recommend running SSH on something other than port 22. Take a look at your logs to see why.

Be wary with the label "terrorism"

[Opportunist]

It's the direct link to more governmental control over something under the premise that it "has to be" so the "terrorists" can be stopped.

While I do agree that this definitly shows the threat spammers really pose to the internet, I fear at least as much handing government the card blanche to monitoring all and any internet traffic for the sake of "saving us from spam".

No, I'm aware that this won't help a single bit in an attempt to quench spam. But did any anti-terror activity actually work against the alleged threat?

So bring this problem to the attention of your senators, your governors, your congressmen or whoever has some power in your country. This is a very, very serious problem, the criminals are getting the upper hand in this turf, and the internet is a resource I don't want to see depending on the goodwill of the spam mafia.

But for all that we hold dear, avoid the word terrorism. Legislators have been using that word before as the excuse for every kind of restrictive laws that did JACK to solve the problem and only created more. Try to find a word that makes them actually realize the problem and realize that this problem is serious. Not only to the worthless humans using it, but also to precious commerce.

Re:Be wary with the label "terrorism"

[ClamIAm]

You kind of have a problem here. Just because we define something as "terrorism" doesn't mean we're handing a blank check of our liberties to our various governments. Sure, in recent years this has basically been the case, but that's only because the definition of terrorism has been twisted to meet the needs of a few rich men who love power, and the public has allowed it to happen. If we actually look at the definition of the word, the US government is very guilty of terrorism. Should we be going after ourselves? Well, probably.

Re:Be wary with the label "terrorism"

[dbIII]

But for all that we hold dear, avoid the word terrorism

Good point - unless it is a robot with a bomb the word "cyberterrorism" makes no sense at all.

Re:Be wary with the label "terrorism"

[mike2R]

unless it is a robot with a bomb the word "cyberterrorism" makes no sense at all

A robot with a bomb and a cause. A robot with a bomb may just be a criminal if its trying to extort money.

Re:Be wary with the label "terrorism"

[Opportunist]

If there actually WAS a country with the power and the will to fight the US, I'd crap my pants if I lived there. But since they currently pretty much have the monopoly on military power, I wouldn't be too concerned that anyone would dare to stand up and yell "terrorists!" while pointing towards Bush and friends.

It is organized crime. Not terrorism. The inflation of a word has the same consequences inflation has in money: It gets devaluated. Was Al Capone a terrorist? Basically, he did it for money. Granted, that's true for the head terrorists, too.

I think we'd be far better off if we manage to get it through the skull of the general population that spamming is on the same level with other criminal organisations like drugs or money laundering. It usually neatly ties into the same group as phishing or other "cyber crimes".

Fragile

[Vexorian]

is the Internet really that fragile?

A system is as weak as the weakest of its elements. And the internet is a system with way a lot of different elements, there are many things involved and many different ways to go wrong. The internet is that fragile and even more

Not fragile, just vulnerable

[Todd Knarr]

No, the Internet isn't that fragile. It's suprisingly robust, in fact. About the only thing that can really do any significant damage is sheer volume, enough traffic from enough distinct sources to overwhelm the target server or swamp it's network connections. No matter what, anything is always going to be vulnerable to that. You can only have finite bandwidth and server horsepower, and if an opponent's willing and able to throw enough resources at you he can simply overwhelm you. It's often referred to as "the Slashdot effect".

The only thing that's happened is that, because of the inherent insecurity of Windows machines and the increasing number of them with broadband connections, the bad guys now have access to orders of magnitude more bandwidth and horsepower than any single server can have. In military terms it's like facing an enemy who outnumbers you by ten thousand to one. Distributing your DNS won't help, redundant pipes won't help, distributing your servers won't help, if you can deal with 99% of his assault he's still got a hundred times what you can absorb left.

The only thing that can help is cutting off the supply of ownable machines the bad guys can take over and use in their attacks. If they're limited to their own machines they can't do much harm.

Re:Not fragile, just vulnerable

[slashdot.org]

The only thing that's happened is that, because of the inherent insecurity of Windows machines and the increasing number of them with broadband connections, the bad guys now have access to orders of magnitude more bandwidth and horsepower than any single server can have.

Tell me about it.

rant
So I have a catch-all email on my domain name (say 'example.com'). A couple of weeks ago, I started to receive bounced email which had a return address like 'wert@example.com' and 'nrtp@example.com'. Great, this is the second time this is happening, only now it seems to be persistent for several weeks.

So you think, well some asshole is obviously responsible for this, lets try to find out. But everything traces back to different originators. So this spammer controlling a whole bunch of zombies is impersonating fake email addresses at my domain, and sending it from systems all over the world. (and you got to wonder, even if he only impersonated 1 real address (say myname@example.com) it would be the same problem)

Now I'm starting to receive spam at random emails @ my domain as well. It's driving me nuts. Of course I can close my catch all account, and only let through legit addresses. But wtf?

I understand the 'need' for anonymity, but impersonation is something else. Why is this accepted? Why can't we have protocols that don't allow that?

Also why the fsck are email servers bouncing email back to an address that obviously can be easily spoofed?

I know there's tons of excuses, but you just wait until you get bombarded with crap and there's no way telling who's responsible for it. You seriously start to wonder about the validity of the email protocols we are using today.
~rant

Re:Not fragile, just vulnerable

[numatrix]

You know, this is very interesting. I was having a conversation with someone else at the local LUG meeting last night and he mentioned the same issue and I told him I've been experiencing it as well. Being html image attachments, and me running my mail through mutt, I haven't looked at the messages to see what their content is, but now I'm really interested. Is this a common thread? I don't have a particularly popular domain that is being spoofed. I'm curious why the sudden increase of this behavior. Perhaps the three of us are not alone? And if so, what's the cause?

Re:Not fragile, just vulnerable

[kiddailey]

Likewise. I've been getting bombarded with undeliverable bouncebacks sent from for the past month or so as well. Frustrating is putting it mildly, but it's about the third or fourth time I've been "Joe Jobbed" so I think I'm getting numb. :)

Re:Not fragile, just vulnerable

[slashdot.org]

Yep, a lot of the bounced emails seem to have nothing but HTML embedded images. Also a lot seem to be promoting stock.

Normally I'd say "follow the money", but I'm having a hard time figuring out who would actually profit from the original spam...

I'm sure we are not alone. I'm not sure what makes the spamers decide to use a certain domain/email address as the spoofed originator.

Now I don't want to sound pesimistic, but I don't think this is a problem that's going to be solved in the near future. But please let me know if you know any place where to start. :)

Re:Not fragile, just vulnerable

[WuphonsReach]

So I have a catch-all email on my domain name (say 'example.com').

You'll pretty much have to knuckle-down and ditch the catch-all email account. It's no longer worth it to have one. Just configure aliases for the common ones (dns@, admin@, postmaster@, webmaster@, root@, abuse@) and let the rest of mis-addressed e-mails get the reject notification.

Also why the fsck are email servers bouncing email back to an address that obviously can be easily spoofed?

Because SMTP never included a mechanism to say "mail from MY domain only comes from THESE servers". There's the MX mechanism to tell you where to deliver mail to my machine(s), but no way for me to say that I only send e-mail through X, Y and Z machines.

That is basically what SPF attempts to address. It allows you to publish reverse-MX information for your domain where you state: "e-mail from my domain only comes from these addresses, you should possibly/definitely ignore e-mail from any other address".

It's not an anti-spam technique (spammers can simply add SPF records with very loose restrictions to their DNS records). Instead, its goal is anti-forgery to lessen the amount of forged e-mail out there, along with less blowback from forged domains (such as bounce messages or virus notifications).

Configuring SPF for a domain is easy. Just figure out what addresses you use to send e-mail, calculate the SPF record, then stick the record in your DNS.

It has a few detractors, but for the domains that I control, the downsides of SPF are negligible. I'd rather deal with the limitations of putting such a "lock" on my domains rather then have all of the blowback from forgeries.

What isn't prohibited, is required.

[sakusha]

One of these days, some asshole is going to take down the entire net, just to prove that it can be done.

I keep thinking about the old saying, "what isn't prohibited, is required." Because the net doesn't prohibit these massive DDoS attacks, someone WILL do them, over and over, either because they are into extortion, or just because they're evil fucks and like creating mayhem. I almost believe that someone ought to just do it and break the net permanently so everyone will have to come to grips with this. So maybe the solution will mean that nobody with an insecure OS will be allowed back on the net. Maybe we need a catastrophic failure to force a total revamp of network protocols, and an excuse to exile all the lusers like people still using Win98. I dunno, it would probably be faster, cheaper, and ultimately more satisfying if we could just assassinate spamming assholes like PharmaMaster/Eran Reshef.

Re:What isn't prohibited, is required.

[CashCarSTAR]

If you want to eliminate zombies, we need to replace PCs with web-surfing applicances. You don't have that appliance (which is massively encrypted, and lacks ANY local saving options), you can't get on the Internet.

But that just sucks. So we live with the status quo. Such is life.

Re:What isn't prohibited, is required.

[EvanED]

So maybe the solution will mean that nobody with an insecure OS will be allowed back on the net.

What OSs are secure?

This is not a facetious question. Define "insecure".

Re:What isn't prohibited, is required.

[Anonymous Coward]

what could be done is the government could make an open-source free product which could be used to wipe out zombies by directly removing malware on people's computers - if they put resources into it it could really work out well... although that would make it a government IT project (so ultimately doomed to failure)

Re:What isn't prohibited, is required.

[Anonymous Coward]

I dunno, it would probably be faster, cheaper, and ultimately more satisfying if we could just assassinate spamming assholes like PharmaMaster/Eran Reshef.

According to the Wired article you linked, Eran Reshef is Blue Security's CEO. I guess you could argue he was spamming PharmaMaster. ;-)

Re:What isn't prohibited, is required.

[Anonymous Coward]

"...and an excuse to exile all the lusers like people still using Win98"

Or an excuse to exile all the lusers who don't know how to secure 98, like you perhaps?

The steps: install 98se, install the Unofficial Patch, install ZoneAlarm, install AVGFree. Don't use major Microsoft apps like IE, Office, Outlook. Use OSS like Firefox, OOffice, Thunderbird instead. Do not run any official Microsoft patches, and if you install any new media player for a codec update, read through their preferences for obvious phone-homes. ZoneAlarm will alter you if you miss anyways.

It's trivial to set w98 right. It'd still be worth using but for things like some Google features that require XP.

Maybe you've got an idea there, but you picked a poor example. But because you didn't know that much, you should reconsider your line of thought.

Re:What isn't prohibited, is required.

[deesine]

"Or an excuse to exile all the lusers who don't know how to secure 98, like you perhaps?"

The fact that he knows about Windows variants means he's not part of the problem. The problem with zombie pc's (which are primarily responsible for internet extortion) are the people who don't even know what version of Windows they're running.

You list over a dozen steps necessary to secure win98. Do you really think Joe-pc is going to do that? Try to narrow down your list, say to one step. If you could only tell internet/pc noobies one step to follow, what would it be?

My answer is to buy a Mac, if they're not the tinkering type.

Re:What isn't prohibited, is required.

