Beyond Firewalls — Internet Militarization 83
angry tapir writes "One of the discussions at the Source Boston Security Showcase has been the militarization of the Internet. Governments looking to silence critics and stymie opposition have added DDOS attacks to their censoring methods, according to Jose Nazario, senior security researcher at Arbor Networks, with international political situations spawning DDOS attacks."
How dare the military invade our internet (Score:5, Funny)
And so... (Score:1)
Militarization? (Score:3, Insightful)
Oh, come on. This is just more hysteria manufactured by people looking for money, fame and fortune.
A DDOS attack is hardly the same the thing as a shell and mortar attack. For one thing, a DDOS doesn't do, and by definition, can't do permanent damage, nor can it kill people.
Can we all just lay off the hype machine a little bit?
Re: (Score:1, Funny)
Have you ever had your server vaporised by slashdot paramilitary forces?
Re: (Score:2)
Have you ever seen it come back as if nothing happened, after the forces were gone?
Re:Militarization? (Score:5, Insightful)
Re:Militarization? (Score:5, Insightful)
Sadly I think that many people would be more upset about a day's outage of their bank than a real shell and mortar attack in Somalia, Iraq, or the Gaza Strip.
Well I think that many people would be a lot more upset about a shell and mortar attack on any city in their own country than a day's outage at their bank. I speak from experience.
Re:Militarization? (Score:4, Interesting)
Re: (Score:2)
Well, there's a large difference between gang-land violence and an actual military mortar attack. For one, the gangs, at the most, have AK-9s and Uzis and are primarily aiming to kill each other. A rocket-propelled grenade attack by an organized militia will generally be far more destructive and cost many more lives.
Besides, gang-land areas are probably among the last places a military or paramilitary attack by the enemies of the U.S. are going to attack. I'm sure they could think of much more valuable t
Re: (Score:2)
Well then do you consider Hamas a gang or a military. They fire hundreds a rockets yet rarely cause deaths with said attacks.
According to your statement they are no more than a street gang.
Re: (Score:2, Informative)
Nice strawman you got there.
To begin with, I've visited and even lived in gang-infested neighborhoods. It's not as bad as they make it out to be in the movies or in the news media outlets. Yes, it's bad, but no, it's not the same thing as living in a war zone.
Re: (Score:1)
Depends on the neighborhood. Two different occasions in Rochester, NY, within two weeks of my moving out, people were killed within eyesight of my former homes. One was a robbery/murder, the other was a gangland initiation, totally random killing of a guy riding his bike on a bridge over the Lower Falls of the Genesee River. The latter neighborhood, my apartment was up on a hill, and some weeks, in the summer, it was very much like being in a war zone -- multiple shots, or bursts of shots, from multiple dir
Re: (Score:2)
I happen to agree with you, but his statement was worded that gangs use grenades and ak-47's to randomly kill and shoot at each other. they blow things up.
yet the death toll is relatively minor compared to that of a war zone.
Re: (Score:3, Insightful)
No, the West Side of Chicago is not the same as a warzone.
The conceal/carry law that's trying to work it's way through the Illinois Assembly may improve the chances of making it one, though.
Think of a gang and drug-ridden neighborhood, now add the easing of restrictions on the purchase and possession of guns.
I heard a pro-gun writer for Reason Magazine (a dim-wit Libertarian rag) say that there should be "absolutely no restriction" on the sale or possession of any type of firearm" because that's what our Fo
Re: (Score:3, Insightful)
So you believe that gang members and those involved in the illegal gun trade are sitting around waiting for this law to pass before arming themselves?
How are they murdering one another now?
Re: (Score:2, Informative)
I used to live in the west side of Chicago. It needs a conceal/carry law that allows citizens to protect themselves. The criminals there already have AK-47 battles in Humboldt Park. Nice logic with the hole in the ground though. How much more gun control can you get in a city that absolutely bans handguns? At what point will you admit that it isn't working? How does your "more gun control" argument work when the law can't be taken any further? I could get an illegal gun in 10 minutes in Chicago.
Re: (Score:3, Interesting)
Re: (Score:2)
So go after the criminals. What's the problem?
Or do you think your gun is going to save you from criminals? Ha!
Re: (Score:3, Informative)
Re: (Score:2)
The US has some of the least restrictive gun laws of any developed country and we still have one in 31 Americans in jail and a higher rate of violent crime than almost any other large developed country
I'm not sure you can make the statement that having an armed population lowers crime.
Tell you what, I'll compromise and say that anyone who's served in the armed forces can own and carry a gun as long as they don't have a history of mental illness. But you? No way. You sound too angry to be anywhere near an
Re: (Score:2)
Re:Militarization? (Score:4, Insightful)
Morgan has a point.
