top 200 commentsshow all 447

[–]Godranks 290 points291 points  (190 children)

Say, hypothetically, that all DNS servers were to be compromised at once around the world. What would we be able to do about it? Couldn't I just set up a DNS server on my home network and just call people to tell them to add my IP as their DNS?

[–]K3wp 566 points567 points  (169 children)

I manage security for a large network in southern california.

If something like that happened and we learned about it before all our cached entries were poisoned/erased, we could just freeze our local services/systems until everything was resolved. Once of our SOC handlers could even put in an immediate mitigation by blocking port 53 outbound. So, essentially we would silo off our DNS from the world and just run off of the cached entries. Which leads to the interesting question of what happens when they start expiring and root nameservers can't be reached. TBH, I don't know the answer to that question.

Regardless, we are a 100Gb+ network and I have access to multiple 10G packet cannons and an unallocated, routable /8 research network. There are many people here and elsewhere that could disrupt the Internet in a manner that would attract national attention, if they so wanted to. Any senior network engineer at one of the tier-1 ISPs could do the same, particularly if they started screwing with routing tables. We don't because it's a career ending move, also illegal and punishable by a long prison sentence.

These sorts of discussions are somewhat silly to engineers like us, as it's just observing that we could do some amount of damage if we felt like it. This is true for any discipline with lots of money, infrastructure or lives at stake. Not sure why anyone would think core networking infrastructure is any different.

[–][deleted]  (77 children)


    [–]K3wp 218 points219 points  (72 children)

    Well, that's why the DoD has their own Internet (SIPRNET).

    With their own internal nameservers, that are functionally air-gapped from the rest of the Internet.

    If any single nation-state tried to attack another one from their own networks, they would get de-peered almost immediately.

    The Internet is like the world's largest co-op. Anyone single entity that tried to destroy it would be blacklisted for life from it.

    A scarier scenario would be a 'False-Flag' attack, where a nation launches an attack from compromised machines on an external network (or networks).

    [–]geeky_username 62 points63 points  (25 children)


    Sounds like a great deterrent to be, like MAD, but no-internet-for-you.

    Imagine how pissed off people of that country would be

    [–]FweeSpeech 26 points27 points  (24 children)

    Tbh, many countries have enough domestic services ppl would not miss enough.

    More importantly, they have plausible deniability and propaganda.

    [–]NotFromReddit 33 points34 points  (23 children)

    The only ones I can think of that have their own copies of all important or popular services are China, and to a lesser degree Russia.

    [–]hylje 22 points23 points  (9 children)

    The main reason stopping minor outlying countries from setting up their own Facebooks and Youtubes is because there's no demand. Everyone there is using the actual FB and YT.

    This would change in an instant should de-peering occur. Domestic services would kick up and get their audience within days.

    [–]NotFromReddit 10 points11 points  (7 children)

    Sounds like great business opportunities. I'm from SA and I could get a few of these up quickly probably. As long as I have access to Github :/

    [–]brtt3000 62 points63 points  (2 children)

    If Stackoverflow goes down we all go down.

    [–]muchtooblunt 25 points26 points  (10 children)

    And USA.

    [–]b1gd4ta 47 points48 points  (9 children)

    But thats the actual internet.

    [–]Sydonai 30 points31 points  (7 children)

    From a certain point of view.

    [–]BeJeezus 5 points6 points  (0 children)

    Was accurate in the 1980's. Slightly less so in 1991. About half true in the 2000's. Increasing less true each year that passes.

    [–]FweeSpeech 4 points5 points  (0 children)

    Yes. And they are the only ones who can truly "take down" the internet without it routing around the damage.

    It takes alot to do more than a 48hr outage.

    [–]ccfreak2k 8 points9 points  (9 children)


    Considering how often accidents happen that blackout portions of the Internet, I don't have confidence in this answer anymore.

    [–]K3wp 13 points14 points  (8 children)

    There is a rumor the DOD has charges on all the undersea fiber and can cut it all instantly. One way to solve the problem.

    [–]ihsw 29 points30 points  (6 children)

    That has the potential to wipe out billions per day out of every nations combined GDP, and sink many Fortune 500 companies instantly. Jesus God-almighty that terrifies me far more than another 9/11.

    [–]interfect 13 points14 points  (1 child)

    Except the fiber-laying companies. They'll be way up.

    [–]emn13 2 points3 points  (0 children)

    Well... maybe. A severely damaged internet is also less valuable to connect too, so it's not all that obvious it would be great for fiber-laying companies. And people might prefer investing in less obviously vulnerable infrastructure the second time around. Or even just in infrastructure that's quicker to deploy, as time-to-market might be more valuable than network quality.

    It's really hard to predict what would happen. I seriously doubt it would be good for much of anybody.

