Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer and
Speaker 1: how Stuff Works in the Love all Things Tech. And recently,
Speaker 1: Randall Charles Tucker, who once proclaimed himself to be the
Speaker 1: Bitcoin Baron, was sentenced to a twenty month prison term
Speaker 1: and find more than sixty nine thousand dollars for launching
Speaker 1: distributed denial of service ord DOS attacks against municipal websites,
Speaker 1: which not only affected normal city operations but also emergency
Speaker 1: response systems. So today we're gonna take a look at
Speaker 1: de DOS attacks and their history, and in our next
Speaker 1: episode I will go into more detail about the different
Speaker 1: kinds of the DOS attacks out there and the security
Speaker 1: measures administrators deployed to mitigate their impact. Because this is
Speaker 1: an ongoing important story. We've heard a lot about DIDOS
Speaker 1: attacks in recent years. There was one that affected some
Speaker 1: apartment buildings over in northern Europe and had them shut
Speaker 1: down the uh the HVAC systems during the coldest days
Speaker 1: of the year, so people no longer had heat. This
Speaker 1: is a serious thing. So what the heck is a
Speaker 1: di DOS attack. Well, it helps to break this down
Speaker 1: by looking at what denial of service means, and generally speaking,
Speaker 1: denial of service refers to using tactics that prevent or
Speaker 1: discourage people from using something online they otherwise would use
Speaker 1: if there were no outside interference, which is a pretty
Speaker 1: broad definition. It can cover lots of stuff, and not
Speaker 1: just stuff that involves hacking or inserting some malicious code
Speaker 1: or sending commands over the internet. A denial of service
Speaker 1: attack by itself also does not necessarily aim to steal
Speaker 1: information or spy on anyone or anything like that, although
Speaker 1: it can certainly accompany those types of attacks as well.
Speaker 1: So there are a lot of instances where the denial
Speaker 1: of service attack is just part of an overall attacker strategy,
Speaker 1: or an attacker might use the threat of a denial
Speaker 1: of service attack to extort money from a potential target,
Speaker 1: essentially saying pay up or we're gonna shut you down. Often,
Speaker 1: attackers will demonstrate their capabilities with a small scale attack
Speaker 1: to accompany their demands to show they mean business. So
Speaker 1: in other words, they might actually launch a small attack,
Speaker 1: bring down a service temporarily, and say that was just
Speaker 1: a taste of what could happen if you don't cough
Speaker 1: up the dough. But as I said, denying service all
Speaker 1: by itself can be the full motive, and it doesn't
Speaker 1: have to require code or scripts or overwhelming internet infrastructure.
Speaker 1: So for example, let's say I'm looking online for a
Speaker 1: forum to talk about one of my interests. And for
Speaker 1: this example, we'll just say it's musical theater. Because I
Speaker 1: love musicals and I would love to go online and
Speaker 1: chat with other fans of musicals. I find a forum.
Speaker 1: It's great, there are tons of other enthusiastic fans. Maybe
Speaker 1: there are some performers in there as well. We have
Speaker 1: threads discussing shows and writers and inspiring performances, maybe some
Speaker 1: embarrassing missteps, personal stories from our own performances or the
Speaker 1: times we've attended plays, all the stuff you would typically
Speaker 1: find on a forum about any given sort of interest.
Speaker 1: But then something frustrating starts to happen. The forum gets
Speaker 1: invaded by one or more troublemakers. These people disrupt conversations
Speaker 1: just for fun. They might hurl insults at people, which
Speaker 1: isn't exactly subtle or clever, but it can be an
Speaker 1: effective tactic. Or they might be more insidious and post
Speaker 1: inflammatory messages that are couched in seemingly reasonable language, which
Speaker 1: gives the troublemaker kind of an out right like, Oh,
Speaker 1: I'm so sorry you're offended. All I was trying to
Speaker 1: do is say such and such. You know, they never
Speaker 1: said anything blatantly awful. They just implied it, or they
Speaker 1: danced around it quite a bit, but ultimately they get
Speaker 1: what they want, which is to disrupt the conversation and
Speaker 1: turn the attention toward themselves. We tend to call these
Speaker 1: folks trolls, and the original reason for that is back
Speaker 1: in the old newsgroup days, they were said to be
Speaker 1: phishing for hits or trolling as it were. Trolling in
Speaker 1: the sense of drawing a bated line through the water
Speaker 1: to lure fish. These trolls were trying to get a
Speaker 1: rise out of people and derail conversations, mostly just for laughs.
Speaker 1: I've done episodes about trolls before, so I'm going to
Speaker 1: leave it at that. But trolling is a type of
Speaker 1: denial of service. It disrupts the activity that was supposed
Speaker 1: to happen on that site. It discourages people from participating,
Speaker 1: it denies them that opportunity. And there was no code
Speaker 1: needed to do it. But in the case I mentioned
Speaker 1: just now, trolls were mostly looking to get a rise
Speaker 1: out of people they found humor and upsetting the apple cart.
Speaker 1: They might not have any goals beyond just being a
Speaker 1: nuisance and exerting some small amount of power over people.
