On the Insecurities of the Internet

Among the most popular stereotypes related to Cyberterrorism, is that of terrorists shutting down the Internet, or to put it in another way, denying access to the desperse and decentralized Internet infrastructure by attacking the Internet's root servers the way it happened back in 2002 -- knowing Slashdot's IP in such a situation will come as a handy nerd's habit for sure. Outages like these would eventually result in a butterfly effect, such as direct monetary losses and confidence in the today's E-commerce world.



In my previous "How to secure the Internet" I commented on the U.S's National Strategy to Security Cyberspace, moreover, I pointed out some issues to consider in respect to the monoculture that's affecting the entire population. While today's threatscape is constantly changing, it still points out key points points such as :



- Improve the Security and Resilience of Key Internet Protocols
"The Internet is currently based on Internet Protocol version 4 (IPv4). Some organizations and countries are moving to an updated version of the protocol, version 6 (IPv6). IPv6 offers several advantages over IPv4. In addition to offering a vast amount of addresses, it provides for improved security features, including attribution and native IP security (IPSEC), as well as enabling new applications and capabilities. Some countries are moving aggressively to adopt IPv6. Japan has committed to a fully IPv6 based infrastructure by 2005. The European Union has initiated steps to move to IPv6. China is also considering early adoption of the protocol."



In my previous "The current state of IP Spoofing" post, I mentioned that if you can spoof there's no accoutability, and you can even get DDoSed by gary7.nsa.gov. But until then we would have to live with the current situation, or keep building awareness on the issue of course.



- Secure the Domain Name System
"DNS serves as the central database that helps route information throughout the Internet. The ability to route information can be disrupted when the databases cannot be accessed or updated or when they have been corrupted. Attackers can disrupt the DNS by flooding the system with information or requests or by gaining access to the system and corrupting or destroying the information that it contains."



During March, Randal Vaughn and Gadi Evron released a practical study entitled "DNS Amplification Attacks" pointing out that :



"Our study is based on packet captures and logs from attacks reported to have a volume of 2.8Gbps. We study this data in order to further understand the basics of the reported recursive name server amplification attacks which are also known as DNS amplification or DNS reflector attacks. One of the networks under attack, Sharktech, indicated some attacks have reached as high as 10Gbps and used as many as 140,000 exploited name servers. In addition to the increase in the response packet size, the large UDP packets create IP protocol fragments. Several other responses also contribute to the overall effectiveness of these attacks."



It feels like a deja vu moment compared to Mixter's release of his award-winning "Protecting against the unknown" research and the emergence of DDoS attacks(read the complete story, and keep in mind that it's wasn't iDefense, but PacketStormSecurity offering $10k rewards back in 2000). VeriSign indeed detailed massive denial-of service attack, and Slashdot also picked up the story. Most importantly, the event also attracted the U.S government's attention, but what you should also keep in mind is that :



"In order to create an 8Gbps attack using carefully crafted zones, you need no more than 200 home PCs on basic DSL lines," Joffe said. That math assumes about 200 bots eating up a full 512Kbps connection with lots of 60-byte DNS queries, each of which is amplified 70x into a 4,200-byte reply against the attacker's target. To put that in perspective, Russian hacking crews advertise that they will place the malware of your choice on 1,000 bots for a mere $25, according to the Internet Storm Center."



No 0day necessary, but DDoS on demand/hire, and renting botnets are the practices worth mentioning the way I pointed them out in my Future trends of malware research.



-Border Gateway Protocol
"Of the many routing protocols in use within the Internet, the Border Gateway Protocol (BGP) is at greatest risk of being the target of attacks designed to disrupt or degrade service on a large scale. BGP is used to interconnect the thousands of networks that make up the Internet. It allows routing information to be exchanged between networks that may have separate administrators, administrative policies, or protocols."



Interdomain routing communications are like empowering assembly line workers with the ability to stop the line at anytime, or have a claim on it, a tricky option sometimes. A recently released research(2005) "A Survey of BGP Security" points out the bottom line these days :



"We centrally note that no current solution has yet found an adequate balance between comprehensive security and deployment cost." Still, IETF's Routing Protocol Security Requirements (rpsec) are worth the read.



What I truly hope, is that any of these guidelines wouldn't end up on a paper tiger's desk for years to come, namely they would eventually get implemented and Internet2 would end up dealing with a more advanced set of security problems compared to the current ones.


