Speaker 1: Welcome to tex Stuff, a production from my Heart Radio
Speaker 1: Heathen and welcome to text Stuff. I am your host,
Speaker 1: Jonathan STRICKLINN. I am an executive producer and apparently vampire
Speaker 1: at I Heart Radio. How the tech are you? Okay,
Speaker 1: I'm dropping in now you all got the cringe out
Speaker 1: of the way. First thing. We're done with that. But
Speaker 1: we are in spooky season as I publish this October
Speaker 1: of two thousand twenty two. And you know, I don't
Speaker 1: typically do episodes that relate to spooky stuff, but I
Speaker 1: thought it would be fun if I did a few
Speaker 1: this month that are tangentially maybe questionably themed to be
Speaker 1: halloween ish. This gets a little tricky in tech. I mean,
Speaker 1: I have done episodes about stuff like the tech in
Speaker 1: professional haunted house attractions and stuff like that, which it
Speaker 1: is great, but you know, I can't really revisit that.
Speaker 1: There's not a whole lot more to say. I did
Speaker 1: do a classic episode with my co host Chris Palette
Speaker 1: about ghost hunting technology or so called ghost hunting technology.
Speaker 1: Maybe I'll do an update to that because it's been
Speaker 1: so long since I recorded that that episode, and uh,
Speaker 1: and I always like getting my dander up about stuff
Speaker 1: like that. But you know, pickens are slim when you
Speaker 1: look at stuff that you can theme toward Halloween in
Speaker 1: the tech space. But yesterday in the news episode, I
Speaker 1: talked about how some activists who at the very least
Speaker 1: are sympathetic to the Kremlin, used distributed denial of service
Speaker 1: attacks or de DOS attacks against a dozen or so
Speaker 1: US airport websites. Not air carriers, not the airlines, mind you,
Speaker 1: but the airport websites. And the attacks brought down some
Speaker 1: sites for a few hours, but otherwise had very little
Speaker 1: impact on travel. Now you might say, okay, but how
Speaker 1: are you connecting di DOS attacks to Halloween. Well, the
Speaker 1: tenuous connective tissue is that to to pull off the
Speaker 1: d DOS attack, hackers first have to assemble a bot net,
Speaker 1: which is a collection of compromised computer systems. And another
Speaker 1: phrase that sometimes describes a bot is zombie, and bought
Speaker 1: net would be a zombie army. So you have these
Speaker 1: zombie computers and so zombies. It's totally thematic, right. Okay,
Speaker 1: let's start with a baseline before we get to distributed
Speaker 1: denial of service attack. Let's just start with denial of service.
Speaker 1: What the heck is that? How does it work. Well,
Speaker 1: let's think of the Internet as a giant, interconnected mess
Speaker 1: of clients and servers. There there are other components there too.
Speaker 1: I am oversimplifying it down to clients and servers. So
Speaker 1: servers are the machines that hold the stuff that we
Speaker 1: want to access online. Maybe we are logging on to
Speaker 1: play an online game and the game exists on a
Speaker 1: server somewhere out on the internet, probably exists on several servers,
Speaker 1: and we just connect to a specific one. Or maybe
Speaker 1: we want to order food online using an app, Well,
Speaker 1: that service is hosted on another server somewhere online. Or
Speaker 1: maybe we just want to pop onto the web and
Speaker 1: visit a news site and read up on the headlines,
Speaker 1: while that news site is on another server somewhere out
Speaker 1: there on the web. So the basic way the Internet
Speaker 1: works is that you access a client of One example
Speaker 1: of a client would be a web browser on your computer.
Speaker 1: That's the client. So that's your point of access to
Speaker 1: the Internet, and you want to see something specific, like
Speaker 1: that news site. Let's say, so you type in the
Speaker 1: u r L for the news site into your browser
Speaker 1: and the browser sends out a message that goes across
Speaker 1: the Internet and it gets directed to the specific server
Speaker 1: that houses that you are l The server receives this
Speaker 1: request from your client, and then it replies to that request.
Speaker 1: It sends the files that represent the front page of
Speaker 1: that news site to your client your web browser. Your
Speaker 1: web browser then displays those files as a web page
Speaker 1: to the user. In a way, this is the most
Speaker 1: simplified method to describe what's going on with the Internet
Speaker 1: in general and the web in particular. The specifics get
Speaker 1: a little more sophisticated than that, but from a very
Speaker 1: high level, that is what's happening with web traffic, without
Speaker 1: getting into things like packets and routing and all that
Speaker 1: kind of stuff. Now, sometimes stuff goes wrong in this process.
Speaker 1: You know, maybe the server that's holding the files you
Speaker 1: want has gone offline for some reason, so you get
Speaker 1: an error back because your request could not be answered.