[Anonymous Coward]

Um, Win98 is much more secure than WinXP these days, if only by obscurity. Just try to find a Win98 remote exploit out there all packaged up for a script kiddie. They don't exist, or at least they're very hard to come by. OTOH, check out metasploit, milw0rm, etc. They're full of exploits for WinXP, Win2K, Win2K3, etc. The largest target is the NT-derived Windows versions. All else are really not a concern or worth the trouble for a hacker. Nearly the only way a Win98 host turns into a zombie these days is by installing malware intentionally. It just doesn't get in all by itself like WinXP et al malware does.

Re:What isn't prohibited, is required.

[MrNougat]

This is not a facetious question. Define "insecure".

This is maybe somewhat tangential, but here goes.

I have always thought that security and usability were inversely proportional. If your computer were unplugged from everything, turned off, and encased in some impermeable substance (think Han Solo), it would be imminently secure. And completely unusable.

If you had a system where anyone anywhere could give it commands just by thinking, and it would immediately execute those commands, it would be imminently useful. And completely insecure.

More to the point: any system can be made to be secure, and any system can be made to be insecure. Yes, even a Win9x system can be made to be secure on the internet - by adding a simple NAT router between it and the internet connection (inexpensive, and don't open any ports), not using IE or OE (replacements can be had for free), using antivirus and antispyware software (also available for free). That doesn't mean your Win9x machine is suitable to be a mail server, web server, Quake server or any other kind of server.

(Before you all chime in with "Linux" and "Mac" - I know. And I don't care.)

As said in another post to this article, a fair portion of the zombie systems are *nix machines with weak passwords. I don't doubt it. I expect that sloppy administration accounts for most hacking incidents, regardless of operating system.

Let's get back to the real question. What OSes are secure? Those that are administered such that authorized persons have access at the intended level, and unauthorized persons have no access. Maybe OSX suits your liking, and you find it easy to work with. Maybe Windows. Maybe some flavor of Linux. Doesn't matter. Administered properly, your OS can be secure.

Consider this. For all the internetting I've done over the last ten years - and I've slummed hard with the best of them - I've gotten a virus exactly one time. And it was my own fault. In a moment of weakness, I was overcome by the desire to view the pictures of Anna Kournikova that my mother-in-law sent me. As soon as I had made my mistake, I knew what I had done, and set about to fixing it. Took about an hour out of my life. Never had spyware, adware, nothing. All on Windows. It can be done.

Re:What isn't prohibited, is required.

[freedom_india]

Mac OS X 10.4.6?

Seriously Mac coupled with Brickhouse for a firewall serves my Wife very well.

She browses, downloads songs, chats, etc, without being turned into a Zombie.

Re:What isn't prohibited, is required.

[Ninjaesque One]

Ditto. I've had a Windows machine for a good 3 years; never any spyware, never any viruses, etc. Common sense is the only thing required, but it is required for all parties; programmers, hardware makers, admins, users. Lack of common sense is the only real reason we don't have an utopia. I'm afraid, however, that common sense is, perhaps, the most horribly difficult thing to come by. It must be repeated; it must be reinstigated. Law, security, anti-spyware, police systems, et cetera; they are all simply safeguards.

Why is common sense so hard to come by? Human evolution provided for that. Reason is useless when speed is needed, but we no longer need speed. We need common sense now, but I guess we'll need a few million years to get that.

Re:What isn't prohibited, is required.

[plenTpak]

"...it would probably be faster, cheaper, and ultimately more satisfying if we could just assassinate spamming assholes like PharmaMaster/Eran Reshef."

Eran Reshef is the CEO of Blue Security, according to the article: "Earlier this week, Blue Security's CEO, Eran Reshef, said a Russian spammer operating under the name PharmaMaster orchestrated a string of attacks this week that disabled its site and sent threatening messages to its users."

PharmaMaster is not Eran Reshef.

Just in case someone decides to harrass him....

Re:What isn't prohibited, is required.

[surprise_audit]

I almost believe that someone ought to just do it and break the net permanently so everyone will have to come to grips with this.

Well now, that sparked an interesting thought - maybe spammers such as PharmaMaster are a front for somebody else, and I don't mean people trying to market dubious products. There's that saying "follow the money", so who would benefit from your drastic solution??

• Various ISPs have recently been trying to set up tiered Internet, so they'd get paid for traffic both ways. Would they benefit from such restructuring?
• Various governments want to censor what their citizens can view.
• The UK government may soon be demanding that people give up their encryption keys to the police - "to fight terrorism". Ironic really - saying, "give us your keys or go to jail" is a form of terrorism, isn't it? How many other countries would like to do the same?
• The RIAA/MPAA would love to have people change to diskless internet terminals that couldn't store viruses, botnet-code or, incidentally, music and videos. They might finally shift to a cheap download business model if it was a definite play-only-once download
• I'd imagine a number of phone companies would like to see VOIP go away
• I'm sure Microsoft would be happy to charge, say, $50 for a Windows LiveCD edition. "Yes folks, throw out that spam/pr0n/virus filled hard disk and pop in this CD."

So, who benefits most if the Internet is restructured??

Dear Homeland Security

[subl33t]

Dear Homeland Security: please look closer at Redmond.

This is terrorism. Everyone with a trojaned Microsoft box is aiding and abetting.

Thank you, Linus and Steve.

Re:Dear Homeland Security

[CashCarSTAR]

There are OS X botnets, and although I've never heard of any, I'd be there's probably a few proof of concept Linux botnets hanging out in hacker circles. Any OS that allows user installation of software is equally suspect to a zombie takeover.

Re:Dear Homeland Security

[RedToad]

When in doubt, blame Microsoft. Screw intelligent research. Maybe somebody somewhere has done some tracking down to see who are the most likely suspects.

The bigger picture on people identified as suspects in the spam and DDOS attacks on Blue Security is painted by Spamhaus / ROKSO. They maintain a global Top 10 list and a global Top 200 list of spammers.

A quick search on "bluesecurity" digs out

ROK6138 - Alex Blood / Alexander Mosh / AlekseyB / Alex Polyakov - Main Info

ROK5514 - Christopher J. Brown / Swank AKA Dollar - Main Info

ROK6643 - Joshua Burch - Interactive Adult Solutions / BulkEmailSchool.com - Main Info

ROK4932 - Leo Kuvayev / BadCow - Main Info

ROK5125 - Leo Kuvayev / BadCow - Partner-In-Spam: Vladislav "Vlad" Khokholkov / Apex Systems Ltd.

What's the betting that Spamhaus, who dare to mount the evidence, won't be the next DDOS target? I doubt that the pharmamasters would have any success destroying that evidence. But they will be sure to try. Put your money on it.

Re:Dear Homeland Security

[Anonymous Coward]

There are OS X botnets

Proof, please? And don't link to any bullshit articles on CNet or ZDNet, we know whose pocket those pricks are in.

Re:Dear Homeland Security

[BrynM]

There are OS X botnets, and although I've never heard of any, I'd be there's probably a few proof of concept Linux botnets hanging out in hacker circles.

There are plenty of *nix botnets in the wild. Here's one source, but I've heard about them for a long time now. Almost all are running a service that gets it hacked (such as PHP on httpd in that example). Back when I was willig to help people with their PHP-Nuke installs, I saw a lot of compromised machines with interesting bits of software on them. My old website was once hacked (before being kind of abandoned) with a simple SQL injection exploit in Nuke.

Re:Dear Homeland Security

[wnknisely]

Really?

Got any data to back that statement up? Seriously - I've never heard of OS X bot networks.

Re:Dear Homeland Security

[debiansid]

Thank you, Linus and Steve.

Who, Linus Torvalds and Steve Ballmer? ;-)

Re:Fragile Internet? No...

[AnotherBlackHat]

... the tens of thousands of pwn3d Windows PC's ...

More like "hundreds of thousands".

My spam traps have been hit by over 1.5 million unique IPs this year alone,
with an additional 30,000 never before seen IPs every day.
I estimate there are currently 3-4 million compromised machines world wide.

-- Should you believe authority without question?

Yes!

[Newer Guy]

The Internet is terribly fragile...It's been crippled by greed. Greed of corporations, and governments, and hackers, and criminals, all looking to stake their claim and increase their power there.

Microsoft is a major trasher of the Internet, by the fact that they have designed and sold operating systems THEY KNOW can easily be compromised. The DSoS attacks of late are all being done with machines using Windows.

I'm not sure if anything can be done at this point, short of trashing half a billion computers, surely an impossible thing to do.....

Re:Yes!

[MarkByers]

...trashing half a billion computers, surely an impossible thing to do.....

That sounds like a challenge for Vista Forever.

Meh ...

[Sonic McTails]

You know, BlueSecurity was working. Had they survived, it might have shutdown the spammers. This is going to become a massive bubble issue. Someone just needs to pick up the torch BlueSecurity dropped, and be willing to fight the fight.

DON'T WORRY GUYS!

[Anonymous Coward]

I backup the internet every night at 10 pm (PST).

Re:DON'T WORRY GUYS!

[Anonymous Coward]

That explains why my ping gets so bad starting around 10

Re:DON'T WORRY GUYS!

[Anonymous Coward]

Look, we know you download a lot of porn. But probably not THAT much...

Re:Fragile Internet? No...

[ByteGuerrilla]

Recently I'd say MS have been anything but negligent towards security. People refusing to patch up, or using out of date Windows (i.e. 95/98) are a bigger problem.

More Laws to Control the Internet

[PineHall]

Unfortunately this abuse of the internet by criminals will mean more laws to control the internet. And there will be more monitoring of the internet. Hopefully there will not be monster firewalls to restrict access, but I could see it happening to prevent this undesirable activity (think China). It is sad, but humans have a tendency to mess up a good thing.

The internet is not fragile, its abused

[burnin1965]

From TFA "These massive assaults harness the power of thousands of hacked PCs to swamp sites with so much bogus traffic that they can no longer accommodate legitimate visitors."

The problem is the thousands of hacked PCs that are used in these attacks. The internet is working exactly the way it was designed and the bot nets take advantage of bottlenecks in the system.

What is being done to take out these bot nets? I've perused a few of these bot squads on IRC and while there are many zombied Windows machines there are also many *nix boxes which succumbed to the brute force ssh password attacks because they had user accounts with stupid passwords.

Aside from locating and neutralizing the individual boxes in the squads shouldn't we be creating and deploying self immunizing tools in our infrastructure that detects these boxes and quarantines them?

Shouldn't we also be holding people accountable for having vulnerable boxes connected to the net? Perhaps a bandwidth restriction will help for repeat offenders.

Re:The internet is not fragile, its abused

[Omnifarious]

I haven't succumbed to any of those attacks yet, and I'm not likely to. But I would like to know what to do to reduce their frequency.

Re:The internet is not fragile, its abused

[Architect_sasyr]

houldn't we be creating and deploying self immunizing tools in our infrastructure that detects these boxes and quarantines them?

We already do. They are refferred to as Nematodes. The primary paper on them is available online: http://www.blackhat.com/presentations/bh-federal-0 6/BH-Fed-06-Aitel.pdf

I maintain some of these for my internal network. Difficult to code, but when you get it (and I haven't yet, I have just coded some well) they are awesome for security.

Also handy to do automatic analysis of open ports, and alerting etc. The world is your oyster, and these help prevent people stealing your pearl.