There is a huge difference between preventing terrorism and fighting a war.
Unfortunately, "war" is something that people who have never been in one think is romantic or exciting. I never thought much about war until my wife and daughter were stuck in Belgrade during the NATO bombing. I'm watching the CNN, seeing US planes, pilots and ordinance doing it's very best to kill my dearest loved-ones.
So, should we fight terrorism with police action or with a "War on Terror"? Clearly, let the cops handle it and get our people out of Iraq before someone else gets hurt.
Re: (Score:2)
The age of wars being "soldiers lining up and shooting at each other" is long over. It looks like the neighborhood cop walking a beat is following.
Things like the Juarez Police Chief [slashdot.org] getting essentially run out of town to the forces that pushed the Russians out of afghanistan (and the USA in Iraq).
Police in some places have a real fear that simply by being identified as police officers could get their families killed. (masked policemen [bbc.co.uk])
Re: (Score:2, Informative)
Life critical monitoring equipment is never plugged into the Internet.
Re: (Score:2, Interesting)
"Should never be" and "never is" are two different things.
And what constitutes "life critical" is fuzzy. Is Google Maps "life critical"? Do you remember the family that got lost [elliottback.com] and the father froze to death? (It's not clear that the map in this case came from Google Maps, but it show the possibility.)
Is your word processor "life criticial"? Michael Richard was executed after his lawyers were unable to file paperwork by a deadline d [ncl.ac.uk]
Re: (Score:2)
Nope, it's hardwired. And in the Pony-world, it will always be so. But in today's buzz word infested, resource strapped Real World, somebody is going to do something stupid like put power generation facility command and control lines on the Internet. That's going to bite somebody.
I think this is all great. Get the military in here and clean up the acts of every nit-wit that thinks the Internet is the key to goddamn everything. Let
Re: (Score:2)
For one thing, a DDOS doesn't do, and by definition, can't do permanent damage, nor can it kill people.
Firstly, I'm interesting in where you got a definition of DDoS that includes the clause 'cannot do permanent damage'? You're probably thinking of of stuff like blowing up buildings though.. sure.. it's not-likely that a DDoS would blow up a building, but there is a likelihood that it could cause permanent damages. If nothing else because of the inaccessibility of real-time data streams.
If you DDoS a bank during it's nightly batch, you can cause that bank to loose a days worth of interest for example. That's
Re: (Score:1)
If you DDoS a bank during it's nightly batch, you can cause that bank to loose a days worth of interest for example. That's a real and permanent damage.
I've never worked in a bank before, but I think it's more likely that interest accrues from the time of the actual transaction recorded by the bank, not from the time the transaction was posted electronically by the bank's nightly batch.
Am I wrong? Can someone with financial IT experience tell me if I'm right or not?
Re: (Score:2)
I think thinking more like the transfer of large quantity funds between banks.
Although I'm totally spitting out of my behind since I don't really understand that much of how high finance bank and ACH transactions really work.
Re: (Score:2)
I hope a TP surgery is being done on um leased lines which are solely under the control of the hospital institutions doing the surgery and the carrier.
Something like that should not be being done of the public internet; it just should not be.
Re: (Score:2)
Oh, come on. This is just more hysteria manufactured by people looking for money, fame and fortune.
A DDOS attack is hardly the same the thing as a shell and mortar attack. For one thing, a DDOS doesn't do, and by definition, can't do permanent damage, nor can it kill people.
Can we all just lay off the hype machine a little bit?
That's right, because it's only information flow that is being disrupted; the core information is intact. It's not like a hospital, emergency services, electric grid, air traffic control or other networks actually need to pass information to work properly.
Re: (Score:2)
Comment removed (Score:3, Insightful)
I guess I'm safe (Score:5, Funny)
Re: (Score:1)
Shhhh! Nobody tell him!
You live in Tacoma Park? (Score:2)
Or Berkeley?
Well, yes. (Score:5, Insightful)
It was inevitable, surely. Once governments came to realise that the web was becoming a legitimate medium rather than an entity, they would obviously start to employ it in the same way they have every other.
I have to ask: is this story about governments wising-up in the ways of the intertubes and turning it to their advantage, or about the fact that this was discussed at a conference? I'd have thought the former was self-evident, and the latter was completely un-newsworthy. Maybe we can discuss specific examples [bbc.co.uk] of political internet jiggery-pokery, but this kind of vague allusion is just going to prompt hot-air discussions with no real content, isn't it?
What makes DDOS hard to stop? (Score:2, Interesting)
Or is the problem more in the "distributed" part than the "denial of service" part? Can a network engineer enlighten me?
Re: (Score:2, Insightful)
What makes denial of service attacks so hard to respond to technologically?