Speaker 1: The server that would normally be there for some reason
Speaker 1: isn't there. Maybe there are issues between the client and
Speaker 1: the server. So it's not that the server has an
Speaker 1: issue or that your client has an issue, but something
Speaker 1: in the middle is causing some problems, or maybe the
Speaker 1: client connection goes down, like maybe your home internet has
Speaker 1: gone down and that's the problem or maybe the server
Speaker 1: is online. There are no other issues between your client
Speaker 1: and the server, but the server itself is currently overwhelmed.
Speaker 1: Now that can happen naturally without malice involved. So let's say,
Speaker 1: for example, that word gets out out a new video
Speaker 1: game console. Let's say, and everyone knows when that console
Speaker 1: is officially going to go up for pre order, and
Speaker 1: you can go straight to this company's website and sign
Speaker 1: up for a pre order the moment it becomes available,
Speaker 1: and you will be first in line to get this
Speaker 1: brand new video game console. And lots of people know
Speaker 1: about this, so tons of people are interested and invested
Speaker 1: in this. So the appointed hour arrives and now millions
Speaker 1: of people around the world are all frantically attempting to
Speaker 1: connect to the same server to put in their pre order,
Speaker 1: and the server is just overwhelmed by the mass of
Speaker 1: incoming traffic and it slows down the servers of ability
Speaker 1: to respond to the requests. So everyone's starting to experience
Speaker 1: these long delays as they try and connect, and you
Speaker 1: get increasingly frustrated because you're waiting and waiting and waiting
Speaker 1: for a web page to load in your browser, and
Speaker 1: the servers doing its best to respond to demands. Sometimes
Speaker 1: this kind of situation can be enough to actually cause
Speaker 1: the server to crash entirely, which is even more frustrating
Speaker 1: because then it has to go through the whole reboot
Speaker 1: process before you can connect to it again, and that
Speaker 1: obviously makes matters more frustrating. And like I said, this
Speaker 1: all can happen naturally just due to demand. We've seen
Speaker 1: it happen multiple times, even in modern day, like we
Speaker 1: saw it happen a lot early in the days of
Speaker 1: the web because of unexpected demand, but it still happens
Speaker 1: today too. However, this thing that can happen naturally can
Speaker 1: also be caused to happen artificially. A nefarious person can
Speaker 1: try and create that sort of situation on purpose. Now
Speaker 1: this brings us to a denial of service attack or
Speaker 1: DOS attack D O S big D little oh big S.
Speaker 1: All right, So there's an analogy that I love to
Speaker 1: use when talking about denial of service. I'm going to
Speaker 1: use it again. So imagine for a moment that anytime
Speaker 1: anyone rang your doorbell or knocked on your door, you
Speaker 1: absolutely had to go answer the door. You couldn't pretend
Speaker 1: not to be home or ignore it. You are compelled,
Speaker 1: you have no other option. You have to answer the door. Now,
Speaker 1: let's say you're at home and you've decided that you
Speaker 1: want to make yourself snack. You're feeling peckish, so you
Speaker 1: start to head to your kitchen, but then someone rings
Speaker 1: the doorbell, so you turn around and you walk to
Speaker 1: the front door and you open it, but there's no
Speaker 1: one there, so you close the door and you head
Speaker 1: back inside. You start heading back to the kitchen, but
Speaker 1: you get two steps toward the kitchen and the doorbell
Speaker 1: rings again, so you do a one eight. You walk
Speaker 1: back to the door and you open it. There's no
Speaker 1: one there, those darn kids, And now you're getting irritated,
Speaker 1: possibly because you've got some low blood sugar going on
Speaker 1: because you haven't had your snack yet, So you close
Speaker 1: the door. You turn back to head toward the kitchen.
Speaker 1: Bing bong goes the doorbell and you turn around again
Speaker 1: to answer the door, and once again, no one is there.
Speaker 1: And this happens over and over, and because you are
Speaker 1: compelled to answer the door, you can't ever make any
Speaker 1: progress doing anything else, and then eventually you just collapse
Speaker 1: in frustration, starvation, and confusion and a denial of service
Speaker 1: attack is really similar to this. A basic one might
Speaker 1: be that someone is sending a message to a server,
Speaker 1: but the return address for this message goes nowhere, So
Speaker 1: it's a message that's going to a server, but the
Speaker 1: server has the wrong information about where that message came
Speaker 1: from and where it has to send its reply. So
Speaker 1: the hacker is just sending message after message to the
Speaker 1: server with this false return address, and the server has
Speaker 1: to answer each one. That's the server's job. So the
Speaker 1: hacker is just flooding the server as much as possible
Speaker 1: to bring it down, because the server can't just ignore
Speaker 1: incoming messages. If a server ignored incoming messages, the basic
Speaker 1: operations of the Internet would break down. Now, that kind
Speaker 1: of attack is actually not that hard to defend against
Speaker 1: because if you do detect it, if you detect that
Speaker 1: there's an unusual amount of traffic coming from a single source,
Speaker 1: um even if that source is a fake IP address,
Speaker 1: you can just block anything coming from there, and then
Speaker 1: you can keep accepting other traffic. And it's britty. It's,
Speaker 1: in the grand scheme of things, relatively easy to deal with.
