Did you experience any difficulty in opening some websites in the last couple of days? I was among the unfortunate people to get a hint of what it meant to be denied internet access yesterday.
Though in my case, it was just a problem that lasted until I switched browsers. Yesterday morning, I powered on my smartphone to do what I normally do each morning: to catch up on what happened while I was asleep. My favourite browser, Opera mini, refused to open a single web page.
I gave it time thinking it was one of those days when network downtime messes up your morning routine. After a while, I decided to give my second favourite browser on Android a try. And just like that, I was back online.
I have never experienced something like this before. One browser working and the other very useless.
Did it have something to do with the worldwide internet shut-down experienced by some people around the world? I saw the news as I was scrolling through my Facebook News Feed. At first I did not give it much thought, after all, since I was already on Facebook, the problem obviously did not affect me.
But for a time yesterday, many people around the world knew what a world wide web apocalypse looked and felt like.
By now regular readers should be aware of what Distributed Denial of Service (DDoS) attacks are. Because of the problems posed by DDoS attacks, Google recently launched a service to help websites that meet certain criteria, ward off DDoS attacks.
In its basic form, DDoS works to stop an attacked website from loading if anybody tries to visit it. This is done by sending millions of computer-generated traffic to the website in a short space of time. The net effect is the site would crash because it can’t handle that much traffic.
And that, in a nutshell is what happened yesterday.
In yesterday’s attack, big websites like Twitter, Reddit, Spotify and Netflix became inaccessible to millions of users around the world.
It was not as if the DDoS attack targeted the websites individually though. Instead, the criminals responsible, targeted the domain registration server used by these websites. In this case, Dyn was the unfortunate domain registration server targeted. The logic is simple, by disrupting Dyn’s operation, the websites hosted on its servers became inoperable.
So how was something as sophisticated as this done? It seems the tool involved is an Internet of Things botnet known as Mirai. A Mirai botnet takes advantage of IoT devices to initiate these attacks. What happens is that most people who buy and use IoT devices never bother to change the default password or login details.
The botnet is able to scan these devices over the net and hack into them using the unchanged passwords. After taking over millions of devices, the botnet sort of connects them together and use their computing power to target firms like Dyn.
Considering how firms like Dyn are important to the whole internet ecosystem, top Internet Security consultants around the world are on the hunt for the perpetrators of this crime. Even the number one domestic security service in the United States, Department of Homeland Security, is involved in the investigations.
The thing about the Mirai software is that it is freely available on the Internet. So any hacker with the know-how can acquire it and initiate the attack. So the list of possible suspects is really wide.
However, on Hackerforums, a user with the moniker ‘Anna-senpai’, uploaded the source code for the Mirai software. Ostensibly, this is an unselfish way to share knowledge with other hackers.
But the truth behind the upload is more likely that the person who uploaded it was trying to cover his/her tracks. This is one way hackers escape arrest. By making the code available to other hackers, security agencies would now have the difficult choice of picking the right needle in a box of thousands of similar needles; in a manner of speaking.
But this development portends worst news for us in the future. Since the source is now available publicly, the likelihood of another attacked has multiplied significantly. Who is to tell if the next attack wouldn’t be even bigger and more sustained than the last one?
Most of the world is still going about its merry business. People who have Internet of things gadgets are still not aware of the fact that their unsecured gadgets are contributing to this disaster. If only they could take time out to secure their gadgets, perhaps we might be able to thwart the criminals from repeating things like this.
image credit: theverge.com; ebuyer.com; axiomcyber.com; money.cnn.com