Re:The internet is not fragile, its abused

[Anonymous Coward]

Aside from locating and neutralizing the individual boxes in the squads shouldn't we be creating and deploying self immunizing tools in our infrastructure that detects these boxes and quarantines them?

A self immunizing smart network?

Sounds cool. I think I'll call it Skynet...

Re:The internet is not fragile, its abused

[pixel fairy]

I haven't succumbed to any of those attacks yet, and I'm not likely to. But I would like to know what to do to reduce their frequency.

on a personal level, these are all things that can help.

• run ssh on a nonstandard port (beware of restrictive networks)
• dont respond to ping
• dont accept from where you dont want to use it. if you never go to foodonia, dont accept traffic on your ssh port from there. google for ip blocks by country etc. if its non critical that you can get to it, then only accept from those places your likely to use it from. (your work, your school, your friends house etc)
• port knocking

stuff that wont reduce frequency of attacks, but will protect against them

• disable password auth (use ssh keys or something)
• disable root access from ssh (theres reasons not to do this too, but if your in doubt, then its probably a good idea)
• disable version 1 of the protocol

Re:The internet is not fragile, its abused

[Anonymous Coward]

The reason there are so many rapists is the miniskirt companies!

Re:The internet is not fragile, its abused

[Omnifarious]

The first set of things are not things I'm willing to do. I only allow RSA authentication on most of my boxes. I allow passwords on one, and I give logins and mail accounts to friends who may travel without informing me. And I feel that not responding to pings is rude, and breaks an important diagnostic tool.

On the second set of things, I've done all those except for the one box that I still allow password authentication from.

I think, what I may do, is set up an iptables rule that throttles new connections on a per IP hash bucket basis. My problem is that sometimes I run things over ssh that like making a bunch of connections. It would be really nice to just throttle unsuccessful login attempts on a per-IP basis. I am really surprised that ssh hasn't grown this feature.

What laws were broken, anyway?

[Anonymous Coward]

1) someone needs to list state or federal laws that were broken.

2) If there were laws broken, a spokesperson for the appropriate government agency (agencies) needs to explain why not prompt action was taken. ISP's whose clients were part of the attacks should have been warned to shut down their clients who are participating, or be shut down.

If no laws were broken, smile!

Perhaps the Federal government should have the power to permanently shut down an ISP that doesn't respond to a demand to block clients until they demonstrate their computers are clean and free of "zombie" software. This would include permanently blocking all traffic to or from an overseas ISP.

Re:What laws were broken, anyway?

[Anonymous Coward]

Many state and federal laws are broken. The problem is finding the perps, which costs time and money that state and federal governments don't have/want to spend.

Sounds fishy to me

[Dilber]

This sound awefully fishy to me that a security company would give up and go out of business over this. Sounds like someone was cooking the books and needed an excuse to fold. Just my 2 Dilber

Re:Sounds fishy to me

[Anonymous Coward]

If your business plan has completely failed, you're ethically obliged to stop wasting any more of other peoples' money. If you want to create another service from scratch, that's riskier than what your current investors signed on for, so start a new business and find investors (maybe the same ones) willing to give you another shot.

White Hat

[l0ungeb0y]

I've always thought of /. as rather BROWN hat myself.
And considering the color scheme in this here section, the only way /. could more readily agree is by adding images of corn chunks scattered here and there... all willy nilly in a fashion.

*ahem*

Terrurizem

[mikiN]

Fanatics flying airplanes into buildings killing thousands : Terrorists.

Haxors commanding botnets to DDOS servers : Cyber-terrorists.

Big corporations doing aggressive take-overs : Corporate terrorists.

Mass producers dumping products below cost overseas : Market terrorists.

Politicians sketching doom scenarios during campaigns to woo scared voters over to their party : Political (party) terrorists.

C'mon cut it out will ya, soon they will brand humans multiplying without limits sucking up resources and scaring other animals away and out of existence : Biosphere terrorists?

You know, according to some theory, black holes will eventually suck up most of the available matter in the universe, leaving it a dark cold desolate place with only some Hawking radiation to warm your soul. Should we call those : Universal Terrorists then?

Re:Terrurizem

[Anonymous Coward]

Personally I think this can be turned into a good thing. Call people terrorists (among yourselves/friends/whatever) for minor issues. Use the word a lot. Dilute its meaning, and it eventually loses its power over people.

world works on cooperation and goodwill

[sloth jr]

Minus these, I can see many systems that could fail with a little effort. One of the problems I see with our current infrastructure is the notion of machine-to-machine communication - when really, what we want to know is in effect, remove anonymity from the equation (there will be discussion this point, I realize). Machines talk to each other as machines. We ultimately want to know WHO did X, or Y, so we can find them and hurt them in some fashion (bullets to the temple, fines, whatever...). (okay, substitute we for I if it makes you feel better).

This is a really nasty point. Privacy versus safety. Or, in this case, utility. The internet does no one any good if denial of services render it unusable - and of course, a good DDoS exploits the behavior of its regular users, so that effective rebuttal becomes increasingly difficult.

I find myself disillusioned by the human race. There are no sacred cows so holy that someone won't shit all over it.

Sloth Jr

Here's the problem.

[Anonymous Coward]

There isn't an efficient, effective, and regularly-applied means of shutting down machines that emit Internet-harmful traffic.

In the past, for example, spammer-friendly ISPs found themselves cut off entirely from USENET until they'd pay attention to cleaning up their part of the neighborhood.

This sort of approach is quite undesireable because it affects everybody else at the ISP, but it was also effective (usually within a week things were resolved).

Tell me that it isn't possible for ISPs to check their outbound traffic for clearly exploitative content. You know, triggering a flag after the first fifty thousand messages sent not even a day after an account was created for example, or spotting signs of security compromises on customer machines (certain IRC traffic patterns, for example).

Although if we go down this road it does open up an argument that ISPs should monitor filesharing traffic as well...

There's DOD's Network And then...

[mpapet]

there's the Interweb you and I use.

I don't know that anyone in gov't really cares half as much about the consumer's network versus their own systems.

Ah, the perils of the "ownership society."

Just to give you an idea...

[sorphin]

I work for an unnamed backbone provider, and have currently been involved in blocking said DNS Amplification attack.. to give you a general idea of the size of the attack and the number of zombies involved.. When I left work... The attack was 14,768% of 9.8MBps... or.. over 13GBit/sec... Our infrastructure is holding up just fine, however.. Personally, I'd like to find the 'owner' of these zombies, and castrate him. I guess the guy doesn't have anything better to do with his life than trash the net...

Re:Just to give you an idea...

[6ULDV8]

"I work for an unnamed backbone provider"

Makes it kinda hard to cash the checks, huh?

Re:Just to give you an idea...

[sorphin]

Heh. I just preferred not to give their name.

reincarnation?

[jefu]

Accorging to this the blue frog model will be open sourced as a peer-to-peer model available through sourceforge.net.

Re:reincarnation?

[ajv]

I blogged about this yesterday:

We need to set up a (de-)centralized place for spammers to check the "do not intrude" list without blowing their cover or exposing e-mail addresses, and a totally anonymous decentralized categorization effort without causing any harm to innocent bystanders (such as Tucows or Typepad).

http://www.greebo.net/?p=339

Re:reincarnation?

[Anonymous Coward]

Sourceforge? But it's already down half of the time even without spammers DDOSing it...
Meh.

Re:reincarnation?

[Julian Morrison]

I have a suspicion those spammers will rue this day like the RIAA rues Napster. "Oh my god, what have we wrought?"

Interesting how things change

[Steeltoe]

A few years back we would have laughed that someone is calling this terrorism, and just saying it's just a few scriptkiddies having fun with DDOS and whatnot. Computers are just a fun box, nothing serious about it. Relax. Nothing of value is lost, and if you don't have a backup, you deserve it. Darwinism at work.

It's also interesting how questions change. We question: Is the internet really that fragile?

What happened to the baser question: Do we really depend so much on the internet?

Of course, now that we do, maybe we should look into making the internet even more resilient than the original creators envisioned. After all, it was made to endure nuclear war, but a few scriptkiddies can still take down any site with a little DDOSing and DNS-tweaks..

Just always remember where we came from.

Re:Interesting how things change

[Anonymous Coward]

What happened to the baser question: Do we really depend so much on the internet?

Do we really depend on so much on radio? Trucks? Telephones? Railroads? Postal mail? Paved roads? Ships? Messengers? Yes, we depend on all those things, and everyone seems to accept it. Why should the internet be so different? How primitive must a means of communications be before we are allowed to depend on it, in your esteemed opinion?

Re:Interesting how things change

[sconeu]

After all, it was made to endure nuclear war,

Myth. See the entry on Paul Baran here

Re:Interesting how things change

[MarkRose]

Do we really depend so much on the internet?

Yes! Last holiday season, over 10% of purchases made using Visa were online (Source - PDF). If you are familiar with trends, 10% is critical mass, the point at which a concept takes off. The Internet is very much an entrenched part of the first-world economy.

Re:Interesting how things change

[tsm_sf]

Myth. See the entry on Paul Baran here

I did, and you're sort of wrong. Here's the relevant bit from your link:

This design, which included a high level of redundancy, would make the network more robust in the case of a nuclear attack. This is probably where the myth that the Internet was created as a communications network for the event of a nuclear war comes from. As a distributed network the ARPANET definitely was robust, and possibly could have withstood a nuclear attack, but the chief goal of its creators was to facilitate normal communications between researchers.

So it wasn't designed to survive a nuclear attack, but it might be able to. Sort of like Donald Trump's hairpiece. (he's on billboards all over town right now... we're so sick of his mug)

Re:Interesting how things change

[DickBreath]

was made to endure nuclear war, but a few scriptkiddies can still take down any site with a little DDOSing and DNS-tweaks..

The threat of nuclear war is very different than an internal attack from within the network itself.

Nuclear war may wipe out a few nodes / connections. You route around the damage.

The threat which the designers were unable to forsee was the rise of Windo..., er, I meant, um, Botnets. This is different to defend against, than rerouting around failed nodes/connections. The initial design probably even had an underlying unstated assumption that all nodes were trusted.

Finally, I propose that possibly you misunderstand why the Internet was created . :-) :-)

Re:Interesting how things change

[poot_rootbeer]

Do we really depend so much on the internet?
Yes! Last holiday season, over 10% of purchases made using Visa were online

Does that show that we DEPEND on the internet, though? One might assume that if there were no internet commerce, those Visa cardholders would have made the same purchases some other way. In that scenario, the internet is a convenience, not a critical part of the economy.

Re:Interesting how things change

[Anonymous Coward]

"After all, it was made to endure nuclear war, but a few scriptkiddies can still take down any site with a little DDOSing and DNS-tweaks.."

Of course, and I understand you may realize this, nuclear war and DDOS are very different attacks. The original design was intended to withstand partial physical destruction of the hardware infrastructure -- and external attack, if you will. DDOS is an internal (i.e., internal to the inter-network system) threat that has evolved within a system that that was designed with some assumption of benign participants having system access. As with LAN security, we now recognize that internal threats (disguntled employees, corrupt insiders or infiltrators, etc.) are the more likely to present a problem than external threats.

