Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello there, everybody,
Speaker 1: and welcome to tech stuff. My name is Chris Poulette
Speaker 1: and I'm an editor here at how stuff works dot com.
Speaker 1: Sitting next to me, as usual, is senior writer Jonathan Strickland.
Speaker 1: Hey there, Crispy. Alrighty, then, so what we got on
Speaker 1: tap for today? Well, what we have on tap to
Speaker 1: start us off is a little a listener mail. And
Speaker 1: this listener mail comes from Dorian, and Dorian says, Hey, guys,
Speaker 1: I really enjoy listening to your podcast. I've been hearing
Speaker 1: a lot of stuff about an attack on Twitter and Facebook,
Speaker 1: and I was wondering what that is all about. I
Speaker 1: heard Twitter was down for several hours, while Facebook took
Speaker 1: it like a man and was knocked down to about
Speaker 1: But still, what's going on? Keep up with a great podcast, Dorian.
Speaker 1: Thanks Dorion. Actually I already responded to Dorian to let
Speaker 1: him know what was going on, but I thought we
Speaker 1: could talk about what happened in general and then get
Speaker 1: down to some specifics. So in general, we're talking about
Speaker 1: a denial of service attack. Yeah. Actually, um, this is
Speaker 1: nothing new. Denial of service attacks have been going on
Speaker 1: for quite some time, and part of the reason for
Speaker 1: that is they're really simple to cause it's a very
Speaker 1: very simple attack on it on a network. Yeah, there's
Speaker 1: actually a couple of different ways you can you can
Speaker 1: perform a denial of service attack. That two most common
Speaker 1: ways really are you can flood a server with requests
Speaker 1: so that it becomes overwhelmed and then shuts down. Or
Speaker 1: you can send a special kind of request to a
Speaker 1: server where you you happen to know that the server
Speaker 1: has certain vulnerabilities, and by sending us a specific kind
Speaker 1: of command, it will cause the server to, uh to
Speaker 1: essentially have a little bit of a freak out. I mean,
Speaker 1: it doesn't know how to handle the command, so it
Speaker 1: ends up shutting down. Um. That way, so in one
Speaker 1: case you're talking about just sending a stream of attacks,
Speaker 1: and then another you just it's like a well placed
Speaker 1: sniper bullet. All right, Then that's that's interesting analogy I
Speaker 1: hadn't heard before, you know, I'm all about the interesting analogies. Okay, then,
Speaker 1: so one shot, one kill. Now the the the denial
Speaker 1: of service attacks like like Chris was saying, aren't really new. Uh,
Speaker 1: And really, a a simple denial of service attack isn't
Speaker 1: the most difficult thing to defend yourself against if you
Speaker 1: are targeted by one, because a very simple denial of
Speaker 1: service attack is coming from a single source. Yeah. Um,
Speaker 1: denial of service can be as simple as sending thousands
Speaker 1: and thousands of email messages uh to a single server. UM.
Speaker 1: Basically instead of you know, handling everything one at a time.
Speaker 1: There you know, there's a log jam of information going
Speaker 1: at the server UM, and uh you know pretty soon
Speaker 1: the computer the other end can't handle it all. I mean,
Speaker 1: this is not something that you could do, uh if
Speaker 1: you wanted to crank up you know, Mozilla Thunderbird, You're
Speaker 1: not gonna be able to to, uh, you know, overwhelm
Speaker 1: a server by sending it messages one by one. You
Speaker 1: would have to dump thousands and thousands of messages per
Speaker 1: second um onto that server in order to overwhelm it. Right.
Speaker 1: And so really, you know that the to really understand
Speaker 1: denial of service attack, you just really get to kind
Speaker 1: of think about the way uh communication across the web works. Essentially,
Speaker 1: whenever you are doing anything on the web where you
Speaker 1: are trying to retrieve information. You are sending out a
Speaker 1: request from your computer to whichever computer out there on
Speaker 1: the network happens to hold this information. That computer then
Speaker 1: sees where this request is coming from and sends the
Speaker 1: information to you. So, uh, denial of service takes advantage
Speaker 1: of this. Um, if you are really clever, when you
Speaker 1: create your denial of service attack, you will send messages
Speaker 1: to a computer and your uh, you're essentially your return
Speaker 1: address will be masked or or um smurfd or spoofed
Speaker 1: if you prefer. And uh, so the the server will
Speaker 1: try and respond by sending messages to either a nonexistent
Speaker 1: IP address or or one that belongs to someone else
Speaker 1: that doesn't belong to you. Uh makes it a little
Speaker 1: more difficult to track where the attacks are coming from.