Speaker 1: Maybe they belong to a different forum and there's a
Speaker 1: rivalry between the two, But there's some people who just
Speaker 1: as as uh you might hear in Batman, want to
Speaker 1: watch the world burn. But denial of service can have
Speaker 1: far more serious effects than just inconveniencing users. For a business,
Speaker 1: a denial of service attack can prevent them from conducting
Speaker 1: their business, which results in lost revenue. So if you
Speaker 1: run an online store and someone brings down your site
Speaker 1: or prevents people from getting to your site, you're not
Speaker 1: going to make any sales during that time. That's lost money.
Speaker 1: Denial of service attacks can also hurt a company or
Speaker 1: services reputation. So for example, there was a massive denial
Speaker 1: of service attack that affected Sony's PlayStation network and Microsoft's
Speaker 1: Xbox Live service back in during the holiday season, and
Speaker 1: it made a lot of gamers really angry. They were
Speaker 1: accusing both companies of not doing enough to secure their
Speaker 1: services to make sure they were robust against such attacks.
Speaker 1: This is sort of like pouring lemon juice in the wound.
Speaker 1: In some ways, you know they're already hurting because they've
Speaker 1: been knocked down, and now the users are yelling at
Speaker 1: them too. But there is a valid argument to be
Speaker 1: made that services, particularly really big, heavily trafficked services, need
Speaker 1: to invest in good security measures. I talked about a
Speaker 1: non technical approach to denial of service attacks with that
Speaker 1: forum example, but most of the time when we talk
Speaker 1: about the denial of service attack, we tend to mean
Speaker 1: one that involved bringing down a system using some sort
Speaker 1: of technology based attack vector. So you can think of
Speaker 1: denial of service attacks belonging to three large categories in general.
Speaker 1: The first category is volumetric. That means the goal is
Speaker 1: to overwhelm the target by sending a huge number requests
Speaker 1: or messages to that target device, more messages than the
Speaker 1: target can actually handle. And I always think of this
Speaker 1: in a rather old fashioned way. When I was growing up,
Speaker 1: cell phones weren't really a thing. Everyone had landlines. You know,
Speaker 1: you'd be at home and you use your phone, which
Speaker 1: was plugged into the wall, and in fact, most of
Speaker 1: the time. It was a wired handset. Didn't have a
Speaker 1: whole lot of wireless ones when I was growing up,
Speaker 1: and they existed, I just didn't have them. And call
Speaker 1: waiting was not a common feature in those early days,
Speaker 1: which meant if you called someone and they were already
Speaker 1: on the phone, you would get a busy signal. Well,
Speaker 1: this volumetric category of denial of service attacks is kind
Speaker 1: of like having a jerk calling you over and over
Speaker 1: again and they call you, you you pick up, you hear
Speaker 1: it's that same jerk. You hang up, they immediately hit
Speaker 1: redial and they call you right back again, and the
Speaker 1: phone starts to ring, and that means no one else
Speaker 1: can get through to you. Anyone who tries is just
Speaker 1: going to get a busy signal, so they're getting a
Speaker 1: denial of service. And because you can't receive any other
Speaker 1: calls due to this person calling you up repeatedly, you
Speaker 1: also get a denial of service. Now that analogy doesn't
Speaker 1: work quite as well today because we can do stuff
Speaker 1: like block incoming calls pretty much routinely, and call waiting
Speaker 1: is a standard feature on almost every phone service. But
Speaker 1: you get the idea. Next, we have the application de
Speaker 1: DOS flood attack. This concentrates not on individual applications. That
Speaker 1: that's what the phrase makes you think, like, oh, this
Speaker 1: is like a Spotify de dos attack or something. No.
Speaker 1: It rather it refers to the application layer of a
Speaker 1: communications network. And I talked about the application layer back
Speaker 1: in the Dip into the Seven Layers of the O
Speaker 1: SI Model episode that published back in November. But this
Speaker 1: would be a flood attack similar to the volumetric one
Speaker 1: I just mentioned, but it aims to overwhelm the system
Speaker 1: with a large number of requests at the application layer
Speaker 1: rather than the network layer. I'll explain more about what
Speaker 1: that means in the next episode. And the third category
Speaker 1: is a low rate denial of service attack also known
Speaker 1: as a vulnerability attack, and those attacks take advantage of
Speaker 1: vulnerabilities or limitations and application implementations and so are kind
Speaker 1: of related to application de dos flood attacks, but they're
Speaker 1: slightly different. I'll explain more about that in the next
Speaker 1: episode two. Then you have a distributed denial of service
Speaker 1: attack that ups the anti in ad DOS attack. Hundreds
Speaker 1: or thousands or even hundreds of thousands of machines combine
Speaker 1: their efforts to bring down a target to go back
Speaker 1: to my phone analogy for a second. Let's just say
Speaker 1: that that jerk who was calling me really wants to
Speaker 1: irritate me by making my phone line absolutely useless, so
Speaker 1: he actually recruits all of his jerk friends and gives
Speaker 1: them my phone number. Then he and all his jerk
Speaker 1: friends just keep dialing me up over and over, which
Speaker 1: makes it even harder to handle than the one jerk
Speaker 1: doing it all by himself. So let's say I managed
Speaker 1: to finally get an open line, so I make a
Speaker 1: call to the phone company and ask them to block
Speaker 1: the number that just called me, and they agree for
Speaker 1: whatever reason. Well, that just reduces the jerk faces attack
Speaker 1: vectors by one, right, It just removes one of the callers.
