Recent attacks on the internet could be a prelude to far worse ones
“SOMEONE is learning how to take down the internet.” This was the headline of a blog post Bruce Schneier, a noted cyber-security expert, wrote in mid-September. It looked prescient when, on October 21st, Dynamic Network Services (Dyn), a firm that is part of the internet-address system, was disrupted by what is called a “distributed denial of service” (DDoS) attack. (Essentially, a DDoS floods servers with requests until they can no longer cope.) For hours, hundreds of sites were hard to reach, including those of Netflix, PayPal and Twitter.
The attack on Dyn was only the latest in a string of similar ones. On September 20th, for instance, the victim was Brian Krebs, an American journalist who often reports on internet criminals. The server where he hosts his blog became the target of one of the largest DDoS attacks on record (it was bombarded with data equivalent to almost half a percent of the internet’s entire capacity). Most of the other recent digital assaults, however, were more discerning—as if the attacker “were looking for the exact point of failure,” Mr Schneier wrote in his blog post.
It is not clear who the attackers are, although security analysts suspect they are either Chinese or Russian. At any rate, all the attacks used the same software, called Mirai, whose source code has been leaked online. It mainly scours the internet for devices such as webcams, digital video recorders and home routers in which easy-to-guess factory-set passwords (“12345” or even “password”) have not been changed. The program then turns those it can gain access to into a huge army of digital slaves that can be directed to inundate targets with requests. Shortly after the attack on Dyn, XiongMai Technologies, one of the biggest makers of webcam components, announced it would recall some products and provide owners of others with software updates to improve security.
This may help, but not much can be done in the short run other than to appeal to owners of internet-connected devices to change their passwords. To fix the problem properly, Mr Krebs argued in a blog post, the makers of such devices, collectively called the “internet of things” (IoT), would all have to recall vulnerable systems and change their careless approach to security. Since this is unlikely to happen, regulators may have to step in. Indeed, the European Commission is already working on legislation to require better security in IoT devices. Lawsuits against negligent device-makers would also help.
As for the goal of the attacks, it could be something other than to take down the internet. Many fret that such virtual weapons could be turned to full blast just before or on November 8th, when America will elect a new president and House of Representatives, and also many senators and state governors. A DDoS could not paralyse voting machines, for hardly any of them are connected to the internet. But striking all kinds of websites, from those of online media to the government’s, could spread chaos—and the feeling that the elections are somehow being “rigged”.
Elon Musk (twitter): Only a matter of time before advanced AI is used to do this. Internet is particularly susceptible to a gradient descent algo. Random user (twitter): #elonmusk will this lead to the first AI v AI conflict? Elon Musk (twitter): good chance Elon Musk (twitter): There would def be millions of agents simultaneously doing a Monte Carlo sim & combining the results to build a map of weaknesses