Speaker 1: A denial of service attack a basic denial of service attack,
Speaker 1: but the denial of service attack is small change compared
Speaker 1: to a distributed denial of service attack. This is big
Speaker 1: D big D little oh big s d DOS. So
Speaker 1: to do ad DOS attack, a hacker needs access to
Speaker 1: a bunch of computers. This is the distributed part, and
Speaker 1: working together these computers, which could number in the millions
Speaker 1: for a particularly huge zombie army or bought net, they
Speaker 1: can all work together to send them just to a
Speaker 1: targeted server, which then gets bogged down trying to answer
Speaker 1: all these messages. Now, if this podcast were instead of book,
Speaker 1: I would have put a footnote up there when I
Speaker 1: mentioned large botton nets. It is hard to get a
Speaker 1: real figure for how big a boton net is it.
Speaker 1: You can make some estimates, but it's hard to get
Speaker 1: a firm grasp, largely because computers are not necessarily always
Speaker 1: on right. They're not always connected. You might turn your
Speaker 1: computer off, or you might your Internet connection might go
Speaker 1: down or whatever, and so it's not easy to actually
Speaker 1: quantify how big these buttonets can be. However, we have
Speaker 1: some general idea of some of the largest ones. So
Speaker 1: there was a botton net. Still is a bottonet associated
Speaker 1: with a trojan called Zeus that involved more than thirteen
Speaker 1: million computers, so they can be quite large. Also should
Speaker 1: add botton nets can be is for lots of other
Speaker 1: stuff besides the DOS attacks. That's like one of the
Speaker 1: easily identifiable reasons for a butt net, but there are
Speaker 1: other ones as well. Also, just adding that you should
Speaker 1: always be careful to make sure your machines don't become
Speaker 1: part of one, which means practicing good etiquette online. You know,
Speaker 1: making sure you're not downloading files that are coming from
Speaker 1: questionable sources, not clicking on links that are coming from
Speaker 1: questionable sources, all the basic stuff you know about. These
Speaker 1: are reasons why that's important to follow. All right, We've
Speaker 1: got some more to say about zombies, but first let's
Speaker 1: take a break. We're back, all right. So for ad
Speaker 1: DOS attack to work, first you have to actually gather
Speaker 1: your zombie army, and that alone requires a few steps
Speaker 1: of its own. So step one is you design or
Speaker 1: you make use of existing malware that compromises targeted computer systems.
Speaker 1: So if someone installs the malware, it creates a compromised
Speaker 1: computer system. So the goal is to create a means
Speaker 1: for a hacker to be able to send a command
Speaker 1: to the compromised machines that will then prompt the machine
Speaker 1: to follow orders the malware. It could be relatively simple
Speaker 1: where it just allows for this de dos attack approach,
Speaker 1: or it could be more extensive, and frequently is more
Speaker 1: extensive that allows a a wider spectrum back door access
Speaker 1: for hackers that could ultimately give a hacker administrator level
Speaker 1: access to a machine, which is obviously a really bad
Speaker 1: thing for that target machine. And that's really why you
Speaker 1: need to be super careful and practice good etiquette when
Speaker 1: you're online, because if you download certain types of malware,
Speaker 1: it essentially means you've just handed your computer over to
Speaker 1: a hacker. They're able to get back door access to
Speaker 1: your your system, they can look at all your files,
Speaker 1: they can lock it down. That's how ransomware works, where
Speaker 1: they locked down your computer system or locked down certain
Speaker 1: directories in your computer and then they demand a ransom
Speaker 1: and in return they will unlock those for you. So
Speaker 1: that this is again a reminder to be very careful
Speaker 1: when you're online. You don't want to hand over the
Speaker 1: keys to your system to some stranger, right, You just
Speaker 1: don't want to do that. Anyway, Lots of hackers make
Speaker 1: use of already existing tools. Uh, there's a much smaller
Speaker 1: group of them who are actually designing the tools. Those
Speaker 1: are the ones you really have to worry about. I mean,
Speaker 1: you have to worry about all of them, the ones
Speaker 1: who just make use of re existing stuff in order
Speaker 1: to advance their own agendas. Often they are dismissively referred
Speaker 1: to as script kitties. They're taking existing script or programming
Speaker 1: and making use of it, but they're not righting it themselves.