Speaker 1: But a group of jerk friends, with the exception of
Speaker 1: the one I managed to catch when I asked for
Speaker 1: the number to be blocked, can keep on calling me.
Speaker 1: They they're calling from different phone numbers, so their calls
Speaker 1: keep coming through, and I can keep trying to block
Speaker 1: the numbers one by one. But this is laborious and
Speaker 1: time consuming, and in the meantime I'm not able to
Speaker 1: use my phone for anything else. That's what ad dos
Speaker 1: attack does, but instead over the phone lines, it does
Speaker 1: it over the Internet. In general, it uses an enormous
Speaker 1: number of machines to carry out an attack, and individually
Speaker 1: those machines might not be able to generate the sheer
Speaker 1: volume of data that could overwhelm a target, but collectively
Speaker 1: they can do it, and they can be difficult to stop.
Speaker 1: In a moment, I'll talk about a real example of
Speaker 1: how an attacker might overwhelm the target machine over the
Speaker 1: Internet using a simple denial of service tactic. But first
Speaker 1: let's take a quick break to thank our sponsor. One
Speaker 1: real world denial of service attack falling into the category
Speaker 1: of the volumetric attack, involves flooding web server with requests
Speaker 1: called pings. A ping is a very simple message that
Speaker 1: computers used to test connections between them on a network.
Speaker 1: It measures the reachability of another computer. So consider that
Speaker 1: the Internet is a network of networks, and between your
Speaker 1: computer and some other computer on the Internet, there may
Speaker 1: be hundreds of machines. Some of them are routers, some
Speaker 1: of them are switches, some of them are computers. For
Speaker 1: your computer to communicate with this target computer, traffic has
Speaker 1: to go through the net work from your computer to
Speaker 1: the distant one, and then traffic needs to be able
Speaker 1: to come back from the target machine to your machine,
Speaker 1: and a ping is a test to see if such
Speaker 1: a thing is really possible. It measures the round trip
Speaker 1: time for a message to be sent out from computer
Speaker 1: A to go to computer B and then return back
Speaker 1: to computer A. The name comes from an older technology,
Speaker 1: which would be sonar and sonar where we use sounds
Speaker 1: underwater to detect objects by listening for echoes. We would
Speaker 1: send out a sound a ping or from a speaker
Speaker 1: essentially underwater, and then we would listen in on a
Speaker 1: microphone for a returning echo. So you send out a ping.
Speaker 1: If you get an echo of that ping, you know
Speaker 1: there is something out there under the water that is
Speaker 1: reflecting that sound back at you. In fact, you may
Speaker 1: remember in movies like The Hunt for October they talk
Speaker 1: about this a lot. They use pings in order to
Speaker 1: send secret messages to each other. But in the Internet,
Speaker 1: we send out a small amount of data and then
Speaker 1: we essentially listen back for its return and use the
Speaker 1: travel time to judge the connection strength between the two computers,
Speaker 1: or really just how much time does it take for
Speaker 1: a message to go across the Internet and back again.
Speaker 1: Mike must created the pain utility back in to help
Speaker 1: test I P network connections. A quick ping could indicate
Speaker 1: if there was a connectivity problem. If you send out
Speaker 1: a ping and nothing comes back, you know there's a
Speaker 1: problem with that connection. If you send out a paying
Speaker 1: and it comes back but it comes back pretty like
Speaker 1: there's a pretty long gap, and we're talking on the
Speaker 1: order of less than a second typically, but it still
Speaker 1: can be a long gap if you're talking about actually
Speaker 1: sending real data across the network. Again, it can tell you, oh,
Speaker 1: you need to really take a look at your network
Speaker 1: and see where the problem is. There might be a
Speaker 1: broken element that you need to replace. It's also a
Speaker 1: great tool if you want to use bandwidth heavy applications
Speaker 1: because it can indicate whether such a connection is even possible.
Speaker 1: So let's say that you want to play an online
Speaker 1: computer game, maybe it's a multiplayer computer game competitive. You
Speaker 1: want to make sure you can find a server that
Speaker 1: doesn't have a long latency issue between you and the
Speaker 1: server you want to pin get a good time. And
Speaker 1: it may be that that's a game that has multiple servers,
Speaker 1: so you want to find the server that has the
Speaker 1: best connection between your computer and that server. So that
Speaker 1: you can have the best experience when you're playing well.
Speaker 1: If one were to send an enormous number of PING
Speaker 1: requests to the same target computer, such as a web server,
Speaker 1: that target could become overwhelmed by all those requests. It
Speaker 1: would attempt to respond to each request, which takes up
Speaker 1: resources it would otherwise use for normal operations. So let's
Speaker 1: say a hacker has targeted the website hosting that musicals
Speaker 1: forum I wanted to pop into, and instead of going
Speaker 1: in there and starting a flame war in the forums,
Speaker 1: they just start sending PING requests an uncountable number of
Speaker 1: PAIN requests to that forums host computer, which is trying
Speaker 1: to respond to each PIN request dutifully. I mean, that's
Speaker 1: what it does. And as a result, the system becomes
Speaker 1: unstable and crashes, and I get an error message when
Speaker 1: I try to go to that forum site. This tactic
Speaker 1: is called a ping flood. It's just one denial of
Speaker 1: service tactic. I'll go into a lot of other ones
Speaker 1: later on. Now, I mentioned earlier how a di DOS
Speaker 1: attack can be effective by leveraging thousands or hundreds of
Speaker 1: thousands of machines in a coordinated attack. But how does
Speaker 1: that happen? How do you get to a point where
Speaker 1: hundreds of thousands of machines can work together. How does
Speaker 1: an attacker get control of that many devices? Well, sometimes
Speaker 1: it happens by people volunteering to be part of this group.
