The Macrosite for News, Analysis and Opinion about the Future of the Internet
Comments
Current display:       newest comments first       chronological order   threaded
Page 1 of 2   Next >
Mashka
Researcher
Wednesday January 23, 2013 11:30:55 AM
no ratings

Sometimes, people just do not know what to do with what they can do. It looks like kids behaviour- ok, we  have done it, what's next? Eeh, have no idea,that's why lets show eveyone our buttocks-what a fun.

I see this situation like this

Kim Davis
Thinkernetter
Tuesday January 22, 2013 2:42:29 PM
no ratings

That's an excellent question, Mashka.  The disruption was limited, nothing was stolen.  Are they just flexing their muscles to deter more exploits like Stuxnet?

Mashka
Researcher
Saturday January 19, 2013 6:22:44 AM
no ratings

Kim,  is it more psychological reason to do that or some practical  meaning?

What's the point for Iran to block  work of USA Banks- to show something like" we are so cool hackers that we can do that?"

Kim Davis
Thinkernetter
Friday January 11, 2013 10:57:49 AM
no ratings

On your specific points, we certainly have reports saying things like: "the recent attacks showed a level of sophistication far beyond that of amateur hackers."

Radware, the security company investigating on behalf of some of the banks, has said:

"The scale, the scope and the effectiveness of these attacks have been unprecedented. There have never been this many financial institutions under this much duress."

More from Radware's Herberger on the cloud angle:

Experts also say the attackers have infected varied cloud computing facilities with a malicious program dubbed Itsoknoproblembro, which can mask the source of the volleys. Attackers have used the bot to commandeer armies of servers that can flood banks' websites with a digital tsunami. "You have an artillery piece instead of a pea shooter," Herberger said.

Herberger says the perpetrators have exploited the trend in which banks and other companies lease processing power and software from remote servers. The result is that banks and cloud computing facilities become intertwined electronically, which can complicate a bank's ability to simply block data from particular Internet addresses when the bank comes under cyberattack. "There's a lot of brilliance in how the 'bro bot has been conceived and executed," Herberger said. Banks have "to figure out what is legitimate traffic versus illegitimate traffic."

 

Kim Davis
Thinkernetter
Friday January 11, 2013 10:47:36 AM
no ratings

You raise some interesting points, Kenton, although I honestly think you're problem is with the original reporting rather than my commentary.  I was fairly careful:

Iran has reportedly launched a series of attacks on US banks, raising dire implications not just for geopolitics, but also for cloud security...

Today, the New York Times is reporting that unnamed "government officials" are saying the attacks are the work of Iran, "most likely in retaliation for economic sanctions and online attacks by the United States." A former official, and security expert, James A. Lewis, has said there is "no doubt within the U.S. government that Iran is behind these attacks."

Now, of course, the government officials may be mistaken, or may be lying for some reason, but it's fairly unlikely that what they are saying has been misreported.  (The story went around the Internet, and there haven't been any denials from the US government.)

 

kenton
IQ Crew
Thursday January 10, 2013 5:28:44 PM
no ratings

"a potential nation-state enemy was disrupting networks by accessing cloud computing centers"

There's where I have a problem with the article. If you had changed "was" to "could be" I likely wouldn't have stopped to question it. No one has come out with any kind of proof that this is a nation state. In fact, many people have come out and said that it could easily be done by a "hacker" group. I've done a bunch of reading on it this afternoon and here is the only thing I can find as a common thread:

Someone (or a group) has compromised a few servers in data centers with high bandwidth and pointed them at bank websites.

No where have I read anything to support it being cloud infrastructure (vs. a few data centers). No where have I read any evidence that it is nation-state sponsored. No where have I read that it was a super sophisticated attack.

I have read a whole lot of; "un-named sources", "not enough understanding", "could be", etc. I've also read that CloudFlare sees attacks of 60Gb/sec on a monthly basis. That the software doesn't require root/administrator privileges opening it up to a huge variety of potential exploit vectors (Ruby on Rails anyone?). I also found that for a few hundred bucks I could rent enough servers to easily push out this kind of bandwidth.