Speaker 1: Uh that that's a term that's often used for them.
Speaker 1: I find that term to be problematic simply because it
Speaker 1: doesn't reduce how potentially dangerous they can be. Uh. You,
Speaker 1: if you dismiss them and you think that they're not
Speaker 1: an issue, then you might be setting yourself up for
Speaker 1: being victimized. So I don't really like using the script
Speaker 1: kiddies designation anyway. A lot of the time hackers hide
Speaker 1: malware packages inside a larger, seemingly legitimate file, and this
Speaker 1: is called the trojan method. It's named after the trojan
Speaker 1: horse of ancient legend. So instead of packing a bunch
Speaker 1: of soldiers inside a big wooden horse, these digital trojan
Speaker 1: horses have a malware package hiding within them. So you
Speaker 1: designed the trojan to look like something else, maybe something
Speaker 1: that folks would really like to get hold of. This
Speaker 1: is one reason while you hear people cause UH and
Speaker 1: others about downloading pirated files, going to sources where you've got,
Speaker 1: you know, stuff that's like games and movie files and
Speaker 1: all this kind of stuff supposedly ready for you to download.
Speaker 1: It's not just that the matter of piracy itself is illegal,
Speaker 1: that you're essentially stealing, you know, the idea of downloading
Speaker 1: a product without paying for that product is stealing. But
Speaker 1: it's also that hackers will sometimes insert malware into files
Speaker 1: and they will hide those in pirate communities, like they'll
Speaker 1: they'll name the files something that people really want, you know,
Speaker 1: maybe it's like uh, an upcoming film that hasn't hit
Speaker 1: theaters yet, but it's supposedly elite copy of it, and
Speaker 1: you know, there are a lot of people who are
Speaker 1: curious about that, and they'll go through the trouble of
Speaker 1: downloading it. Well, you hide some malware in there, and
Speaker 1: whether it's the real film or not, you've delivered malware
Speaker 1: to someone and potentially commenced them to install it because
Speaker 1: you know, maybe you've compressed the file in some way
Speaker 1: and you've disguised it and people are clicking on it.
Speaker 1: They're just eager to get a look at this movie,
Speaker 1: and in the process they install malware to their machine. Also,
Speaker 1: if someone is illegally downloading files, that person is likely
Speaker 1: to resist speaking up about being victimized simply because they
Speaker 1: were already engaged in something that was questionable, right they
Speaker 1: were pirating files. It's it's that thought that if someone's
Speaker 1: being dishonest, they're not going to come forward when you
Speaker 1: have targeted them because they're worried about being found out.
Speaker 1: So it's it's identifying your target audience and the ones
Speaker 1: that are less likely to actually take steps to fix
Speaker 1: a problem if it pops up, so that can give
Speaker 1: hackers more time with these compromise machines, these zombie computers.
Speaker 1: So hackers build up their zombie armies, their bought nets
Speaker 1: by distributing the malware in various ways. The trojan method
Speaker 1: is just one of many. There are lots of others,
Speaker 1: and they monitor the botton net as it grows. You know,
Speaker 1: they're essentially administering the botton net in the back end.
Speaker 1: They have the ability to send out commands. This is
Speaker 1: why you get concepts like a zombie army because the
Speaker 1: the individual compromised devices are the soldiers of that army.
Speaker 1: The hacker ends up being the commander of that army
Speaker 1: and can send out commands to the entire army. And
Speaker 1: maybe the hacker doesn't take action right away. Maybe they
Speaker 1: just sit and wait. They have this growing number of
Speaker 1: devices that are part of their army, and they just
Speaker 1: wait until the time's right. In fact, it's even possible
Speaker 1: that they don't even have a target in mind yet.
Speaker 1: They just they compromise the machines. But it's really because
Speaker 1: they plan on doing an attack, but they haven't even
Speaker 1: decided who they're going to attack. That can sometimes happen too.
Speaker 1: But when the time comes, they send out the command
Speaker 1: to all these infected devices, at least the ones that
Speaker 1: are currently online, and they direct these devices to all
Speaker 1: start flinging messages at the target server and boom, you
Speaker 1: got your distributed denial of service attack carried out by
Speaker 1: zombie computers. Spooky. Now, de dos attacks can get more
Speaker 1: complicated than how I've described. For example, it's also possible
Speaker 1: to make use of compromised Internet of Things devices. They
Speaker 1: don't have to just be computers, and you may have
Speaker 1: heard me speak in past episodes about issues with IoT
Speaker 1: security in the past. Some companies are not very good
Speaker 1: at securing their devices properly, so you'll get a manufactured
Speaker 1: product there's poor security on that product. There's the assumption
Speaker 1: is just that it's not going to get targeted. UH.