    [–][deleted]  (3 children)


      [–]KennyFulgencio 9 points10 points  (0 children)

      page, keywords, anything? With my own guesses at what to search for, I haven't found anything fitting your description

      [–]delfinom 3 points4 points  (0 children)

      Why do you have to nuke what's just a building... Are we afraid a guided bomb will miss and take out a only wedding again?

      [–]TheGift_RGB 13 points14 points  (0 children)

      why do people take the Internet so seriously, it's just a fad that's been dying since the 90s

      [–]Kenya151 2 points3 points  (0 children)

      The Ol' Event Horizon style

      [–]Taek42 32 points33 points  (2 children)

      That's great for the DoD but if I lost internet it'd mean the end of my income. It'd probably be the end of credit cards. It'd probably be the end of worldwide shipping. So the military would have internet but it really wouldn't matter because daily life is absolutely dependent on the internet at this point, especially if you are considering something like a nationwide outage.

      The fact that our internet infrastructure is so fragile is something we should be extremely worried about.

      [–]KayInIvory 4 points5 points  (0 children)

      While there are risks, even an extremely successful attack wouldn’t shut things down permanently. The Internet is resilient enough to work around catastrophic attacks—eventually. It would sure suck for a while depending on the severity.

      Bank and credit card networks are mostly separate from what you’d normally consider the Internet, just like the power grid etc.

      [–]stevenjd 44 points45 points  (11 children)


      An attack on the internet is not like a missile attack, where you can see the missiles launching from the country that is attacking.

      An attack on the internet will come from all over the world, simultaneously. You might suspect, for circumstantial reasons, that it was launched by country X, but you won't know.

      The US has repeatedly legislated an "Internet Kill Switch". I think Schneier is being naive in blaming the Chinese or Russians. I don't see that switching off access to the Internet will seriously impact the US's ability to defend themselves in the event of war, but switching off the Internet will certainly help the US government keep control in the event of widespread civil unrest.

      But even if taking the Internet down was followed by a physical attack, there would still be no blacklist. If the attacker wins, there will be no blacklisting, because winners get to write history, and if you think that the world is going to blacklist (let's say) the US after they've taken down the evil totalitarian Putin regime in Russia, or visa versa, well, you're ignorant. Companies and governments all over the world will be lining up to congratulate them and get some of that sweet, sweet spoils of war.

      Even if they lose, one change of government later, and those same companies and governments will be fighting for a chance to reconnect the loser to the internet, so long as they can make a profit from it.

      [–]Somegeezer 13 points14 points  (9 children)


      You kidding? If my router is even down 5 minutes, I feel the madness kicking in. To outright switch off the internet would cause widespread concern and panic more so.

      [–]scriptmonkey420 17 points18 points  (2 children)

      Not to mention massive disruption of services like Health, finance and Manufacturing.

      [–]Kalmah666 5 points6 points  (1 child)

      And redditing at work because you're bored.

      [–]saphira_bjartskular 14 points15 points  (14 children)

      I'm curious, have you actually worked with DISA and seen how SIPR is routed?

      [–]K3wp 32 points33 points  (10 children)

      Yes. It's routed over the same glass as the 'dirty' public Internet, but they use their own internal routing and DNS infrastructure. They still own large bits of the Internet, though it's not visible to the general public.


      [–]saphira_bjartskular 32 points33 points  (9 children)

      So you should know that routing tables alone won't keep SIPR up and running, and if a major datacenter has its operations compromised in a manner that affects the actual trunks' ability to route ANY information, this will affect the ability to pass information, internal routing tables be damned.

      [–]K3wp 40 points41 points  (3 children)

      Oh yeah, totally. The original discussion was about DNS attacks.

      [–]saphira_bjartskular 30 points31 points  (2 children)



      Carry on. Derp.

      [–]spast1c 24 points25 points  (1 child)

      An argument on reddit that gets settled? I feel like we can shut the internet down right now...I've seen the mountain top.

      [–]scriptmonkey420 3 points4 points  (2 children)

      SIPR is not the only network the DOD has. They have a TS network (JWICS) that is physically separated from the regular and SIPR nets.

      [–]Gskip 1 point2 points  (0 children)

      SIPRNET is considered an Intranet - just wanted to add some reddit semantics here.

      [–]cp5184 0 points1 point  (0 children)

      Didn't I read that russia is exploring creating it's own network separate from the internet?

      [–]phpdevster 2 points3 points  (1 child)

      Also helps as a form of propaganda. Shut down communication as a means of hiding the truth from people.

      [–]Somegeezer 4 points5 points  (0 children)

      When people are incapable of getting information, they always assume the worst.

      [–]ikilledtupac 0 points1 point  (0 children)

      we did it to North Korea that one time


      That's an interesting point. And effective infrastructure attack instead of an ELP blast that they scared us about in the 80's.

