Slashdot Log In
BlueSecurity Fall-Out Reveals Larger Problem
Posted by
CowboyNeal
on Thu May 18, 2006 06:14 PM
from the continuing-sagas dept.
from the continuing-sagas dept.
mdrebelx writes "For anyone following the BlueSecurity story, sadly the anti-spam crusader has raised the white flag. Brian Krebs with the Washington Post is reporting that after BlueSecurity's announcement, Prolexic and UltraDNS, which were both linked with BlueSecurity through business relations came under a DNS amplification attack that brought down thousands of sites.
While much of the focus about the BlueSecurity story has been centered on the question of what can be done about spam, I think a bigger question has been raised - is the Internet really that fragile? What has been going on is essentially cyber-terrorism and from what has been reported so far the terrorist clearly have the upper hand."
Related Stories
[+]
Blue Security Gives up the Fight 672 comments
bblboy54 writes "According to The Washington Post, Blue Security has closed its doors, which can be confirmed by the Blue Security application failing to work today and their domain no longer resolving. Blue Security's CEO is quoted in the article: "It's clear to us that [quitting] would be the only thing to prevent a full-scale cyber-war that we just don't have the authority to start," Reshef said. "Our users never signed up for this kind of thing." You have to wonder where it goes from here. It seems an effective method has been found but more than a small private company could handle. Will someone else adapt this concept, or does the internet world give up?"
[+]
Technology: Blue Security Reborn As Social Action Enabler 29 comments
griswaldo writes "Wired News writes about the re-birth of the ill-fated Blue Security as a social action company. According to the article, founders of the former anti-spam company that made headlines after incurring the wrath of a Russian spam king have set up a company called Collactive that provides tools to organize grassroots action on political and social web sites. The article mentions a global warming initiative called WorldCoolers and, for the Slashdot YRO crowd, the Privacy Alert Network that kicked off by letting people comment on Homeland Security's latest crazy idea."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
interesting question about fragile (Score:5, Insightful)
There have been other outages, major, which have had significant impact. It's a good question: is the internet that fragile?
In many ways it probably is. At the same time, the infrastructure seems resilient enough. The world so far hasn't laced up life-and-death critical systems to the internet such that a failure could cause loss of life. Well, that is, if you don't include:
Oh, wait, I guess people have started doing that.
What mechanisms exist for more than resiliency, i.e., instant self-healing? Could terrorists with a little knowledge and a few well-placed EMP generators disable major segments of the internet?
Unlike phones and the phone networks which were built with lots of oversight and regulation (Universal Service was a big driver for this (aside: now that everything is profit driven, don't expect phone service at that farm house at the end of that long country road anymore... noone HAS to provide it)), I'm not aware of what safeguards back up the internet. In my entire lifetime, I've not one time experienced a phone outage, not once! Power outages, etc., the phone companies have backups to backups to ensure service (though there is the occasional and hard to manage for ditch digging incident).
While large pieces of the internet are built upon the phone companies' infrastructure, other pieces aren't, and there are significant additional layers of complexity not in the phone companies' purview (switches, routers, coax cable from cable companies).
That question, "is the internet that fragile?", is probably the biggest reason I've never opted to switch my phone service to VOIP yet. I'd hate to be the one (tiny chance, I know) who needs to make that one 911 call and not be able to do so because the internet is unavailable (which happens occasionally here, which is also too often).
Re:interesting question about fragile (Score:3, Insightful)
The only kind of people a terrorist would terrorize by taking down the internet temporarily are people on slashdot.
Terrorists are interested in killing people to get their message across, not inconveniencing them.
Re:interesting question about fragile (Score:5, Informative)
Traditionally yes, this might be "economic terrorism"(tm) according to the Dept. of Defense terroism is "the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives." This would seem to apply here.
