Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other internet-connected systems to crash by overloading them with traffic. The "distributed" part means that other insecure computers on the internet—sometimes in the millions—are recruited to a botnet to unwittingly participate in the attack. The tactics are decades old; DDoS attacks are perpetrated by lone hackers trying to be annoying, criminals trying to extort money, and governments testing their tactics. There are defenses, and there are companies that offer DDoS mitigation services for hire.
Basically, it's a size vs. size game. If the attackers can cobble together a fire hose of data bigger than the defender's capability to cope with, they win. If the defenders can increase their capability in the face of attack, they win.
What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things.
Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
Gonzalo San Gil, PhD. on 24 Dec 12[Top-down, international regulation is antithetical to the Net, which has flourished under its current governance model. ...]
Paul Merrell on 26 Dec 12A further thought: There is binding and enforceable international law on the subject of freedom of speech and access to information in a treaty that has been ratified by all nations other than China, which has signed but not yet ratified the treaty. That treaty's terms might provide a rallying point for at least limiting the ITU's desire to grab power over the Internet. The International Covenant on Civil and Political Rights ("ICCRR") Article 19 provides: "1. Everyone shall have the right to hold opinions without interference. "2. Everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice. "3. The exercise of the rights provided for in paragraph 2 of this article carries with it special duties and responsibilities. It may therefore be subject to certain restrictions, but these shall only be such as are provided by law and are necessary: (a) For respect of the rights or reputations of others; (b) For the protection of national security or of public order (ordre public), or of public health or morals." http://www2.ohchr.org/english/law/ccpr.htm The last exception is broader than what I would prefer. However, while the rights created by by the ICCRR transcend national boundaries, the quoted provision unquestionably stands for the proposition that exception (b) applies only to nations and not to a U.N. body itself. Therefore, there is a very strong argument that content-based both content-based restrictions and changes in the internet's functioning to facilitate such restrictions are beyond the legal jurisdiction of the ITU. I.e., changes in the internet's functioning to facilitate content-based restrictions require consideration of the content types to be restricted. The treaty permits only national level restrictions and arguably, it thereb