      [–]lesser_futhark 14 points15 points  (2 children)

      A phrase I didn't know I needed to know until I read it here: packet cannon.

      [–]mythogen 9 points10 points  (3 children)

      These discussions aren't silly, they're about something else. You're referring to insider threats, which are certainly real (Ed Snowden says hi) but are distinct from attacks by outsiders, which is what Schneier is talking about. If a Chinese espionage agency wants to disable American communication systems, an insider may not be an option.

      Calling Schneier's concern silly is like saying research into body armor is dumb because the enlisted men could just frag the officers in their sleep. Sure, that does happen, but you still need body armor for protection against the opposing force.

      [–]lobehold 3 points4 points  (1 child)

      Lol, the Chinese are way way WAY more scared of the US than the other way around. The most they'll do is spying.

      Seriously we are talking two nuclear armed countries, an attack on any single nation on the scale you're talking about is next to impossible realistically speaking.

      It's the terrorists who have no nation and not afraid of MAD who are the real threat nowadays.

      [–]Kalmah666 1 point2 points  (0 children)

      The US and China are also wayyy too economically connected... A major attack on one, be it Cyber attack or Nuclear would destabilize the flow of money between the two and both would end up a lot weaker because of it...

      I find it funny that people are scared of the Chinese of all people, considering he money being involved. Why do you think China keeps telling NK to shut the fuck up? The last thing they want is tensions between the US and them because the village idiot wont stop acting up.

      [–]MetaAbra 13 points14 points  (7 children)

      That's why they pay engineers the big bucks I guess.

      Salary = rarity of acceptable employees * cost of worst case fuckup

      [–]BassoonHero 6 points7 points  (3 children)

      Honestly, I'm a bit surprised every week BGP doesn't fail on its own.

      [–]JasonDJ 6 points7 points  (0 children)

      It technically does. But for seconds at a time. Bgp is designed to be a slow protocol for that very reason.

      [–]jeaguilar 4 points5 points  (0 children)

      It does. But the failures are isolated to folks who can't report them 'cause their routes are farkled.

      [–]K3wp 2 points3 points  (0 children)

      Check out the SpamHaus DROP list.

      [–]Divided_Eye 4 points5 points  (1 child)


      That's all that's holding you back? :P

      [–]celerym 1 point2 points  (0 children)

      People do more to get some crack

      [–]IrishWilly 23 points24 points  (7 children)


      That's such a dangerous attitude to have. People will always be the weak link but there are still ways to mitigate it by making any changes have to happen through multiple checks. Dismissing the concerns as "silly" if you are in any position of influence is very worrying. Security is a never ending discussion and requires constant improvement even if it will never be perfect. These discussions are ESSENTIAL for that process, not silly at all.

      [–]K3wp 14 points15 points  (6 children)

      Those multiple checks cost a lot of money to implement and most companies aren't going to do that unless they have to. Again, any senior engineer at one of the tier 1 carriers could seriously disrupt the Internet.

      [–]Vulpyne 3 points4 points  (3 children)


      That's an observation, not a justification for preserving the status quo.

      Multiple checks might cost a lot of money, but if not having those checks ends up costing more in the long run then refusing to implement them is naively ignoring the true cost. The correct approach would seem to involve quantifying the risks and determining which approach costs less overall. I don't personally know enough about it to argue for/against any specific approach.

      [–]K3wp 8 points9 points  (1 child)

      I'm not disagreeing with you. I'm just explaining how modern MBA culture works.

      [–]thebigslide 1 point2 points  (0 children)

      It's also a fact that with such checks in place, you can design an attack vector where mitigation is delayed.

      [–]dracotuni 2 points3 points  (6 children)

      I'd like to see on the "we don't" list the "because it's a dock move" reason.

      [–]Taek42 2 points3 points  (6 children)


      Yeah but what if Russia decides to start a war off by killing our cyber infrastructure? We're in deep trouble. That's something that should be a big concern. Credit cards depend on the Internet. Industrial logistics depend on the internet. Some large percentage of the population depends on the internet to perform their job. Half of our economy is practically based purely on the internet.

      It's not people like you that I'm afraid of. It's nation states who have imperialist agendas that scare me.

      [–][deleted]  (4 children)


        [–]Taek42 10 points11 points  (0 children)

        Most people here are US citizens and therefore overlook the dangers that the US poses to the rest of the world. I'm not at all proud of the things that my tax money has done in the Middle East, and if I was living anywhere outside of the US or Europe I'd consider potential military and cyber-military aggression from the US to be something worth losing sleep over.

        Especially with our next candidates poised to be Trump or Clinton. Both of those candidates seem like they would be highly imperialist.

        [–]Prod_Is_For_Testing 2 points3 points  (1 child)

        Would you mind explaining what a packet cannon is?

