Attacking Internet … Hannu H. Kari

1. Attacking Internet … Hannu H. Kari National Defence University professor, research director

2. Technical solutions Solution alternatives Legislations Policies

3. History

4. Technology enhancements ~100+ years (www.daimler.co.uk) (decorateyourgarage.com) (www.macarthurcoal.com.au)

5. Technology enhancements (www.route79.com) (www2.jsonline.com) (www.pennways.com) (www.openfire.us) (www.eia.doe.gov) (en.wikipedia.org)

6. The same thing has happened in Internet in 10…15 years! Technology enhancements

7. Doomsday’s prophecy

8. V. 2003: Increase of garbage The dramatic increase of viruses and junk mail V. 2004: Deterioration of network infrastructure Attacks on infrastructure has increased V. 2005: Manipulation of content Systematic manipulation of content in Internet V. 2006: Internet collapses People and companies do not tolerate any more the load of garbage We don’t trust on the content on the net Malicious attacks on the network infrastructure deteriorate the usability of Internet Internet will cease to be place to make business We go 10...20 years back before the time of computer networks Prediction 28.5.2004:Future does not look very good!

9. What I meant by ”Internet collapses by 2006?” Not a sudden and total breakdown, but more and more problems, e.g.: viruses, junk mail, DoS attacks, network criminals, forged mails/WWW-pages, utilization of vulnerabilities of commercial programs/operating systems, phishing attacks more and more ”protection money” firewalls, virusprotection SW updates, operating system updates, junk-mail filters, backup routes/systems, training unreliability of the network works, doesn’t work, works, ... If your business depends on Internet, you must be prepared Risk for major problems is imminent Internet collapses?

10. YETTS: yhteiskunnan elintärkeät toiminnot tulee turvata kaikissa tilanteissa Myyrmanni, Jokela & Kauhajoki: * syrjäytyminen sisäisen turvallisuutemme suurin uhka * monia ei-toivottuja kehitystrendejä Tarkoituksellisin verkkohyökkäyksin saatetaan heikentää valtion päätöksentekojärjestelmien tai esimerkiksi rahaliikenteen toimivuutta Ikävät tapahtumat tulevat eteemme aina jossain määrin yllätyksenä* varautumisesta ja riskianalyyseista huolimatta. Asymmetrinen maailma, asymmetriset arvot ja motiivit Kaikki uhkat eivät välttämättä tule ulkoa Holmlund: Verkkohyökkäys voi uhata rahaliikennettä {10.11.2008: MPK 187:n avajaiset}

11. Scenario ”20xx”

12. Election in a small EU country a country famous on ICT usage, including electronic voting During the election days, a massive DDoS attack is launched against the election system Electronic voting system is unavailable for several hours As a back up alternative, people will use ”traditional paper voting system” No harm done???? Scenario “3/2011”

13. Report for the Council of Europe: Internet voting in the March 2007 Parliamentary Elections in Estonia Internet attacks, such as DDoS (Distributed Denial of Service) attacks, could have hampered the ability to run the e-voting application. An extension of the e-voting period could potentially make it more difficult to launch such attacks. ... But will anyone really seriously think electronic voting as a viable alternative for paper voting after this??? NO! We have lost the game permanently Scenario “3/2011”

14. Threats

15. 1. We loose our confidence 2. Internet does not work 3. We loose data/money with Internet Main threats of Internet

16. Who and Why? • WHO • Amateurs are just tip of the iceberg • Hackers: Fun, can-I-do-it?, show-up, ... (1, 2) • The real problem: Professionals • Mafia, organized crime (3) • Industrial espionage, competitors (3) • Cyber terrorists (2, 4) • Terrorist-countries (4, 5) • Military (5) WHY Motivations: • Social behavior • Vandalism • Money • Ideology • Military strategic interests

17. Internet problems

18. Security problems in Internet, samples October 2002,Scientific American ”9 out of 13 root DNS –servers were crippled by DDoS attack” January 2005, BBC News ”Internet gambling hit hard by the attacks. Extortionists are targeting net-based betting firms and threatening to cripple their websites with deluges of data unless a ransom is paid.” November 2004, Damages caused by worms/viruses, Mikko Hyppönen/F-Secure Slammer: Intranet of nuclear power plant in Ohio downBank of America ATM network down Blaster: Electric power network down in NY, USA Several SCADA systems down Sasser: All train traffic halted in Australia Two hospitals in Sweden infected September 2006,Scientific American ”Attack on DNS (Domain Name System) allows cybercriminal to hijack ordinary netbanking sessions” January 2007,www.idg.se ”Almost 1 Million € stolen from a Scandinavian bank by a Russian hacker with a trojan distributed with spam mail” ”The biggest so far..” January 2005,FBI/Tsunami ”Net criminals used fake web pages of American Red Cross to get credit card data” May 2007,IT-Viikko ”Attacks on Estonian governmental and commercial net sites”