Speaker 1: There's a great example of various manufacturers that have used
Speaker 1: common login and password for devices like including routers where
Speaker 1: there's a a generic UH log in and password, and
Speaker 1: if you know the generic logan and password for those routers,
Speaker 1: it means that you can access any router where the
Speaker 1: user has not made the effort to change those and
Speaker 1: as you might guess, most people don't go to that effort.
Speaker 1: Most people fail to go in and change the default
Speaker 1: settings on their various devices, which means if you know
Speaker 1: the default log in, you can access those devices right
Speaker 1: even if you don't have access to other stuff on
Speaker 1: the network. So then hackers can get access to a
Speaker 1: very large installed base of Internet of Things devices in
Speaker 1: this way. For Scout Research Labs looked at more than
Speaker 1: eight million devices in the IoT field and they found
Speaker 1: that there are some particularly weak examples and they happen
Speaker 1: to be in very important places. They found that one
Speaker 1: category of device of IoT device that tends to have
Speaker 1: pretty weak security our medical devices. That is terrifying. They
Speaker 1: also found that networking equipment was particularly weak with security. Again,
Speaker 1: this is like the infrastructure, the bones upon which everything
Speaker 1: is built, and those are weak points in a way,
Speaker 1: it almost doesn't matter how much security you've built on
Speaker 1: top of everything else. If you can get at the
Speaker 1: underlying networking equipment, you can cause some real havoc. So
Speaker 1: it's possible to direct these kinds of devices to also
Speaker 1: send Internet traffic to a targeted server. So a zombie
Speaker 1: army may not be composed of computers. It could include
Speaker 1: stuff that's well outside your typical computer. And as more
Speaker 1: devices joined the Internet of Things, this problem continues to grow.
Speaker 1: And while companies like cloud Flare, which we'll talk about
Speaker 1: in a couple of minutes, have really come up with
Speaker 1: some mitigation strategies to deal with de dos attacks, the
Speaker 1: attackers are always looking for other ways to be effectived.
Speaker 1: DOS attacks can also be sophisticated in other ways. So
Speaker 1: I gave a big overview of how de dose works.
Speaker 1: But while that is an overview, you need to know
Speaker 1: that there are different types of de DOS attacks that
Speaker 1: target different elements or layers of a network, So you've
Speaker 1: got you know, you can think of networking as different layers,
Speaker 1: with each layer corresponding to a specific subset of UM tasks.
Speaker 1: And I'm not going to go into the full layer description.
Speaker 1: I've done episodes about that in the past, but my
Speaker 1: point is that ad dose attack can target a specific layer,
Speaker 1: and if you use ad DOS attack that targets multiple
Speaker 1: layers using lots of different computers, that becomes a very
Speaker 1: sophisticated de DOS attack, one that is much harder to
Speaker 1: defend against than one than ADDS attack that targets just
Speaker 1: a single layer, like the web server layer that I
Speaker 1: kind of described earlier, the one that took down the
Speaker 1: airport websites that I mentioned at the beginning of this episode,
Speaker 1: that was a very simple de DOS attack. It was
Speaker 1: attacking a specific layer, just one, so it wasn't a
Speaker 1: multi layer attack UM and so was therefore easier to
Speaker 1: defend against. But they don't all have to be like that.
Speaker 1: They can be a multi layer attack from multiple vectors,
Speaker 1: and that becomes a much more challenging issue to defend against.
Speaker 1: And you know, the goal is almost always to gum
Speaker 1: up the network so that traffic slows to a crawl
Speaker 1: or it crashes entirely. So the goal is usually the
Speaker 1: same goal, right, You're just trying to disrupt connectivity to
Speaker 1: a specific target, But there are different ways of doing that,
Speaker 1: whether you're attacking the server itself or you're attacking elements
Speaker 1: within the Internet that direct traffic to that server. And
Speaker 1: maybe in the future episode I'll go into more detail
Speaker 1: about that, but that's going to require like a full
Speaker 1: length episode, so we're gonna leave that for now. We're
Speaker 1: also going to take another quick break. When we come back,
Speaker 1: I'm gonna talk more about cloud Flare and how cloud
Speaker 1: Flare helps protect against things like de dos attacks and
Speaker 1: keep us safe from the zombies. But first this break.
Speaker 1: All right, before the break, I mentioned cloud Flare, which
Speaker 1: provides several services, not just protection against de dos. But
Speaker 1: that's one that a lot of people relate cloud Flare too.
