Science & technology | Cyber-security

Crash testing

Recent attacks on the internet could be a prelude to far worse ones

“SOMEONE is learning how to take down the internet.” This was the headline of a blog post Bruce Schneier, a noted cyber-security expert, wrote in mid-September. It looked prescient when, on October 21st, Dynamic Network Services (Dyn), a firm that is part of the internet-address system, was disrupted by what is called a “distributed denial of service” (DDoS) attack. (Essentially, a DDoS floods servers with requests until they can no longer cope.) For hours, hundreds of sites were hard to reach, including those of Netflix, PayPal and Twitter.

The attack on Dyn was only the latest in a string of similar ones. On September 20th, for instance, the victim was Brian Krebs, an American journalist who often reports on internet criminals. The server where he hosts his blog became the target of one of the largest DDoS attacks on record (it was bombarded with data equivalent to almost half a percent of the internet’s entire capacity). Most of the other recent digital assaults, however, were more discerning—as if the attacker “were looking for the exact point of failure,” Mr Schneier wrote in his blog post.

It is not clear who the attackers are, although security analysts suspect they are either Chinese or Russian. At any rate, all the attacks used the same software, called Mirai, whose source code has been leaked online. It mainly scours the internet for devices such as webcams, digital video recorders and home routers in which easy-to-guess factory-set passwords (“12345” or even “password”) have not been changed. The program then turns those it can gain access to into a huge army of digital slaves that can be directed to inundate targets with requests. Shortly after the attack on Dyn, XiongMai Technologies, one of the biggest makers of webcam components, announced it would recall some products and provide owners of others with software updates to improve security.

This may help, but not much can be done in the short run other than to appeal to owners of internet-connected devices to change their passwords. To fix the problem properly, Mr Krebs argued in a blog post, the makers of such devices, collectively called the “internet of things” (IoT), would all have to recall vulnerable systems and change their careless approach to security. Since this is unlikely to happen, regulators may have to step in. Indeed, the European Commission is already working on legislation to require better security in IoT devices. Lawsuits against negligent device-makers would also help.

As for the goal of the attacks, it could be something other than to take down the internet. Many fret that such virtual weapons could be turned to full blast just before or on November 8th, when America will elect a new president and House of Representatives, and also many senators and state governors. A DDoS could not paralyse voting machines, for hardly any of them are connected to the internet. But striking all kinds of websites, from those of online media to the government’s, could spread chaos—and the feeling that the elections are somehow being “rigged”.

This article appeared in the Science & technology section of the print edition under the headline "Crash testing"

Liberty moves north: Canada’s example to the world

From the October 29th 2016 edition

Discover stories from this section and more in the list of contents

Explore the edition

Discover more

Antarctica, Earth’s largest refrigerator, is defrosting

The world must pay more attention to its southern pole

Killer whales deploy brutal, co-ordinated attacks when hunting

Their techniques are passed down through the generations


A new generation of music-making algorithms is here

Their most useful application may lie in helping human composers