Schneier on Security

Clive Robinson • September 27, 2016 1:20 AM

@ Bruce,

You write,

In fact, the site is down as I post this.

Having given the site link in the previous sentance +1 for making me smile.

That aside DDoSing has been a problem for some time, yet we appear to be at a loss as to how to deal with it. Further it appears that few have mentioned it may not possible to solve it and what that might mean.

Whilst there have been suggestions of ways to limit DDoSing, some atleast appear to be a case of “The cure is worse than the disease”.

This particular attack shows that the “passive defence” of just having “more bandwidth” is never realy going to be a solution even if the “attack amplification” techniques are some how magicaly removed over night.

For instance the seemingly obvious idea of “kill it at source”, whilst sounding logical is it’s self likely to become an attack vector via any signaling mechanism you would use to implement it. This is simply due to the Internet not having a reliable distributed trust mechanism as the problems with the proliferation of CAs has shown.

Likewise most other ideas that people have thought of have the seeds of being a worse problem within them.

Unfortunatly at the end of the day a DDoS requires very little to become a significant problem. Because all that is needed is a single bug that can be turned into an attach vector and an appropriate payload to provide the attack packets.

This means that anyone with a little luck and skill from a curious teen in their bedroom through to a state level attacker can do this as it falls neatly into the “Army of One” issue.

Attribution would be nearly impossible because you would have to consider if the “single bug” was accidental or deliberate.

That is to play a “Red Flag Gambit” let us assume that a major manufacturing nation of IoT or network appliances decided to “plan ahead” for cyber-war. Having heard the rantings of their most likely enemy about “kill switches” and “pulling the plug” they decide to “infiltrate an army”. Thus putting the bug and the ability to run a payload in all export devices they manufacture. Thus the delightfull situation that the potential enemy pays for their own defeat. Which is an interesting variation on “Economic Warfare”.

Whilst we are never likely to know who launched this current attack, or for that matter who was actually the real target –unless the perpetrator is daft enough to brag about it– there are several lessons in it that I suspect a number of people are going to be banging their head against the wall over.

The first lesson is that the sort of “Cyber-Commands” talked about in the US etc are in effect paper tigers. The second is that concentrating your efforts on “Cyber-attack” not “Cyber-defence” is so unbalanced it is untenable as even a short term strategy. Thirdly and especially so if your network on which you have based a large part of your econony, is infact populated by devices from a potential enemy state who things more in the longterm than the shortterm…

However this idea is far from new, I first read about the technological army within in one of Issac Asimov’s Foundation Series books. More recently Futurama had an episode where the manufacturer of all the robots in a fit of peek or boredom threw the “kill switch” she had secretly built in all her robots, thus the robots “revolted” and mayhem followed.

Clive Robinson • September 27, 2016 9:06 PM

@ tyr,

Once you
get beyond the personal/ site inconvenience, I
think the cure will be orders of magnitude worse.

Yes the repression of privacy etc most certainly will be, it’s been obvious to me we’ve been moving into LEO “We have the right to know, all resistance will be crushed” territory for years (just read the ACPO reports, it makes “going dark” fears look mild).

But there is another side than LEO/Gov paranoia writ large, we appear to be incapable of secure and efficient designs. To stop DDoSing we will come in with a bad design with bad trust etc, thus all that will happen is that the existing DDoSing methods will be partialy solved by tools that will themselves become DoSing tools etc.

Even going to “a real communication network” will only shift the DoS problem not fix it, and in the process give significant power to others who will abuse it.

Thus my view is to fix problems like DDoSing we need to dig down to where the problem realy is, which is crapy OS’s and Applications giving the attack vectors that the DDoSers have been using to build their bot nets. Lest anyone think I’m singling out certain well known companies and organisations I’m not. Because most commercial Closed Source as well as Open Source suffer from the layer nine and up[1] problems being reflected down into the lower layers. Resulting in Johnny not just being unable to encrypt but act or code securely either. It’s that realisation back a quater of a century or so ago that made me keep “my systems” away from others, and keep other systems I used for work etc issolated where possible, and as locked down as tight as I was allowed otherwise.

Thus with the majority of systems insecure we live in a “low hanging fruit world” where the only thing stopping most systems getting raped and plundered by the ravening hords of attackers, is to few attackers in a very target rich environment. Thus chance is what determines where the eyes of the attackers fall and the choice is rich enough that attackers can pick the lower hanging fruit to their hearts desire at their leisure. Which unfortunatly gives the likes of the layer nines and tens over confidence in their abilities, especially with respect to the time element. They see each day they think they are not successfully attacked as the measure of their security, not as being one day closer on the probability curve to them finding they have been attacked.

This under valuing of attack risk by managment and above is exacerbated by attackers “over estimating” target value, thus putting more effort into methods of attack than will pay back. Which means there is a quite wide reality gap in risk / reward assessment that needs to be closed.

However it is that gap that gives us the botnets by which DDoSing can thrive. Mainly due to those attackers who have developed exploits being unable to cash in on them any other way. If the OS and App security improved the supply of bots would decrease, thus the price would rise, and DDoSing become scarcer due to the cost/risk involved…

No doubt Ross J. Anderson and his team over at Cambridge Labs have looked at or know who has looked at the figures for this and drawn up papers for the Security Economics research domain.

[1] The ISO OSI Seven layer model only covered a part of the computing stack. So unoficialy it has been augmented with “physical” layers below and “human” layers above. With the other layers above currently being approximately, Users at eight, Managment at nine, Organisations at ten, and others that cover the external political etc layers of society still getting shaken out by sociologists etc.

Clive Robinson • September 28, 2016 3:19 AM

@ Drone,

Where is the U.S. Government in this? M.I.A. it seems to me – that’s where.

I think you answered that one yourself over on the neural net thread, with,

You pay for the silicon version once up-front and it works continuously without complaint. On the other hand, you pay repeatedly for the biological version, it gets sick, complains repeatedly, joins corrupt labor unions, and sues you when it doesn’t get what it wants.

And maybe those left did not have enough time to push the start button 😉