        [–]interfect 1 point2 points  (0 children)

        What crime is it, exactly, to start announcing some network that you don't own and eating all the traffic?

        [–]Kok_Nikol 1 point2 points  (0 children)

        Nice write up.

        Also, happy cake day!

        [–]program_the_world 0 points1 point  (8 children)

        Do you guys run a telescope?

        [–]K3wp 0 points1 point  (7 children)

        Yeah biggest in the world. A /8.

        [–]program_the_world 1 point2 points  (6 children)

        Neat. I've read a lot of papers about the exciting research made possible by those telescopes (background radiation!).

        [–]justaguy240 0 points1 point  (0 children)

        I was just thinking about a timed attack on strategic ASN that would announce bad routes to the root servers. That might actually cause some hell.


        The biggest issue (?) would be to build the cache - have the cache up to date at the right time, unless you just wanna provide GAFA and other big stuff to your little friends, that's probably a nice hash map of 2 Billions entries to keep up to date.

        [–]Godranks 11 points12 points  (3 children)

        Yeah that would be definitely be unreasonable. Although if the reason the DNS servers go down is because of some huge war starting, then I think supplying a local DNS to a few news sites should be enough. Throw in a facebook and google IP address and you're pretty much golden for what's hypothetically going on.

        While writing this I had a thought: don't modern routers cache DNS requests now? And it would make sense that personal computers do too. Maybe having the root DNS servers go down wouldn't be a problem until after a few hours downtime.

        [–]justaguy240 27 points28 points  (2 children)

        Almost all large DNS Infras the Root servers included are anycasted across a pool of hundreds of servers that will shut off interfaces and removed bad servers from the pool if an issue is detected. I run a very large DNS infrastructure and the long and short of it is that knocking down the DNS servers is damn near impossible, saturating provider links to the servers is a much more reasonable vector.

        [–]granadesnhorseshoes 13 points14 points  (1 child)

        This. DNS is terrible but it's ubiquity makes it pretty damn resilient.

        I would say though that poisoning DNS, especially for a nation state, is an even better attack than link saturation. Because its subtle, you may not notice its happening, and its trackable; They KNOW you wanted to go to the Prole resistance website that's now been redirected to infest your computer with spyware.

        Please remain in your home. A unit from the Ministry of Love will arrive shortly to take you to a re-education center.

        [–]mpact0 13 points14 points  (5 children)

        HOSTS file

        [–]TaylorSpokeApe 38 points39 points  (2 children)

        Before DNS that's exactly what we did. Each week we would download the new hosts file. It was about 5 pages long and had every host on the Arpanet along with a synopsis of available files. Usually that was the cold fusion papers and porn if it was a university.

        [–]argv_minus_one 10 points11 points  (0 children)

        Grab your dick and double click!

        [–]mpact0 1 point2 points  (0 children)

        Reminds me of Fidonet

        [–]TheGermanDoctor 1 point2 points  (1 child)

        ....are incredible slow

        [–]codebje 11 points12 points  (1 child)


        If all the DNS servers were compromised at once, there'd be no Internet, because DNS is so widely distributed that for every (let's just stick to root) server to be down at once would essentially mean every IXP in the world would be down at once.

        A number of the roots operate local anycast instances: ones only visible to a limited subset of the Internet. These local instances are lower capacity, but only serve a few million people anyway; they're cheap, easy to deploy, and low-risk.

        They're also extremely hard to disrupt, because you can't reach them unless you're in the little dedicated part of the Internet they serve. This renders them just about immune to DDoS, because having fifty thousand Korean PCs ready to attack does you no good if Korea can't see the German local instance.

        For some notion of scale, one of the root zone operators is serving DNS from around 70 locals as global instances, and an undisclosed number of local instances. This doesn't render a root operator immune, of course. A sufficiently powerful DDoS could easily overwhelm one instance, and may then be able to cascade the failure to the other global instances one by one; a very well organised one with an enormous number of zombies might be able to determine how to attack a desired set of global instances at once, which essentially means determining the routing of each zombie.

        It's pretty unlikely, IMO, that anyone can organise a DDoS well enough to take down all thirteen root operators at once, without also generating so much traffic that the Internet ceases to work regardless of DNS lookups.

        The software the operators run is diverse, so the likelihood of an exploit affecting every operator all at once is likewise very remote, and is a brief one trick pony anyway.

        [–]justaguy240 0 points1 point  (0 children)

        Not really unless you hardcoded the zones in the bind config because the auths for other domains would be compromised which is the source of truth for lookups that then get cached.

        [–]mirhagk 86 points87 points  (32 children)

        With all these digital attacks always discussed, I wonder how difficult a physical attack would be. Like if you took down a few major exchanges, it'd grind most of the internet traffic to a near halt. Plus that'd have the "advantage" of being a lasting attack (DDoS is just a temporary thing)

        [–][deleted] 92 points93 points  (4 children)

        You don't need to take down the exchange, just few bundles of fiber that are coming into it.

