Taking down the internet in 30 minutes?

----

Quote:

---

They are the elite of hackers, whose notoriety brought them before Congress a year ago.
On May 19, 1998, Sen. Fred Thompson (R-Tenn.) of the Senate Government Affairs Committee asked L0pht members, “I’m informed that you think that within 30 minutes the seven of you could make the Internet unusable for the entire nation. Is that correct?�
“That’s correct,� one L0pht member responded. “It would definitely take a few days for people to figure out what was going on.�
The L0pht’s workspace is not much to look at. There are a lot of circuits, old keyboards and odd tributes to the information age.
What they do is try to break into programs we’re led to believe are secure.

Avoiding Lawsuits
They refer to each other by nicknames. By not revealing their real names, they protect themselves from lawsuits by companies and individuals. They have perfected ways, for example, to crack passwords, those secret letters or numbers we enter assuming they protect our privacy.
When asked how long it would take to crack, one member quickly replied, “minutes … seconds.�
But L0pht doesn’t just “bypass passwords successfully.� On their Web site, they show the world which software has vulnerable security, then they give instructions on how to break in. It’s an open invitation to other hackers. But L0pht says it’s meant to embarrass companies into better protecting our privacy,
“Well, if we can find it,� says Space Rogue of the L0pht, “somebody else can find it.�
Why not just tell the companies that they have a problem?
“We initially tried doing it that way,� says Dr. Mudge of the L0pht. “We’ve found if we don’t take it a step further nobody pays attention to it.�

Creating ‘More Security Breaches’
They accept that they might have created, through their work, more security breaches.
“Sometimes you have to kick up the hornets’ nest a little to get it to settle in a better way,� says Dr. Mudge.
And it usually works. Lotus, which makes a popular office and e-mail program, credits L0pht with flagging a potential security issue in some of its software.
But not all of L0pht’s work is as constructive. Some members of the group claim they can target any computer system and try to shut it down. They say it’s to remind us how we’ve become reliant on computers for more than just communicating; they help run our power systems and are the backbone of the military, two potentially dangerous targets for hackers.
Are they legitimizing destructive behavior?
“We don’t think we are,� Dr. Mudge says. “I don’t know who deserves to get that information. … We don’t suppose to know who the good guys or the bad guys are.
In that same morally ambiguous way, the members of L0pht see what they do as neither good nor bad. More akin to Robin Hood, whose merry band of outlaws used unorthodox ways to help.
“We feel we’re actually making a difference,� says one L0pht member.
But like Robin Hood, one person’s hero, can be another’s rogue

---

Is it physically possiable to bring down the internet in 30 min?

What do you think?

Mudge was the guy who wrote netcat, so I'd be prepared to believe that if it [em]was[/em] possible, he and the rest of l0pht would be the people to do it. Conversley l0pht have never been adverse to publicity of their exploits, and my own view is that this may be case in point.

The internet was designed with the express purpose of enabling communication between points a and c when point b is a smoking pile of rubble. The de-centralised nature of the net would make a system wide hack very difficult.

Therefore what is being discussed here (to bring down the entire internet in 30 mins) is not very likley unless you could identifly points of mutual vulnerability for all of the participating Telcos/network providers. As I said - not very likley. Even an attack on the atlantic pipe would not cut communications via the australasian pipe and visa versa.

Perhaps a combinaton of hacks, aimed at different targets but orchestrated similtaniously and against some very well placed routers... Possible? maybe. Likley? Not really.

Hmm, I'm not sure, but that's mainly because I think on a completely different level than those guys. What's incomprehendable to me, is clear as sky to them, and that's what scares me.

What if they found some bug in widely-used routers? What if they released an undetected worm, making xx % of the computers online a potential DDoS tool? What if they constructed some virus which will spread Ã* la LoveLetter, and deletes all info on the computers it travels through?

Then again, most of those guys are as addicted to the internet as you and me, so they'll probably keep the thing online, if only to feed their addiction :)

Quote:

---

On May 19, 1998, Sen. Fred Thompson (R-Tenn.) of the Senate Government Affairs Committee asked L0pht members, “I’m informed that you think that within 30 minutes the seven of you could make the Internet unusable for the entire nation. Is that correct?�

---

Well, notice the article was from 1998 and from what I know, alot has changed since then. I am doubtful they can do that, and computer security, hacking, and computers in general have changed since 1998.

When the Code Red worm first appeared it just sucked up all the bandwidth on the internet. Logs files blew up to unmanageable levels and CPU usage on servers jumped. I remember we had a lot of customers that were unable to reach our (linux) web servers because of the bandwidth reason. My guess is they would have to go that route to bring down the Internet. I'm sure the idea is being thrown around in some laboratory over in china.