Trusted Platform

[eMbry00s]

To all of you asking for "validiation" and such to prevent trojan infected computers entry onto the internet:

What you are asking for is a trusted/treacherous computing platform. I hardly believe that is what we want, but that is the only solution if you want to ban computers that run non-whitelist-programs.
I'm guessing that the possible abuses of such a system are a lot worse than spam mail. I hope users will become more aware of what spam is, and I can see this happening in the next 10 years; especially considering that the older people are dying and all the youngsters are growing up with computing as a daily activity.

Introduce the world to a global TC platform, and it will not go away. You say it'd go away if it would be abused too much, but guess what? The people who are at the top know how much is too much, and would not go that far.

Parts of the Internet are Indeed that Fragile

[36 6_42]

I work for a small ISP (100 subscribers currently). We recently had a customer plug in a DCHP server to our service. The DCHP server interferred with our router and ker-bang! A nasty lesson for my bosses.

Re:Parts of the Internet are Indeed that Fragile

[Sinus0idal]

Perhaps running a DCHP server is why you are still small.

what internet?

[cez]

dns has always had inherrent weaknesses due to its universal standards and how the interenet relies on it as it does. scary how the internet is only the internet that you can view through whatever controls your DNS...

Re:Fragile Internet? No...

[matthewcraig]

Why not sue each individual user? Even if the box is operating without their knowledge or consent, they are the physical owners of the machine. When your empty, parked car rolls down a hill and damages a house, aren't you still liable?

I imagine that it would not take many publicized lawsuits before Joe Sixpack also considered security and system vulnerability when choosing an operating system.

Might also consider suing some or all of the ISPs who allowed blatantly malicious traffic to pass through their wires after letters of concern were written from your office.

You might say "don't legislate the Internet!" But this isn't new legislation. The fact is, spammers and cyber-criminals are using intimidation tactics and destructive forces to scare off organizations trying to suppress their activities.

Want to find out how bad it is? Start writing "admin@.com" and complaining about the spam coming from their domain. Do this for a couple of your spam emails and you'll be on their "bulk spray spam" hit-list faster than you can say Denial Of Service ten times fast ...Thousands of spam messages per day.

It seems like the Internet is getting owned by zombie computers and their masters, and businesses are more willing to accept denial of service attacks than take punitive action.

warning: botnet operators 0wn the interweb!

[mpcooke3]

Sadly the internet is already compromised since the bot networks are already too large for most organisations to take on.

I hope someone does something to deal with the botnet threats. Being able to suck multiple gigabits of bandwidth means 'they' can kill any small to medium sized internet operation if they want to via a range of attacks from the simple to the rather sophisticated.

Tier1 ISPs usually don't care other than possibly to try and filter all your traffic to prevent their other customers from suffering.

Some medium/larger sized companies use services like Akamai siteshield that are capable of sustaining a reasonable DDOS-ing but the botnet operators will eventually realise that the attacks are not just about knocking a site offline. Akamai will charge you for that traffic which will send the companies bankrupt anyway (and possibly quicker than going offline). In fact i was wondering how on earth bluesecurity were going to pay their bandwidth bill.

The defences we have against such attacks are pathetic. I was amused in an episode of 24 when they came under an online attack from terrorists and their new "CISCO FIREWALL" protects them, i mean seriously the firewalls are the least of your problems these days. If you come under attack from one of these serious russian dudes - you'd be looking at trying to filter the traffic well before it reaches the firewalls since your line and network would be saturated.

Re:warning: botnet operators 0wn the interweb!

[mikiN]

My very sketchy idea (shoot it down if you like):
- Setup a (seperate from the internet) inter-router network
- Monitor traffic density and send status reports over the inter-router network
- As soon as certain areas (IPs, IP blocks) reach a traffic density threshold, throttle!
- ???
- Profit!

Re:warning: botnet operators 0wn the interweb!

[Anonymous Coward]

ok, lets think about that... you would end up "throttling" slashdot! (and google, digg, yahoo, akamai, etc...) Oh wait someone just made a mad Myspace page that everyone has to see, and lets not even mention youtube or any of the megadownloders, or Microsoft or Apple when a new system update comes out.

Is the nonstop 24/7 Internet fragile?

[Mattness]

The internet is so not fragile it isn't even funny. Can people make it hickup and sneeze along minor portions of it? Yes. Is it fragile? Hell no! It's been running for 20 years across the globe. It has been hammered by viruses, trojans, organized DDOS attacks and world-wide calamities and their corresponding data-storms and still the internet as a whole has functioned. It may simply be that the internet is not enough of a singular entity to be susceptible to a singular vulnerability. Computers are fragile, software can be fragile, but the aggregation of those two into an organism made up of millions perhaps even billions of machines is not fragile. The DDOS attack on Blue Security, when compared to the totality of the internet is practically meaningless. The only thing that might make the entirety of the internet fragile would be a universal vulnerability which has no workaround and cripples the main traffic routes of the internet itself. Maybe this will happen, but I think even then, the internet will continue to function but perhaps just along it's backroads and private secure networks.

Cyber-Vigilantism

[Sentri]

So cyberterrorism is running rampant huh?
Lets find some geeks with enough redneck in them to set up some cyber-vigilante gangs to go recruiting, shooting, and looting. And maybe look for these nasty russians aswell.

Seriously though, what do we need to stop spam?
I think we need some sort of grassroots effort. The antivirus/antispam companies wont 'stop' spam in the same way that pharmaceutical companies wont 'cure' diseases. It is in their best interests to make the problem bearable, and charge alot of money for the privelege of having bearable spam/disease/virus's

We need to do this ourselves.

Having said all that, vigilantism may not be the best way, we all know it doesnt work to well in the real world.

It doesn't make sense

[gnurb]

Why would the spammers be 'hellbent' on taking down bluesecuritie's site, *after* blue posted the message saying they were going out of business. Just for fun?

Re:It doesn't make sense

[Anonymous Coward]

For the same reason parents spank their kids; it felt good.

Fighting fire with fire

[nephridium]

That was the concept of Blue Frog. And it seemed to piss off certain spammers so much that they got out a weapon at their disposal DDOS which works perfectly against centralized systems like the Bluefrog system.

Consequently they logical way to would be to use the same means, i.e. attacking them from distributed sources as well. Not in the form of zombies like Pharmamaster did, but in the form of distributed database software. The 'other' blue frog (Azureus and its DHT) comes to mind - a similar distribute database software could be written that (instead of distributing seeding nodes and data packets) 'spams' the spammers. Now we just need someone who will do it (Bluefrog?)..

Re:Fighting fire with fire

[nephridium]

Argh sorry for the typos and incoherence, dudes - I'm quite tired. But what do you think about this idea of a decentralized network spamming the spammers? Possible? Effective?

Re:Fighting fire with fire

[mikiN]

Quite workable methinks.

It could be implemented as an Azureus plugin

Sketchy scenario

- Monitor RSS feed(s) for antispam torrents
- Verify seeds for authenticity (apply crypto to taste)
- Share the torrents containing target IPs
- Blast the spammers!

Re:Fighting fire with fire

[Anonymous Coward]

Ok, fight fire with fire but how does one actually determine the source of the spam?

The spammers could use the same DDoS zombies to host mail forwarding while changing the mail envelope instead of centralized mail servers?

Maybe some strategic honey pots?

A 'white knight' style trojan?

Re:Fighting fire with fire

[miley]

huh? For forwarding to come into play, the end recipient has to get an account under that domain so that mail addressed to sally@sdlsdfsdlfjsdlkj_sdff.com can then get relayed to the real account.

The source is most likely a zombified windows machine nowadays.

Phone outages

[mangu]

In my entire lifetime, I've not one time experienced a phone outage, not once!

You are lucky! I've had several phone outages. I had a few outages caused by water in the cable ducts in my street after heavy rains. I had one in the old days (~25 years ago) of analog hardware that took them several days to fix. I've had an outage caused by a truck hitting a utility pole, in a neighborhood where the cables were overhead.

Although telephone stations are more robust than the internet, because they are very specialized and have lots of redundancy, the last mile is susceptibel to outages. Of course, internet connections use the same last mile, so they are also vulnerable. I agree, the phone service is more reliable than the internet, but this does not mean it cannot fail.

Re:Phone outages

[maxume]

I have phone outages all the time. It is a consequence of living in an area where the phone was a party line in the '50s and there just isn't the population to encourage infrastructure upgrades.

Re:Phone outages

[WhiteWolf666]

I've had several POTS outages (DSL too, of course) in an SBC area of S. Milwaukee, Oak Creek, WI.

They claim its construction problems during upgrades, or just cut cables.

*shrug*

Re:Phone outages

[innocent_white_lamb]

A couple of years ago the phone service went out completely in a fairly large city not too far away from the town where I live. The radio station started broadcasting "If you have an emergency, radio-equipped police cars with lights activated are located at the following intersections" followed by a list of locations. They did this over and over continuously for about three hours until the phone service was restored.
 
First time I've ever heard of that being done. I thought it was a rather clever idea.

Re:Fragile Internet? No...

[Vancorps]

That's it? Of the hundreds of million machines out there that's pretty good! If thats the case then its all about the last little bit with not even 1% of Windows machines being infected and used for such tasks things don't look so bad. Can't forget the broad scope that is Windows.

Seems to me like ISPs should just ban port 25 everywhere. If you are a business hosting your own email then pass abuse.net certification and then the ISP will turn it on for you. Same could go for home users. Can't really do this with DNS for obvious reasons though.

selfhealing networks have been available for years

[Anonymous Coward]

I get sick of this stuff.

completely automated, fully self-healing technology for networks and the internet
has been available for YEARS!

yes even 5-10 YEARS now! it's out there.
nobody wants it.

Yet you keep whining about not having it. well it's around.

just check out one, called "L2R". it works. try it.

Re:Fragile Internet? No...

[MrNougat]

What is fragile are the tens of thousands of pwn3d Windows PC's that are being used without their owners' knowledge to perpetrate these massive DDOS attacks. If I were a lawyer for Blue Security, Yahoo, or anyone else who has been hit recently, I would be seriously looking in to the merits of a lawsuit against MS for gross negligence or something similar.

You're right on the first part, wrong on the second.

It's true that if there weren't zombie machines out there to take part in botnets, that DDoSing would be much less of an issue, if one at all.

However, suggesting that Microsoft could be legally liable is right out. Just because I leave all of my car doors open and the keys in the ignition doesn't mean someone has the right to steal my car. I may be stupid, yes, but I am not legally liable for the crime, and I'd be able to make the insurance claim, too (unless there's a clause in my policy that says I need to adhere to certain standards of vigilance in order to qualify for reimbursement).

Suggesting that Microsoft is at fault for the botnets is the same as suggesting that BlueSecurity is at fault for the 'collateral damage' outages.

The people responsible for the mayhem - at least in a legal sense - are those who have perpetrated it.

(Oh yeah, IANAL, but I watch Cops on TV all the time. Cops set out 'bait' to catch thieves all the time. Expensive mountain bike unguarded and unlocked; someone walks off with it, cops swoop in and make the arrest. Same concept here.)

An Open Source Bluefrog

[gnurb]

Some folks have decided to continue where blue security left off - apparently they recently also got the source code (and presumably best wishes) from blue

DDoS is not violence.

