Theoretical Question: Attacking the Backbone

Forgive me if it's a dumb question, as I'm trying to come up with better stuff to throw out there with my threads. :) So, hope I can spawn a somewhat fun conversation with this one. That said --

During my MIS courses in college, a class or two I took briefly hit upon the Internet concept of the "backbone". Despite prodding one of my professors on the matter, I don't think I ever fully got it. From what I understand, the backbone basically consists of the servers that make up the very foundation of the Internet as a whole. I have trouble swallowing that though as it seems most unfeasible today. Back in the days of ARPANet, sure, you could trace everything back to a handful of servers, but what about today?

The question resurfaced in my head as I was reading one of Tony Bradley's tutorials a few minutes ago, where he briefly mentions the modern day backbone of the Internet:

Quote:

---

The largest ISP's own the major conduits of the Internet referred to as the "backbone".

---

So, in other words, there are still a group of servers spread across the planet that, more or less, are the core of the Internet? I'm sure that even still those servers are in massive numbers and widely spread out, but at the same time there are few enough that, if an entire ISP went down, the entire Internet would potentially feel the blow, so it seems to have been suggested here:

Quote:

---

If something happens to one of the companies...that make up the backbone...it can affect huge portions of the Internet because a great many smaller ISP's that utilize that portion of the backbone will be affected.

---

Ok, so let's talk hypothetical situation then. Let's say we've got a terrorist hacker who wants cause some widespread havoc. If, however unlikely to be successful, he were to bring down one or more major ISP's (especially the latter), what ramifications would that have for the Internet as a whole? Something only to be found in a Tom Clancy novel, or something perhaps remotely possible?

from IP network view, no. You cant bring Internet down attacking, i.e., US backbone (old arpa). For example, if U.S. backdone is down, i (from Brazil) can still access servers on Europe (cause South america has a path direct to Europe) and so on. However, It will severe impact user at USA, since most ISP rely on core. ATT, for instance, route their customers thru a "private" core until near the target and "there" packet re-enter on "internet network".
From dns view, you can attack . servers, but they are well replicated all over the world, so if you bring some down, you can only cause some slowness on network.
You can do a big mess however attacking inter continental conections. That you cause a lot of trouble. However, i cant imagine a flood attack against that channels. Maybe a physical attak to installations, but....
Ahn, you cant bring U.S. military down that way. they have their own links :). they are smart enough to dont rely on comercial links..

The U.S. Military is a joke, I won't even talk about how stupid they do somethings.

Now as a note, you need to know other things first. You need to know about the routers, that control most of the trafic on the net. You also need to know about DNS servers.

If someone was stupid enough to try to drop the net, it could probably be done by hitting a main router.

I would go into a little more detail, but I don't really feel like explaining a lot of things. That and I am in a bit of a rush.

Here is a link with some physical map of some of the major players.

http://www.nthelp.com/maps.htm


Here is one as well w/some more detailed and several different ways of explaing. Most European.

http://www.cybergeography.org/atlas/isp_maps.html

Quote:

---

Internet backbone
This superfast network spanning the world from one major metropolitan area to another is provided by a handful of national Internet service providers (ISPs). These organizations (including Net 99 and Alternet) use connections running at approximately 45 mbps (T3 lines) linked up at specified interconnection points called national access points (which are located in major metropolitan areas). Local ISPs connect to this backbone through routers so that data can be carried though the backbone to its destination.

---

This is from CNET.



Still looking for more. I know somewhere in a book of mine I have an explanation that broke it down very well.

hjack

nice links hjack.
Angelic, as you can see, due to a lot of redundancy and providers, you need to have a lot of power to brind down enough links to shut internet down (USA thinking only).
Take a look at some Europe countries backbone structure and you will see that some of them have "star" structure that can be attacked.
But the problem is allways:
You need more power (throughput) than the core to bring it down. However "legs" of network arent large enough to achieve it.
I think that nowadays the only attack that can be done (and its being done) is to "flood" entire network with a kind of trojan or something that replicate itself.
Like Netsky virus for example.
I believe this year someone will create a plague that will spread (thru e-mail or other media like dns functions) that will cause a crash on internet.

Very interesting stuff, thanks guys.