19. Security problems in Internet, samples DDoS attacks Design flaws DoS, DDoS attacks Criminal intentions DNS attacks Design flaws Viruses, worms, mallware Criminal intentions Phishing Users’ stupidity DoS, DDoS attacks Design flaws Scams Users’ stupidity

20. Why Internet is so buggy?

21. Primary goals Multiplexing of channel Various network archtectures Administrative boundaries Packet switching Gateways (routers) between networks Secondary goals Robustness (loss of routers and links) Multiple services (reliable or realtime data) Usage of various networks Distributed management Cost efficient implementation Simple attachement to network Resource usage monitoring Internet design criterion Based on David D. Clark:”The Design Philosophy of the DARPA Internet Protocols”

22. Silent assumptions Benevolence Openness Low level of dynamicity No mobility Limited computation capacity High cost of crypto algorithms Limited bandwidth Implicit Internet design criterion ASSUMPTIONS NOT VALID ANY MORE !!! STILL VALID, IN SOME CASES !!!

23. Today we have Internal problems Eavesdropping Packet manipulation Privacy problems Viruses Network criminals ... Modern problems

24. Original design principles: The enemy is out there! ”Everybody can send anything to anybody” Security measures are introduced afterwards The new design principles: The enemy is among us! We must be prepared to pay for security/reliability in form of computation power, bandwidth, energy, etc. Strong security as the fundamental building block Legal sanctions against malevolent entities Every packet must have an owner! Internet design flaws

25. Solution alternatives

26. Four security domains 4. Virtual communities(Knowledge sharing) Restricted caller groups 3. Content integrity/authenticity/timelyness(information sharing) PGP, S/MIME 2. End-to-end secured communication(Data integrity and confidentiality) IPsec, TLS 1. Reliable operation of the critical network infrastructure PLA, MPLS, Physical protection

27. Four security domains GOOD “BRAND”MANAGEMENT IS MOST IMPORTANT 4. Virtual communities(Knowledge sharing) Restricted caller groups 3. Content integrity/authenticity/timelyness(information sharing) PGP, S/MIME 2. End-to-end secured communication(Data integrity and confidentiality) IPsec, TLS 1. Reliable operation of the critical network infrastructure Partial solutions: MPLS, Physical protection

28. Info-bulimia Flooding, DoS/DDos, Smurf, Sync, ... Info-anemia Link breakage, data corruption, rerouting packet, router attacks, DNS-attacks, ... We don’t get vital information in time We can’t make decisions or we do decisions with incomplete information Reliably operating network is a MUST Weakest point: Infrastructure

29. Society and warfighting

30. (R)evolution of War Evolution of societies and their relations with war ? AGRARIANSOCIETY INDUSTRIALIZED SOCIETY VALUESOCIETY ? INFORMATIONSOCIETY The war is fought for/with/against the most valuable assets of the society

31. “WAR” and “ENEMY” in the future? The dilemma is that the military have to cope with all the different types of conflict at the same time some of which they are not suited to do. Rhizomethic War Definition of War and Enemy?

32. Managing Military Transformation and Future Soldier unmanned weapon ?

33. 4 Warfighting strata

34. 4 Strata: Physical PHYSICAL AIR GROUND SPACE SEA

35. 4 Strata: Cyber-space PHYSICAL CYBER-SPACE AIR GROUND SEA SPACE ”INTERNET”

36. 4 Strata: Mental PHYSICAL MENTAL CYBER-SPACE OPINIONS TRUST AIR ATTITUDES VALUES GROUND BELIEVES SEA SPACE BRAND ”INTERNET”

37. 4 Strata: Time PHYSICAL TIME MENTAL CYBER-SPACE OPINIONS NOW AIR ATTITUDES 2030 VALUES YESTERDAY GROUND BELIEVES TOMORROW SEA SPACE BRAND ”INTERNET”

38. OODA-loop

39. Decision making based on OODA-loop OODA-loop by Colonel John Boyd Model for human decision making Right information delivered to right place at right time

40. OODA-loop WE Others To protect and speed up To disturb and slow down

41. Attacking decision making process Externalworld Internal decision making Tender points Info bulimia Wrong info Old info Missing info Compromized source of info

42. War of values ORIENT-phase CulturalTraditions DECIDE-phase OBSERVE-phase Analysis & Synthesis GeneticHeritage VALUES Previous experience New information

43. Systems of Systems

44. CAP

45. Management of Information • Consistency(eheys/ajankohtaisuus) • C&A-P • C&P-A • Pick two out of three • (C,A,P)=> 3rd is unmanageable Privacy(yksityisyys) • Availability(saatavuus) • A&P-C

46. NATIONAL DEFENCE UNIVERSITY ”Do the work that has a meaning” Thank you for your Questions? attention!