        It would just route around it regardless, but downing say AMS-IX means that it is now ~4.5 Tbps of traffic that have to go somewhere else

        [–]crackanape 19 points20 points  (3 children)

        That in itself is not a small project, given that AMS-IX is distributed all over town.

        [–]AetherMcLoud 5 points6 points  (1 child)

        So we have to hack the Gibson?

        [–]SmartassComment 3 points4 points  (0 children)

        I understood that reference, and wish I didn't.

        [–]NotExecutable 2 points3 points  (0 children)

        I mean, if you are really serious about it: Drop a nuke on Amsterdam (AMS-IX) and Frankfurt (DE-CIX) and the internet - at least in europe - should be in big enough trouble.

        But at that point, the people would have bigger concerns than the internet.

        [–]its_never_lupus 21 points22 points  (7 children)

        Someone with a lot of resources could cut a few undersea cables and slash the bandwidth between continents.

        [–]dgriffith 36 points37 points  (0 children)

        You don't really need huge resources. Undersea cables have to come out of the sea at some point. A guy with a backhoe hired out at $60/hr can ruin everyone's day.

        [–]xiongchiamiov 28 points29 points  (5 children)

        [–]MyTribeCalledQuest 9 points10 points  (3 children)

        That certainly doesn't seem like a coincidence.

        [–]bananahead 13 points14 points  (2 children)

        Did you see the section labeled "common occurrence"?

        According to Stephen Beckert, a senior analyst at TeleGeography, the events are far less exceptional than they seem because cable cuts happen all the time.

        [–]drysart 6 points7 points  (1 child)

        You'd have to cut a significant number of cables at once to have anything more than a temporary impact. There's plenty of unused undersea capacity available, because they're both laid with headroom for future traffic growth and specifically so they can handle cable failures.

        [–]iAMADisposableAcc 38 points39 points  (2 children)

        A grad student I know did his thesis on this.

        His initial draft submission was confiscated by the CIA (CSIS? FBI? I don't remember which) and he was awarded his masters without any further academia.

        [–]Mufro 15 points16 points  (0 children)

        ...Looks like I have a plan to finish my masters.

        [–]krackers 11 points12 points  (0 children)


        [–]Johnny_Truant 17 points18 points  (7 children)

        Why risk exposing yourself by coming into the country when you can take your time and accomplish the same thing?

        [–][deleted]  (5 children)


          [–]interiot 6 points7 points  (0 children)

          ... who have a stronger connection to the attacker. The inability to 100% attribute an attack is a nice feature of cyberattacks.

          Another nice feature — it can be deployed anytime, without having to wait for a physical attacker to be put in place (or having one prestaged).

          [–]bananahead 4 points5 points  (2 children)

          This isn't a Bond movie.

          [–]Amuro_Ray 0 points1 point  (0 children)

          I wouldn't send Phil and Grant to do this.

          [–]xdig2000 0 points1 point  (0 children)

          No need to expose anyone, sabotage from an in- or outsider or a 'terrorist' attack will do the job without linking it to the real attacking country.

          Am I on a list now?

          [–]ccfreak2k 4 points5 points  (2 children)

          About a year ago (I think), someone chopped a fiber link somewhere here in California that cut off a good chunk of customers for a regional ISP for hours. It's feasible, but there's too many backups nowadays for it to be truly effective except to confuse maybe a portion of the populace, at least here in the US. (for instance, if my Internet access at home goes down, I can just drive a few miles to work which is on a separate network, or use my cell phone which is on yet another network) Not to mention, depending on exactly where you decide to attack, you might have cops on you quickly.

          [–]demonstar55 1 point2 points  (0 children)

          Could just dig a hole, hit a major fiber line. And they're not always well protected.

          [–]syllabic 20 points21 points  (6 children)

          If they're using straight up DDoS attacks with an approach relying on volumes of data, where would they even get the traffic from to overload multiple backbone-level providers simultaneously? I get the feeling that that volume of traffic just couldn't get overseas at a fast enough pace to cripple US infrastructure. You can overload one hosting provider sure, but overloading many simultaneously would be an impressive feat.

          Maybe by targetting specific weak links? A couple key routers? Is that what they're looking for here?

          [–]twat_and_spam 35 points36 points  (0 children)

          The trick is that traffic would come from within US infrastructure. All those malware ridden windows laptops suddenly receive an instruction to spew their bandwidth at full capacity.

          There's also traffic amplification attacks that, in the simplest case, allows to double the effective traffic easily, in more advanced cases have potential to grow exponentially.

          Generating traffic is easy. Controlling it remotely is pretty easy too, just hop around via tor for an exit far into the target network.