Yeah, it just left me a bit curious, especially with cyberterrorism being a serious concern now. So theoretically, it's somewhat possible, but practically unprobable. Should be interesting to see if that "internet plague" actually comes to pass...wouldn't be surprising at this point.

to the best of my knowledge (im at work now so cant verify) there are 13 root name servers around the world. there exact locations are not given and they reside in fortified structures. so yes the core of the internet does consist of a small number of servers

13? If you find your source on that when you get a chance, that'd be worth sharing.

The 13 main root DNS servers

http://www.root-servers.org/

Attacking the backbone could be done a number of different ways...

DNS was mentioned and has already been done. It took out several of the root dns servers IIRC.

http://searchsecurity.techtarget.com...859083,00.html

Also, the backbone routers could be attacked.
http://arstechnica.com/news/posts/1082490095.html

The pipes are so large that I'd probably be very difficult to flood the pipes...

This is interesting:

Quote:

---

Julian: There are two sides to that issue. On the one hand, there are limitations to attacks on DNS servers, as they are very distributed. It would take an eight- or nine-hour attack [Monday's lasted only an hour] for Internet users to see noticeable impacts.

But on the other hand, attacks on DNS servers aren't a pretty scenario. If a more sophisticated attack [than Monday's] were run for a day, then we'd have a big problem on our hands.

---

Of course, that was a 2002 article. I wonder how much has changed since then?

So does that mean every IP address on the Internet is traced back, eventually, to one of the 13?

Quote:

---

Originally posted here by AngelicKnight
This is interesting:



Of course, that was a 2002 article. I wonder how much has changed since then?

So does that mean every IP address on the Internet is traced back, eventually, to one of the 13?

---

The primary function of " root nameservers" is providing down level name server information.
IP's and their distribution / allocation are un-related to that purpose.

Angelic, those 13 are used to resolve top-down dns requests. they are called dot servers (or root servers) ,because they resolve requests like: "who is resolving .com domain? who is resolving .fr domain?" and so on.
but although they are primary root servers, they have tons of replicas around the world.
you can see those ip address browsing dns servers .txt files --> they are listed there.

Quote:

---

Originally posted here by AngelicKnight
13? If you find your source on that when you get a chance, that'd be worth sharing.

---

I did fnd this.

Quote:

---

Attack on domain name servers fails
October 23rd, 2002
By Robert Lemos, CNET News.com

An assault on all 13 domain-name service root servers attempts to shut down the address books of the Internet. An attempt to cripple the computers that serve as the address books for the Internet failed on Monday.

The so-called distributed denial-of-service attack leveled a barrage of data at the 13 domain-name service root servers beginning around 1 pm PDT on Monday and apparently is ongoing, according to Internet performance measurement company Matrix NetSystems. Traffic from several Internet service providers have been slightly delayed, but because the domain name system is spread out and because the 13 root servers are the last resort for address searches, the attack had almost no effect on the Internet itself.

source: http://www.whois.sc/news/2002-10/root-attack.html

---

Kinda the same theroy

-Breeze

The easiest way bring down a large part of the net would be a physical attack. I would be willing to bet if someone did a study on it, that would be the best chance of success on taking down anything. It would take almost more zombies than what exist to flood the pipes of the root servers... They increased the pipes after those 2 of them went down a while back.

I think it would be a lot easier for a terroist to hijack a gas truck from phillips 66 and find the location of a backbone router or one of the 13 root servers and drive into it and blow the thing to crap, even though it might take 30 trucks or so. I think that would be easier for them to pull off compared to filling the pipes.

If I recall correctly there is an (for the US) and East Coast and a west coast central switching hub, (i think AT&T operate them) where various ISP's terminate. So taking down those puppies would cause some problems. I think the fear with the recent BGP exploits was that they could take down a large chunk of the routers out there (of which there are some core ones that were identified in a study, I`ll try to remember which one), so that would take out the backbone.

Outside the US you then have the various large POP's, such as the one in Canary Wharf (London) which went down the other year due to a power cut and took out half of the UK net.

I agree with Grunt, a phsyical attack would be the easiest (?) to do and would not be remediated by simply patching some network devices.

Beyond physical attacks I think an attack on the routing backbone would be the way to go, taking out the DNS servers is going to stop www.yahoo.com from resolving, but traffic will still get through as the IPs are still up. Maybe some kind of funky packet attack that worked on all network devices would be the way to go...I have toyed around with a few ideas on this.