Speaker 1: There are activist groups that will send out a message
Speaker 1: and say, hey, if you want to be part of
Speaker 1: this movement, you can download the software and then we
Speaker 1: can use your computer to be part of this attack
Speaker 1: on whatever the target is. But in other cases it's
Speaker 1: happening through trickery. Uh, it ends up being a compromised device. Right,
Speaker 1: So for target computers, a hacker either rights some malware
Speaker 1: or more likely makes use of existing malware. There's tons
Speaker 1: of malware that's already been written out there. A lot
Speaker 1: of the people who use these tactics aren't necessarily coders
Speaker 1: or programmers. They are what some folks dismissively referred to
Speaker 1: as script kitties. They go and they find code that
Speaker 1: will do what they want it to do that someone
Speaker 1: else has already written, and then they'll essentially download that
Speaker 1: and use that kind of as a just an attack package.
Speaker 1: So they're not having to make it themselves. They're already
Speaker 1: it's kind of off the shelf hacker sort of software.
Speaker 1: So they then use this malware to create a way
Speaker 1: to infect numerous machines, typically by fooling people into execute
Speaker 1: eating a file on their computers or their their computing devices.
Speaker 1: The malware contains a way for the hacker to direct
Speaker 1: those computers to send messages to a specific target. Um.
Speaker 1: They may be completely automated. You just hit a little
Speaker 1: button and then everything does it. You know. You hacker
Speaker 1: might put in the IP address for the target machine,
Speaker 1: but otherwise everything else gets taken care of automatically, and
Speaker 1: the hacker uses those devices to turn all their focus
Speaker 1: onto the target machine and then they bombard it with
Speaker 1: countless messages. Uh. Or the hacker might exploit a known
Speaker 1: vulnerability in various Internet connected devices such as routers, or
Speaker 1: even stuff like smart TVs or Internet connected thermostats. Essentially,
Speaker 1: the Internet of Things and the smart home movement have
Speaker 1: created the potential for truly enormous coordinated attacks because again,
Speaker 1: they don't have to send really sophisticated information across the Internet.
Speaker 1: It could be as simple as pings. Pings are one
Speaker 1: of the most basic messages you can send, so if
Speaker 1: you just get devices that are capable of sending a ping,
Speaker 1: then you're you're all set to go. And part of
Speaker 1: this is because that Internet of Things developed faster than
Speaker 1: companies could create good security measures to protect those devices
Speaker 1: from people who would compromise them. And part of it
Speaker 1: falls on the consumers shoulders, because a lot of people
Speaker 1: don't bother to ever update their security settings. Right, they'll
Speaker 1: get a new thing out of the box, they'll plug
Speaker 1: it into their network, and they never bother to update
Speaker 1: the log in and passwords on their devices, so they're
Speaker 1: using the default settings for their login and passwords, and
Speaker 1: that can create the opportunity for a hacker to access
Speaker 1: those devices. If a company is using essentially a the
Speaker 1: same sort of login and password for all of its
Speaker 1: products along a certain line, that all you have to
Speaker 1: do is know what that is, and then you have
Speaker 1: access to countless instances of those unprotected devices because so
Speaker 1: many people do not bother to update it a law.
Speaker 1: The routers I've seen have had a log in that's
Speaker 1: kind of like admin one and a password that might
Speaker 1: literally be the word password. So if you just plug
Speaker 1: that in, if you're a hacker to try and compromise
Speaker 1: someone's home systems, chances are it's gonna work on a
Speaker 1: lot of people because they never bothered to change it.
Speaker 1: So uh, lesson there, change your passwords on your devices
Speaker 1: from the default to something else. Now, some companies they
Speaker 1: go a little bit further. They'll they'll create a password
Speaker 1: for each device that is unique to that device, right.
Speaker 1: They don't use the exact same password for all of
Speaker 1: their routers, for example, And that's a good step that
Speaker 1: makes it much harder to do. You you can't just
Speaker 1: use a blanket attack the way a hacker normally would. Anyway,
Speaker 1: I don't put the full blame on the consumer, and
Speaker 1: I don't put the full blame on the manufacturer. It's
Speaker 1: a problem that both parties have to pay attention to.
Speaker 1: But there are some manufacturers out there who have made
Speaker 1: product with very poor or completely absent security measures, And
Speaker 1: in those cases, I pretty much blame the manufacturer of
Speaker 1: the company, not the customers, because if you didn't even
Speaker 1: include any kind of security measures in your device, then
Speaker 1: there was nothing really the customer could do on their
Speaker 1: side to protect themselves. And in any case, the collection
Speaker 1: of infected computers and devices would be called a bot net.
