Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other internet-connected systems to crash by overloading them with traffic. The "distributed" part means that other insecure computers on the internet—sometimes in the millions—are recruited to a botnet to unwittingly participate in the attack. The tactics are decades old; DDoS attacks are perpetrated by lone hackers trying to be annoying, criminals trying to extort money, and governments testing their tactics. There are defenses, and there are companies that offer DDoS mitigation services for hire.
Basically, it's a size vs. size game. If the attackers can cobble together a fire hose of data bigger than the defender's capability to cope with, they win. If the defenders can increase their capability in the face of attack, they win.
What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things.
Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
This page includes the opinion of the Ninth U.S. Circuit Court of Appeals on an interlocutory appeal from a district court decision to dismiss two California state law causes of action from an ongoing case, leaving only the federal law causes of action. The Ninth Circuit disagreed, vacated the district court's decision, and remanded for consideration of the dismissal issue under the correct legal standard. This was a pro-plaintiff decision that makes it very likely that the case will continue with the state law causes of action reinstated against all or nearly all defendants. This is an unusually important price-fixing case with potentially disruptive effect among mobile device component manufacturers and by such a settlement or judgment's ripple effects, manufacturers of other device components globally. Plaintiffs are several major voice/data communications services in the U.S. with the defendants being virtually all of the manufacturers of LCD panels used in mobile telephones. One must suspect that if price-fixing is in fact universal in the LCD panel manufacturing industry, price-fixing is likely common among manufacturers of other device components. According to the Ninth Circuit opinion, the plaintiffs' amended complaint includes detailed allegations of specific price-fixing agreements and price sharing actions by principles or agents of each individual defendant company committed within the State of California, which suggests that plaintiffs have very strong evidence that the alleged conspiracy exists. This is a case to watch.