          [–]inthebrilliantblue 3 points4 points  (1 child)

          It would have to be a botnet of computers in the states for that to happen. Even then I doubt theres enough to do that.

          [–]theoldboy 4 points5 points  (0 children)

          The Zeus botnet at it's height was estimated to have infected 3.6 million PCs in the US alone. Koobface was estimated at 2.9 million US infections. And there are some other lesser known ones with US infection rates well over a million.

          Still not enough? Well don't worry, if the Internet Of Insecure Things carries on the way it's currently going then those numbers will probably be larger by at least an order of magnitude in a few years time. And then we'll have a cyber-war being fought by lightbulbs and other home appliances :)

          [–]saphira_bjartskular 3 points4 points  (0 children)

          He also said they were testing other capabilities, like route manipulation.

          [–]mc8675309 1 point2 points  (0 children)

          They don't need to overwhelm the link capacity, just the end equipment packet capacity which is much lower.

          As for where the traffic comes from, any compromised computer will do, well, every compromised computer, and there's a lot of bot nets out there.

          [–]gurenkagurenda 1 point2 points  (0 children)

          In addition to various methods of originating the attack from within the US, there are amplification attacks which require only a fraction of the incoming bandwidth.

          [–]AwfulAltIsAwful 73 points74 points  (15 children)

          Everytime I read one of these articles, I find them a bit strange. The tone always comes off a bit sensationalist.

          At the shitty little firm I work at, we pay for third party pen-testing just like every other internet connected company in the world. These sorts of attacks just strike me as pen-testing at a sovereign level. Every nation in the world has exposure to the internet so I don't know why it's surprising that some of those nations would want to gauge exactly how vulnerable its infrastructure is, especially given the fact that a lot of that infrastructure is in the hands of just a few countries.

          I'd actually be upset at the NSA if I found out that it hadn't taken its own risk assessments. If not then wtf are my taxes paying for other than collecting a database of my browsing habits.

          E: Letters are hard.

          [–]WarWizard 64 points65 points  (5 children)


          You'd be surprised at how NOT common this actually is.

          [–]checkthebarometer 3 points4 points  (4 children)

          are you that guy from the gaming forum?

          [–]WarWizard 10 points11 points  (2 children)


          [–][deleted]  (1 child)


            [–]WarWizard 1 point2 points  (0 children)

            Speaking from experience; it is hard enough as it is to get them to buy storage space on the SAN when it is needed... forget preventative pen testing. It sucks but it is hard for small companies to manage that. Or they don't understand the importance. Or both. Usually both.

            [–]IrishWilly 29 points30 points  (4 children)

            Calling this "risk assesment" seems to be downplaying the scale of it. This is watching North Korea do nuclear missile tests, not watching North Korea build missile defense systems. There is quite a bit of difference between the two.

            [–]AwfulAltIsAwful 3 points4 points  (2 children)

            And what is the scale of it exactly? Do you have specifics? Because the article doesn't.

            [–]IrishWilly 33 points34 points  (1 child)

            Furthermore, the size and scale of these probes -- and especially their persistence -- points to state actors.

            Honestly I could quote half the sentences in that article that emphasize the scale and methodology of these attacks are much bigger than anything that could be attributed to something like 'risk assesment'. Of course he's not giving solid numbers, "oh and it turns out if you want to crash so and so you need X many resources". That's ridiculous. If there is anyone though with a reputation in network security that you should listen to when he says these attacks are worrying, it is Schneier. This isn't a Fox news segment meant to scare people for ratings, his blog is targeted at a technical audience.

            [–]almightykiwi 12 points13 points  (3 children)

            For anyone else wondering, "pen testing" is a shorthand for penetration testing.

            [–]gurenkagurenda 25 points26 points  (1 child)

            Yes, but it can also refer to when you have a bunch of ballpoints, and you're not sure which ones still work, so you scribble each on a piece of paper and throw half of them away.

            [–]postmodest 12 points13 points  (0 children)

            That's the only kind of pen testing my company does.

            [–]SandorClegane_AMA 1 point2 points  (0 children)

            It's as if they didn't shove the entire word into the expression, just the tip.

            [–]TankorSmash 34 points35 points  (17 children)

            Why couldn't it be the US gov trying to do this? He even says how big the US's program is.

            [–]tobascodagama 23 points24 points  (1 child)

            One of his sources seems to have reason to suspect China specifically. Bruce is probably just hedging when he adds the "or Russia" part.

            [–]its_never_lupus 12 points13 points  (8 children)

            Because they wouldn't need to? The US government could shut down key companies far more reliably by sending FBI agents into Verisign or wherever, or cutting the cables to their building.


            That wouldn't be very covert...


            Unless they carry an accompanying national security letter.