May sound stupid but couldn't it be done by hacking the telco's at the same time and shuting them down? I know there are a lot of telco's but could it be done in that way?

I remember that once some small ISP misconfigured their router so that it believed it served all addresses, and it somehow advertised that, making a big slowdown somewheres.

I agree with ntsa, takeing down the entire Internet would be very unlikely.

The internet is constantly growing ever since it was started in 1969 as the ARPA NET.

With the cisco routers being capable of handleing 320 billion bits of information per second and, when fully loaded with boards, move as many as 60 million packets of data every second.

It would be extreamly dificult, and even then, punishment for even trying such a task would be something of high order.

And as mentioned why would they take down the net when they spend their days and evenings online and have become a net adict.

Mudge & co. are masters of self promotion. If they thought you'd believe it, they'd tell you all about how they could fly and walk through walls. I'm not saying that they don't have some "skillz" but the main one is their nose for creating hype. Like ntsa pointed out, the 'net is designed to be resistant to any one thing crippling it. Even as far back as the gulf war, the US couldn't shut down the Iraqi command network by Physically blowing the crap out of their routers. This is 10 years later. With the diversity of proocols and OS's running the 'net today, and the octopus-like network of redundant routes, there is no way to kill it. This isn't 1988, there are more'n 3 OS/architectures and a few thousand machines online, so I don't worry about the next Morris worm. Netcat (created by Hobbit of l0pht, I believe) may be a great tool, mostly for its practicallity, but is more a product of good common sense and need then ev0l h4x0r genius.

One thing you must keep in mind is who they were talking to. Congress isn't exactly the most technically knowlegable group.

There are not as oceanic pipelines between continents as you could think.
Some good attacks on strategical points could probably stop those comunications and isolate us in several areas.
If we add the attempts to try again and again to comunicate in different ways, + the panic of users. It could paralyze Internet easily.

I don't want to prognosticate consequencies on economy and armies movements but it could be disastrous.

OK kisscool, I'll bite. Exactly how would you go about paralyzing the internet??

I don't know how practically (I don't plan to attack the world :)) but in theory we could imaginate a lot of scenarii with different ways:
- DDOS attack really really well prepared (I don't believe it could work), maybe manipulating some panic movements.
- using various vulnerabilities with viruses specifically designed (mmh).
- a better method would be to gain access to each strategical points one after one, hiding the access and starting the global attack when all is prepared.
....

The preparation would be the key, but it's true the more easy would be to have physical access to installations and cables (army is probably already ready to do a such thing).

KissCool -> If I'm right this has something to do with "percolation" or better it hasn't but it has... ;) Percolation is about transition phases and maximum tresholds in an infinfite network model. But the internet is infinite therefor it's possible to calculate how many points you need to disable to bring it down. But if you talk about "the internet" even when it are only 2 remaining computers, you should take out that last connection too. So theoreticly and correct speaking would mean disable all network traffic. offcourse we do not mean that here. You mean the net like we now it today with today's importance and traffic. Well for this network you can calculate how many points should been destroyed / disabled to lower bandwidth significantly therefor the net losing its meaning. This would be the critical point.

Talking about critical points... hmm like said above the internet is designed from ARPA net, a military decentralized network capable to survive even if many points were / are lost. The network needs to reach a critical point, this is called "Phase transition" in physics, when such higher number of points are lost the whole network goes down. Try to calculate this for the internet and you will know what effort it would take. ;)

the scientific approach:

Percolation theory
from http://ist-socrates.berkeley.edu/~jq...00000000000000

http://ist-socrates.berkeley.edu/~jqwu/paper1/gif/1.gif

Quote:

---

The basic idea of percolation is the existence of a sharp transition at which the long-range connectivity of the system disappears(or, going the other way, appears). This transition occurs abruptly when some generalized density in this system reaches a critical value(percolation threshold).

---

from http://ist-socrates.berkeley.edu/~jq...00000000000000

The Critical Point

Quote:

---

You will investigate how the probability of a site matrix having a spanning cluster depends on the site occupation probability p. Site percolation is an example of a critical phenomenon. There is a special value of p, called the critical site occupation probability pc, such that for p < pc spanning clusters never occur. While for p > pc they always occur. The case p=pc is called a critical point.

---

from: http://www.anu.edu.au/Physics/course...rcolation.html

More about critical points:

Quote:

---

Critical Points

At critical points a qualitative transition in the behaviour of a system occurs: typically between ordered and disordered states. In our case the transition is from no spanning clusters to always spanning clusters.