Speaker 1: They think of that as like a company that protects
Speaker 1: other companies from unwanted massive amounts of traffic, in other words,
Speaker 1: de DOS attacks. This is tricky because, at least initially,
Speaker 1: a de dos attack can look like legitimate traffic to
Speaker 1: a server, and you know you don't want to block
Speaker 1: legitimate traffic, right, You don't want to proactively cut people
Speaker 1: off from connecting to a server. The whole point is
Speaker 1: of services to allow clients to connect to them, and
Speaker 1: so if you are blocking off all traffic, then there
Speaker 1: might as well not be a server there at all.
Speaker 1: So you want to make sure you're able to differentiate
Speaker 1: between what an attack is and what legitimate traffic is.
Speaker 1: The server starts getting requests that are piling up, but
Speaker 1: these requests are coming from different machines with ad DOS attack, right,
Speaker 1: They're not coming from a single source. So at first
Speaker 1: Blush it looks like it's just a massive uptick in
Speaker 1: legitimate traffic. And as I said, there could be times
Speaker 1: when this actually happens, like there are situations where this
Speaker 1: occurs naturally, so you have to be able to sort
Speaker 1: those moments out from malicious de dos attacks. Now, the
Speaker 1: way cloud Flare does this involves a few different approaches.
Speaker 1: One is to look at the IP addresses of the
Speaker 1: incoming messages. Uh, if they originate from the same address
Speaker 1: or from a relatively narrow range of IP addresses, that's suspicious, right.
Speaker 1: If you're if you're looking at and you're thinking, these
Speaker 1: are all really similar, so it looks like they're all
Speaker 1: coming from the same group. That could indicate a the
Speaker 1: DOS attack. Similarly, if the traffic is coming in from
Speaker 1: a narrow range of behavioral profiles, that's a red flag.
Speaker 1: So a behavioral profile in this context is really about
Speaker 1: the type of device that sent the traffic in the
Speaker 1: first place. Right, Was it a laptop, was it a
Speaker 1: mobile device? Wasn't an Internet of Things device? So if
Speaker 1: you are running a news site and you start to
Speaker 1: detect a you know, ton of traffic that's coming in
Speaker 1: from smart thermostats, that's a big old red flag because
Speaker 1: you can't really think of a reason why smart thermostats
Speaker 1: would be pinging a web server for a news site.
Speaker 1: So if you're cloud flare, you might look at the
Speaker 1: incoming traffic and say, that's hanky, this is probably ADDS attack. Also,
Speaker 1: if the surge in traffic starts arriving in patterns, like
Speaker 1: if you notice that every thirty minutes you get another surge,
Speaker 1: that's a red flag. If it's happening at a regularly,
Speaker 1: you know, kind of timed interval that looks artificial, that
Speaker 1: looks like that's a system that's directing waves of messages
Speaker 1: at a predetermined amount of time. If they're not coming
Speaker 1: in haphazardly, If they're coming in in these waves, then
Speaker 1: that suggests it's an artificial attack. Or if you detect
Speaker 1: a huge traffic spike but it's an unusual time of day,
Speaker 1: that's another indicator. For example, you wouldn't expect a ton
Speaker 1: of traffic to hit say a website for a line
Speaker 1: of credit unions that are on the East coast of
Speaker 1: the United States at two a m. Eastern time, for example, right,
Speaker 1: because typically those sites should only really be getting huge
Speaker 1: amounts of traffic or even just regular amounts of traffic
Speaker 1: during the daytime for Eastern time. So, yes, the Internet
Speaker 1: is global, so it's not like you would expect traffic
Speaker 1: to drop to zero necessarily. But we tend to see
Speaker 1: traffic behave in similar amounts uh and and in similar
Speaker 1: scale wherever the site happens to be based. Right, So
Speaker 1: if a site is based on the East coast of
Speaker 1: the United States in the middle of the night in
Speaker 1: the US, you probably see a drop in traffic there.
Speaker 1: If you see a spike in the middle of the night,
Speaker 1: that's a potential indication of an attack. Now, obviously that's
Speaker 1: not always true, but you know, for certain types of sites,
Speaker 1: it's a good rule of thumb. So first, cloud flare
Speaker 1: actually has to differentiate an attack from legitimate traffic, and
Speaker 1: then it essentially has to block incoming traffic from suspected
Speaker 1: attack sources, thus shielding the client from all of those
Speaker 1: unwanted messages. It may also use something called rate limiting.
Speaker 1: This is essentially all about setting boundaries, which is important
Speaker 1: in any relationship. You've got to set your boundaries. Now,
Speaker 1: in this case, setting boundaries means setting how many requests
Speaker 1: a server will accept in a given amount of time,
Speaker 1: and once you hit that limit, no more requests can
Speaker 1: come through until the next available time slot opens up.