            [–]geeky_username 6 points7 points  (0 children)

            But it could be a great testbed for the NSAs capabilities with reduced risk of international incident compared to testing on another country

            Could also double as a hardening test against our own companies

            [–]sprkng 0 points1 point  (0 children)

            That would only disrupt internet in USA and not the rest of the world though, right?

            [–]syllabic 1 point2 points  (4 children)

            It could be, but I have a hard time thinking why the US gov would want to do this. Executing an attack on this scale would freeze the US and likely the world economies.

            [–]TheOldTubaroo 5 points6 points  (2 children)

            They might not want to actually execute the attack (or they might, I'm sure there's a number of reasons they could have), but it seems sensible for them to know how vulnerable they are to this kind of thing.

            [–]syllabic 1 point2 points  (1 child)

            I don't think they would need to keep it a secret if that were the case? Dunno really, audits and stress tests get performed all the time.


            I imagine it wouldn't be too hard for the US to bring down large portions of the internet. A court order, or failing that a few squads of soldiers, could shut down all AWS datacenters. Or tear down all ISPs operating in US territories.

            The real trick is to subvert the internet. Invisibly control access to certain resources, alter content, monitor data sent.

            [–]internetnavigator 26 points27 points  (12 children)

            I wonder if the possible US relinquishment of ICANN has anything to do with the timing here.

            [–]mc8675309 4 points5 points  (0 children)

            I doubt it. The attacks he's talking about have been happening for a few years now.

            [–]FromTheThumb 16 points17 points  (19 children)

            My puny Web server was getting, on average, 10 crack attempts per second.

            I blocked, and more, and more, and more...

            I now only get one serious attack a day.

            I block .cn, .kr, .br, .ru, .ae, .il, .vn and any Web host service I can identify.

            I automatically block by script, once per 5 min, any host that attacks more than 10 times gets port 22 blocked. Then periodically I look up the host on centralops.net then increase the netmask as needed.

            [–]argv_minus_one 35 points36 points  (12 children)

            Protip: allow private key authentication only. Passwords are feasible to crack; Ed25519 is not.

            [–][deleted]  (3 children)


              [–]bloons3 10 points11 points  (0 children)

              fail2ban will just null route them after too many failed attempts. Then they can't fail to login anymore.

              [–]the_dummy 4 points5 points  (0 children)

              You should look into tmpfs if you're worried about degraded SD life. You'd be able to create a filesystem, mount it to wherever, point the logging system to that directory, copy to that directory at boot and copy from the directory at power off.

              [–]p0mmesbude 0 points1 point  (0 children)

              I like the concept oft port knocking.

              [–]LtWorf_ 2 points3 points  (6 children)

              Changing port 22 to something else also dramatically reduces the attempts.


              That only filters out the novice attackers. Pub key auth is the way to go with SSH when robust security is needed.

              [–]FromTheThumb 0 points1 point  (0 children)

              I use this to block all other protcols. ssh is the low hanfing fruit.

              [–]indrora 4 points5 points  (0 children)

              I have fail2ban set at 2 bad attempts in 5 mins as a 600 minute ban. I have a script that lifts a ban for 20 seconds. If a host touches it again, it's 900 minutes.

              I see new ranges every day come up. My block list is running out of memory.

              [–]skanadian 1 point2 points  (1 child)

              That's fine for your webserver, but when you run networks for end users, and they can't get their email from or go to compromised.webserver.ru, they'll tell you it's broken, and then blame you for blocking it.

              [–]FromTheThumb 4 points5 points  (0 children)

              You are correct.
              I was not offering a solution, I was commenting on where most attacks come from.

              If someone can't see pictures of my brew in a bag in Beijing, I won't lose sleep.


              10? I set mine to first fail on password auth. My iptables already has more than 1000 blocked IPs in a month

              [–]p0mmesbude 0 points1 point  (0 children)

              You could look into port knocking.

              [–]YourFatherFigure 3 points4 points  (1 child)

              Verisign is the registrar for many popular top-level Internet domains, like .com and .net. If it goes down, there's a global blackout of all websites and e-mail addresses in the most common top-level domains.

              It's almost like we've introduced a dangerously centralized authority into what really ought to be a more decentralized system.

              [–]BigTunaTim 31 points32 points  (34 children)

              Not to discount China's ambitions, but this kind of methodical probing is right in line with Putin's campaign to test Russia's international limits.

              [–][deleted] 12 points13 points  (18 children)

              I don't know, China shot down a satellite a few years ago, so they're clearly interested in testing their ability to cripple an enemy's cyber infrastructure.

              [–]caskey 12 points13 points  (17 children)

              It was 2007. Then we did it in 2008. Basically an international game of "I see what you're doing and it's not fooling anyone."

              [–]argv_minus_one 4 points5 points  (16 children)

              Did our version at least not generate a shit ton of space debris? I remember that being the main concern with what China did.

