Lessons from distributed denial-of-service

Some reports have claimed that overall response time on the Internet worsened by as much as a quarter during the attacks (one news story quoted a figure of 27%, ridiculously precise for such an estimate). Some analysts watching the stock markets estimated that paper losses supposedly caused by investor reactions to the attacks exceeded a billion dollars as share prices fell 2%.

Security experts have been warning for years that the 'Net is vulnerable to denial-of-service attacks. Donn Parker warned of automated computer crime in his 1998 book, "Fighting Computer Crime: A New Framework for Protecting Information"; he also published a couple of articles about automated computer crime in the September and October 1999 issues of Information Security Magazine.

Is there anything we can do about these attacks?

The most important message right now is that everybody on the 'Net has a social responsibility, as well as a professional obligation, to patch all known vulnerabilities so that criminals cannot exploit weakly secured systems to attack strongly secured systems. In addition, my colleague Robert Gezelter, a Flushing, N.Y. Internet expert, points out that at least some of the attacks may involve headers with spoofed originator addresses. He argues strongly that no site should ever allow packets with forged headers to escape their perimeter.

Soon, we need to impose more demanding volume testing on all systems as a normal part of quality assurance. Another improvement in current network systems would be to integrate some of the artificial-intelligence routines that have been applied in modern intrusion-detection systems, to recognize bogus traffic and block it before the spurious requests and data can bog down critical servers.

In the longer run, we may have to agree on methods for strong authentication of Internet traffic. I hope to see a day when packets on the Internet will be digitally identified; those systems refusing to use digital signatures will be classified as low-priority traffic. Using a system of cryptographically-sound packet checksums, including packet sequence numbers, we can establish a trustworthy session with trustworthy partners. Anyone not playing by the rules would be relegated to a low-priority bin and would have much more trouble trying to deliver a denial-of-service attack.

In some ways, such a system would resemble what we already do with paper mail. We recognize and often discard unsolicited commercial mail without even having to open it. Our tolerance for junk mail declines when we become busier. We are instituting an informal triage, based on a natural evaluation of our own processing power. Similarly, with adequate identification and authentication of Internet packets, routers could decide which packets deserved immediate attention and which ones would have to wait for attention.

Finally, these attacks remind us that we are still not integrating cyberspace into our moral universe. We really do have to get out into the wider community and explain to young people just what happens to the human beings trying to run and use systems when there are hacks and denial-of-service attacks. Too many kids have grown up with the idea that hacking is about as serious as playing video games. For many such players, trying to break the rules in video games is part of the fun; it's not surprising, then, that breaking the rules in the real world of today's e-commerce seems like fun and games.