Really, it's not.
Our pipes are limited in capacity, surely. Is it not possible to build a router that can mask out requests from IP ranges as fast as they can electrically come in?
Yes, such routers actually exist, although even some commercial-grade routers tend to made with low end processors and such that if your pipe is fat enough, it can become overwhelmed.
If you want to stop a DDOS and your firewaall can't seem to mask off IP ranges quickly enough, by far the easiest technological measure is really quite simple: sever the connection. I guarantee you the DDOS will no longer be affecting your equipment at that point.
Our TCP/IP networks were built to survive conn
Re: (Score:2)
If you want to stop a DDOS and your firewaall can't seem to mask off IP ranges quickly enough, by far the easiest technological measure is really quite simple: sever the connection. I guarantee you the DDOS will no longer be affecting your equipment at that point.
Congratulations the attacker just won. You've DOS'ed yourself by yanking the plug. Admittedly this might be a consideration if the DDOS is performing attacks on your servers as well as flooding the tubes to keep your data safe.
Re: (Score:1)
It often makes sense to abandon a battle. The attacker only wins if you permanently sever the connection, a temporary disconnection may make lots of sense (and it may not make any sense...).
Re:What makes DDOS hard to stop? (Score:4, Informative)
Our TCP/IP networks were built to survive connections going down. At least if they were built cluefully, anyway.
Well, I am not a super-network-nerd, but my impression is that the reality is very different. As has been pointed out repeatedly there are a limited number of choke points which, when interrupted, disrupt large percentages of internet traffic. In addition you have to generally spend some money to get multihoming. For the home user, no big deal; you might lose your connections-in-progress but it's not likely that you'll have any other serious repercussions. So sure, a home user could back up Cable with DSL, for example, and gain all the most important benefits of multi-homing without even doing anything very complicated. But a business user needs to spend, spend, spend to multi-home. Once you're over a certain size you're going to need multiple connections anyway, so the relative cost of doing this drops considerably.
A lot of things were designed to work much better than they do due to implementation. I suggest that evolution needs to give way to revolution and the internet we know and occasionally love must give way to a somewhat more anarchic mesh-network. Honestly I see a place for both; When I want to communicate with "the system" I'll use "the internet". It is however long past time for the people of the world to just utilize technology to bypass our corporate masters and take control of our own lives.
On that note, anyone have any ideas on the cheapest possible mesh networking currently available which could scale to at least one access point for every human currently on the planet? I suspect that the carrying capacity of earth has been exceeded, at least as we are practicing life, so this is a reasonable upper bound for now. Besides, you don't actually need that many APs.
Re: (Score:2)
But a business user needs to spend, spend, spend to multi-home.
Wrong. The only cost is implied by the use of potentially bigger pipes sold with BGP service but nowadays you can have a 100mpbs link for $1000.. Technically it costs 0 (open source routers, IPs and routing registries (except RADB) are free.
Re: (Score:3, Informative)
Wrong. The only cost is implied by the use of potentially bigger pipes sold with BGP service but nowadays you can have a 100mpbs link for $1000.. Technically it costs 0 (open source routers, IPs and routing registries (except RADB) are free.
Well, correct me if I'm wrong - my understanding of this subject is limited to conversations I've had in the distant past - but isn't it true that in the CIDR era your provider has to agree to carry your route if it is actually going to do you any good? Your ISP allocates you a piece of their network, which is already routed. Don't they have to (at minimum) tweak their routes so that they don't override yours? I mean, otherwise you first have to buy a block of addresses, which is (again, to my understanding
Re: (Score:2)
That's what BGPs are for - it allows YOU to control how your traffic is routed. Because all major routers on the Internet also use BGP to configure routes.
The grandparent is also correct in saying that it doesn't cost much. It's possible to have completely OpenSource router and even modest hardware can handle routing.
Re: (Score:2)
Typo: BGP, not BGPs - I meant BGP-capable routers.
BGP stands for "Border Gateway Protocol", so it can't be plural.
Re: (Score:1)
Super-network-nerd here. Do you own any fiber? Who are you peering with for your magical internet access? Sorry, I don't mean to be a dick but people forget that you actually have to connect to the network at some point. The choke points you speak of are peering points and I have to say if you DDOS them it won't last very long. This is why groups like NANOG exist.
Re: (Score:3, Informative)
On that note, anyone have any ideas on the cheapest possible mesh networking currently available which could scale to at least one access point for every human currently on the planet?
The short answer is, there isn't one. None of the existing wireless networking schemes are designed with mesh networking in mind. None of them are designed with the range required to achieve sufficient density to qualify as a mesh.
