CybersecurityCyberweapon could cause Internet doomsday
Researchers show that an attack by a large botnet — a network of computers infected with software that allows them to be externally controlled — could take down the Internet; the researchers reckon that 250,000 such machines would be enough to do the job; a sustained 20-minute attack by the 250,000-strong army — they will be sending waves of border gateway protocol (BGP) updates to every router in the world — would overwhelm the net, bringing Web servers down by overloading them with traffic
A new cyberweapon could take down the entire Internet — and there is not much that current defenses can do to stop it. So say Max Schuchard at the University of Minnesota in Minneapolis and his colleagues, the masterminds who have created the digital ordnance. Thankfully, they have no intention of destroying the net just yet. Instead, they are suggesting improvements to its defenses.
Schuchard’s new attack pits the structure of the Internet against itself. Hundreds of connection points in the net fall offline every minute, but we do not notice because the net routes around them. It can do this because the smaller networks that make up the Internet, known as autonomous systems, communicate with each other through routers. When a communication path changes, nearby routers inform their neighbors through a system known as the border gateway protocol (BGP). These routers inform other neighbors in turn, eventually spreading knowledge of the new path throughout the internet.
A previously discovered method of attack, dubbed ZMW — after its three creators Zhang, Mao, and Wang, researchers who came up with their version four years ago — disrupts the connection between two routers by interfering with BGP to make it appear that the link is offline. Schuchard and colleagues worked out how to spread this disruption to the entire internet and simulated its effects.
Surgical strike
New Scientist reports that the attack requires a large botnet — a network of computers infected with software that allows them to be externally controlled: Schuchard reckons 250,000 such machines would be enough to take down the Internet. Botnets are often used to perform distributed denial-of-service (DDoS) attacks, which bring Web servers down by overloading them with traffic, but this new line of attack is different.
“Normal DDoS is a hammer; this is more of a scalpel,” says Schuchard. “If you cut in the wrong places then the attack won’t work.”
An attacker deploying the Schuchard cyberweapon would send traffic between computers in their botnet to build a map of the paths between them. Then they would identify a link common to many different paths and launch a ZMW attack to bring it down. Neighboring routers would respond by sending out BGP updates to reroute traffic elsewhere. A short time later, the two sundered routers would reconnect and send out their own BGP updates, upon which attack traffic would start flowing in again, causing them to disconnect once more. This