[weierstrass]

Making multiple DNS requests is not a violent act. It's the electronic equivalent of following you around in the street repeatedly asking "What's the frequency, Kenneth?". I could be done for harassment, but not for assault.

Re:DDoS is not violence.

[moz25]

Tapping you on your shoulder is not a violent act either, but if it's done a million times per second, it's going to hurt.

Re:Fragile Internet? No...

[Original Replica]

Start writing "admin@.com" and complaining about the spam coming from their domain.
What about suing said .com ? I'm not a big fan of litigation, but this would seem appropriate here. The owners of the domain are in another country, ok sue to have that domain cut off from the DNS system. Anything coming from that domain will go nowhere, they lose the priviledge of being part of the internet. That could go for domains, or certain servers or whole countries, play nice or get out.

Re:Fragile Internet? No...

[Elminst]

When your empty, parked car rolls down a hill and damages a house, aren't you still liable?

Ahh.. but this is not the same....
this is more like; you park your car on the street and leave the keys in it. Someone comes up, hops in and drives off with your car, then uses it to smash into a bank.

you are not responsible for their commiting a crime, whether they did it with your car or not.

Yes, you're an idiot for leaving your keys in it, but you are not commiting the crime. the person that stole your car is.

Ahh... the never ending stream of "computer is like a car" analogies...

Standards

[justchris]

I think it's a question of standards. There are standards for TCP/IP, DNS and all these other protocols and utilities we use on the internet. The problem is, the standards are built to the lowest common denominator, not the most secure. If we required all DNS servers, top-level domain providers and ISPs to adhere to a standard of security (to the point that, if your servers are insecure, no other server will accept requests from you), while it would not get rid of problems, it would significantly reduce their impact.

Of course, some companies are doing this voluntarily, to the point that they are rejecting email from domains that do not meet certain requirements. But it's not a standard, so that means that someone's going to find a way around it.

Part of that is because the internet is still building itself as we speak. It's not a project that was planned and implemented, it just sort of happened, and it keeps just sort of happening. That's what makes it so wonderful, but it also makes it incredibly vulnerable.

So basically, you face a trade-off, the same kind of trade-off you face in life outside the internet. How much of your freedom are you willing to give up for the sake of security?

Try reading a dictionary once

[Anonymous Coward]

From m-w.com
Violence
3 a : intense, turbulent, or furious and often destructive action or force

SNA to the Rescue!

[6800]

In those days gone by, IBM was reluctant to support any moves to tcpip, infact vendors with tcpip based products were the competition. The reasons were at least two fold, SNA was deeply imbedded in the then current product line AND they thought tcp/ip was an inferior network.

Well the customer clammer arose loud and IBM succumbed to the marketing opportunity and SNA is now a little known but still tough as nails network archetecture.

Now with the rise of tiered networks on the horizon, the headaches of admin and all, SNA might again be found desirable, at least for some of us old fogies.

Re:Fragile Internet? No...

[Fatchap]

If you did that nobody would be able to email from home unless they passed. As having a system turned into a bot could happen anytime this would have to be an ongoing process. I can't see how that would work in reality

Also relevant:

[Anonymous Coward]

http://castlecops.com/postitle156112-0-0-.html c/o digg.com

Re:Fragile Internet? No...

[saleenS281]

AGAIN, NOT WINDOWS MACHINES. This was DrDOS from misconfigured BIND servers running on... you guessed it, *NIX.

But spammers don't want to take it down

[karlto]

Who would they peddle their viagra to if there was no-one else on the Internet?

Fixing the DNS problem

[Animats]

OK, now we have to fix the DNS problem.

The basic requirement here is that DNS servers shouldn't be accepting queries from clients outside their local organizations. This is like the old "open relay" problem with SMTP. Obviously, such DNS servers have to be fixed. To force the issue, DNS servers queried by other DNS servers should find out if the querying server incorrectly accepts queries from the outside. If it does, that server is marked as a loser, and its queries get processed only after any other queries, and maybe with a deliberate delay. That should deal with the problem in the near term.

The stronger form of this protection is that many queries from loser servers are answered with an address that returns a page saying something like "Your DNS server at [xxx.xxx.xxx.xxx] has a problem and must be upgraded." The screaming users will get the problem fixed.

Re:Fixing the DNS problem

[necro2607]

heh. "Your DNS server at [xxx.xxx.xxx.xxx] has a problem and must be upgraded."

Sounds like a popup banner I would close immediately without thinking twice about...

Re:Fragile Internet? No...

[Anonymous Coward]

Restrict 25 to their own mail servers. Require SMTP_AUTH. And tag all outgoing email with the real email address (sender field) based on SMTP AUTH.

That way if a home user is compromised, there's no guesswork to track them down.

Internet a infastructure delicate balance

[SeaFox]

I think a bigger question has been raised - is the Internet really that fragile?

Yup, so by all means lets heap some HD Video on top of it.

Fixing the attack problem

[Animats]

Fixing the attack problem is going to require a combination of forensics work, investigation, and muscle. There are companies in that business, such as Kroll International and Securitas. These are the companies you call when there's a big problem. They have the resources to conduct an international investigation, from accountants to former British SAS people, and if it takes people with guns to solve the problem, they have them on the payroll. The bill might be in six or seven figures, but there are times when a company needs to spend that kind of money.

You just proved him right.

[ClioCJS]

You just proved him right, actually. ha ha

Re:Fragile Internet? No...

[beoba]

No, the Internet is robust and redundant. In agreement: After all, the internet as a whole apparently had no problem forwarding a DDOS-sized burst of requests to BlueSecurity, it was just that they (or their ISP) were unable to handle this burst once it reached them.

What's this about INTERNET fragility?

[jthill]

Anybody care to estimate the number of people who would have even noticed this absent the media reports? How about how many more more than peripherally noticed the media reports? I'll post an entirely wild-assed guess: something like 50K people worldwide have any real clue what happened, and fewer than a five thousand of those experienced any actual symptoms.

This was nothing. We've known for years that it doesn't take a whole lot more than script kiddie competence to drop a site or two, just about any site, and that's all they did. Remember what'shisname, Gibson was it? They've been able to do it for years, and nobody is willing to install and run the technology necessary to defang them. BECAUSE IT AIN'T WORTH DOING.

<gets a brainwave> Duhhhh. Talk about overkill. Next /. poll: how long would it take the NSA to find them all? Answer number 4: There's only one.

Re:What's this about INTERNET fragility?

[arkhan_jg]

Well here in the UK, we were affected. Our users (including me) were having trouble resolving a number of sites yesterday, including .org and .uk ones, that the dns cache didn't have. I've had to send out a organisation wide email to explain the problem, why the 'intenet was broken'.

Re:Fragile Internet? No...

[matthewcraig]

Hmm -- I don't agree with your analogy of the spammer being like a car-jacker who operates the car illegally. The spammer is NOT breaking into your computer -- the user is active participant in loading the trojan and providing the environment for the zombie to operate. At the least, he is negligent, at worst, an accomplice.

Use hackers' techniques against them

[Dadoo]

Since most of the zombies belong to people who don't know any better and are too lazy to do anything about it, we should be able to use hackers' own techniques against them. When a remote "mail server" connects to your mail server, probe the machine for all the known remote exploits. If one is successful, install a virus on it that replaces the boot sector with a program that says something like:

Your machine has been determined to be a spam zombie. None of your files have been deleted, but you will need professional help to get them back. After your computer is restored, INSTALL PROPER SECURITY SOFTWARE and/or GET A PROPER FIREWALL to prevent this from happening again.

Of course, all they'll really need to do is go to Best Buy or Comp USA or wherever and have them run "FDISK/MBR" and scan for malware, but it's enough of a pain so that they'll put some effort into making sure it doesn't happen again. I guarantee, it would only be a matter of weeks before all the zombies were gone.

Shut off the supplier

[Anonymous Coward]

I've long held the view that the solution to attacks is to shut off any server which supplies a packet with a spoofed originating address. Only when the downstream supplier of that packet has been identified and shut off can the parent be reinstated.

For example, my PC connects to an ISP who connects to a wholesaler (is that the right term?) etc. If the wholesaler detects packets coming from the ISP which do not originate from that ISP's IP range, then the ISP should be shut off. In turn, the ISP would have the responsibility for ensuring that all packets exiting its network had valid IP return addresses, and if my PC did not comply it would be shut off.

This would give us a guaranteed trace to the originators of so many attacks, and a means of removing them from the internet.

Yes, there would be massive network outages in the short term, but it would create a great incentive to identify and remove the rogue ISPs, and finally the rogue / owned computers.

Why does everyone make this needlessly complex?

[Anonymous Coward]

1. Provoke an attack.
2. Grab all of the IPs querying your server during the DDoS.
3. Shut off your connection before the server goes down.
4. Transmit the IPs to the approriate ISPs.
5. Have them shut down the ISP customers
Or
Route all of the compromised PC traffic to a page that requires scanning for viruses and the installation of security software
AND
If possible shutdown those customers' access to the IRC (either through software or ports, etc). No IRC, no commands for the botnet. Anyone that needs the IRC must contact the ISP to get that service restored. Most customers won't even know it is gone. Most customers don't even know what it is.
6. Repeat 1-5.

If the customers get angry the ISP can explain to them compromised PCs are unwittingly taking part in a criminal enterprise and are violating the ToS for their contracts.

It probably wouldn't kill all botnets, but you could probably start taking some chunks out of them if you get enough IPs.

Very easy

[scruffyMark]

If you did that nobody would be able to email from home unless they passed. As having a system turned into a bot could happen anytime this would have to be an ongoing process. I can't see how that would work in reality

You let them connect only to smtp.isp.com on port 25. smtp.isp.com has egress spam filtering. What you don't let them do is connect to any smtp servers outside of that.

smtp.isp.com has spam filtering (it doesn't have to be perfect, as a spambot is pretty noisy if you catch it at the source), and if the customer trips the spam filter, you cut off their email sending access until the problem is fixed.

Why is everyone overlooking the obvious solution ?

[nomad63]

The #%^^@$! spammer jerk has thousands of computers in his bot network and leashed them on BlueSecurity. So far so good. These zombies are mostly on broadband connections, served by a cable or DSL provider.

Isn't it in the TOS of the ISPs to require the end user to keep his/her computer safe from viruses and malware, crippling the provider's network ? If so, why the ISPs shut those zombie machines' network connectivity down ? Yeah, there will be few bystanders who may get nabbed but most of these bystanders will be the geeks who are pushing their broadband connections to the limit and they will contact the ISP and get their connections re-instated. The clueless users, whoch have been own3d by the hacker will have to find someone to clean up their pc's caoghing up some dough which will make them a little more carefull about listening to people when they were told not to open attachments to see the cute dog pictures or accept free product offers from inscrupulous websites.

If you do not hold the ignorant users' feet to the fire, this zombie issue will not come to an end. Yes, we al know that, Redmond's finest operating system is no more than a joke when it comes to security, but if one is buying this crap, they should be ready to keep it safe and secure or find some other platform, let it be mac or linux or what have you.

I for one, am sick and tired of seeing the spammers to go unnoticed while the solution, regardless how brutal it is to the end user, goes unnoticed. Enough is enough !

There's a term for that one...