Speaker 1: That way, Um, But because that's the way the web works,
Speaker 1: you know, you send a request and then the server responds.
Speaker 1: That's how you take advantage of it. I mean, it's
Speaker 1: it's kind of an obligatory response, right. You can't just
Speaker 1: ignore it unless you build that into a firewall. Yeah. Yeah,
Speaker 1: And and that's the whole thing is Uh, the web
Speaker 1: is doing what it's naturally designed to do in this case.
Speaker 1: So I mean, if it didn't work that way, you
Speaker 1: wouldn't be able to get information when you needed it.
Speaker 1: You'd load up your web browser, you would go to say,
Speaker 1: I don't know www. Dot how stuff works dot com?
Speaker 1: And if it didn't automatically serve up that website, you
Speaker 1: wouldn't you wouldn't get anything in your browser. The the
Speaker 1: web just would not work without this kind of process.
Speaker 1: So that's what the attackers take advantage of. Yep. Now,
Speaker 1: um uh. Spoofing is one way to mask an attack.
Speaker 1: Another way would be to build a massive army of bots, right,
Speaker 1: or a zombie army as we call it. And then
Speaker 1: you wouldn't even have to launch it an attack from
Speaker 1: the primary primary computer at all. You can just have
Speaker 1: all your you know, zombies attack it for you. Now,
Speaker 1: this this is a multi step process. Let's say that
Speaker 1: you are a nefarious hacker who is intent on bringing
Speaker 1: down some poor company's website. Right, So you are an
Speaker 1: unscrupulous person and you want to cause lots of damage.
Speaker 1: First of all, shame on you, But how would you
Speaker 1: do this? Well, the first step if you're wanted to
Speaker 1: do one of these attacks, which By the way, these
Speaker 1: are called distributed denial of service attacks because the attack
Speaker 1: is distributed across an army of computers as opposed to
Speaker 1: coming from just one source. Yeah, makes it which also
Speaker 1: makes it just that much worse because now it's not
Speaker 1: coming from one computer, it's coming from lots and lots
Speaker 1: of computer. Right you, your options become more limited when
Speaker 1: you are dealing with a distributed denial of service attack.
Speaker 1: You can't just shut off access from one IP address
Speaker 1: and hope to be all right, because, of course the
Speaker 1: attack is coming from every direction imaginable. So the first
Speaker 1: step in creating one of these attacks is to build
Speaker 1: your zombie army. And the way you do this is
Speaker 1: you create malware, so malicious software and often in the
Speaker 1: form of a trojan, where you trick innocent people into
Speaker 1: installing software that will create a backdoor to their operating system,
Speaker 1: often completely disguised so that it's really really difficult to
Speaker 1: detect the fact that someone has intruded upon your your computer.
Speaker 1: And you do this enough times where you compromise enough
Speaker 1: computers where you can direct all of these computers at
Speaker 1: the same time. You can then send usually a pretty
Speaker 1: simple command to start peppering a target, in this case,
Speaker 1: the company's server, the one the company company that you
Speaker 1: wanted to attack in the first place. And you tell
Speaker 1: all of these computers to start sending thousands upon thousands
Speaker 1: of messages or requests electronic requests to this one company
Speaker 1: server all at the same time, and it just becomes
Speaker 1: a massive attack, and it will eventually, uh either overwhelmed
Speaker 1: the server or I mean, if the if the people
Speaker 1: working at the company are really clever, they may be
Speaker 1: able to uh to get around without it bogging everything
Speaker 1: down for too long. But usually it'll it will at
Speaker 1: least cause some massive headaches for a few hours, which
Speaker 1: is pretty much what happened with the Twitter case. But
Speaker 1: we'll get into that a little bit more later, okay. UM. Yeah,
Speaker 1: And and you know, with these situations, the cys admin,
Speaker 1: the system administrator UM on the receiving end of this,
Speaker 1: by this point, probably woken up at two a m.