I've seen multiple drops from backbones in the last couple of years. they only seemed to affect certian areas or certian ISP's. All it takes is one unaware backhoe worker to have admins screaming and cussing about a "fibercut" except for that one that happen out in the ocean. That one cause aultrailia to be cut off from the states.Could you imagine the look on that network techs face when they handded him wet suit and pointed him twards a boat.

Talking about net disasters... someone knows how many of the intercontinental links are by satellite? I don't know if major part of them are by satellite or by cable, but if they are by satellite a magnetic storm coming form the sun (or some kind of EP device) will be a big trouble!! :eek:

take a look at this site: http://www.cybergeography.org/atlas/cables.html
You can see tons of maps, including intercontinental links.
the Majority of connections are thru undersea cables (most fiber now). Satelite links are still too expensive for primary intercontinental backbones, although some isps have "contigency" links thru satellites.
Some Sun activities can impact satellite operations (in fact they cause - every satellite link experience at least some minutes/year shutdown due to Sun activity).
But like a Sun EM pulse that fryes satellite... i dont have enough information about those Sun tempest to see if that is probable. Maybe Some kind of massive radiation from Sun -- but it will fry us all too.. so, i dont bother about that :)
But there is EMP weapons in use (USA has) to affect eletronic devices of the enemy...
its better to have concern about humans (wars) that about natural causes....

Very interesting link. .. :D

I agree with you that we have to concern more about human activities than the natural ones.

I'm not an expert but i think that it could be an EP coming from the sun, powerfull enogh to fry all the satellites but not humans... EP has no effects ins "biological circuits" and we are bellow the atmosphere too...

If the EP kill the same satellites than humans, we will not to have worried about it! :D The trouble is be alive but unconnected! ;)

indeed. i cant imagine one day without internet. a couple of months ago, my home adsl link stopped for 8 hours and i got crazy!. and 10 minutes down at service drive me nuts..
we are really internet adict (and AO too:P)

Sunspots can fry satellites and communication disruption via flares is common, extremely common. Anyone who operates a international communications system like a phone company or ISP keeps track of sunspot activity and the military issues a daily forcast of the electromagnetic spectum That possibility and the fact that running a fiber for 10 thousand miles is actually cheaper than launching a sat, just like cacosapo mentioned. In addition satelite contingency links would be like putting the continent on 56k dialup (in relative terms). And only critical subscribers would get access I bet. It's not even a fraction of the bandwidth. Fiber links terminate at specific locations and even though multiple links exist, any one of those would cause serious issues. For instance Guam and Hawaii are both international sort of fiber exchanges for Asia. The cables hover a few hundred feet below the surface, they just float there and maintenance ships come along and scoop them up and run them through that hull to maintain and check them. I have talked to both engineers and service ship personal over many beers, plus I dove down just to look at one and see what it looked like outside of a contained facility. In this instance it was owned by ATT. A major fiber cut is only a few hours down time assuming someone doesn't set up a military perimiter around it. But given the backup capability of the US military command and control structure, it would be stupid to cut them. The terrorist or who ever does the deed will lose their own command structure and would have to resort to key word commands on Arabic television, but that may be out as well. Just a different take. :)

Looks like my theoretical question wasn't as far fetched as I thought it might be. This is a little different, but --

Quote:

---

The attack on DoubleClick is another sign that attackers are beginning to target key Internet pressure points that -- when squeezed -- darken the Internet
for most users, said Johannes Ullrich, chief technology officer for the SANS Institute's Internet Storm Center.

"The hackers don't need to attack the Internet. If you attack Akamai or DoubleClick you can take out 95 percent of what most people consider to be the
Internet," Ullrich said.

---

SOURCE

Yeap, you can cause damage if shutdown key places, like Google, Yahoo, MS.
regular ppl, without those places, will think that internet is down...

BTW, this kind of action has best results on USA, since americans are kind of "freak" about attacks. Anything attack (even localized ones) causes big sensation and everybody starts to scream....

You kind of get that way when the heart of your country is attacked and destroyed. :) Makes you think what if they take out my main busness hub? What then. I bet Manhatten was without internet and telephone for months outside of very key busness structures.

I was thinking "smaller" that your examples RoadClosed :)

Shutting down phones or internet on an area like that can be considered a "massive" attack.

I was referring to a smaller attack that can cause the same effect.

I dont think that "google" is the"heart" of USA.... or even is a critical service...
but ppl will scream on streets if someone put it down....

<mental image>

"AAAAAAAAAAAHHHH!!! Google's down! The end is here!!"