[woolio]

C'mon cut it out will ya, soon they will brand humans multiplying without limits sucking up resources and scaring other animals away and out of existence : Biosphere terrorists?

Nope. They're called Americans

(Yes, I'm from the US).

dnssec

[tcyun]

we should be talking about how to encourage the deployment
dnssec and related protocol modifications/enhancements.

yes, re-creating the internet from the ground up to be safe from all harm would be nice. i suspect that this effort will take a little while. until then, interim measures should be pursued. dnssec is one of them.

How long before the RIAA hires a botnet

[Oztechreich]

I wonder how long before the RIAA hires a botnet to attack sites that they can't get at otherwise (allofmp3 for instance?)

And then, how long before one company takes down another company using botnets?

Re:How long before the RIAA hires a botnet

[Sentri]

Corporations wagin open war upon one another is part of many dystopic futuristic scifi

luckily they cant do it so openly yet..

yet

Fighting fire with fire is stupid

[dbIII]

Consequently they logical way to would be to use the same means, i.e. attacking them from distributed sources as well

This makes no more sense than returning every spam email and sending back every virus email and will just clog the network used by innocent bystanders and piss everyone off. If you know enough to send something to the source address then you know enough to just drop packets - and if you can do it in enough places not much will get out. Even this can create problems if it is implemented badly - consider the behaviour of some of the spam blackhole lists.

Re:Fighting fire with fire is stupid

[nephridium]

I like the metaphor "fight fire with fire" because it illustrates that it depends on the concept and methodology, whether using fire to extinguish another one will just escalate the problem or whether it will kill off the other fire's ressources.

In the same way I'm pondering about whether this approach will initially cause more fire (the clogging you talk about), but eventually will kill off the spammers on by one, or whether the spammers will find ways around this system as well.

They seemed to be pissed off by the bombardment of their servers by Bluefrog anyways.. So it does seem to be one of their vulnerabilities - they do need to receive the 'legitimate' replies (ie. those by people that really admit having small dicks to anonymous companies) on their own servers.

If they opt for using zombies to spam mails that will at least make it more complicated for them and the permanent additional traffic might alert some of the administrators (and some users) to secure their systems.

Maybe this should really be implemented as an open source plugin for file sharing programs that already use up a lot of the net's bandwidth. The coding has to be waterproof though..

CoDoNS

[Tracy Reed]

We desperately need to implement new internet infrastructure. I am highly in favor of:

http://www.cs.cornell.edu/people/egs/beehive/codon s.php

This could make the DDoS attack impractical. But for now it seems that the Cornell guys are playing their cards pretty close to their chest and not releasing source for their software so the rest of us can use it. Distributed Hash Tables are the way of the future.

Someone is full of sh**

[Zaphod2016]

This company was back by MILLIONS in VC money.

To the disappointment of users, they pulled the plug without any warning.

Of course, this probably makes me sound like some evil spammer. I am not.

(at least) two open source projects are in the process of taking over the BF source code. BlackFrog already has a name, other are being discussed at http://bluefrogfanclub.com/ (hosted by Google Groups).

The comon thinking is that a P2P system is the way to go. As best I can tell, these projects and groups are being run by good people with the best intentions.

Blue Security on the other hand...

Terrorism, the Mafia, and /etc/hosts

[abb3w]

First, as usual there are problems with the summary. The good news is this (IMHO) isn't Terrorism; it's closer to a classic protection racket, with a mix of snake oil sales, that's also willing to make an example of anyone who tries to stand up to them. That is to say, a cyber-Mafia, not cyber-Al'Qaeda.

The bad news is I see no reason why this cyber-Mafia would have any hesitation to hiring out to Al'Qaeda, as long as the money is good.

On the bright side, this is a DNS attack, not affecting (so far as I can tell) the routing of IP packets themselves. You can get there, you just can't get a map. Thus, "/etc/hosts" is a fallback strategy. I'm old fashioned and deeply paranoid. Besides loopback on some of the really annoying ad sites, and the eleven machines on my personal networks worthy of names (six legitimate, five unofficially at "something.MINE" addresses), I've always had google.com and cert.org. I'll be adding resolutions for: cnn.com, bbc.co.uk, slashdot.org, mirrordot.org, and a few others. At least if DNS goes down, I'll have a chance to read about why.

Anyone have other better ideas for further preparations us IT peons can take?

Re:Terrorism, the Mafia, and /etc/hosts

[Anonymous Coward]

>I see no reason why this cyber-Mafia would have any hesitation to hiring out to Al'Qaeda, as long as the money is good.

If you work for Al-Kaida with electronics, you are dead, period. Anything maxwellian the NSA can locate in seconds. The only thing that keeps Prince Laden and Dr. Zawahiri alive is that they only use paper, pencil, camels and personal messengers for communication. Their occasional videos and speeches are first sent on tape to a remote place, where it can be digitized and loded to the net without revealing their true location.

Remember the chechen rebel warlord Dudayev, who spoke on a satellite phone in 1996? US satellites located him and the position was forwarded to the russian airforce in real-time. An Su-25 attack plane fired a missile on his car, the explosion tore off his arm and he bled to death.

The federal USA is much mightier in high-tech than any mafia or hacker ring can be. Not worth taking the risk, you won't survive.

And I don't have a problem...

[bwcbwc]

saying that all of those people/organizations exhibit terroristic behavior. I would add than any government of laws uses a certain level of coercion on the members of it's society. Similarly, children are forced to attend school. SO it isn't just being coerced and threatened that constitutes terrorism.

Terrorism is the little guy's reflection of tyranny. When they use violence and threats to get what they want, the powerful are tyrants, the humble are terrorists.

Besides coercion and the threat of violence, there has to be a certain level of actual violence. And you should also mention lawlessness. The tyrant and terrorist distinguish themselves by excluding themselves from the obligations of the rule of law, and their threats are credible because they are usually carried out. So, many fundamentalist terrorists violate the tenets of their own religion (jihadists and abortion clinic bombers for example) under the belief that the outrage they are fighting against doesn't deserve the law.

Interestingly, under this definition, we end up with Patent trolls, and MPAA/RIAA off the list. They may wield the law like it was a nuclear weapon, but they don't have guys going to people's houses to knee-cap them. Some of the others depend on how you interpret events. The NSA, FBI, and UN seem to stay within the law on the surface. And the evidence otherwise is debatable, especially when you include the requirement of an active threat of violence. On the other hand, Greenpeace, PETA, bullies and the others qualify (though I haven't heard of Greenpeace eco-terrorism in a long time). Finally, you left out drug dealers and street gangs, which are much worse than school bullies, even if you just consider witness intimidation. And George Bush is looking a lot like a tyrant.

He's certainly expressed that he considers certain laws as not restraining his own executive authority, as in the notes associated with the signing of the McCain anti-torture bill. His justice department has also expressed that "unlawful enemy combatants" are outside the pale of the Geneva convention, even though they (eventually) elected to honor it. Special extractions, Guantanamo and Abu Ghraib demonstrate that he is willing to condone violence outside the law (though he may still have his foot holding the door open).

I won't even get into all the other hot topics we always see on /., other than to note that the administration is very into "the ends justify the means". You constantly hear Cheney, Rummy and Bushie saying things like "You've got to remember that these are very bad people we're trying to catch." whenever someone complains about how things are being handled. It doesn't matter if you're trying to catch terrorists or squirrels, unless you believe that the ends justify the means.

So IMO, Bush stays on the list of terrorists and tyrants. If nothing else, it just disturbs me that regardless of whether his actions are legal or not, whenever he exercises his power, it always seems to be in the direction of greater secrecy, greater government control over dissent, and greater monitoring of the general public.

Re:And I don't have a problem...

[Redwin]

Mostly I agree with you, the main thing I disagree with however is the requirement of actual violence. Physical harm is not the only means of coercing someone into doing something. Surely fincancial threats (RIAA/MPAA etc) is just a relevent? "We will kill you (financially)" and it has actual events to back up the threat. That seems to fit all the required criteria doesn't it?

Personally, something that I've seen as rather ironic is the strategy of "scaring the populous into needing more security measures with the fear of terrorist threats". By definition is that not terrorisim itself? "You will let us do this or the terrorists will get you". Only one level of abstraction away, the terrorists carrying out the attack not the government directly (although imprisonment without trial etc might disagree with this).

Stating that the nation is under the threat of terrorisim, is something that it always has been under, you have crime therefore you as a people may come under attack from it at some point. Being mugged/murdered/raped etc isn't new and as a society you know that it happens and take your own precaucions. It is just that as a "terrorist" it clearly defines who the enemy is. A middle eastern person with a strong religious agenda. Not joe six-pack who may live in your neighbourhood. Danger! Danger! A terrorist may be coming up the street right now to blow up your local store when you are in there! Has a lot more effect than "Danger! Danger! A guy might be about to rob your local store and he may kill you as you could be a witness". Anyway just my thoughts on the subject.

No! No! Right idea, wrong implementation

[whitehatlurker]

DECnet to the rescue.

Yes, but it's more than that.

[jd]

With the move away from US Government-funded infrastructure towards a purely profit-making attitude, virtually any redundancy in the Internet has been eroded at best, eliminated at worst. Redundancy costs hard cash and earns nothing extra. The days of the backbone being able to survive a full-scale nuclear attack are over. These kinds of attacks will persist - and worsen - because an individual is quite capable of summoning a cyber-army of zombies that can easily take out any one of a number of single points of failure.

The backbone providers are unlikely to care that much - it impacts a little business, but most make money off their inter-corporate and inter-Governmental lines. The more the Internet degrades, the more high-priced services the major vendors can sell and the more copper/fiber the telecos can charge for. I don't see much of a motive to fix things here.

The vendors further up the chain don't need to care much, either. The companies on the Internet can't gain by switching ISP, because it's the backbone that's broken and they'll have to go through it to reach the peasents - err, home users anyway. The corporations that sell over the Internet don't lose any sales, as a person who is going to buy from an online store is likely to be doing other stuff and won't go out to the stores, so they'll be back. Home users, for the most part, are ignorant enough to think AOL and MSN are really neat ideas, have no clue what the Internet involves, what needs fixing or why, and is likely to pass it off as someone else's problem anyway. And those who ARE smart enough are Libertarian enough that they won't Unionize and DEMAND the fixes that damn well should be made.

(IT users and IT professionals should stop with the "unions are evil" crap - no organization is any more evil than the people in it - and collectively insist that the defects be fixed. No ifs, no buts, no maybes, no excuses, no delays - these kinds of attacks SHOULD be impossible and COULD - very cheaply - be made impossible. But nobody is going to even take the cheap option without a fight, if there's an even cheaper option of apathy open to them.)

Re:Yes, but it's more than that.

[mutterc]

no organization is any more evil than the people in it

What about corporations? Most people in a corporation (yes, even CEO's) are decent. There are very few people who are as sociopathic as the typical corporation. Do you know anybody who's willing to run society into the ground for a small amount of short-term personal gain? Do you know any corporations that are not?

Re:Fragile Internet? No...