Speaker 1: Caffeine free, unshaven and in his jammies somewhere in a
Speaker 1: big room full of machines that aren't working where they're
Speaker 1: supposed to. UM is going to have to try and
Speaker 1: figure out where this is going. Because UM, for a
Speaker 1: distributed denial of service attack to work, it has to
Speaker 1: be targeted at one specific point. That's how it overwhelms
Speaker 1: the server. So UM he or she is going to
Speaker 1: try and figure out what port um that attack is
Speaker 1: coming from is directed toward and shut it down to
Speaker 1: keep the service from being overwhelmed. The thing is that's
Speaker 1: where all the other traffic is going through, the legitimate traffic,
Speaker 1: so UM, you know there there's a problem here. It's
Speaker 1: also got to be rerouted. So you basically have to
Speaker 1: tell the legitimate traffic, Hey, go through this hole in
Speaker 1: our firewall, use this hole to go send messages to
Speaker 1: our server, and we'll send him back through this port.
Speaker 1: And we're not going to tell the guys who are
Speaker 1: sending these uh attacks against us. And sometimes that restore
Speaker 1: service pretty quickly, right, and sometimes it takes hours and
Speaker 1: hours or even days before service returns. Um. Another another
Speaker 1: thing I wanted to point out is to make this
Speaker 1: even more difficult to trace, because I'm sure you can
Speaker 1: imagine if you are being attacked, if your service being
Speaker 1: attacked by a zombie army, you know, you start looking
Speaker 1: at the the the origin of these attacks, you're going
Speaker 1: to find the victimized computers, you're not necessarily going to
Speaker 1: be able to trace it back to the original computer
Speaker 1: the hackers computer. Um to make that even more difficult
Speaker 1: to trace, they can a hacker can use something called reflectors. Now,
Speaker 1: this is really nasty. This it's different. It's different. That's
Speaker 1: good that you have those, because I've seen plenty of
Speaker 1: bikers who have not had those. I'm amazed they're still upright. Um,
Speaker 1: but no, these reflectors are totally different. So let's get
Speaker 1: off that tangent right now. The way this works is
Speaker 1: that the hacker sends a command to the zombie army.
Speaker 1: The zombie armies sending requests to other computers, innocent computers
Speaker 1: that have not been compromised by any sort of malware whatsoever.
Speaker 1: All right, so these are just average servers and computers
Speaker 1: across the net. But what the the zombie computers are
Speaker 1: doing is they're sending it as if the messages were
Speaker 1: coming from the targeted server. So let's use a let's
Speaker 1: use a name. Let's say that it's CNN's server. So
Speaker 1: the the hackerson's the command to his zombie army. The
Speaker 1: zombie army all start sending messages to various computers. Across
Speaker 1: the net as if those messages were coming from CNN.