Speaker 1: Sometimes people call it a zombie computer army. Although you
Speaker 1: hardly ever hear that phrase these days, it's almost always
Speaker 1: just bought net and it's because the compromise computers are
Speaker 1: being controlled by some sort of remote entity, either a
Speaker 1: human hacker or an automated script or bought This can
Speaker 1: happen even without you being aware of it. By the way,
Speaker 1: you may only notice that your device is operating more
Speaker 1: slowly than normal, and you wonder, well, why is my
Speaker 1: computer no longer as fast as it used to be.
Speaker 1: One possible explanation is that some of your computer systems
Speaker 1: are being dedicated to sending out the tax over the
Speaker 1: Internet and you never know it. Or you might get
Speaker 1: a message about how much data you're using over a
Speaker 1: given length of time and your thinking, that's weird, I'm
Speaker 1: not even home when all this stuff is happening. Well,
Speaker 1: that's an indicator that something has gone wrong. So to
Speaker 1: understand how most distributed denial of service attacks work, it's
Speaker 1: good to remind ourselves of how information tends to travel
Speaker 1: across the Internet. There are protocols like TCP I P,
Speaker 1: which that's actually two different sets of protocols. Those are
Speaker 1: really rules that information has to follow to travel across
Speaker 1: the Internet. The architects of the Internet who worked on
Speaker 1: our pannet first one of the actual methodology of allowing
Speaker 1: information to go from point A to point B to
Speaker 1: be very light with the data. In other words, the
Speaker 1: process itself shouldn't have been data specific. It should be
Speaker 1: data agnostic. It doesn't matter what the information is. It's
Speaker 1: just concerned with making sure that information can get from
Speaker 1: the source to its destination. That's the only thing that's important.
Speaker 1: The end points, the edge machines where a message originates
Speaker 1: and where it terminates, would do all the heavy thing,
Speaker 1: but the middle bits would be much less hands on
Speaker 1: with the data, with a deeper concern with just making
Speaker 1: sure it gets to the right destination. And it's verify
Speaker 1: that everything got to where it needed to go. So
Speaker 1: the Internet sends data in bundles called packets. This is
Speaker 1: really where TCP comes in. A single file might consist
Speaker 1: of hundreds or thousands or millions of packets, and the
Speaker 1: packets are just bundles of data, and your computer sends
Speaker 1: this information over the Internet. So let's say you want
Speaker 1: to send a big file. Let's say it's a film.
Speaker 1: You've got a film and it's an enormous file and
Speaker 1: you want to send it across the Internet to a
Speaker 1: friend of yours. Well, the data gets chopped up into
Speaker 1: these packets, and the packets include a header that has
Speaker 1: important meta information about the data the packet carries. Namely,
Speaker 1: it has the identity of the sender's computer, and it
Speaker 1: has the identity of the destination computer. And also it
Speaker 1: has information about how the data inside the packets fits
Speaker 1: in with all the other path gets of data that
Speaker 1: are being sent. So one way to imagine this is
Speaker 1: to think about having like a giant poster for an
Speaker 1: awesome movie. Let's say it's Big Trouble in Little China. Now,
Speaker 1: on the back of the poster, you've got a grid,
Speaker 1: and inside each cell of this grid is a number,
Speaker 1: and their insequential order. So the top left corner has
Speaker 1: the number one, and then when you move to the right,
Speaker 1: they increase sequentially till you get to the number twenty.
Speaker 1: And then you dropped down a row so that the
Speaker 1: first number on the far right side, on the second
Speaker 1: row is twenty one. You go sequentially to the left,
Speaker 1: and so on you zig zag all the way down,
Speaker 1: so you've got the whole poster numbered. And let's say
Speaker 1: it's got a hundred cells total, so it's one to
Speaker 1: one hundred you send. You cut up the poster into
Speaker 1: these cells, so you you cut up all the little
Speaker 1: blocks because that's the only way you're gonna be able
Speaker 1: to send it to your friend. And you send it
Speaker 1: to your friend in one hundred different envelopes, and your
Speaker 1: friend opens up the one hundred different envelopes and then
Speaker 1: they see the numbers on the back and they're able
Speaker 1: to put the poster back to other based on those numbers. Now,
Speaker 1: it doesn't make a whole lot of sense in this
Speaker 1: real world example, but over the Internet it makes perfect sense.
Speaker 1: And that's because the Internet depends upon relatively cheap, unreliable connections,
Speaker 1: which is actually a good thing. See in the old days,
Speaker 1: before the Internet, before Arpanet, connecting computers together would require
Speaker 1: a dedicated connection linking computer A with computer B. We're
Speaker 1: talking direct connection between the two, which ends up being limiting.
Speaker 1: It's also expensive, and if the connection were to fail,
Speaker 1: you would have to repair it before any communication could continue.
