On Thu, Jul 04, 2002 at 02:35:32PM -0400, Richard A Steenbergen wrote:

But I'm sure there are probably more subtile ways to do it. As with all good vulnerabilities, it takes someone who is working on the inside to REALLY know how to muck things up... Fortunately the terrorists seem to be concerned with killing thousands of innocent people and scaring millions, not pissing off a few nerds and disrupting eBay's profit margin for a week. As much as we like to think we are important, I'd hardly put them in the same class.

Or, you could work behind the scene, get Michael Powell appointed to the FCC, and make sure there are no brakes on the shortsightedness of lawyers at the RIAA, the MPAA, and the US RBOCs. Oh. Wait. That's been done. Nevermind.

Ah the infamous accounting.eml of 2002, good call. -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Geo. Sent: Thursday, July 04, 2002 5:01 PM To: Richard A Steenbergen Cc: nanog@merit.edu Subject: Re: Internet vulnerabilities

I can't quite picture Osama leading a crack team of BGP commandos on a jihad against the internet...

It won't be OBL who takes down the net, it will be a bunch of accounts like those at WCOM.. Geo.

I'm actually more worried about script/packet kiddies.

13 year olds with some scripting knowledge rarely know the financial cost of their "fun".

Does the possibility of these 13 year olds being recruited exist? I think so. I think most people are grouping terrorist into the "strap a bomb to your body and commit suicide" stereotype. Is there a possibility that intelligent terrorists exist? Or even people that have the knowledge and sympathize with them? OBL used a satellite phone, they found laptops in Afghanistan, there is evidence they are using the web to transmit information to each other. I think someone out there has a clue about computers. Crippling the entire net may be impossible, but it sure sounds like a well planned out series of attacks could do some serious damage. jas

The 13 year olds generally do it for the glory of being elite, not for greater political agendas. And, while I think that if terrorists wanted to, they could... I think terrorists are more interested in collateral damage. --Phil -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jason Lewis Sent: Thursday, July 04, 2002 6:42 PM To: nanog@merit.edu Subject: RE: Internet vulnerabilities

I'm actually more worried about script/packet kiddies.

13 year olds with some scripting knowledge rarely know the financial cost of their "fun".

Does the possibility of these 13 year olds being recruited exist? I think so. I think most people are grouping terrorist into the "strap a bomb to your body and commit suicide" stereotype. Is there a possibility that intelligent terrorists exist? Or even people that have the knowledge and sympathize with them? OBL used a satellite phone, they found laptops in Afghanistan, there is evidence they are using the web to transmit information to each other. I think someone out there has a clue about computers. Crippling the entire net may be impossible, but it sure sounds like a well planned out series of attacks could do some serious damage. jas

Jason Lewis wrote:

... Is there a possibility that intelligent terrorists exist?

I'd take that as a given. Planning, security and execution of the Sept. 11 attack were all done competently. These guys are certainly fanatics and arguably crazy, but they are neither stupid nor incompetent. Osama's a university graduate. I taught English at the same U (King Abdul Aziz in Jeddah) a few years after he left. It wasn't at the level of MIT or Cambridge, but it wasn't dreadful either.

Or even people that have the knowledge and sympathize with them?

Most of my best students were Palestinian scholarship winners. This was early 80s. Most of those kids had grown up in refugee camps where their parents had been since the 50s. Care to guess where their sympathies were?

OBL used a satellite phone, they found laptops in Afghanistan, there is evidence they are using the web to transmit information to each other. I think someone out there has a clue about computers.

In assessing threats, the rule I'd use as a first approximation is that they have, or can easily get, any skill you can expect from a bachelor's degree or tech college grad in any field. If they need a water systems engineer, an embedded computers guy and a biochemist to pull off a particular attack, assume that they're almost certain to have at least one of each. The question of whether they have the skills is only interesting for more esoteric attacks, where they may not have exactly the specialist they need.

Crippling the entire net may be impossible, but it sure sounds like a well planned out series of attacks could do some serious damage.

Various worms have done moderately serious damage. My guess would be that a well-planned and executed attack could take the net down for a few days.