Parent
Re:interesting question about fragile (Score:5, Interesting)
Parent
Re:interesting question about fragile (Score:4, Insightful)
Parent
Re:interesting question about fragile (Score:3, Insightful)
Re:interesting question about fragile (Score:5, Insightful)
Parent
Re:interesting question about fragile (Score:4, Funny)
There's this program available for Windows called FastCache [analogx.com] which has been more than handy when my ISP's DNS servers have gone down and so forth. You use it as a nameserver by setting your DNS addresses to localhost, and it caches entries for several days.
It's not something you typically thank every day, but when for whatever reason DNS fails for me, it's a lifesaver.
Does anyone know of equivalents of this on Linux/Mac?
Parent
Re:interesting question about fragile (Score:4, Informative)
Don't rely on your ISP's DNS.
Lots of times my ISP's DNS has gone down and opennic has saved the day. Of course, they can go down too, but usually ONE of the two work.
Parent
Interesting how things change (Score:5, Interesting)
It's also interesting how questions change. We question: Is the internet really that fragile?
What happened to the baser question: Do we really depend so much on the internet?
Of course, now that we do, maybe we should look into making the internet even more resilient than the original creators envisioned. After all, it was made to endure nuclear war, but a few scriptkiddies can still take down any site with a little DDOSing and DNS-tweaks..
Just always remember where we came from.
Parent
Re:Interesting how things change (Score:4, Informative)
Do we really depend so much on the internet?
Yes! Last holiday season, over 10% of purchases made using Visa were online (Source [visa.com] - PDF). If you are familiar with trends, 10% is critical mass, the point at which a concept takes off. The Internet is very much an entrenched part of the first-world economy.
Parent
Re:Well that is easily explained (Score:4, Interesting)
No, the problem is that the Internet was created as a trusted network between universities. IPv6 has been created as an untrusted network and many of these problems would disappear if everyone switched.
Parent
Phone outages (Score:3, Insightful)
You are lucky! I've had several phone outages. I had a few outages caused by water in the cable ducts in my street after heavy rains. I had one in the old days (~25 years ago) of analog hardware that took them several days to fix. I've had an outage caused by a truck hitting a utility pole, in a neighborhood where the cables were overhead.
Although telephone stations are more robust than the internet, because they are very special
Yes, the internet is that fragile (Score:3, Interesting)
Re:Yes, the internet is that fragile (Score:5, Funny)
Parent
Re:Yes, the internet is that fragile (Score:3, Funny)
Re:Yes, the internet is that fragile (Score:4, Informative)
Any tool improperly used can possibly cause problems.
This a proper way to secure a Bind nameserver.
An example would be in your bind named.conf adding an acl section and adding to section options.
acl "trusted_queries" { 127.0.0.1; 192.168.1.0/24; some.ip.network.outthere/8; };
acl "trusted_recursion" { 127.0.0.1; 192.168.1.0/24; some.ip.network.outthere/8; };
options {
allow-query ( "trusted_queries" };
allow-recursion { "trusted_recursion" };
version "no version";
};
zone "some.zone.com" IN {
type master;
file "pri/some.zone.com.zone";
allow-query { any; };
};
Parent
Of Course (Score:3, Insightful)
Terrorism too strong a word (Score:3, Insightful)
Re:Terrorism too strong a word (Score:5, Insightful)
The use of force (taking down servers) by a group (spammers) against people/property (blue & others) with the intention of intimidating socieities (blues users) for ideological (financial too) reasons.
Parent
Re:Terrorism too strong a word (Score:4, Insightful)
Parent
Re:Terrorism too strong a word (Score:4, Insightful)
Gotcha - of course by that definition:
al quaeda = terrorists
pro-life protestors = terrorists
school bullies = terrorists
NSA = terrorists
George W. Bush = terrorist
FBI = terrorists
PETA = terrorists
Greenpeace = terrorists
Patent trolls = terrorists
China = terrorists
Microsoft = terrorists
UN = terrorists
MPAA/RIAA = terrorists
Parent
Re:Terrorism too strong a word (Score:4, Insightful)
Terrorism's gotten a rather bad rap these days. It's just a tactic. It's used 'legitimately' against occupying armies, for example.(1) Don't try to wipe them out...just scare people into not supporting them by killing a few people who do. And don't go after the soldiers...go after the policy makers and leaders. They can always get more soldiers, but if you kill every single person who occupies a certain position, soon no one will want to do that.