              [–]caskey 11 points12 points  (15 children)

              Yeah. China's created a giant shitstorm of space debris that lasted, ours was lower orbit and cleaned itself up within weeks.

              [–]snerp 3 points4 points  (12 children)

              Yeah, this is clearly either Russia or the NSA testing their power.

              [–]BigTunaTim 11 points12 points  (10 children)

              As much as I believe that the NSA can go fuck themselves sideways for becoming the Big Brother that earlier generations feared, I don't think they're involved with this. They aren't going to intentionally disrupt one of their primary intelligence sources.

              [–]darksabrelord 6 points7 points  (5 children)

              Not directly but it would certainly be good for them to know how other people might be able to disrupt them.


              Or how to disrupt them if it ever became necessary. If an American agency were to have that knowledge it would be the NSA.

              [–]BigTunaTim 3 points4 points  (0 children)

              Point taken, but they almost certainly have both the technical capability and the budget to wargame that scenario without actually severing their intelligence lifeline.

              [–]Matt-chewy 2 points3 points  (1 child)

              Ironically, if the attacker succeeds Op or writer won't be able to say I told you so..

              [–]peterquest 0 points1 point  (0 children)

              Just in meatspace.

              [–]ihsw 2 points3 points  (0 children)

              I'm just waiting for the days of when awful things like Nimda and Sql Slammer return to the norm. In those days the internet really was like the wild west, with simple vulnerabilities like sql injection and cookie spoofing being fairly abundant.

              [–]matty323 2 points3 points  (0 children)

              I work in critical infrastructure for a G7 country. This article is absolutely true, and absolutely terrifying.

              [–]megasmooth 1 point2 points  (0 children)

              Or wait for the next major sun flare event

              [–]defmacro-jam 3 points4 points  (1 child)

              Why aren't there any dial-up BBSs any more?

              [–]port53 14 points15 points  (0 children)

              There are loads still.. except your phone line probably goes over the Internet now anyway.

              [–]istarian 1 point2 points  (0 children)

              I imagine that at some point, unless everyone is doing that to each other, that it becomes obvious who is poking around.

              [–]mc8675309 1 point2 points  (0 children)

              For all the people saying that the US could be behind it, the US government has easier ways of finding out what the response of these networks is. They just have to ask and we'd tell them.

              The US government knows the playbook and the capabilities of these companies already.

              [–]almightykiwi 1 point2 points  (0 children)

              God I'm lazy. The discussions in this thread look really interesting, but the amount of acronyms and names I would need to look up far exceeds my willpower to google shit.

              [–]dmg36 4 points5 points  (0 children)

              funny how he states Russia and China but fails to forget USA...

              [–]Whisper 2 points3 points  (4 children)


              United States.

              [–]Solon1 6 points7 points  (3 children)

              Except, the US is basically the Internet. And the supposed sources are US based networks. The US doesn't need to use crude methods like a DDoS to take down companies in the US. The US is also quite rare globally to not have a central database of links in and out of the country.

              The whole "nation state actor" thing is over used. There are no sources being presented. Lots of non state actors have the ability to launch 300Gbps DDoS attacks, and are constantly improving their methods. How do they improve them? Vendor lists, data sheets and technical manuals are available for basically everything. Given the testing that Bruce described, it sounds like the testing is being performed without any network engineering experience. Nation state actors would presumably hire ex telecom people for this? But criminal gangs in Eastern Europe would not have those skills.

              [–]port53 1 point2 points  (2 children)

              Nation States could afford to hire (pay off) a handful of key people, pay them LOTS of money and bypass all the need for probing networks. Everyone has a price, after all.

              [–]anonymous-coward 0 points1 point  (6 children)

              Do these DDOS attacks rely on compromised personal computers within the US?

              It seems that layering on protections at the low-level OS level (that's you, Microsoft) would provide the best long-term immunity.

              And if it's not within the US, then it would seem to make sense to throttle incoming traffic right on the fibers at they emerge from the ocean (eg, the owner of an IP could say "throttle my foreign traffic now" to an upstream provider).

              [–]drysart 5 points6 points  (4 children)

              I'd be interested to hear what "low-level OS level" protections you think Microsoft could put into their operating system that would both A) be effective in distinguishing illegitimate outgoing network traffic from legitimate network traffic; and B) wouldn't send the Internet into a collective frenzy with concerns about "spying" and "having control of their own computer taken away from them".

              [–]mc8675309 0 points1 point  (0 children)

              They are relying on a variety of compromises and owned/leased equipment. The attack vectors are varied and many.

              [–]rattus 0 points1 point  (0 children)

              [–]Z0di 0 points1 point  (0 children)

              Wouldn't it be easier to cut the "giant" cables in the ocean?

              [–]EngineerDogIta 0 points1 point  (2 children)

              How to download internet?