Such qualitative changes are known as phase transitions. Examples are the freezing of water and demagnetisation of a ferromagnet at the Curie temperature. Strictly, critical points only exist for infinite systems. For finite systems, like we will investigate using the computer, the transition is not sharp but smeared out over a parameter range.

Percolation models are good physical descriptions of many phenomena, especially in condensed matter physics. Examples are discussed by R. Zallen in his book "The Physics of Amorphous Solids".

---

from http://www.anu.edu.au/Physics/courses/CP/critmore.html

Ok kiss. l0pht(@stake, whoever they are now) claim they could do it in 30 minutes. How do you like their odds. It's BS pure and simple

I don't speack about attacking the decentralized system itself but the points (like pipelines under oceans) where the comunications are less decentralized (if you wanted to stop an army during the medieval age, destroying the bridges was a good idea).
The threat is primarily to isolate large areas. After, it is not impossible that panics movements (not only informatical, the phenomenon of all the people using telephone after a disaster is well known and can block all the lines) and multiplication of attempts to continue normally with the pipelines which work again could provocate more problems.


-----
For your question DoktorFoobar: the global attack could perhaps be done in 30 min but I think they would have to works months and months before to prepare all (the famous method: you crack, you hide, and you'll use it on the future).

Ok Ok I see what you mean, but still... They are talking about attacking w/ software not blowing up installations. There isn't like one cable connecting the Americas and Europe that is the nerve center of the net. It may be possible, with much effort, to temporarily slow down a goodly percentge of long-distance packet travel, but I think even that much would be a prodigious effort, and would only be quickly rectified. tcpip is designed for exactly this contingency. Don't believe the hype.

Well, I for one think it is very possible to cut off the net in under 30 mins. Without going into to much detail:

The internet is based on routers basicly taking a packet, and moving it along its way to its destination. There are many different speed pipes of varying bandwidth. If you wanted to take out a bridge, building, dam, whatever. You always go for the main thing holding it up. So in this case they would go after the main pipes that are owned by various telephone corps, ie.. At&T, MCI, Sprint, etc... and other make backbones of the net. There are DRDoS styles of attacks that will be able to tie up these various backbones and routers till they are full. Once they are full the main normal internet traffic will seek other lowerband routers. So in the second phase of attack you go towards the routers etc.. that are just below the main backbones. Once again doing a simultaneous DRDoS attack on those points would fill them up quickly. Now the traffic will be force to tunnel through lower-band routers etc.. virtualy overloading them. They would't be able to handle the loads and would virtually cause a domino effect of the routers going down, one overloading after the other. Once all the lowerband routers have been taken out, then you unlock the mid-band routers, all the while still tying up the main backbones. When you unlock the mid-band, instantly in one big brunt they will have to take on the entire nets routing. That would overload them. In the final phase you would open the main backbones. Now, they are very powerful, but without the support of the smaller channels, like the capillaries of the human bodies blood system, the main body will fail.


Now, how would these be done? Thru a style of DoS attack, you can use a spoofed ip and send that to a list of routers, say 5000 different routers, that will all be sent to the main routers. without giving to many details, you would be using routers to attack other routers.

IMO, yes it can be done. Although it would take a masive 20 or 30 server WAN system working together to have enough impact. But it can be done.

There is no way a typical internet user could take down the internet in 30 minutes. It's basicaly impossible. L0pht is just trying to make people aware of how insecure the internet really is. " IMO, yes it can be done. Although it would take a masive 20 or 30 server WAN system working together to have enough impact. But it can be done." If you can arrange this, and I don't believe anyone could, it might be possible, but I'm talking about the average user. Yes the as we know it internet can be taken down there's no questions about it. It's been done before. But there's no way it can be done in 30 minutes or less. Kisscool had a good point with attacking oceanic pipelines, maybe a terrorist attack, but that would just slow down the internet. There are still satalites and I believe there are several pipes going across the Atlantic and the Pacific so destroying 1 TPC pipe would do little damage. The only true way the average user could take out the entire internet is with a worm like codered. It would take "me" months to code (or alter around previously written source code "script kiddy") a worm like that. It would have to be able to mutate on its own, and it would have to be timed to "go off" months after it was initialy released into the world, just to make sure almost every major server is infected. When these computers are taken out then major websites would be gone, like google or lycos, atms would stop working, those credit card scanners at Stop and Shop would break down and the civilized world would basicaly fall into chaos.


end of rant....

