Slashdot Mirror
US Planning Response To a Cyber Attack
We've all heard of Google bombing; the US Government may be taking the expression rather literally. Planning is now underway across the government for the proper way to respond to a cyber attack, and options on the table include launching a cyber counterattack or even bombing the attack's source. The article makes clear that no settled plan is in place, and quotes one spokesman as saying "the preferred route would be warning the source to shut down the attack before a military response." That's assuming the source could be found. From the article: "If the United States found itself under a major cyberattack aimed at undermining the nations critical information infrastructure, the Department of Defense is prepared, based on the authority of the president, to launch a cyber counterattack or an actual bombing of an attack source."
I wonder what their response would be to the attack of a botnet. Carpet bombing, maybe?
That's an option that the Feds have that the average whitehat doesn't: calling in airstrikes against the DOSer.
So if we can spoof enough IP's we can get the USA to bomb any country of our choosing.... interesting.
The best test environment is production. - Me
chrome://browser/content/browser.xul
A few bombings ought to move people off Windows.
Uhh... woudln't just be easier to bomb the source. It's not like we don't know where Micro$ofts head quarters are.
The real Sig captains the Northwestern. This one captains
Please cease and desist linking to site xxx.mil ( reacted ) or whitehouse.gov or else we will bomb you.
Signed G.W. Bush.
General, the bombers are ready to go and the cruise missiles are fully fueled. And our intel group has pinpointed the source of the attack. It's coming from 127.0.0.1 .
OTOH, I suspect that the NSA & DoD aren't that stupid
[Fuck Beta]
o0t!
I think that we're all reading too much into this. The article is basically saying that if somebody is going to attack the US in a way that would be damaging to the country that US is prepared to retaliate...by any means necessary.
I'm not sure if I agree with everything in the article but it is the Government's job to protect this country and there are a lot of businesses and people that demand on the internet. If some outside source could mess with this it would be devastating to the economy and the country...
If you keep a dangerous instrumentality on your property, and it causes damage to others, you are liable for that if the harm is foreseeable.
That is only true if all responsible parties are held to a reasonable level of accountability.
If you found out that your oven was, without your knowledge, part of a local arson ring, you'd be pretty upset a being held accountable for the neighborhood damages. You'd probably blame Kenmore for making such a thing remotely possibly in the first place, since it has no connection with how or why you bought the oven in the first place.
Until the hardware mfgrs, OS mfgrs, software mfgrs, and users are all held to roughly similar standards, you can't place all blame on the user.
To put things a different way:
-If 1% of your products cause widespread damage, then 1% of your users are idiots.
-If 5% of your products cause widespread damage, then 5% of your users need training.
-If 25% of your products cause widespread damage, then you are the idiot.
Your scenario is a little off, since your oven can't walk out of the house and burn someone else's house down. Let's try a more realistic scenario.
You buy a new drive-by-wire car. Then either of the following happens: You forego the option to park your car in a readily-available garage and a terrorist quietly breaks into it, or you simply take the car to a garage that you thought was reputable because of its professional-looking store front but was in fact a terrorist-run shop. Either way, they had their way with your car, installing hidden remote controls on the drive-by-wire system. Then they install a bomb using any available space, such as the empty body panels, inside the seats, etc. They can now damage or destroy any bridge they like, but you never knew what they did to your car, so you went on with life as usual. Then they did it to other owners' cars around town that were similarly vulnerable to compromise or social engineering.
Now for the best-case-scenario version of the outcome. We'll assume that the bridge is unoccupied, so there is no human life lost when they take your car and all the other zombie cars on their final joy ride, but the bridge is damaged and has to be closed while its structural integrity is assessed. Meanwhile, traffic has to be rerouted or stopped altogether. People can't get to work. Goods can't be delivered. The general population is afraid that there will be another attack, possibly trapping them in their neighborhood.
Now imagine that the cars were your computer and all the other zombie machines out there, the home garage was a simple NAT router or decent software firewall or the repair shop was a software package that contained malware, and the bridge was any major server or router that a decent-sized portion of the internet population relies on for day-to-day electronic transactions.
Do you really think it was the car manufacturer's fault that you left the car unprotected, or worse, you handed the keys to an untrustworthy mechanic because he had a professional-looking shop? While I don't think the car's owner should be held criminally responsible, I think they unknowingly forfeited the car when they ignored their responsibility to keep it reasonably secure. Don't be surprised if the government starts fragging driverless cars once they've identified them.
Your scenario is a little off, since your oven can't walk out of the house and burn someone else's house down. Let's try a more realistic scenario.
You buy a new drive-by-wire car.
You can tell right there it's going to be a good analogy.
Literalism isn't a form of humor, it's you being irritating.