1) Depending, of course, on whether or not you think the occupying is legitimate or not.
Parent
Yes this was cyberterrorism (Score:4, Funny)
> clearly have the upper hand.
Yup, and I'd have loved to have seen the US gov use this as a perfect 'live fire' exercise. After all, if they can't stop a few punk spammers how can we have any confidence they could stop a determined attack by the usual terrorist suspects?
Perfect opportunity to test all the phases of response, from tracking the responsible parties all the way to eliminating them. Ok, in this case a SEAL team would probably have to be tasked to capture em instead of just dropping a few bombs on their sorry asses. Or if, as I suspect, the ringleaders are in the US or other western representive nations, just have em all arrested.
weakest link (Score:5, Insightful)
None of those attacks (DOS) could have been done without the use of thousands of zombie machines.
I guess the only way of stoping the attakers is by taking their weapons (zombies) from them and thats left as an excersise for the survivors.
Re:weakest link (Score:4, Insightful)
Parent
Maybe they pay more for a tiered solution.... (Score:5, Funny)
Re:Maybe they pay more for a tiered solution.... (Score:4, Interesting)
Parent
Fragile Internet? No... (Score:5, Interesting)
No, the Internet is robust and redundant. What is fragile are the tens of thousands of pwn3d Windows PC's that are being used without their owners' knowledge to perpetrate these massive DDOS attacks. If I were a lawyer for Blue Security, Yahoo, or anyone else who has been hit recently, I would be seriously looking in to the merits of a lawsuit against MS for gross negligence or something similar.
Re:Fragile Internet? No... (Score:5, Interesting)
More like "hundreds of thousands".
My spam traps have been hit by over 1.5 million unique IPs this year alone,
with an additional 30,000 never before seen IPs every day.
I estimate there are currently 3-4 million compromised machines world wide.
-- Should you believe authority without question?
Parent
To get in front.. (Score:3, Insightful)
#1. Don't blame Windows. Most botnets spread through software downloaded installs. 99.999% of computer installs today are vulnurable. The exception, of course, is the LiveCD type OS run directly from a CD in a read-only format. Your choice of OS is no protection. If you run malicious software, your computer is a zombie. Period.
#2. The problem is E-mail. Don't want spam? Don't use e-mail. That seems harsh, but it's true. E-mail is an open protocol, and as such, is ripe for such abuses. It's about time to come up with a new type of server based messaging. I'm not saying let the spammers win. What I'm saying is remove their audience.
Re:To get in front.. (Score:4, Informative)
Really? I looked around and can find no links through google for malicious zombie downloads on linux that will run on all flavors. Please post the link to one or a link to an article that disects one.
I'm not making the argument that linux can't be hacked - it can and I've seen the results of root kits. How many linux zombies are there? Is it proporational to the number of linux vs. windows machines? (Assuming Linux desktops and servers total 2% of desktops, 2% of spam zombies should be Linux, right? Where are the 4% of OSX zombies?)
It's about time to come up with a new type of server based messaging.
For every lock, there is a new way to pick it. For every type of security, there is a new way to hack it. This is a band-aid. The real problem is the fact that there is money to be made from this.
Parent
Re:To get in front.. (Score:3, Insightful)
As the parent poster stated "if you run malicious software, then your computer is a zombie." I won't hazard to state the proportions but last I checked the number of Apache servers hacked in a given year outnumber IIS hacks. Of course there are far more Apache servers out there so that's really not saying that much.
As for email, I don't think it is near as broken as people seem to think. It's amazing how people just want to throw the whole th
Re:To get in front.. (Score:4, Insightful)
1)Its free- you only pay for bandwidth
2)Its universal, anyone can get an account
3)Its open, no company can block a user from email
4)Its possible to send email to anyone, even someone you don't know, if you have their email address.