Speaker 1: Because it's just this direct communication channel that the architects
Speaker 1: of the Arpanet wanted to make certain that communication could
Speaker 1: continue even if individual pathways were to shut down. If
Speaker 1: you think about like a town, it's saying, well, the
Speaker 1: main road has been shut down because a tree fell
Speaker 1: across it. But luckily they're all these side roads you
Speaker 1: can take to still get to the same destination. Might
Speaker 1: take you a little longer and you go a little
Speaker 1: further out of the way, but you can will get
Speaker 1: there well. To that end, the architects of the arpanet
Speaker 1: built their infrastructure on cheap hardware. Individually, those pieces of
Speaker 1: hardware aren't as reliable as the more expensive, more sophisticated
Speaker 1: types of hardware out there, but collectively, this is a
Speaker 1: approach that makes a lot of sense because it made
Speaker 1: scaling the Internet easier. It didn't require a whole huge
Speaker 1: investment to add more infrastructure to the Internet. It scaled
Speaker 1: up very very quickly. But if you build your network
Speaker 1: on top of hardware that sometimes goes offline, you have
Speaker 1: to make sure that the rules the data follows are flexible,
Speaker 1: that they're able to handle that situation and route around
Speaker 1: those problems. And that's where packet switching comes in. Packets
Speaker 1: of data follow whatever path is best at that given time,
Speaker 1: as in whatever connection is the most reliable, fastest connection
Speaker 1: between the originating computer and the destination computer. Now that
Speaker 1: can change over time just from not just physical things
Speaker 1: that are going on on the network, but also traffic
Speaker 1: that's passing across the network at the same time from
Speaker 1: other computers. So one hundred digital packets representing the same
Speaker 1: file could potentially take one hundred different pathways to get
Speaker 1: to their destination, so that it's kind of like a
Speaker 1: caravan all splitting up and taking different routes in order
Speaker 1: to get to the final destination. Now, there's probably never
Speaker 1: going to be a case where every single packet is
Speaker 1: going to take its own individual pathway. Some of them
Speaker 1: may end up taking at least part of the same
Speaker 1: journey to get to their destination. But you get the idea. Uh,
Speaker 1: it makes the Internet much more robust because one pathway
Speaker 1: could fail and data can still find a way to
Speaker 1: the intended destination. In addition, computers will send more packets
Speaker 1: than what are needed as a redundancy measure. This is
Speaker 1: probably that TCP protocol which is redundant. It's like a
Speaker 1: t M machine. But TCP does make certain that all
Speaker 1: the different packets get to where they need to go,
Speaker 1: and if anything didn't show up, then it can make
Speaker 1: certain that essentially a replacement packet gets sent so that
Speaker 1: it can verify that all the packets that are necessary,
Speaker 1: all one hundred of them, for example, have made it
Speaker 1: to their destination, and that the communication from that that
Speaker 1: part of the communication at any rate, is complete. This
Speaker 1: approach makes the Internet easy to build out, but it
Speaker 1: also makes it more challenging to do anything across the
Speaker 1: infrastructure layer in response to people who exploit the system,
Speaker 1: because the underlying connections are really only concerned with moving
Speaker 1: data from origin to destination. They're not concerned with what
Speaker 1: that data is or what purpose it serves. Now, I've
Speaker 1: got a little more to say about the basics of
Speaker 1: distributed denial of service attacks, but first let's take another
Speaker 1: quick break to thank our sponsor. One other element of
Speaker 1: the Internet I feel I should mention before I talk
Speaker 1: about the history of denial of service attacks. Is the
Speaker 1: domain name system. And you guys is likely at least
Speaker 1: have heard of an IP address. I mentioned it earlier
Speaker 1: in this episode. Those are the addresses that identify a
Speaker 1: device that's connected to the Internet. Uh. It can be
Speaker 1: a device like a router that then sends out temporary
Speaker 1: addresses to anything that's connected to the router, but you
Speaker 1: get it. This is the way that a computer system
Speaker 1: knows where to send information. They're necessary for communication. It's
Speaker 1: like if you were to send a letter, you would
Speaker 1: have to include an address on the letters envelope, so
Speaker 1: the postal service knows where to deliver that letter, and
Speaker 1: if you wanted to get a letter back in return,
Speaker 1: you would want to have a return address on there
Speaker 1: if you've got to want to get a response. And
Speaker 1: the Internet is similar. All devices have an IP address
Speaker 1: to facilitate communication um at least through a router if
Speaker 1: nothing else. But the devices address might change over time,
Speaker 1: so that's a little different. It's not like the device
Speaker 1: is always going to have the exact same IP address.
Speaker 1: It may change depending upon what network gets connected to.
Speaker 1: In fact, it will change depending upon what network gets
Speaker 1: connected to. So it's not exactly analogous to a physical address,
Speaker 1: but it's similar enough for us to kind of think
Speaker 1: about that. Now here's a problem. However, these addresses are
Speaker 1: not easy for us to remember. You know, IPv four
Speaker 1: addresses and IPv six addresses. These are series of numbers
Speaker 1: and sometimes letters within the case with IPv six, where
Speaker 1: they don't seem to make any rhyme or reason to us.