Speaker 1: That limits both the attacks and legitimate traffic however, so
Speaker 1: it can definitely reduce the probability of addos attack taking
Speaker 1: down a target, but it also means that legitimate users
Speaker 1: aren't going to really be able to get access either,
Speaker 1: so everyone kind of gets affected. Another strategy is making
Speaker 1: use of a reverse proxy. All right, so proxies are
Speaker 1: really useful things on the Internet, and it's very possible
Speaker 1: that you've used one before. If you use a VPN,
Speaker 1: you have relied on a proxy, so a proxy stands
Speaker 1: in place for some other entity. With VPNs, the proxy
Speaker 1: stands in place for clients. So when you connect to
Speaker 1: your computer to a VPN, you're connecting to a proxy
Speaker 1: server and all the web traffic you engage with has
Speaker 1: to go through that VPN. So to the outside world,
Speaker 1: if someone were snooping on you, they would see that
Speaker 1: you are connected to a VPN, but that's as far
Speaker 1: as they can tell. They know that you connected to
Speaker 1: this VPN, but that's as much as they know. They
Speaker 1: can also tell that the VPN is connecting to all
Speaker 1: these other different sites and services, but they wouldn't be
Speaker 1: able to say for sure that that was you directing
Speaker 1: the VPN to do that because the VPN is also
Speaker 1: got lots of other computers connected to it, so you
Speaker 1: don't know who is connecting to what. You can see
Speaker 1: that everything is going into the VPN, and then you
Speaker 1: can see that the VPN is then sending that information
Speaker 1: along to the various clients connected to the VPN, But
Speaker 1: you have obfuskated what folks are doing. VPNs are used
Speaker 1: for all sorts of legitimate reasons. There are companies that
Speaker 1: use VPNs so that way outsiders can't snoop on traffic
Speaker 1: between the company and the employees. For example, VPNs can
Speaker 1: be used to get around regional restrictions. So an example
Speaker 1: of that could be in a foreign country where the
Speaker 1: government is really cracking down on Internet access, a VPN
Speaker 1: might allow you to or proxy server might allow you
Speaker 1: to sidestep those restrictions and access the Internet in an
Speaker 1: otherwise unfettered way. So they're legitimate reasons for this. So
Speaker 1: the VPN sends all traffic along to you, and due
Speaker 1: to encryption and the fact that there are multiple clients
Speaker 1: connected to the VPN, it hides what's going on. Now.
Speaker 1: Reverse proxy is similar, but it's different in an important way.
Speaker 1: So a reverse proxy is a server that sits in
Speaker 1: front of or servers. So with a VPN, no server
Speaker 1: will ever connect directly to a client. It can only
Speaker 1: connect to a client via the VPN. With a reverse proxy,
Speaker 1: no client can connect to a specific server, instead connects
Speaker 1: to the reverse proxy server, which acts as kind of
Speaker 1: a mentalman and then sends traffic along to the ultimate server.
Speaker 1: So it's a gatekeeper really, and attackers would not have
Speaker 1: the IP address of the target server, they would instead
Speaker 1: be able to only direct traffic to the reverse proxy server.
Speaker 1: So if a company like cloud flare is in charge
Speaker 1: of those reverse proxy servers, cloud Flare can institute tougher
Speaker 1: security measures to prevent an onslaught of illegitimate traffic hitting
Speaker 1: the target. So the reverse proxy kind of acts like
Speaker 1: a really tough bouncer outside of a club. The bouncer
Speaker 1: will let the right folks into the club and make
Speaker 1: sure that the undesirables hit the curve. Now, protect the
Speaker 1: against the dos attacks can get really sophisticated, largely because
Speaker 1: a well designed de dos attack will aim at hitting
Speaker 1: a target through several layers. Right. They won't just be
Speaker 1: a simple overwhelming attack if they're if they're planned out properly.
Speaker 1: So defense has to be able to work for all
Speaker 1: these different layers of attack. Otherwise, you can protect one
Speaker 1: part of your target but leave another part unshielded and
Speaker 1: boom the di dos attack. It still ends up being effective.
Speaker 1: This is why companies like cloud flare exist because while
Speaker 1: protection isn't impossible, it is time consuming, it's easy to
Speaker 1: get wrong, and it's also why it's a really big deal.
