Who Is Trying To Disrupt The Internet?

A prolonged Internet outage affecting major sites like Twitter, Netflix, Spotify and The New York Times recently has commentators concerned that this is was a practice run for future, more widespread disruption of the internet.

The distributed denial of service attack (DDoS) targeted the dynamic domain name service provider Dyn and came in three waves during the day.

Dyn provides internet address translation through DNS servers to take a name like www.nytimes.com and translate it into an address like 170.149.159.130. Denial of service attacks use a variety of techniques to keep the DNS servers busy. The attacks work by flooding DNS servers with millions of requests that seem legitimate but are for fake addresses, causing the DNS server to get overloaded. Real DNS requests from real users can’t get through and so it appears that the site they are trying to get to, like www.netflix.com is down.

DNS attacks operate in a number of different ways but those that affected the Dyn servers were using a range of techniques that included sending requests for sites that had random characters attached to the start of a valid domain e.g. abcd123.nytimes.com. Because these addresses are essentially valid, the DNS server tries to look the up the address but gets tied up because of the sheer volume of requests. The attacks are difficult to guard against because the requests are essentially valid.

The sheer volume of requests were being sent in part by the Mirai botnet of Internet of Things devices, mostly internet connected cameras and digital video recorders. This botnet has been in a previous attack this month on the website of a security reporter Brian Krebs.

These types of attacks have been occurring more frequently and because they involve pieces of internet infrastructure, have a more widespread impact. Last month, security analyst Bruce Schneier wrote that he believed that state actors were increasingly probing for weaknesses in the basic infrastructure of the internet in order to be able to mount large-scale devastating attacks. Because of the increase in number and intensity of DDoS type attacks in recent years, security analysts have theorised that some of the attacks are masking probing for vulnerabilities.

A particular fear is that a DDoS attack could prevent people from voting online during the US election on November 8th. Overseas military and citizens are allowed to vote online in several US states and everyone in Alaska can vote online. Russia has already been implicated in the hack of Democratic National Committee emails and organizing their release through WikiLeaks. There is concern that the Russians will try and discredit the election process in whatever way they can and disrupting it through a DDoS attack on the day would be one way of achieving this.

The risk of this actually effecting the vote on the day has been dismissed however as the window for voting online in some of these situations is weeks before the election rather than on the day. When Alabama trialed online electronic voting during the primaries, their site was in fact attacked, but although it slowed down the site, it didn’t prevent anyone from voting.

There is also the possibility that this attack was actually just hackers going after a particular site that happened to be using the Dyn service. The source code for the Mirai botnet was released on October 1st and since that time, other hackers have been using the code to expand the number of bots involved and create their own botnets. DDoS attacks may actually just be hackers testing out the power of their creations.

The internet remains incredibly vulnerable to attacks on its infrastructure and right now, there are few ways of avoiding them. Because Internet of Things devices like cameras, digital video recorders, and a whole range of other equipment are being used as vehicles to launch DDoS attacks, making sure that the devices are secure would be a priority. However, manufacturers are creating these devices in a way that doesn’t allow for automated, un-monitored updates which is what is really required for security patches to be applied when they are discovered. Governments could potentially legislate that they should take all efforts to ensure their devices are secure before allowing the public to connect them to the internet, but this would need all countries of the world to do this.

It does bring into question the ability of governments to put even more of its interface with the public online since as soon as it does, it becomes a potential target for malicious actors. Governments in particular need to become more adept at dealing with this possibility, especially after the Australian Bureau of Statistics demonstrated that it was unable to run an online census collection successfully in the face of relatively minor DDoS attacks.

Science2.0

« China’s Plan To Organise Society Using Big Data
Strategies For A Cyber Security Culture (£) »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

WEBINAR: 2024 and Beyond: Top Six Cloud Security Trends

WEBINAR: 2024 and Beyond: Top Six Cloud Security Trends

April 4, 2024 | 11:00 AM PT: Join this webinar to find out about six emerging trends dominating the cloud cybersecurity landscape.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

StratoKey

StratoKey

StratoKey is an intelligent Cloud Access Security Broker (CASB) that secures your cloud and SaaS applications against data breaches, so you can do secure and compliant business in the cloud.

Nethemba

Nethemba

Nethemba provide pentesting and security audits for networks and web applications. Other services include digital forensics, training and consultancy.

DataLocker

DataLocker

DataLocker offers both hardware based external storage and software based cloud storage encryption solutions.

Ellipsis Technologies

Ellipsis Technologies

Ellipsis Technologies is a diversified technology company that develops innovative security software for websites and online applications.

CASES.lu

CASES.lu

CASES.lu is a government-driven initiative offering awareness-raising, a web resource and other tools to assist SMEs concerning information security.

Pentest People

Pentest People

Pentest People are a UK-based security consultancy focussing on bringing the benefits of Pentesting as a Service (PTaaS) to all its clients.

National Cybersecurity Preparedness Consortium (NCPC)

National Cybersecurity Preparedness Consortium (NCPC)

The mission of the NCPC is to provide research-based, cybersecurity-related training, exercises and technical assistance to local jurisdictions, counties, states and the private sector.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

Krypsis

Krypsis

Krypsys is an information security company with a focus on helping you defend your information and data against emerging security threats.

iTechArt Group

iTechArt Group

iTechArt is a top-tier custom software development company offering Cybersecurity Consulting, Application Security Testing, Risk Management and Compliance, and Infrastructure Security services.

Fasken

Fasken

Fasken is one of the largest business law firms in Canada and a recognized leader in privacy and cybersecurity law.

SAFECode

SAFECode

SAFECode is a global industry forum where business leaders and technical experts come together to exchange insights on creating, improving, and promoting effective software security programs.

TRU Staffing Partners

TRU Staffing Partners

TRU Staffing Partners is an award-winning contract staffing and executive search firm for cybersecurity, eDiscovery and privacy companies and professionals.

Orbus Software

Orbus Software

Orbus develops, markets and sells enterprise software which helps large, blue chip and government organisations across the globe to achieve digital transformation outcomes.

Saidot

Saidot

Saidot is a Finnish AI governance and alignment company committed to helping businesses safely and transparently integrate AI into their operations.

AuditBoard

AuditBoard

AuditBoard is the leading cloud-based platform transforming audit, risk, ESG, and InfoSec management.