Speaker 1: They're hard for us to recall. So we had to
Speaker 1: come up with a way to map addresses based on
Speaker 1: language to the IP addresses that machines can deal with. So,
Speaker 1: for example, www dot how stuff works dot Com is
Speaker 1: a u r L an address that we humans can
Speaker 1: easily remember, and there are special computers called DNS servers
Speaker 1: that resolve these u r l s into IP addresses
Speaker 1: so that traffic can go to the right locations. So
Speaker 1: an attack on DNS servers which has happened can slow
Speaker 1: down traffic to numerous website because the servers will be
Speaker 1: so busy dealing with the attack they have trouble resolving
Speaker 1: u r l s into IP addresses, even though the
Speaker 1: actual websites themselves are perfectly fine. So if there's an
Speaker 1: attack on a DNS server that would typically resolve www
Speaker 1: dot how stup works dot Com to its respective IP address,
Speaker 1: how stup works dot Com is fine. We haven't been
Speaker 1: attacked by anybody, but the the name server that would
Speaker 1: actually do the job of resolving that you are l
Speaker 1: into an IP address, it's busy handling this attack, so
Speaker 1: it would look like our site is loading super slowly
Speaker 1: that you just can't even pull anything up. But it's
Speaker 1: not a problem on our end, it would be a
Speaker 1: problem in the middle. So there are a lot of
Speaker 1: different ways that attackers can potentially affect the traffic and
Speaker 1: the speed of internet connections. Now, to end this episode,
Speaker 1: I'm going to talk about some early denial of service
Speaker 1: attacks and some of the more notable examples, and in
Speaker 1: our next episode, I'm going to focus more on the
Speaker 1: spe cifis for types of de DOS attacks and how
Speaker 1: companies try to handle them. So, first of all, it's
Speaker 1: hard to get definitive history of denial of service attacks
Speaker 1: because oddly enough, hackers were not too concerned about documenting
Speaker 1: their actions as they unfolded. But before there was d DOS,
Speaker 1: there were plenty of denial of service examples. One of
Speaker 1: them happened in nineteen seventy four with David Dennis, who
Speaker 1: was thirteen years old at the time. I wondered if
Speaker 1: he might be able to affect all the terminals connected
Speaker 1: to a computer at the Computer Based Education Research Laboratory
Speaker 1: at the University of Illinois Urbana Champagne Campus. Dennis knew
Speaker 1: that he could cause a terminal, which think of a
Speaker 1: terminal as kind of as a keyboard and a monitor
Speaker 1: in itself is not a computer, but it's connected to
Speaker 1: a computer. You have multiple terminals all hooked up to
Speaker 1: this central computer and they're all sharing those resources. Well,
Speaker 1: he knew that if he was using a terminal connected
Speaker 1: to this computer and he executed a command called external
Speaker 1: or e x E, which was a command that would
Speaker 1: tell the terminal that it was supposed to communicate with
Speaker 1: a connected external device. But if you didn't have an
Speaker 1: external device connected to the terminal and you and you
Speaker 1: sent this command anyway, it would make the terminal lock up.
Speaker 1: The terminal would be searching for this external device, it
Speaker 1: would not find it, and that would send the terminal
Speaker 1: into the terminal equivalent of a tizzy. And the only
Speaker 1: way to fix it would be to shut everything down
Speaker 1: and reboot. So he thought, what if I did this,
Speaker 1: but I created a way for to do it across
Speaker 1: all the terminals connected to that computer at the same time,
Speaker 1: not just one, because I mean then I'm just I'm
Speaker 1: just sitting there having to change it. So he wrote
Speaker 1: some code and figured out a way to send that
Speaker 1: command to all the terminals connected to a computer at
Speaker 1: the same time, making them execute that e x D
Speaker 1: command without the individual users knowledge or permission, and this
Speaker 1: forced to shut down and nearly all the terminals connected
Speaker 1: to that computer. The university ended up does stabling this
Speaker 1: feature that would allow people to send such a command
Speaker 1: to all the terminals from one single spot. They said,
Speaker 1: you know, we gotta turn this default setting off. They
Speaker 1: didn't think about it until after it had happened. In
Speaker 1: Robert Morris unleashed a denial of service attack by accident.
Speaker 1: He had developed a bit of code that would make
Speaker 1: its way through the machines connected through the arpanet, and
Speaker 1: the purpose was to find out how big the network was.
Speaker 1: He just wanted to know how big the network was.
Speaker 1: No one was really sure that this was something that
Speaker 1: was growing very kind of organically and rapidly. So Morris
Speaker 1: thought he had the perfect solution. He had this code
Speaker 1: that would go out and essentially infect every single node
Speaker 1: on the system that it encountered. But it was meant
Speaker 1: to infect just as a way of making count of
Speaker 1: each of the nodes. Really, he just wanted to find
Speaker 1: out what the head count was. However, he made a
Speaker 1: mistake when he was creating this code, and it ended
Speaker 1: up being the equivalent of a worm. It went through
Speaker 1: the system and it would replicate itself. It would infect
Speaker 1: the same machines multiple times. It failed to detect that
Speaker 1: it had already infected a machine, so it just kept
Speaker 1: passing through this arpanet system, infecting node after note after node,
Speaker 1: again and again and again, coming up the network and
Speaker 1: essentially causing a shutdown of sixty thousand nodes. And he
Speaker 1: would end up being fined ten thousand dollars and sentenced
Speaker 1: to fours community service for that mistake. The earliest example
Speaker 1: of a distributed denial of service attack that I could
Speaker 1: find happened in nine. An Italian activist group called the
Speaker 1: Strano Network or Strange Network launched a denial of service
Speaker 1: attack against the French government in a protest against the
Speaker 1: that nation's policies relating to nuclear power. But this was
Speaker 1: done with actual human operators who were working voluntarily. They
Speaker 1: were they had agreed to be part of this sort
Speaker 1: of virtual sit in, and they were working on their
Speaker 1: computers in an attempt to overwhelm on the target servers.