Speaker 1: All of those computers and servers respond to this request
Speaker 1: by sending data to CNN's server, which of course has
Speaker 1: not set anything out at this point, so it's getting
Speaker 1: responses to messages it has not sent. It gets overwhelmed
Speaker 1: by the traffic and by the fact that it's getting
Speaker 1: responses to something that it didn't even do, and then
Speaker 1: you have your denial of distributed denial of service attack,
Speaker 1: basically using it against itself. Yes, it's it's both really
Speaker 1: clever and really nasty. Yeah, yeah, I would agree with that. Ye. Now,
Speaker 1: there's a couple of different ways you can talk about,
Speaker 1: you know, what you should do in case of a
Speaker 1: denial of service attack, but really the best defense is
Speaker 1: to just practice smart, safe web behaviors, you know, because
Speaker 1: the only way denial of service distributed denial service attacks
Speaker 1: work is for people to download the software that turns
Speaker 1: their computer into a zombie in the first place. Right
Speaker 1: that's true. You you know, you could already have participated
Speaker 1: in one of these, if you've ever had one of these,
Speaker 1: you could be participating in one right now. That's true,
Speaker 1: and you may not even know it. You know, you
Speaker 1: might have a computer that's running a little slowly, but
Speaker 1: otherwise you might not realize it. Yeah, So if you
Speaker 1: if you just practice those safe behaviors, you know, you
Speaker 1: don't don't go to UH just don't click on on
Speaker 1: weird links that you don't recognize. UM. Make sure you
Speaker 1: have good anti virus and anti spywear UH software and
Speaker 1: make sure you're running it regularly and that you keep
Speaker 1: it updated. Make sure that you install patches when you
Speaker 1: get them. A lot of the malware, the way it
Speaker 1: works is that it will target a specific vulnerability that
Speaker 1: a hacker will find out about a specific kind of
Speaker 1: operating system. So let's say you're running Windows Vista and
Speaker 1: there is a known vulnerability. Well, Microsoft is going to
Speaker 1: release patches that patch the security holes on on a
Speaker 1: fairly regular basis, but you have to install them for
Speaker 1: them to work. If you don't update your system, it
Speaker 1: will remain vulnerable. So, I mean, we talk about in
Speaker 1: the office a lot about how annoying it is to
Speaker 1: get system updates that require you to reboot your system,
Speaker 1: and it it takes forever to download them, I mean,
Speaker 1: like yesterday. Yeah. But on the other hand, if it
Speaker 1: means that it prevents your computer from becoming part of
Speaker 1: a zombie army. That's a good thing. So, I mean
Speaker 1: I'm irritated by them too. But so now we we
Speaker 1: talked about the flooding ones, let me just talk a
Speaker 1: little bit about the other kind, which is that's the
Speaker 1: kind that send um an attack that that just sort
Speaker 1: of confuses the computer. Um. That's a it's a really
Speaker 1: a logic or a software attack. And there's several different
Speaker 1: kinds of that as well. And this is just where
Speaker 1: you you come up with a command, uh that gives
Speaker 1: a computer trouble. It just it's not able to try.
Speaker 1: It's not really able to execute the command as um.
Speaker 1: It should be able to. It tries to, but it can't.
Speaker 1: Like when you provide one by zero and it gets
Speaker 1: stuck in an infinite loop something like that, or or
Speaker 1: you ask a robot of paradox and then it explodes. Yes,
Speaker 1: when the owner of the robot finds out right, Yeah,
Speaker 1: I was thinking of the Futurama episode with the Evil
Speaker 1: Santa Claus robot. They say, well, if you if you are,
Speaker 1: if your programmed to kill everyone who's naughty, isn't that naughty?
Speaker 1: And doesn't that mean you should kill yourself, which, by
Speaker 1: the way, is not actually a paradox, but that that's
Speaker 1: what they called it in the episode. Um, but yeah,
Speaker 1: it's the equivalent of that, you're sending a computer a
Speaker 1: a question that it is not able to answer, and
Speaker 1: uh that again, it's one of those things where once
Speaker 1: you realize that this is a problem, you can adjust
Speaker 1: the computer's programming so that it no longer uh has
Speaker 1: that trouble. But you know, you have to you have
Speaker 1: to identify the problem first before you can fix it, obviously, right,
Speaker 1: all right, my therapist tells me that nice. I have
Speaker 1: no response to that. All right, So let's talk about
Speaker 1: the first you heard it here. Let's talk about the
Speaker 1: Twitter attacks, shall we. Okay, so what happened with Twitter?
Speaker 1: And at the time that we're recording this, actually we're
Speaker 1: we've gotten really close between recording and publishing right now,
Speaker 1: so uh, this will go live pretty quickly. But the
Speaker 1: the attack that happened on Twitter, um a while ago,
Speaker 1: in a short while ago, was a kind of denial
Speaker 1: of service attack, and it was interesting because it wasn't
Speaker 1: meant to necess necessarily take down Twitter or Facebook or
Speaker 1: live journal. Live journal was another site that was affected
Speaker 1: by this attack. Um. In fact, this attack was specifically
Speaker 1: targeted at a particular individual yep, a professor in fact,
Speaker 1: um who was sort of providing a place for refugees
Speaker 1: from from the from Georgia, the country, not the state. Um.