[ElAsturiano]

Exactly! Blue Security should sue Micro$oft just like the families of shooting victims sued handgun manufacturers in the past. The concept is very similar: although the gun people were able to prove that "guns dont kill people" they still lost because their manufacturing and marketing practices were making it extremely easy for innocent people to be on the wrong side of the gun at the wrong time. Windows doesnt launch DDoS attacks on its own but M$ puts crappy, half finished software on the market and its marketing tactic is to make it hard for the average Joe to buy a computer that doesnt come preinstalled with Windows ==> the innocent is standing on the wrong side of hundreds of thousands of computers attacking his livelyhood and his integrity. M$ should pay.

War on Spam?

[Anonymous Coward]

Since BlueSecurity was an Israeli company, maybe Shin Bet will take a sudden interest in "taking out" some of these Russian-mafia-spamking types. I wouldn't shed many tears.

P2P Blue Security?

[Fordiman]

This makes me wonder if a peer-to-peer antispam system is in order. Like anything, it occurs to me that Blue's weakness was its centralization.

Let's see spammers take down a distributed system with a distributed DoS. Somehow, I doubt it's possible.

  should probably get started on designing this...

Re:P2P Blue Security?

[dutibudg]

Some people already started a new project based on the blue frog.
Check out:
http://www.okopipi.org/

Well that is easily explained

[SmallFurryCreature]

Take a CD and insert it in your PC and try to read it.

No problem right?

Okay now intervere with it script kiddie style. Scratch it and try to read it again.

Notice how your computer grinds to a halt as it tries to read the damaged area?

Okay now let a nuke fly. Totally obliterate the CD by removing it from your PC. Try reading it again. That didn't take long to fail did it?

Nuclear attack would have destroyed a connection. This is easy to detect and causes very little load on the machine that has been disconnected.

A DDOS however keeps the link alive just saturated so now the machine that is connected has to deal with a huge load.

The machine can't simply decide to cut the line if it goes over a certain limit so it just has to deal with it.

This makes a nuclear attack much simpler to deal with.

I can see the same effect on my linux machine. It tries to mount some network shares during boottime. Now two things can go wrong. Sometimes there is no network connection at all. This is simple. If there is no network you can't mount a network share and so the script fails almost instantly. IF however for some reason the remote machine ain't serving properly then it takes ages as the bootscript has no way of knowing if the remote machine is down or merely slow as hell.

So yes the Internet is that fragile. It was designed to deal with outside threaths, not inside.

Re:Well that is easily explained

[FireFury03]

A DDOS however keeps the link alive just saturated so now the machine that is connected has to deal with a huge load.

The machine can't simply decide to cut the line if it goes over a certain limit so it just has to deal with it.

Well, more importantly than that, a DDoS attack is directed at a specific host, not a specific connection. Take down the connection and the DDoS traffic just gets rerouted via a different connection... oh, and you probably just made the effects of the attack worse since you dropped your primary high-bandwidth link so now the same amount of DDoS traffic is going over the smaller links.

Taking down a link that DDoS traffic is flowing over is very similar to preventing traffic jams by closing the motorway - you just end up shifting that traffic onto the smaller side roads, which were probably already at capacity anyway.

A DDoS attack is pretty much impossible to filter since it's coming from *everywhere* - even if you filter it on your link then it's probably still having a serious effect on the links upstream of the filter. The more upstream you move the filters, the more filters you need and the more ISPs you need to cooperate and implement those filters.

Re:Well that is easily explained

[vandon]

So yes the Internet is that fragile. It was designed to deal with outside threaths, not inside.

No, the problem is that the Internet was created as a trusted network between universities. IPv6 has been created as an untrusted network and many of these problems would disappear if everyone switched.

Re:Fragile Internet? No...

[cogg]

Yes, you're an idiot for leaving your keys in it, but you are not commiting the crime. the person that stole your car is.

IIRC there is a law in the UK with regards to failing to secure a motor vehicle (but I'm supposed to be working so I haven't dug up a cite)

os x botted...

[sxtxixtxcxh]

i've had my computer compromized running a bot. i had a tcpdump showing it was reporting to a couple different IRC servers. they got in through brute force attack on my ssh server. most likely they got in through my test account, username: test, password: test. i know.. ultra secure. but it was my fault for leaving the account enabled after finishing my troubleshooting. i doubt i'm the only os x user guilty of having a weak username/password with remote shell access.

Re:os x botted...

[Blakey Rat]

How about some information I can sink my teeth into? What was the process name? How did it infect you? What should I be looking for? How do I remove it?

Re:os x botted...

[sxtxixtxcxh]

i only figured something was wrong when my bandwidth and processor usage kept spiking. i did run top, but i didn't notice anything out of the ordinary. i ran "lsof | grep ESTABLISHED" to see what was connected to what, and that's how i figured out what ports to tcpdump. to get rid of it, i just removed the compromised account.

as far as how they got in... have you ever looked at your ssh auth logs? i had a stupid username/password combo. i've noticed an increase in brute force attacks whenever i used bit torrent. but... correlation != causation so i don't know for sure. of course, i'd still get attacked even if i wasn't using bit torrent. i got tired of the attacks (which really takes a toll on my tibook) so i eventually just disabled ssh port forwarding on my router.

you can restore ssh logging using this hint and see for yourself.

Oh okay

[SmallFurryCreature]

Mmm, what then. Ah, the spammer is from russia so how about "Communist attack on the internet". That better?

No? Oh okay, how about russian spam is often for pedo sites. "Pedo's attack on the internet". Nah, "Red Pedo's attack Internet!"

Yeah, that will work. Good thing we got rid of the mention of terrorists. After all people might argue that one person's terrorsit is another freedom fighter but no-one will dare come to the defence of pedo's. Or pinkos.

Re:Oh okay

[Opportunist]

Nah, Commies are so 80s. They're dead. Like disco.

Why does it have to be hyped? Can't we sit down and talk sensibly? This is, objectively, a threat to the internet. It doesn't even need any hype to be taken serious. It needs no terrorists, no commies, no pedos. It is a REAL threat, we needn't fabricate one.

Re:Why is everyone overlooking the obvious solutio

[Anonymous Coward]

It's a *lot* more complicated, though:

First of all, the TOS of an ISP is usually only invoked when *their* network is affected. A customer (zombie) machine being used to bombard some other ISP's network doesn't usually have much interest, unless it is *also* causing problems on the source network.

Second, no ISP is going to try to dictate an operating system to their customer base, no matter how much sense it might make. A variant on this would be for the ISP to provide the user some sort of 'shell' program which would only allow access to the Net according to the ISP's rules. Again, this won't fly in the real world - would you use an ISP that forced you to run some program of theirs, and maybe forced a browser on you ?

Third, spammers inconvenience end users, but also generate a lot of bandwidth usage, which in turn generates revenue for various providers in the network ecosystem. So they have mixed emotions about spam, DDOS, etc. On the one hand, they don't like it if these activities actually *cost* them money. On the other hand, they like these activities when they *generate* money (indirectly, via bandwidth usage).

The problems are absolutely resolvable (or at least reducable), at the backbone/tier-1/large-ISP level without changing any existing protocols, no matter what happens on the client side. But it won't happen. Oh well. As other folks have noted, man tends to enjoy destroying things just for the fun of it.

My couple of cents

[SkiifGeek]

Going back to the GGP comment, and the price for a catch-all address is that, to a remote system, ANY address is a valid address at your mail domain. Because a bounce is considered more 'important' than a randomly occurring normal message, most systems will let them through unmolested. The issue is the brain dead systems that spit back bounces no matter what.

The stock spam is part of a stock manipulation effort by people who have significant / some stock held prior to the spamming. They quickly dump the stock a set period after the spam, and cash in on the difference. There is a small, but significant, effect that the spam will actually have on the stock price, and it forms a simplistic pump and dump scheme for those people behind it. Why try and extort money / sell worthless sugar pills when you can launder money / make a killing on the stock market and make it appear completely legal?

These issues have been going on for a long time, and I have seen my company accounts used almost continuously in various Joe Jobs (and the resultant bounces), but accept that it is part of the price for going online. It shouldn't be, but it is. It is like advertising - it is an accepted annoyance that now forms part of the background noise for the Internet. There will also always be people at the other end of the connection who don't care, no matter how much you argue the point. There is not going to be a quick and easy solution, and most of those that get brought up have more potential to harm than benefit the end user (AOL's pay us and we'll guarantee your spam gets through sort of thing).

why not to opensource/gpl the whole thing?

[ZmZ]

Then it would be developed by a big community leaving spammers noone to attack and result would be still the same - spammers getting their vgr and c14lis back to their own servers...

Hackers defeating israelis, don't believe for 1min

[Anonymous Coward]

If I understand correctly Blue Security is an israeli company. The zionists have power all over the world, they can demand NSA give them exact location info on the hackers based on carnivore/echelon/satellites/etc. Then they would exterminate the hackers, like Eichmann, the Munich terrorists or Sheik Ahmed Jassin. This is not happening, so something must be fishy about the story. Anyone who believes for one minute that somebody can be smarter then jews is definitely looney. Jews are the master race among humans, money and mind they are vastly superior, you can't beat them.

Unique IP != Unique PC

[giafly]

Not everyone has a static IP. Some (most?) of these "additional 30,000 never before seen IPs every day" could be the same PCs every time, which reduces the total.

Re:Why is everyone overlooking the obvious solutio

[imthesponge]

"A variant on this would be for the ISP to provide the user some sort of 'shell' program which would only allow access to the Net according to the ISP's rules."

This already exists: Cisco Clean Access (better explanation here). It can require current anti-virus, critical updates and the like. It only restricts computers running Windows.

Terrorism BS

[JetScootr]

It's not terrorism. Terrorism, as the name implies, is using TERROR, that is, "intense, overpowering fear" (www.dictionary.com) to achieve a goal. It used to mean that the goal was politcal, that is, to change a government's policies or force political leaders to do something.

It's a pissing contest. Nothing more, other than the cost incurred to the legitimate businesses being attacked.

J.C. in jackboots, everytime someone does something bad to someone else nowadays it's called terrorism.
Lighten up, everybody.

Re:Fragile Internet? No...

[deacon]

You picked an analogy which disproves your assertion.

Two words: contributary negligence.

If you leave your keys in the car and the door open, and some drooling kid drives off with the car and runs down toddlers on the playground, you ARE going to get sued at the least, and hopefully charged as an accesory before the fact. You are certainly enabling the crime.

There is no excuse for you to fail to follow common sense and exercise reasonable care. There's no excuse for MS either.

Re:Not fragile, just vulnerable (SPF guys!)

[Anonymous Coward]

Lean on everyone you know to implement the "sender policy framework" (its just an entry added to the DNS entries that state what the valid mail servers are for that domain). Once enough people do this, we will be able to start just dropping emails that don't pass the sender policy check (which will be all those from bots).

Where in the hell is the FBI???

[Anonymous Coward]

They spend boatloads of money catching "the homeless hacker," a guy who isn't harming anything, just doing a little pen testing for free.

How much did they spend catching and imprisoning Mitnik?

Why haven't these spammers been arrested? Is the FBI even looking for them?

Well, so long as the spamming DoSer doesn't illegally download any copyrighted music I guess he's safe.

Re:Fragile Internet? No...

[MrNougat]

Two words: contributary negligence.