Coordinated infrastructure attacks are scary for that reason. They are scary. :) Netcraft will provide you the information on every web server/server OS just for the asking -- you don't need an OC3 or even nmap. Historically, wide spreading worms have had a flaw in the program that prevented how much damage they could cause. (i.e., either too virulent or too patient). I suspect even in your dd solution, the attacker would leave a delay to allow some additional CPU power devoted to attacking other destinations. If the timeout is too short and interesting machines go down fast, the spread takes longer. If its too long, it can be stopped before it gets as far. The nastier you make it, the less far it spreads. In some paranoid networks, within 20 minutes of the content disappearing they would probably pull all or many of their most significant machines off line while they are figuring out what attack is occuring. The least responsive networks are going to be the most vulnerable to a scenario like this. Rate limiting ICMP (or your favorite attack packet) isn't as difficult as it used to be (even at the border), and since most large networks use automatic configuration generators -- no matter how cumbersome -- it is concievable that the brute force attack could be killed on the largest networks at a mean of 10-12 hrs. Server damage would take longer depending on how available/recent backups are. The best part of multilevel NOCs (level 1-2 open tickets 3+ solve problems) is that under large, cascading attacks of this sort, those who actually solve the problem are not as bogged down by frantic customers calling. ---- Risers (inside) a building aren't even that big a deal. Most manholes around these carrier hotels are not welded shut, and most of the POEs (no matter how many there are) have a man hole or two on the street for splicing purposes. A few bad guys could drop a <explosive, incendiary, acid, etc> in each of these around each major carrier hotel and disable the hotel in about 20 minutes from start-to-finish. (4 men teams at each major infrastructure location in the U.S. -- say 10?) could disable everything in less than 5 minutes from start to finish and be making a quick exit before the first fiber goes down. If you simultaneously melt/explode/destroy every POE to every major cable landing/telecom hotel in the U.S., you will have problems (sky links MIGHT be excepted if you are especially clever). And >24 hr repair times, assuming you can get the repair call out in the first place. Lets not forget that manholes are almost always in public right of way, or similarly accessible. Opening them quickly/publicly won't even freak out too many people. Worst case 2-3 blocks away you triple the number of manholes to open/disable, and have no tech-savvy types or building-security types have the chance to even see it go down -- better, no welded manholes to worry about whatsoever. --- Its almost ridiculous to worry about protecting carrier-buildings from deliberate mischief because they are far more vulnerable outside than inside. Security guards inside are (IMO) to keep large pieces of equipment from walking out without getting a good look at the guy(s) doing it. Even then, most misunderstand their role and rely on the basic honesty of the visitors to maintain anything... I could just be grumpy though. Deepak Jain AiNET

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Phil Rosenthal Sent: Thursday, July 04, 2002 2:17 PM To: jlewis@packetnexus.com; nanog@merit.edu Subject: RE: Internet vulnerabilities

Thinking about a physical threat... If you go to 111 8th ave, NYC. They have added security since 9-11-01 which now requires either building ID, or showing a driver's license before entering building (because terrorists don't have driver's licenses).

On some floors (eg the 7th). The building risers and conduits are completely exposed. I can't help but wonder how much damage a terrorist attack to that would do.

Also, say someone from a moderately fast internet connection (OC-3) ran nmap across the entire internet on ports like 21,22,53,80,443,3306. In one day, they can probably have a list of every server answering those ports, and the versions of the daemons on them.

Next, just wait for an wide enough exploit to come out, and then write a Trojan that has a list of every other server vulnerable, and on every hack, it splits the list in 2, and roots another box and gives it the 2nd half of the list.

I estimate that with a wide enough exploit (eg apache or openssh), you could probably compromise 20% of the servers on the net within 1 hour, and then have them all begin a ping flood of something "far away" network wise (meaning a box in NYC would flood a box in SJC, a box in SJC would flood a box in Japan, etc... Trying to have as much bit distance as possible).

Damn scary, but I believe if someone was determined enough, they could take down the whole 'net within one hour of pressing "enter".

I suppose there really isn't anything that can be done at this point to make that scenario impossible.

--Phil

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jason Lewis Sent: Thursday, July 04, 2002 1:57 PM To: nanog@merit.edu Subject: Internet vulnerabilities

There is a lot of news lately about terrorist groups doing recon on potential targets. The stories got me thinking.

What are the real threats to the global Internet?

I am looking for anything that might be a potential attack point. I don't want to start a flame war, but any interesting or even way out there idea is welcome.

Is it feasible that a coordinated attack could shutdown the entire net? I am not talking DDoS. What if someone actually had the skills to disrupt BGP on a widescale?

jas

:: Said in my best Dr. Evil voice :: Ok, here is my master plan to take down the Internet. First, we will spend two weeks writing up several hundred seemingly simple, short questions and innane statements regarding ORBS, filtering RFC1918 space, Peering, and all of Nanog's other favorite topics. Then, we'll start posting the messages to NANOG addressed from two seemingly intelligent ex-dot-comer's named Bob and Jay. Thus, our code name for this project will be "Jay and Silent Bob Strike Back". We'll start by sending the first message out to NANOG. Now, you know that all the IMPORTANT engineers on the Internet have no way to resist reading these messages and responding to them. The threads will begin to build in traffic during the subsequent hours taking up the precious brain power of critical engineers. Every hour, we will submit a new message from our database - sent, of course, through some open relay so the message sources are randomized and hard to filter and with private source addresses so they cannot be traced. After a single day, the traffic level on NANOG will be so great that it will have effectively consumed all available resources for every NANOG member, rendering them completely unable to do any work. The traffic from these emails, which are replicated and amplified by engineers who can't resist responding to our innane, repetative, and silly messages, will grow exponentially until all peers and backbone circuits on the Internet are full. No one will notice their threshold alarms going off. No one will notice HPOV desperately trying to page them. No one will see the tickets queuing in their ticket systems. No one will notice Instant Messages from loved ones warning them that the Internet is imploding. No one will see us as we move in and take over the world!!!!!! Any questions? :: reaches for a hot pocket :: Dr. Evil.