I have no doubt that attacks like this will increase, nor that there could be nation states that will take advantage of the opportunity to hijack large swaths of bandwidth. I just think that you've tried to prove your stance by using a bunch of media hype rather than actual facts. That's very atypical of your articles.

Kim Davis
Thinkernetter
Thursday January 10, 2013 3:49:49 PM
no ratings

The thud to which I referred is the realization that a potential nation-state enemy was disrupting networks by accessing cloud computing centers.  I had identified cloud security and cyberwar as the two big threats which never fully materialized in 2012.

I was wrong: in fact, before the end of the year, they had come together in a very threatening way.

Bringing down bank customer-facing bank websites may be no more than an inconvenience, but what other capabilities might the intruder's have?

kenton
IQ Crew
Thursday January 10, 2013 12:20:35 PM
no ratings

Kim, while most people use their bank's website to interact with them, it isn't the only way. If I can't get through to the bank website to transfer my money, I can either walk across the street or pick up the phone. It isn't like the website that I connect to is the one that is handling all of the internal and inter-bank functions. Is it awkward and an inconvenience? Sure, but it isn't going to stop people from spending money nor banks from doing business.
Again, maybe it's that Im misunderstanding things, and I'll go read the NYT article, but I'm not so sure why this is seen as such a "thud".

Kim Davis
Thinkernetter
Thursday January 10, 2013 12:08:08 PM
no ratings

Not sure if I understand you correctly, Kenton, but if DDOS attacks could bring down banking websites for extended periods, that would surely be disruptive to the banking system.

Kim Davis
Thinkernetter
Thursday January 10, 2013 12:06:51 PM
no ratings

The New York Times published the newsworthy detail that officials are saying Iran is responsible.  Now whether you believe the officials or not is another question, but generally speaking the Times can be relied on to report what they are saying accurately.

The details of the exploit were actually revealed a few months ago, but kept a low profile, partly because nothing was stolen, partly because there was no suggestion of nation state involvement.  See, for example, the article I linked to: "Recent Bank Cyber Attacks Originated From Hacked Data Centers, Not Large Botnet".

The majority of the banking attack traffic does not appear to have been generated by client bots, but rather from compromised servers in data centers...

See also Bloomberg.

Page 1 of 2   Next >


The ThinkerNet does not reflect the views of TechWeb. The ThinkerNet is an informal means of communication to members and visitors of the Internet Evolution site. Individual authors are chosen by Internet Evolution to blog. Neither Internet Evolution nor TechWeb assume responsibility for comments, claims, or opinions made by authors and ThinkerNet bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.
a moderated blogosphere of internet experts
Mary E. Shacklett
Social media has been with us for a decade -- but employer policies and the law are anything but firm about the most appropriate usage of this powerful tool.
Dan Cypra
Dan Cypra   5/23/2013   31 comments
Businesses often struggle to decide which domain to use. When it comes to purchasing a domain name, you have plenty of extensions to choose from, ranging from .com and .net, to .me, and even .mobi. But which one should you pick?
Matt Heusser
Matt Heusser   5/23/2013   13 comments
I've been writing about how the next evolution of the Internet might just be an advertising revolution, and how corporate IT can stay involved as the enablers and providers of the technologies that make this possible.
David Weldon
David Weldon   5/22/2013   15 comments
In the 1970 science fiction thriller Colossus: The Forbin Project, two giant supercomputers from the United States and Soviet Union secretly join forces to take control of the collective nuclear might of the two countries. In the film, the two machines discover each other's existence, communicate back-and-forth, share their collective data, and cut their human creators out of the process. It is the ultimate example of machine-to-machine communications, or M2M.
IETV: the thinkerNet on film
5
of
Kim Davis
Big-Data Can’t Always Sell Wine

5|21|13   |   2:23   |   4 comments


Whole Foods Global Wine Purchaser Doug Bell told me about some of the constraints on using analytics in the US wine market.
Paul J. Fleuranges
Digital Signage Keeps NYC Subway Straphangers on Track