All of these are extremely important and make email the useful tool it is today. Take any away, and the usefulness plummets. Spam is annoying, but the benefits of the four above points far outweigh it.
Parent
Be wary with the label "terrorism" (Score:4, Insightful)
While I do agree that this definitly shows the threat spammers really pose to the internet, I fear at least as much handing government the card blanche to monitoring all and any internet traffic for the sake of "saving us from spam".
No, I'm aware that this won't help a single bit in an attempt to quench spam. But did any anti-terror activity actually work against the alleged threat?
So bring this problem to the attention of your senators, your governors, your congressmen or whoever has some power in your country. This is a very, very serious problem, the criminals are getting the upper hand in this turf, and the internet is a resource I don't want to see depending on the goodwill of the spam mafia.
But for all that we hold dear, avoid the word terrorism. Legislators have been using that word before as the excuse for every kind of restrictive laws that did JACK to solve the problem and only created more. Try to find a word that makes them actually realize the problem and realize that this problem is serious. Not only to the worthless humans using it, but also to precious commerce.
Not fragile, just vulnerable (Score:5, Insightful)
No, the Internet isn't that fragile. It's suprisingly robust, in fact. About the only thing that can really do any significant damage is sheer volume, enough traffic from enough distinct sources to overwhelm the target server or swamp it's network connections. No matter what, anything is always going to be vulnerable to that. You can only have finite bandwidth and server horsepower, and if an opponent's willing and able to throw enough resources at you he can simply overwhelm you. It's often referred to as "the Slashdot effect".
The only thing that's happened is that, because of the inherent insecurity of Windows machines and the increasing number of them with broadband connections, the bad guys now have access to orders of magnitude more bandwidth and horsepower than any single server can have. In military terms it's like facing an enemy who outnumbers you by ten thousand to one. Distributing your DNS won't help, redundant pipes won't help, distributing your servers won't help, if you can deal with 99% of his assault he's still got a hundred times what you can absorb left.
The only thing that can help is cutting off the supply of ownable machines the bad guys can take over and use in their attacks. If they're limited to their own machines they can't do much harm.
What isn't prohibited, is required. (Score:3, Interesting)
I keep thinking about the old saying, "what isn't prohibited, is required." Because the net doesn't prohibit these massive DDoS attacks, someone WILL do them, over and over, either because they are into extortion, or just because they're evil fucks and like creating mayhem. I almost believe that someone ought to just do it and break the net permanently so everyone will have to come to grips with this. So maybe the solution will mean that nobody with an insecure OS will be allowed back on the net. Maybe we need a catastrophic failure to force a total revamp of network protocols, and an excuse to exile all the lusers like people still using Win98. I dunno, it would probably be faster, cheaper, and ultimately more satisfying if we could just assassinate spamming assholes like PharmaMaster/Eran Reshef. [wired.com]
Dear Homeland Security (Score:4, Funny)
This is terrorism. Everyone with a trojaned Microsoft box is aiding and abetting.
Thank you, Linus and Steve.
Meh ... (Score:4, Insightful)
reincarnation? (Score:5, Informative)
Parent
DON'T WORRY GUYS! (Score:5, Funny)
The internet is not fragile, its abused (Score:5, Interesting)
The problem is the thousands of hacked PCs that are used in these attacks. The internet is working exactly the way it was designed and the bot nets take advantage of bottlenecks in the system.
What is being done to take out these bot nets? I've perused a few of these bot squads on IRC and while there are many zombied Windows machines there are also many *nix boxes which succumbed to the brute force ssh password attacks because they had user accounts with stupid passwords.
Aside from locating and neutralizing the individual boxes in the squads shouldn't we be creating and deploying self immunizing tools in our infrastructure that detects these boxes and quarantines them?
Shouldn't we also be holding people accountable for having vulnerable boxes connected to the net? Perhaps a bandwidth restriction will help for repeat offenders.
Terrurizem (Score:4, Insightful)
Haxors commanding botnets to DDOS servers : Cyber-terrorists.
Big corporations doing aggressive take-overs : Corporate terrorists.