Phil Rosenthal wrote:

Also, say someone from a moderately fast internet connection (OC-3) ran nmap across the entire internet on ports like 21,22,53,80,443,3306. In one day, they can probably have a list of every server answering those ports, and the versions of the daemons on them.

Given the ability (which anyone can have with a few downloaded scripts) to subvert poorly secured machines on cable or DSL links and make them do the work, you could do this without a fast connection, and without being obvious enough to raise major alarms from intrusion detection systems. It might take a few weeks or even months. For some types of target, you may not even need nmap. Look at MX records, or at mail headers, to find mail servers, at news headers to find Usenet servers. Use a web crawler, or an existing index, to find web and FTP servers. Or write a little program that searches the DNS for names with leftmost element ftp, mail, pop, smpt, www, ns, dns, ... These won't get you a full list, but perhaps enough.

Next, just wait for an wide enough exploit to come out, and then write a Trojan that has a list of every other server vulnerable,

You don't need them all, just a few 1000 with good net conections to get things rolling. Once you have those infected, it doesn't matter if your method of spreading further is inefficient; you'll get everything anyway. Also, you may not need a new exploit. Many systems are not patched against the old ones, and it is certainly possible to try multiple exploits in a single worm.

and on every hack, it splits the list in 2, and roots another box and gives it the 2nd half of the list.

Better, give it the whole list and have each instance start at a random point in the list. That way, even if some instances are caught and killed, you still get the whole list.

I estimate that with a wide enough exploit (eg apache or openssh), you could probably compromise 20% of the servers on the net within 1 hour,

For better estimates and detailed discussion of worm design, see: http://www.cs.berkeley.edu/~nweaver/warhol.html

and then have them all begin a ping flood of something "far away" network wise (meaning a box in NYC would flood a box in SJC, a box in SJC would flood a box in Japan, etc... Trying to have as much bit distance as possible).

Why futz with a ping flood? If the objective is to take down the net, you want to attack infrastructure -- nameservers, routers, ...

From that viewpoint, the ideal worm would use whatever it needed to become widespread, but would switch attacks once it had spread, trying for known holes in things like BIND or IOS, or just flooding the root name servers.

Damn scary, but I believe if someone was determined enough, they could take down the whole 'net within one hour of pressing "enter".

Except what if in my scenario, while flooding, it executed dd if=/dev/zero of=(hd) on all of the system drives. If someone wanted to do it, it could be done. --Phil -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of David Ulevitch Sent: Thursday, July 04, 2002 2:23 PM To: nanog@merit.edu Subject: Re: Internet vulnerabilities <quote who="Jason Lewis">

What if someone actually had the skills to disrupt BGP on a widescale?

I think the media talk about "taking down the Internet" are kind of bogus. Nobody has ever died because they couldn't check their email. If the net went down for an hour, a day, or even a week I think that my mom and the rest of the non "glued-to-their-terminal" world would somehow struggle through and sustain a normal daily routine. -davidu [who probably would not survive a week long net outage ;) ] -- "Never doubt that a small group of thoughtful citizens can change the world. Indeed, it is the only thing that ever has." --Margaret Mead

On Thu, Jul 04, 2002 at 02:47:24PM -0500, jnelson wrote:

How about this: ISP X had its tftp server compromised by a wily hacker who evaded tripwire and covered his track well, uploaded some cracked Cisco code (the current release for their GSRs). This code was designed to corrupt the directories and shut down the router at date XX:XX:XX. Each of these affected GSRs, 7-five new roll-outs and 2 upgrades--went down at the same time (save one who's time was no set correctly). Each site had to driven to, flashcards replaced. ISP X severely crippled for 6 hours. The hacker could have gone the extra leg to have the tftp server expunge the backup configs at the same time--extra couple hours--but did not.

Who needs malicious hacking, running the latest code for a GSR will crash your network just fine... The specific crash date and time functionality hadn't been added yet though, maybe you could put in a feature request. :) Besides, if someone actually did get the IOS code (laugh) AND manage to compile images out of that cruft, I'm pretty sure changing the MD5 signature on cco would be the least of their problems. -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

At 04:20 PM 7/4/2002 -0500, jnelson wrote:

Keep the gloves up...cruft...lol, but if you wanted to compare Cisco "features", I've dealt with some bugs that would cook your hair.

I don't think software is a good focus. Facility destruction would be a far worse "attack" than software. I think we'd recover much faster from a "layer 3" + attack vs. a layer 1 attack.