Speaker 1: So this attack was limited both in scope and duration. Also,
Speaker 1: back in those days, you were paying by the hour
Speaker 1: for Internet access, so the actual protest lasted about an
Speaker 1: hour because no one was willing to pour in a
Speaker 1: whole lot of money to sit at their computer and
Speaker 1: actively carry out this attack. The denial of service attack
Speaker 1: became a go to strategy for activist groups in general.
Speaker 1: One such group, called the Electronic Disturbance Theater or e
Speaker 1: d T, developed a tool called flood Kit, which would
Speaker 1: send a large volume of messages towards a targeted computer
Speaker 1: across the Internet. A predetermined target is the important part
Speaker 1: to remember here. Anyone who wanted to make use of
Speaker 1: flood kit could download it, and the tool even had
Speaker 1: to drop down menu that would let users select the
Speaker 1: predetermined targeted computers like the White House Computer System. E
Speaker 1: d T would arrange for virtual sit ins in which
Speaker 1: they would schedule a coordinated effort to attack a specific
Speaker 1: target like the White House servers, and then users would
Speaker 1: all use that drop down menu to launch their individual
Speaker 1: attacks as a big collective so as a collective of
Speaker 1: individual attacks in that sense, and again in this case,
Speaker 1: it was a voluntary action. It wasn't like they were
Speaker 1: infecting computers and trying to uh take them over without
Speaker 1: the user's consent. In two thousand, Michael Cols, a teenage
Speaker 1: hacker who used the handle Mafia Boy, launched a series
Speaker 1: of distributed denial of service attacks against high profile targets
Speaker 1: like Yahoo, Amazon, Dell, and others. He also attempted to
Speaker 1: attack the d n S system by targeting several of
Speaker 1: the root name servers. He had compromised computers at university
Speaker 1: networks and used them to send traffic to his targets
Speaker 1: that would overwhelm the targets, and years later he would
Speaker 1: say the whole purpose behind it was so that he
Speaker 1: could impress and intimidate other hackers, so he was doing
Speaker 1: it for the online street cred In other words, He
Speaker 1: was eventually tracked down by agencies like the FBI and
Speaker 1: got a pretty light punishment all things considered. He was
Speaker 1: sentenced to eight months in a youth group home. And
Speaker 1: part of the reason for the relatively light sentence is
Speaker 1: that the law was dragging behind technology, because it's hard
Speaker 1: to charge someone with a crime when you don't have
Speaker 1: a law defining that crime yet. And this is something
Speaker 1: we've seen in technology over and over where the developments
Speaker 1: of tech have outstripped the social constructs like law. In
Speaker 1: two thousand seven, in Russia, a massive de dos attack
Speaker 1: shut down not just a site or made a service slow,
Speaker 1: and actually shut down internet coverage for entire cities. The
Speaker 1: attack was aimed at an Internet service provider, and it
Speaker 1: was so effective that the provider went offline multiple times
Speaker 1: in waves of attack that hit over the period of
Speaker 1: a month. So they would get back up and then
Speaker 1: they would be hit by another attack and it would
Speaker 1: go down again. At the peak of an attack, traffic
Speaker 1: being sent to the provider reached ten gigabytes per second,
Speaker 1: which was pretty darn staggering back in two thousand seven. Later, Anonymous,
Speaker 1: the most famous secret society of activists and techno anarchists,
Speaker 1: began to make use of voluntary button nets to attack targets.
Speaker 1: They urged people who wanted to lend their computer's power
Speaker 1: to an attack to download software called the low orbit
Speaker 1: ion cannon. This would make the users computer join a
Speaker 1: large bot net, which then could be directed to attack
Speaker 1: specific targets. Essentially, this is what hackers often try to
Speaker 1: do through tricking others to install malware, only in this case,
Speaker 1: Anonymous was outright saying, Hey, your computer is going to
Speaker 1: be part of this if you download the software. So
Speaker 1: if you want to help bring down the man, download
Speaker 1: and install it now. That wraps up this episode. In
Speaker 1: our next one, we're gonna talk more about how de
Speaker 1: dos works and also the various strategies that people and
Speaker 1: companies used in order to try and mitigate the effects
Speaker 1: of de dos. As it turns out, it's pretty tricky.
Speaker 1: If you guys enjoyed this episode, let me know. Also
Speaker 1: give me a shout out if you have any suggestions
Speaker 1: for future episode topics. Whether it's a technolology, a company,
Speaker 1: a person in tech, maybe there's someone you want me
Speaker 1: to interview, let me know by sending me an email.
Speaker 1: The address is tech stuff at how stuff works dot com,
Speaker 1: or drop me a line on Facebook or Twitter. The
Speaker 1: handle for both of those is text stuff H s W.
Speaker 1: Don't forget to follow us on Instagram and I'll talk
Speaker 1: to you again really soon. For moral thiss and thousands
Speaker 1: of other topics. Is that how stuff works dot com