Speaker 1: And it was some possibly Russian hackers that that targeted
Speaker 1: this person's accounts and UH as a result, the site
Speaker 1: suffered collateral damage. Twitter the worst of all of them, yep, yep. Well,
Speaker 1: it's just one of those things where they were they
Speaker 1: were trying apparently you know, of course they haven't exactly
Speaker 1: stepped forward and said, yes, we're just trying to get
Speaker 1: this one guy sorry the rest of you, right, um,
Speaker 1: But yeah, they were apparently trying to silence him or
Speaker 1: at least you know, on the web. And UH, in
Speaker 1: the meantime, managed to take down Twitter for several hours,
Speaker 1: not even a fail whale. Yeah, some of us, some
Speaker 1: of us were having difficulty coping that day. A few
Speaker 1: of you, yes, yeah, some of you out there were
Speaker 1: probably having trouble. Um. I was in a corner weeping
Speaker 1: for most of that day for those of us who
Speaker 1: were trying to work. Yeah, I'm sorry about that. Uh,
Speaker 1: the corner being the corner of Chris's desk because you know,
Speaker 1: it's comfy over there. But yeah, it was bad, and
Speaker 1: of course, you know you, you know, you're the first reaction.
Speaker 1: Anyone has a Twitter's down. I should tweet about that.
Speaker 1: Oh wait, I can't lematic. Yeah, there's sort of a
Speaker 1: circular problem there. So the other interesting thing about this
Speaker 1: is that by doing this attack, and by causing all
Speaker 1: this collateral damage, the hacks are pretty much guaranteed that
Speaker 1: way more attention is being directed towards this this person
Speaker 1: they were trying to silence than they had anticipated. And
Speaker 1: uh that may have actually hurt them more than helped them. True. Yeah,
Speaker 1: it sort of makes a digital martyr anyway. Well, and
Speaker 1: and now more people are aware of this person and
Speaker 1: the message that he is trying to to convey. And
Speaker 1: so really it's this was probably well, I mean, it
Speaker 1: was already a bad thing to do, period, but it
Speaker 1: was definitely a mistake on their part. I think so.
Speaker 1: But that's exactly what happened, you know, you have someone
Speaker 1: was using a sledgehammer to take care of a very
Speaker 1: precise problem that they perceived. So fifty bit of alliteration there,
Speaker 1: thank you. I I was not intending to do that,
Speaker 1: but it just kind of happened. So we'll really that's
Speaker 1: pretty much what I have about on denial of service attacks. Yeah,
Speaker 1: it's um it's one of those things that is amazingly simple.
Speaker 1: Yet when you factor in some of the things, like
Speaker 1: you know how to stop them, and uh, you know,
Speaker 1: the different kinds of attacks and some of the nasty
Speaker 1: new twists they're throwing in, you know. I mean, we
Speaker 1: can always hope that as consumers get more savvy about
Speaker 1: computer security that these sort of attacks will decrease in number,
Speaker 1: because again, it does really depend upon uh, the individual
Speaker 1: victims trying to install this code on their computers to
Speaker 1: to make themselves part of the zombie army for it
Speaker 1: to work. The distributed ones anyway, the straight up denial
Speaker 1: of service of course, could be done by anyone. UM,
Speaker 1: and be a computer skeptic, you know, don't just install
Speaker 1: random things that get sent to you from people, even
Speaker 1: from people you trust, because sometimes these programs use their
Speaker 1: email boxes and you know, they go through the contact
Speaker 1: lists and everything to everybody that they know and oh, well, hey,
Speaker 1: you know, if John installed this, then I should too.
Speaker 1: You know, John didn't mean to install that he thought
Speaker 1: it was something else, and so did you. Yeah, it's
Speaker 1: a domino thing, and if one person gets uh, gets compromised,
Speaker 1: then it may may mean that everyone they know then
Speaker 1: follow a suit. And then of course it spreads out
Speaker 1: that you know what that is. That's a web Yeah,
Speaker 1: and it's worldwide or a shampoo commercial. Oh yeah, and
Speaker 1: they called two friends. Um, but yeah, so that's a
Speaker 1: that's denial of service in a nutshell. Uh. I hope
Speaker 1: you guys kind of have a better grip on the concept.