Everything I see regarding 'contributory negligence' refers to its use in personal injury cases, not in property theft cases.

http://dictionary.law.com/definition2.asp?selected =341
http://en.wikipedia.org/wiki/Contributory_negligen ce
http://www.lectlaw.com/def/c125.htm
http://insurance.cch.com/Rupps/contributory-neglig ence.htm
http://www.west.net/~smith/negligence.htm
http://www.criminal-law-lawyer-source.com/terms/co ntributory_neg.html

Even in situations of contributory negligence, the injured (suing) party must have been negligent to the point that they could have been injured apart from the injuring (sued) party.

Perhaps if I had left all my car doors standing open and the car parked in the middle of the street, I would be contributorially negligent. If it's parked in front my my house with the windows open and gets stolen, I'm not negligent. Apart from the actions of the person stealing my car, I would not be "injured."

As with Microsoft - apart from the actions of those who take malicious action against computers, those computers would not be compromised.

Source is available

[Anonymous Coward]

http://prdownloads.sourceforge.net/bluefrog/

Calling this cyber-terrorism is not helpful

[Martin Spamer]

It's not helpful to call this cyber-terrorism, people do not feel terrorised by it, it sounds superlative and generally they see it as exaggeration, which turns them off and they feel they can safely ignore it.

We need to point out that internet crime, junk email, scam email, credit card fraud, ddos, ddos extortion are all
organised crime part of the broader problem of organised crime.

We need the general public to see this as a everyday threat to _them_ like mail fraud, mugging, burglary, are threats against them.

Survival of the fittest.

[Ginger Unicorn]

Why doesnt someone write a virus that is a virulent as Slammer or whatever, but that blocks off the victim's internet connection (expect for it's own worm activity)?

That way all these people who don't know or (infuratingly) don't care that their windows box has no firewall, virus scanner or security updates applied will be FORCED TO FUCKING UNDERSTAND AND CARE that they need to protect themselves and the rest of us from this stuff if they want to use the internet.

As irresponsible as this suggestion is on face value, if you look at the eventual outcome, what you get is lots of non-protected windows boxes blocked from accessing the internet until their owners either get advice on protecting their box, or learn how to do it themselves.

SSH is zero next to Windoze

[twitter]

I've perused a few of these bot squads on IRC and while there are many zombied Windows machines there are also many *nix boxes which succumbed to the brute force ssh password attacks because they had user accounts with stupid passwords.

ssh worms are a problem, but one that's several orders of magnitude smaller than the windoze threat and it's being dealt with. This is not and never will be a problem of the scale Microsoft has created.

Newbies are being protected and looked after. Newer distributions come with the ssh server turned off, so that newbies don't get burnt. The scans are easy to identify, and my university automatically cuts you off if your box starts spewing ssh scans. ISPs should do the same for ALL obvious signs of compromise. So, if you did not learn your strong password lesson by the time you set up a ssh server, you will learn it when you figure out why your networking is down. The fix is pretty simple - wipe and reload your binaries then pick a reasonable phrase based password.

Though an individual machine can and must spew a lot, there are not that many machines out here, especially compared to Windoze. This is a slow attack taking an average of one second per attempt, thanks to random time outs all distributions come with for incorrect passwords. It takes thousands of hits to find a correct user name and a typical crack of an easy password takes tens of thousands of tries. Because of this, the infected machine must scan and attach to many machines at once to have any chance of spreading. The number of ssh infected machines is a small fraction of a fraction of the world's computers. Windoze, on the other hand, has anywhere between 25% and 75% infection at any given time because of it's infamous 12 minute half life and "services" you can't turn off.

Re:Fragile Internet? No...

[Vancorps]

Abuse.net was just an example, you'd probably have to do all the testing on an alternate port, then when the test results passed they would be allowed to switch to port 25 and send email. This would obviously be combined with standard authentication. This would end the days of anonymous email but it would also end spam.

Re:Fragile Internet? No...

[gbjbaanb]

But, if you run a shared webserver, and want per-site emails, then you cannot do this (or replies will all go to the administrator).

People talk about compromised home users, but I see a lot of webservers installed without any security - some hosting control panels come with 'functionality' enabled by default instead of being secure by default. We should fix that, looking at the number of posts on webhosting forums from 'server admins' saying thev're been hacked and don't know what to do.

The solution...

[Anonymous Coward]

Time to call in Section 9!!!!!!

Major Motoko will sort it all out, and Batou will kick some spammer arse!!!

As I said: We are ALL "pwned"

[TFGeditor]

As stated in a comment in a related story http://it.slashdot.org/article.pl?sid=06/05/17/132 2258 , the spammers own and control the internet; the internet is no longer free (not as in beer); we must pay obesience to the owners by allowing their spam in out inboxes; and I, for one, do NOT welcome our spam-spewing overlords.

It is a bit like street gangs: So long as you allow them to graffiti "tag" your buildings/houses, sell drugs on the corner, and otherwise flaunt their "ownership" of "their turf," they allow you to co-exist more or less peacefully. If you start complaining to cops, covering up or removing their grafitti, or otherwise interfering with them, they visit retribution on you and yours without regard to "collateral damage."

The spammers must be stopped.

How to solve the problem?

[Rohan427]

IMEO, there is a way to fix or at least mitigate the problem. Make ISPs more responsible. The ISPs control the connections of every computer on the Internet. The technology is available (many of us have it on our own PCs and routers in the UNIX world) to block things such as e-mail with spoofed headers, port scans, repeated attempts by crackers to break into our systems, etc. The ISPs can head off most of the attacks virtually at the source. In the overall scheme of things, is trivial to disable the account of an offender. In the case of someone with a compromised system, the ISP can disable their account until they secure their system (I've had ISPs do this to people that have cause me problems on my networks). When people start losing their accounts due to their irresponsible attitude or naivete toward computer and network security, they will quickly become more responsible and knowledgeable.

If someone abuses the telephone service, it's not real difficult to have the phone company take action (and depending upon the abuse, have the offender arrested). ISPs must be forced to take the same responsibility.

The only way to stem the tide of cyber-terrorism (or whatever you'd like to call it), is to make ISPs take the responsibility to mitigate it.

PGA

Hacker info made public

[Anon-Admin]

Maybe we should run more honey pots and make the info public.

Mine gets hit all the time.

The hackers attempt to connect to Irc.hackcrew.cc (An irc server that has lots of bots on it.)

I also get to look at the files they try to download. Lots of neet scripts and hacks just waiting for me to take a look at them :)

If more of us ran honey pots and made the information public it would be harder for the kids to hide there stuff.

I have experience with Prolexic, they suck

[Anonymous Coward]

Have to post this anon to not get fired.

I have experience with Prolexic and Barrett, and it may be petty, but a network outage could not have happened to a more deserving guy. This guy would make grandiose claims, but any outage or problem would be blamed on an external source (upstreams, dns hosting, internet peering jerks) until I could prove to them that they were the ones fucking up (them with misconfiged bgp or oversaturated links). It seemed like Prolexic's techs were always having to find ways around Barrett's large ego to explain problems with me. Finally I had enough and moved my traffic away from them.

I would not be suprised is this is more than UltraDNS' problem, because I've heard the exact same excuse before.

Re:Fragile Internet? No...

[thogard]

Check out the "Innocent third party" laws in your state. When my server got targeted by Sween, I sent a nasty letter to Microsoft and they took care of the bandwidth costs. They know they are liable and the law agrees, I just wonder why some lawyer has used these laws to take some of Billy Gates money away.

Caching DNS?

[SanityInAnarchy]

I use djbdns, specifically it's dnscache, for the same thing. Bind can also be set up this way.

Basically, this is exactly what your ISP's DNS server is doing, or in fact any DNS server except the root one. I don't think they usually cache them for more than a day by default, though.

Re:Caching DNS?

[miley]

I don't think they usually cache them for more than a day by default
Why wouldn't they cache for $TTL instead of using $randomtime_that_seems_somewhat_long_for_everyone?

Be wary of the government. period.

[enjahova]

I do think your comment is insightful, up until the point where you call for us to contact our government representative.

This is not terrorism, and it is exactly the kind of thing we do NOT want the government involved in. I ask, what can the government do with legislation? Aren't these spammers already outside of our borders? It seems to me that a service that everyone likes alot can find a market solution to people trying to disrupt it. That has been the beauty of the internet so far, let everyone on and see what happens.

This is just my armchair philosophy, I don't really know anything, I'm just sure that asking the government to fix this problem is fruitless and most likely damaging. Especially since they will introduce the bill against "cyberterrorists"

Don't want illegal immigration? Jail....

[Anonymous Coward]

employers who hire them.

Don't want spam?

Jail companies that pay the spammers. When a cibercop clicks on a URL in a spam that company/website owner that is first contacted should be jailed. Just follow the money.

DJB equivalent

[SanityInAnarchy]

Here's how I do it with djbdns:

I have TinyDNS listen on the external interface. DJB will always be bound to one interface, listed in env/IP.

I also have a local TinyDNS, because the internal address is different -- for instance, local clients connect to 10.1.1.1, external clients connect to the external address -- no sense sending local clients to the external address.

And finally, I have an internal dnscache. Aside from being only on a local address, I have to explicitly tell it which networks are allowed to access it by creating files in root/ip -- in my case I have two empty files (hardlinks of each other) called root/ip/10.1 and root/ip/127.0.0.1. I configure it to look up requests for my domain from the TinyDNS on localhost, and all other requests get cached from my ISP.

The point is, it's very hard to misconfigure DJB in the way I think people are describing, because dns caching is a different program entirely than dns serving, and the dns cache has to be explicitly configured for each network it allows beyond localhost. If you're just serving DNS, you probably aren't even running a cache. If you're just running a cache, you'd have to work to make it accessible to anyone on the Internet.

THANKS NSA!

[Anonymous Coward]

End of message.

Hmm...

[SanityInAnarchy]

Two things I'd do:

1.) When you trap them, really trap them, as in tarpit/teergrube them.

2.) When you've got a couple of live ones caught in that trap (there's a limit to how many connections you can keep open that way), start contacting ISPs.

3.) Write to your Congressmen and tell them that you want users to be responsible for anything done with their machine, unless they can prove it was done by someone else.

The goal is to get a large settlement from each one of those IPs, so that people start to take security seriously again.

ISPs should do egress filtering

[SaberTaylor]

I don't see 'egress' on this page, so I'll just throw the usual advice out there. ISPs should filter traffic coming out of customer computers to only allow i,p. addresses that the ISP has assigned. This is ok since if the customer computers are using other i.p. addresses, then they have no network functionality other than to do denial of service attacks.

a terrorists objective

[petermgreen]

is to strike terror into a population. By doing so they aim to cause far more indirect damage than the direct damage of thier attacks.

Muggers at least normally are mugging people because they wan't money (either directly through cash, through using stolen cards, or by selling other property). Any terror struck into the population is a side effect and in fact may have a negative effect on the muggers primary objective by reducing the number of potential victims.

"Windoze", LOLOLOLOL!

[Anonymous Coward]

ssh worms are a problem, but one that's several orders of magnitude smaller than the windoze threat and it's being dealt with. This is not and never will be a problem of the scale Microsoft has created.

*chuckle* You just keep telling yourself that. Your ridiculous "newbies are being protected" thing will be useful in a few years, so remember it well.

Heh.