Slashdot Mirror
Bill Cheswick On Internet Security
Franki3 invites our attention to a SecurityFocus interview with Bill Cheswick. He started the Internet Mapping Project in the 90s; you have probably seen the maps that resulted. The interview ranges over firewalling, logging, NIDS and IPS, how to fight DDoS, and the future of BGP and DNS. From the interview: "I have been impressed with the response of the network community. These problems, and others like security weaknesses, security exploits, etc., usually get dealt with in a few days. For example, the SYN packet DOS attacks in 1996 quickly brought together ad hoc teams of experts, and within a week, patches with new mitigations were appearing from the vendors. You can take the Internet down, but probably not for very long."
I would call a week very long time for something as vital as the Internet now is.
For as long as the story is on the front page of Slashdot, at least.
At the Internet Archive: http://web.archive.org/web/20050218224540/http://w ww.cheswick.com/ches/map/gallery/index.html
or smelled the smoke coming from his web server.
The interview ranges over firewalling, logging, NIDS and IPS, how to fight DDoS, and the future of BGP and DNS.
FWIW, FYI, TFA is SFW but IMO not OMFGF.
The theory of relativity doesn't work right in Arkansas.
..is one that isn't connected to the Internets...
Error 102: Connection timed out.
Tsunami -- You can't bring a good wave down!
From TFA:
What do you think about reactive firewalls, also knows as IPS (Intrusion Prevention Systems)?
Bill Cheswick: Reactive security is an idea that keeps popping up. It seems logical. Why not send out a virus to cure a virus, for example? How about having an attacked host somehow stifle the attacker, or tell a firewall to block the noxious packets.
These are very tricky things to do, and the danger is always that an attacker can make you DOS yourself or someone else. As an attacker, I can make you shut down connections by making them appear to misbehave. This is often easier than launching the original attack that the reactive system was designed to suppress. (By the way, this happens a lot in biological immune systems as well. There are a number of diseases that trigger dangerous or fatal immune system responses.)
So I am skeptical about these systems. They may work out, but I want to keep an eye on the actual user experiences with these.
I think that Mr. Cheswick is mostly correct in his opinions, but in the case of IPS's some of them certainly are effective, if not for mitigating minor attacks, at least for keeping the network up and running during these attacks. He talks about making a network operator DoS themselves by feigning an attack, but to make this work you have to assume there is no meat in the loop. Just because someone appears to attack me does not mean I filter all packets from that IP(s). I'm not going to let my network automatically block traffic, although rate limiting can be automated to some degree. The real thing is, if your tools allow you enough visibility into your network to map what is your normal and critical traffic, you can block large swaths of noncritical traffic without serious financial consequences. Compared to the cost of a complete outage, this is a huge leap forward.
Still, may of the IPS tools on the market today do not provide that ability and you need to get a good toolset together.
For all these problems, and others in the past, I have been impressed with the response of the network community. These problems, and others like security weaknesses, security exploits, etc., usually get dealt with in a few days. For example, the SYN packet DOS attacks in 1996 quickly brought together ad hoc teams of experts, and within a week, patches with new mitigations were appearing from the vendors. You can take the Internet down, but probably not for very long.
Since the 90's a lot more effort has gone into formalizing and speeding up collaboration. It used to be that if a major worm or something hit the internet, within a week it would be well known as people called each other and traded notes and techniques for mitigation. Today if I see a novel new and widespread attack, I also have up to date data as to whether or not it is hitting other ISPs and large networks and where and in what traffic rates via information they automatically share with me. Further, I can semi-automatically create a signature that matches that attack, a filter for that attack for my routers and firewall type devices, and share that information with them along with my notes. Even if the network is down, I still often have the contact info for the security people at those networks so if my Internet access is out I can look at who else has been hit and call them.
This has really started to take off only in the last year or so, but what Mr. Cheswick applied to the 90's is today that same process on speed. Personally, I think anyone would be hard pressed to take out "the internet" today and the closest one might come would be a very sneaky attack on the Windows monoculture.
Same for Digg and other popular sites with links.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Their technique of hiding many geographically-separated servers behind one IP address is interesting. For example, ISC's server at 192.5.5.241 (the "F" server) has over 40 sites, including Ottawa, Palo Alto, New York City, San Francisco, and Madrid. Given the obvious advantages of this configuration, it actually surprised me that there are root servers not doing this: VeriSign, University of Maryland, NASA, the U.S. DoD, the U.S. Army, and ICANN all seem to have single-site root servers. I wonder whether those organizations are taking the responsibility that they hold seriously enough, if cost or level of effort are what's stopping them.
Also, the number of servers that have IPv6 addresses is a bit disappointing (B, F, H, K, M), but I suppose understandable given the slow uptake of that technology. In many ways, the root DNS system is seemingly one of the oldest and least-noticed parts of the Internet's infrastructure; if the network as a whole were a city, it's the stonework aqueducts far beneath the streets, that nobody thinks about as long as the water comes out when you turn the tap.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
> You can take the Internet down, but probably not for very long.
Dunno, we have yet to experience a real widespread outage. If someone managed to take out enough of the net that it couldn't be used to colaborate on the fix or to distribute it the time to repair would be a lot worse.
It is something I wonder about. First the net was attacked by kids looking for thrills. Now it is attacked by spammers looking t make a profit. The scenario I worry about is if a determined foe with resources attacked it with the goal of simply inflicting maximal damage.
The raw materials are out there, just waiting to be weaponized. Imagine a combo punch, a Warhol worm from hell to nuke the Windows boxes, reflashing as many as possible into boat anchors within the first hour. Follow that up with an attack on the backbone routers, again with the goal of bricking as many as possible. If you get enough it makes recovery damn near impossible since you need the net to get the fixes. Sure it would be possible to clean up the mess and bring up enough of the net to get the important things moving in a day or two but a full cleanup would take months. Would enough people would lose confidence in depending on the net for critical commerce to gut the stocks of some major players and set things back to a pre net mindset?
Democrat delenda est
maggard, why post this?
Cheswick is a very good speaker and I recommend hearing him talk if you get a chance. I got to here him talk at an Infragard conference about internet mapping was used to do damage assessment after the US bombed Serbia. I don't know that the military actually used the data, but he showed us pictures of how packets were routed before and after the attacks.
He also discussed how you could detect unauthorized connections in a network by injecting packets with source addresses external to the network and seeing if any of the packets exited the network by an unknown path and made it back to the supposed source. (By spoofing the source address while inside of the firewall you could avoid having your packets blocked.) Of course smart people with covert network connections would notice the packets came in on the wrong interface and would reply back on the same interface so as not to reveal the covert connection.
mewanna soo bad to know about all of the crazy kewl hacks
English mutherfucker do you speak it?
Wow, these maps are really beautiful - They look like a cross between Paul Klee's painting "Composition With Fruit" and Joan Miro's "Frustrated Cat"
Alright, that's a stretch, but they could be confused for modern art if the viewer was not aware of their origin.
You had me at merlot
Marge: You can take the Internet down...
Bart: We can? Thanks mom!
Lisa: Bart, quit it!
Yah, my web server is on the local end of a 768/768 ADSL line. Yesterday was a good day to catch up on my reading.
I did wonder if my home server would ever get slashdotted, and if so, should I attempt to engineer a web solution that can handle it. Too expensive, and I am not sorry I didn't do it.
ches