Speaker 1: It's um, it's interesting stuff, and I'm sure it'll be
Speaker 1: a tactic that people use for for years to come
Speaker 1: because there are a lot of people will spare time
Speaker 1: on their hands and chips on their shoulders, and it
Speaker 1: is so innate to the web that it's just it's
Speaker 1: just gonna be one of the first things that people
Speaker 1: try when they want to take down a website. Well, since, uh,
Speaker 1: since we've exhausted that topic, I think it's time for
Speaker 1: just a little more listener man. Then all right, and
Speaker 1: this listener man on me scroll all the way and
Speaker 1: so I can get the name right. Comes from Alan
Speaker 1: from the University of North Carolina, Chapel Hill so a
Speaker 1: tar heel. I guess uh and Alan actually wrote a
Speaker 1: very nice email, very and it was a pretty long one,
Speaker 1: so I'm gonna have to summarize part of it, but
Speaker 1: I'll read the beginning here. Hey guys, First of all,
Speaker 1: I love the show and then listened listened since the beginning,
Speaker 1: Thanks a lot, Alan. I have a minor correction about
Speaker 1: the August fifth podcast on cell phone interference, but it
Speaker 1: has nothing to do with the subject material. Y'all misspoke,
Speaker 1: But putting a the in front of Mayo Clinic. They
Speaker 1: are sticklers up there about it because they feel that
Speaker 1: putting a the diminishes the respect that the name of
Speaker 1: the hospital gives to the founder, Dr Mayo. Leaving it
Speaker 1: as simply Mayo Clinic without any article pays more homage
Speaker 1: to the patient, first staff, second philosophies that Dr mayor Mayo. Sorry, wow,
Speaker 1: I just made it worse made so successful. Well, thanks
Speaker 1: a lot, Allen. Um. I did not know that. I've
Speaker 1: always it as the Mayo Clinic. Yeah, and it kind
Speaker 1: of makes sense that definite article would be in there.
Speaker 1: It kind of makes it makes it weird. It's you know,
Speaker 1: it's one of those things like yourself from the clinic.
Speaker 1: But Alan also had a couple of other little points.
Speaker 1: He had mentioned that he had been in the hospital
Speaker 1: several times and that I have never had a problem
Speaker 1: with any hospital staff about using his cell phone, so
Speaker 1: he wanted to point that out. And he also wanted
Speaker 1: to point out the episode of MythBusters where the MythBusters
Speaker 1: tested the myth about cell phones being dangerous on planes. Now,
Speaker 1: they weren't allowed to take a plane up into the
Speaker 1: air and test their theories, which I mean for obvious reasons,
Speaker 1: because if they were in fact dangerous, you no longer
Speaker 1: have a show true, you have myth busted into tiny,
Speaker 1: tiny pieces. So what they did was they had to
Speaker 1: do all their tests on the ground, but they tried
Speaker 1: to replicate the the as much of the scenario as
Speaker 1: they possibly could, including changing the pressure and all that
Speaker 1: kind of stuff, and they found that there was no
Speaker 1: appreciable um effect on the airplanes systems through any modern
Speaker 1: cell phone. A cell phone and older cellphone might be
Speaker 1: able to cause a little bit of interference, but anything
Speaker 1: within the last five years or so, UM not so much.
Speaker 1: So thanks a lot Allen for pointing that out and
Speaker 1: for promoting one of discovery shows. That was great. We
Speaker 1: didn't have to do it ourselves because Allen did it
Speaker 1: for us. All right, then, if any of you have
Speaker 1: anything you'd like to say to us, you can email us.
Speaker 1: Our email ad us is tech Stuff at how stuff
Speaker 1: works dot com. If you want to learn more about
Speaker 1: computer security, I highly recommend you visit our site how
Speaker 1: stuff works dot com. Crispy and I will talk to
Speaker 1: you again really soon. For moral thiss and thousands of
Speaker 1: other topics. Esit how stuff works dot com and be
Speaker 1: sure to check out the new tech stuff blog now
Speaker 1: on the house stuff Works homepage, brought to you by
Speaker 1: the reinvented two thousand twelve Camry. It's ready, are you