My point is that, while only the paranoid survive, seeing ghosts here and there is like totally missing the big picture -- Richard Clarke for instance once said that "If there's a major devastating cyberspace security attack, the Congress will slam regulation on the industry faster than anything you can imagine. So, it's in the industry's best interest to get the job done right before something happens." But when, and how it would affect the commercial side of the question, that is how visionary are the vendors themselves to anticipate the future in here?



No one would want to shut down the Internet as terrorists are actively using it for propaganda, communication, and open source intelligence. Still, the deceptive PSYOPS initiated by terrorist sympathizers or wannabe such is what will continue to hit the deadlines -- just don't miss the big picture!



UPDATE : The post just appeared at LinuxSecurity.com "On the Insecurities of the Internet"



Technorati tags:
Security, Information Security, Internet, Internet2, DDoS, Networking, IPv6, VeriSign Continue reading →

How to secure the Internet

I recently wondered, are there any existing government practices towards securing the entire Internet?

So I went though the U.S National Strategy to Security Cyberspace, to find out what is the U.S up to given it stillmaintains "control" of the Internet. What is the Internet's biggest weakness? No, it's not a sophisticated term, its a common word called design.



A fact that is often neglected as the core of all problems, is that the Net's design by itself was primarily developed for reseach purposes. That is, universities and scientists exchanging data, users whose activities would definitely not result in the following :)



- infect the competing Ivy League universities with malware, and "borrow" as much intellectual property as possible

- Conduct DNS poisoning and redirect their competition's site to their own one

- Eavesdrop on their fellow researcher's communications



The Internet wasn't mean to be as secure as we wished it could be today. So, when it became public and turned into today's part of daily life, I feel this weakness started to remerge on a harge scale.



Perhaps the second biggest vulnerability is the ability to forge source addresses, and given you can spoof the origins of your packet no accountability for a great deal of today's threats is present. IPv6 isn't the panacea of security, and would never be though. There are as a matter of fact a lot of vulnerabilities related to mostly, implementation, and awareness on the possibilities. But the introduction of IPv6 over the Internet, still remains an ambition for goverments and organizations across the world. As a matter of the the U.S DoD indicated their troubles while migrating to IPv6, but they desperately need it. Though, I greatly feel the sooner the better.



The current Internet IP space is so easily mapped and datamined, that on most occasions,such transparence is mostly beneficial to malicious attackers. I believe that security threats can indeed have a national security impact, of course, given their sevirity and actual abuse. Today's information and knowledge driven societies are largely dependent on information and technology infrastructure for most of their needs. This has on the other hand boosted a tremendous technological growth. It eventually resulted in an increased world productivity, but the dependance can also affect real life situations on certain ocassions.



Can cyberspace indeed influence real-life situations and cause havoc?
Would someone wants to bring down the Internet, and how sound is this? What are the main driving factors behind the known weaknesses of the infrastructure, and how can their negative effects be prevented?



I greatly feel that the growth of E-governments, native Internet population, improved communication infrastructure, thus more bandwidth and opportunities,are crucial for the growth of a nation. The only weakness besides actual usability or utilization, is Security.



Going back to the report, it clearly highlights and takes into consideration both, soft and hard dollars.


That is, enemies conducting espionage over companies, universities, or mapping key government, industry networks, and easily reachable known targets to be used later on. Hit-lists for potential targets can be easily gathered in today's open source intelligence world.



On a worldwide basis, the implications to the entire Internet posed by insecure DNS servers, and by the insecurities of the DNS protocol can undermine the Internet in itself. What happens when all sites are actually there, but remain unreachable worldwide? The 2002 attacks on the root Internet servers indeed acted as a wake up to the international community on how fragile the current system really can be.



Some of the obstacles for a secure Internet from my point of view consist of :

- Plain text communications are the easiest, most common way malicious attackers can abuse a nation's communications, excluding the fact that the majority of communications remain unencrypted

- Lack of evolving compliance, threats change so fast, that everyone can barely keep up with them, and what used to be "secured" yesterday, is vulnerable today

- Less procedures and strategies, more actions, perfecting planning is futile, by the time you end you planning process you would have to change everything. My point is, empower those who are able to execute real actions towards improving security.

- The gap between government, private and academic sectors is resulting in a lack of integrated early warning systems, that would eventually benefit everyone

- Realization of a nationwide client-side sensor, I have also considered Symante's utilization of their 120M client based as the biggest, most sensitive honeypot ever.



To sum up my ideas, migration to the, at least though to be more secure Internet2 , would take years and cost billions of dollars on a worldwide basis, yet it's worth it!



Have an opinion? Share it!



Technorati tags :

cyberspace,security,information security,IPv6,Internet2 Continue reading →