Mass producers dumping products below cost overseas : Market terrorists.
Politicians sketching doom scenarios during campaigns to woo scared voters over to their party : Political (party) terrorists.
C'mon cut it out will ya, soon they will brand humans multiplying without limits sucking up resources and scaring other animals away and out of existence : Biosphere terrorists?
You know, according to some theory, black holes will eventually suck up most of the available matter in the universe, leaving it a dark cold desolate place with only some Hawking radiation to warm your soul. Should we call those : Universal Terrorists then?
Just to give you an idea... (Score:5, Informative)
warning: botnet operators 0wn the interweb! (Score:5, Informative)
I hope someone does something to deal with the botnet threats. Being able to suck multiple gigabits of bandwidth means 'they' can kill any small to medium sized internet operation if they want to via a range of attacks from the simple to the rather sophisticated.
Tier1 ISPs usually don't care other than possibly to try and filter all your traffic to prevent their other customers from suffering.
Some medium/larger sized companies use services like Akamai siteshield that are capable of sustaining a reasonable DDOS-ing but the botnet operators will eventually realise that the attacks are not just about knocking a site offline. Akamai will charge you for that traffic which will send the companies bankrupt anyway (and possibly quicker than going offline). In fact i was wondering how on earth bluesecurity were going to pay their bandwidth bill.
The defences we have against such attacks are pathetic. I was amused in an episode of 24 when they came under an online attack from terrorists and their new "CISCO FIREWALL" protects them, i mean seriously the firewalls are the least of your problems these days. If you come under attack from one of these serious russian dudes - you'd be looking at trying to filter the traffic well before it reaches the firewalls since your line and network would be saturated.
Is the nonstop 24/7 Internet fragile? (Score:3, Insightful)
Fixing the DNS problem (Score:4, Interesting)
The basic requirement here is that DNS servers shouldn't be accepting queries from clients outside their local organizations. This is like the old "open relay" problem with SMTP. Obviously, such DNS servers have to be fixed. To force the issue, DNS servers queried by other DNS servers should find out if the querying server incorrectly accepts queries from the outside. If it does, that server is marked as a loser, and its queries get processed only after any other queries, and maybe with a deliberate delay. That should deal with the problem in the near term.
The stronger form of this protection is that many queries from loser servers are answered with an address that returns a page saying something like "Your DNS server at [xxx.xxx.xxx.xxx] has a problem and must be upgraded." The screaming users will get the problem fixed.
Re:motivation (Score:5, Funny)
Emperor Palpatine, is that you?
Parent
Re:motivation (Score:5, Insightful)
I don't know where you got the idea that NSA's activities have done anything to "impose structure and law" on the Internet.
If anything, the NSA has been actively participating in the chaos by going ahead and doing their own thing with no regard to the law.
Parent
Re:motivation (Score:5, Insightful)
I would further submit that America was far less chaotic in the good old days when big government wasn't so big, wasn't so invasive and tended to leave its citizens alone. It isn't necessary to have a government that restricts and monitors its citizens to the degree that ours is doing for the purpose of achieving a stable society. In fact, the imposition of excessive control, coupled with erratic enforcement, creates instability! This is variously called "political unrest" or "social protest" or, when carried to the logical extreme, "rebellion". Furthermore, it is the kind of thing Americans do when they're pushed too far. At least, I hope it's still the kind of thing we do. It's about the only hope we have left. The way things are in D.C. nowadays, it's pretty obvious that while the lights are still on there's nobody home.
The Wild West aspect of the Internet, which seems to disturb you to some degree, is precisely what makes the Internet the greatest advance since the invention of fire, the wheel and air conditioning! The economic, scientific and cultural benefits of the Internet, as it is today, far far outweigh the dark side. Reducing the Internet experienced by ordinary people to a bland, "civilized" mix of email and heavily-filtered browsing would take away the power, freedom and utility so many people have come to expect and enjoy. It would also largely eliminate innovation and the development of new technologies, as no-one would be allowed to do anything not approved by the powers-that-be. Huh
Parent