Speaker 1: Whenever cloud Flare dumps a client, which doesn't happen often,
Speaker 1: but it can in extreme circumstances. For example, there's the
Speaker 1: Kiwi Farms case. Now, in case you are unaware of
Speaker 1: Kiwi Farms, which I would say you are lucky if
Speaker 1: you don't know what Kiwi farms is. Kiwi Farms is
Speaker 1: a site that houses forums largely dedicated to doxing, that
Speaker 1: is the release of private information about a person harassing, abusing,
Speaker 1: and threatening certain folks, for example the trans community. And
Speaker 1: it's beyond horrifying the links that folks will go to
Speaker 1: in order to torture targets. And the Kiwi Farms groups
Speaker 1: have been known to heap so much abuse on people,
Speaker 1: including revealing details of their personal lives on online, or
Speaker 1: inventing stories and spreading them as if they were true
Speaker 1: online or swatting victims that that means that they make
Speaker 1: a fake emergency call into law enforcement that prompts an
Speaker 1: armed response team to arrive at the target's home. These
Speaker 1: levels of abuse have gone so far that some folks
Speaker 1: were driven to committing suicide as a result. It is
Speaker 1: truly hardifying stuff. Now, Kiwi Farms depended on cloud Flare
Speaker 1: to shield the site from attacks, because obviously hate group
Speaker 1: is also going to become a target itself from people
Speaker 1: who want to take that hate group down. In September
Speaker 1: of this year, cloud Flare announced it was dropping Kiwi
Speaker 1: Farms as a client due to quote immediate threat to
Speaker 1: human life end quote, and so Kiwi Farms has had
Speaker 1: trouble staying online ever since and has been the the
Speaker 1: site of data breaches since then. People have gotten access
Speaker 1: to accounts and things like that, and there are related
Speaker 1: issues that the site has encountered that involve hosting, so
Speaker 1: not just protection but hosting. But that's that's just a
Speaker 1: related but different matters, So we're not going to go
Speaker 1: into all that, but it really does illustrate that cloud
Speaker 1: flares services are really important, particularly for high profile sites,
Speaker 1: whether that site is high profile because it's seen as
Speaker 1: being a really important part of the infrastructure as a
Speaker 1: as a whole, or it's just high profile because of
Speaker 1: the nature of the site itself in the case of
Speaker 1: Kiwi Farms, and once that protection goes away, those sites
Speaker 1: have a real hard time staying up because they are
Speaker 1: such attempting target at any rate. The di DOS attack
Speaker 1: that brought down the airport websites that I talked about
Speaker 1: at the beginning that appears to have been a relatively
Speaker 1: simple one. It was effective in that it did clog
Speaker 1: up web traffic to the airport websites, but it didn't
Speaker 1: take very long for folks to resolve the problem, and
Speaker 1: as I mentioned, it failed to disrupt travel at all.
Speaker 1: But we still see the occasional di dos attack take
Speaker 1: down sites and services that have a wider impact on society,
Speaker 1: so it's not like these things are going away. And again,
Speaker 1: part of the responsibility falls to us as denizens of
Speaker 1: the online world to make sure that we are being
Speaker 1: as careful as we can so that we don't compromise
Speaker 1: our devices and have them join zombie arm. Some of
Speaker 1: that is beyond our control. Some of it falls to
Speaker 1: companies to make sure that they institute better security measures
Speaker 1: when they create Internet connected devices so that hackers don't
Speaker 1: easily have a skeleton key that gives them access to
Speaker 1: an enormous number of those devices. And obviously, ultimately at
Speaker 1: fault are the people who are directing these attacks. Right
Speaker 1: if they weren't doing it, then it wouldn't be a concern.
Speaker 1: But we have to do our best to make sure
Speaker 1: we don't become part of the problem anyway. That was
Speaker 1: today's spooky topic of zombie computers zombie armies. Um, I'll
Speaker 1: be talking about lots of other types of spooky related stuff,
Speaker 1: questionably spooky related stuff this month. I'm still trying to
Speaker 1: figure out how I could do a ghost in the
Speaker 1: Machine episode. I'll try and figure out if I couldn't
Speaker 1: make that happen, And there's some other concepts that are
Speaker 1: floating around that I would like to tackle. If you
Speaker 1: have suggestions for spooky top picks that are tech related,
Speaker 1: let me know. One way to do that is to
Speaker 1: download the I Heart radio app. It's free to download
Speaker 1: and use. Just navigate on over to the tech Stuff page.
Speaker 1: You can do that in the search engine and use
Speaker 1: the little microphone icon to leave me a voice message
Speaker 1: up to thirty seconds in length. Let me know if
Speaker 1: you would like me to use the message in an
Speaker 1: upcoming episode. I'm all about opt in, so I will
Speaker 1: only do it if you tell me expressly that it's
Speaker 1: okay to do it. And the other way to reach
Speaker 1: out to me is on Twitter. The handle for the
Speaker 1: show is tech Stuff hs W and I'll talk to
Speaker 1: you again really soon. Tech Stuff is an i heart
Speaker 1: Radio production. For more podcasts from my heart Radio, visit
Speaker 1: the i heart Radio app, Apple Podcasts, or wherever you
Speaker 1: listen to your favorite shows.