To me, the easiest way to really take the Net down is to go after the DNS.....take that out and you cut off a pile of people quick

I suggest that the question posed was not that the Internet would be brought down, but that the Internet would be unusable for the United States to varying degrees.

(quote)
I’m informed that you think that within 30 minutes the seven of you could make the Internet unusable for the entire nation. Is that correct?� (/quote)

Remember, the Internet encompasses the whole planet, and I don’t believe they could bring it all down in 30 min. There are several areas that would be considered the weaker links in the Internet, such as the Telcos themselves. These buildings house local area connections for voice and data, and these signals are passed on to another CO. they eventually reach various communication backbones. From these backbones, they go to smaller and smaller CO’s until they reach the local neighborhood box where the card for your phone connection to your house is. IF something were to happen to a large number of CO’s at one time, what this could be I don’t know, there would be a significant loss of connectivity.

Just some food for thought, I am sure someone could come up with a scenario that would actually look feasible.

IMHO, it could be done, through a worm/DDoS like attack. If you look out how severe the code red worm or nimda hit the internet (i still see hundreds of these a day) and then think about what would happen if someone was a little more malicious, you could have a serious problem on your hands. For example, what if some type of sadmind/code red/slapper/nimda (translation, multi-platform, multi-vulnerability) like worm were to propogate relatively slowly (at least not as obviously bandwidth consuming as nimda/code red) and then have some kind of a preconfigured payload day of a certain time GMT, where the infected machines begin to probe every IP on the internet (starting at different locations, kind of reminds me of the lawnmower man where all the phones in the world rang at once) as fast as possible (increasing propogation and consumption of bandwidth)...The bandwidth usage would be outrageous.

It may even be more lethal if you were to couple in some precanned attacks on other popular needed services, like email or DNS. Won't take much of the infrastructure down, but it would sure make it slow so as to be unusable.

Neb

I agree that the average computer user simply would not have the power to do so. But in this, the information cyberwarfare era, it would be very easy, again very easy, for a country such as china or korea, iraq, iran, etc to pull this off. The initial planning for the attack would take several months because they would have to make a list of virtually every single router in the united states. Once that is complete they would have to set up the list of routers, devide the list into major pipes, middle pipes, and small pipes. Once thats done they would take each list, and upload it in notepad form to each one of the servers on their WAN. There is a type of attack where you spoof your IP to that of the victim. Then you send out a SYN packet to a particualr router, and that router sends a SYN-ACK to the target. When the target recieves it, the router will not get a responce, so the default is to send the packet 3 more times (4 in all). Now if you send this one packet, through a list of routers, say 1000 routers, that target will recieve 4000 packets.

Now, If you make that target IP the IP of the router, you will have the routers attacking other routers and tying them up. Now figure how many routers there are in the world, and how many pipeline routers there are in the US. The initial attack will put the worlds routers all against the major pipelines in the US. This will tie them up. . Now once the major pipes are tied up, the US's traffic, and the incoming traffic from the world will be diverted to the middle pipes. This will put a strain on them already. Once they are tied up you send the second wave of the attack. This will target the already straining middle pipes, tying them up furthur, which will divert all the traffic to the small pipes. These small pipes are not designed to handle all this traffic, and will cause a domino effect of samller routers going down, until all of them are down.

Internet is now unaccesible, but not destroyed. You would then untie the middle routers and all the traffic would flood them, without the help of the small routers, the same would happen to them. Finally you unlease the entire internet's traffic onto the main pipes. Which will tie them up and it would virtually be impossible to get anything through.

So there you have it.

Lets not forget that the internet uses a mesh topology and router are capable of selecting the best route for data. I think the best you could do is take out a few back bones and split the internet into several large chunks.

Yes xmadness: Iraq, Korea, etc over several months. L0pht over several minutes? This is a snow job pure and simple.

It was said that if apocolyps came, the internet would be the only thing to survive.

If you would like to see the DNS Root Name Server Query Response Time Graphs, they can be seen at the following site.
http://www.cymru.com/DNS/dns.html
Information, about the whereabouts of these servers can be found on this page or by following the links on it.
I was amazed at how much information is readily available on these servers considering how important they are to the internet.

I think maybe with a few thousand l337 h4x0rs acting as one it could be done in under 30 minutes, otherwise it would take days and weeks of planning/preperation, then an hour or so to make it happen, if you cut off access to a few hundred key servers it would create mass panic and the internet would revert to an ancient form, however as the internet was designed to last through nuclear war, it will most likely never fail, no matter how hard poeople try. Besides, why would anyone addicted enough to computers and the internet want to destroy the very entities which they thrive on?