5|6|13   |   3:51   |   No comments


New York's Metropolitan Transit Authority is conducting a pilot test of digital kiosks to guide subway users to where they want to go more efficiently and at lower cost.
Kim Davis
Fast Forward to the Future

4|23|13   |   2:29   |   20 comments


A look back at tech writing in the 90s makes us wonder where enterprise IT will be 20 years from now.
Mitch Wagner
Google Launches Its Most Depressing Service Yet

4|15|13   |   2:59   |   10 comments


Google's new Inactive Account Manager lets you control how Google disposes of your accounts when you die.
Second Shooter
Argument Over Top-Level Domains Is 'Stupid'

4|11|13   |   2:07   |   3 comments


The whole Amazon.reader debate is a double-stupid. It's stupid to think that there's any e-book buyer who doesn't know Amazon's URL, and it was stupider to let ICANN launch the whole free-form TLD initiative to start with.
Kim Davis
Ladies, Your Tablet Awaits

3|21|13   |   2:22   |   37 comments


ePad Femme is the world’s first tablet “made exclusively for women.”
Wisdom of the Big Chair
NFC Moves Into the Mainstream

3|20|13   |   2:16   |   No comments


While NFC's original goal was to enhance mobile commerce applications, it is finding its way into a number of other uses, which is creating both opportunity as well as challenges for IT departments.
Wisdom of the Big Chair
Integrating Security Into Your Cloud Contract

3|19|13   |   3:35   |   No comments


Enterprises would like to move to cloud computing but are hesitant because they are concerned about providers’ ability to secure company data. Here are some tips that help to ensure that if breaches occur, the business is not left holding the bag.
Brian Baron
How Edmunds.com Collects Customer Information

3|18|13   |   1:15   |   No comments


Edmunds separates customers into segments based on the info it collects on its site and from partners, and uses that to push out custom content, said Brian Baron, director of business analytics for Edmunds.com, at Predictive Analytics Innovation Summit.
Brian Baron
How Edmunds.com Uses Analytics to Customize Site

3|14|13   |   0:47   |   No comments


The automotive website uses propensity modeling to target ads and customer registration forms, said Brian Baron, director of business analytics for Edmunds.com, at Predictive Analytics Innovation Summit.
an IBM information resource
sponsored content
big blue blog
an IBM information resource
sponsored content
Expert Integrated Systems: Changing the Experience & Economics of IT
In this e-book, we take an in-depth look at these expert integrated systems -- what they are, how they work, and how they have the potential to help CIOs achieve dramatic savings while restoring IT's role as business innovator.

READ THIS eBOOK
your weekly update of news, analysis, and
opinion from Internet Evolution - FREE!

REGISTER HERE
Wanted! Site Moderators
Internet Evolution is looking for a handful of readers to help moderate the message boards on our site – as well as engaging in high-IQ conversation with the industry mavens on our thinkerNet blogosphere. The job comes with various perks, bags of kudos, and GIANT bragging rights. Interested?

Please email: moderators@internetevolution.com
Internet Evolution – not for thickies
Keep Critical Data With a Knowledge Management System
Taimoor Zubair
Fortune 500 companies lose at least
$31.5 billion a year by failing to share knowledge. A Knowledge Management System (KMS) can help companies significantly reduce these costs.

CLICK FOR MORE
M2M: Rise of the Machines? Not Yet
David Weldon
In the 1970 science fiction thriller
Colossus: The Forbin Project, two giant supercomputers from the United States and Soviet Union secretly join forces to take control of the collective nuclear might of the two countries. In the film, the two machines discover each other's existence, communicate back-and-forth, share their collective data, and cut their human creators out of the process. It is the ultimate example of machine-to-machine communications, or M2M.

CLICK FOR MORE
M2M: Rise of the Machines? Not Yet
David Weldon
In the 1970 science fiction thriller
Colossus: The Forbin Project, two giant supercomputers from the United States and Soviet Union secretly join forces to take control of the collective nuclear might of the two countries. In the film, the two machines discover each other's existence, communicate back-and-forth, share their collective data, and cut their human creators out of the process. It is the ultimate example of machine-to-machine communications, or M2M.

CLICK FOR MORE