A device designed to operate in the ultra wideband (UWB) frequency range is a possibility. In theory such a device could achieve 480 mbit/s at 10m ranges. Attempts to date have fallen rather far short, but that could be addressed by better engineering. Actual devices [videsignline.com] (wirel
Re: (Score:1)
Re:What makes DDOS hard to stop? (Score:5, Informative)
It's pretty hard to stop because it is a outright brute force method.
1) All tubes have a limited capacity.
2) If the packet makes it to your router you've already lost. The router's memory and/or processing power is being expended to 'ignore' or 'throw away' packets coming from certain IP ranges.
Distributed makes it harder because the IP addresses do not come from any singular location so you cant just perform an IP range ban. Also the distributed part makes it more difficult to filter out 'garbage/attack' data request from legitimate traffic.
Re: (Score:1)
Re:What makes DDOS hard to stop? (Score:5, Informative)
Re: (Score:2)
I gather that if you have a BGP peering relationship, you may be able to signal to your ISP that they should "black hole" traffic from certain IP address ranges before it reaches you.
Perhaps it would help if this were something that could be adopted across the whole internet. For example use a digitally signed source quench message to clobber traffic to the IP address range you own (based on your digital signature) right where it enters the internet (or at least where it enters the first compliant node)
so, when... (Score:2)
are we going to see things like specifically targeted viruses designed to put a server out of commission as permanently as can be done?
poor man's slashdotting (Score:3, Funny)
DDOS attack is the poor man's slashdotting
Government Working Hard... (Score:1)
New territory means it must be defended (Score:3)
It's inevitable that space and the internet are going to be militarized.
If I were our government, I'd use big media for military purposes: convince the youth of other countries to engage in selfish, yet self-destructive, activities.
Oh wait, someone beat me to it!
Um,.. (Score:2)
Damn. We are loosely badly to all the lawlessness adware, malware, and viruses out there. I don't really want a cyber gun per se, but I'd like to hire some one to effectively shield myself from them. Current anti-virus, anti-spyware, and anti-malware products just aren't quiet cutting it right at the moment. They are better than nothing, but I want 'em to be much more effective.
Heck, I want assassin squads sent out after the writers of adware, malware, and viruses. Let's see what happens when these cyber gu
War against anybody not supporting our government (Score:2, Interesting)
I've heard recently that the police forces across all states are given documents suggesting anyone who mentions the US Constitution and espouses their rights (for example, warrantless checkpoints) are being classified as terrorists against the government. It has also mentioned the shutting down of the current internet in favour of Internet II which would be more controlled (for example, anti-government sites would not be allowed...freedom of speech anyone?). See the following for more: the Alex Jones Channe
Re:War against anybody not supporting our governme (Score:2)
The Canadian guy is a real comedian. To suggest running the printing press to cover a trade deficit. The Canadian dollar would become worthless over night. The only scandal he points out is fiscal irresponsibility. Nothing new there.
Re: (Score:1)
The main fiscal fact in both the US and Canada is that money is being allowed to be created and controlled by the private banking interests. Governments have the right and obligation to create their own INTEREST FREE money for the continued freedom of their people. Money now is simply debt(with interest!) owed to a bank and no longer based on a hard asset such as gold or silver they simple create it on the 'books', which should ONLY be the right of the government. This at it's root is basically a scam to re
Ah...the good old days (Score:2)
Sounds like a rehash of the mid 90's of EFnet....riding the splits.
So how long before the Pentagon loads up some eggbots, a few BitchX clients and some war scripts...
Hi Ho, Hi Ho, it's Off to War we go!
More to come (Score:1)
When News Was News (Score:2)
"Governments looking to silence critics and stymie opposition have added DDOS attacks to their censoring methods"
This was news 8 years ago when China first attacked individuals' pro-Tibet web sites. The attacks were readily traced back to their Ministry of Defense.
If it were a case of someone foisting old news as new on the knowledgeable, that would be pitiful. However, the conference where it was presented was specifically for newbies (both persons and companies) to the field. While hardly news to /. it wa
Government Intolerance (Score:3, Insightful)
Since computers tend to be communication devices the question folds backward into another question. Can any government survive good communications among its citizens? I really doubt it. Understanding government will lead people to realize that for their individual situation the government is a negative. If you end up with any substantial percentage of a population feeling that the government is negative in their lives they will find a way to crash the government. Even 10% who are real disaffected with government will assure failure of a nation.
Back in the Hippy movement the young understood that. Tune in, turn on, and drop out was every bit as serious as an enemy marching toward a border. Whether the hippie seeking to end the Vietnam War or the kid in the mud in Vietnam was the better patriot is open to debate. But one thing is sure. The hippies did cause that idiotic war to end. Sadly we have so many ruined lives on both sides of that war as living testimony that war is a lousy idea.