Computer Question

[RBB]

Where I get to my point in a round-about way...

I was born in 1953. That makes me a lot older than I used to be. The thought of being pre anything is surprising to me, but I'm definitely pre-computer age - at least pre PC computer.

In college, one of my friends got some kind of degree in computers. I remember him bringing me into the "computer room" at the college and showing me this behemoth which was able to add 2+2 or some such childish feat, and (I was) thinking, "What in the world do you see in this?"

I ran into him just recently. He works for a large corporation. He told me the newest college grad he hires knows more about computers than he can ever hope to learn, but because he was one of the first to get involved with computers - they all call him boss.

Yesterday I read an article about an April Fools virus where millions of computers may be infected with this virus which may make them - oh I forget the word - some kind of slave computers to who ever hacked this up to begin with. The virus was not activated on April Fools Day - like the experts thought it would be, but it may be activated soon. One "expert" said "This hacker or hackers have been very smart up to now, why would they start it up on April 1st - which is an obvious date?"

My question, for the computer experts among you - How bad could it be if the internet was entirely compromised? Please conjecture. If the entire net went down, what would it effect and what could we expect?

[Ken]

ENTIRELY COMPROMISED??? Wow. Well, first kiss your electric service goodbye - at least a few nuclear plants may go critical as well. Same goes for cable T.V., satellite communications, and, obviously, the internet itself. Your personal computer files may well be gone or corrupted by the time it's fixed. Your bank accounts may be drained, and forget about that tax refund you were expecting. Don't expect to use your ATM or credit cards. Stock markets will be closed as will banks. Mass communiations will be virtually shut down. Grocery and department stores will be ringing up your orders on adding machines as long as the food supply holds out - don't expect resupplies to arrive any time soon. Mail delivery will be even slower than it now, though you may not notice. Traffic controls will go haywire on most major city roads and in the air as well. Expect your flight to be cancelled. Most railroad and commercial marine traffic is managed by computers also. Don't forget your roadmap - no more G.P.S.

National security files will be compromised as will national security itself. The military depends on computers for everything. Police and public safety forces rely on networks every second of the day. Don't waste your time calling 911. Oh, don't waste your time trying to call anyone else either, 'cause your home phone and cell phone will be useless.

Don't get sick or injured. Medical services will be delayed and your records may not be available.

And that's just the tip of the iceberg.....

Don't think of it as being like life in 1900. You would WISH life was like it was back then. The delivery of goods and services in 1900 didn't rely on the internet. Society today is almost entirely dependent on computers to function, and most systems are tied into the internet and therefore vulnerable to compromise themselves.

Any act which would entirely compromise the internet would be nothing less than a major act of war.

[Rick]

Life as you know it would cease. At least in the short term. Virtually everything you do in terms of commerce, utilities, transportation, medical and web communication would be gone. Hardly any aspect of our lives are not touched by the internet whether we have access to it or not. Stores restock via the internet, banks clear checks and transfer funds via internet, electric companies buy and sell electricity and route the same via internet and telephone (land line and wireless) utilize the internet for all their data transmission.

So it would be a big deal. If your assumption is it never comes back up then there are probably enough of us old codgers around that know how it used to work in the "old days" that we cold bring the various systems back up and operational....in time. But it would be a colossal change.

Read the book "The Machine Stops" by E.M. Forster. He speculated the end of the world by similar means. Once mechanization stops, we cease according to him. He wrote it in 1909!

[Alpine_Sapper]

My question, for the computer experts among you - How bad could it be if the internet was entirely compromised? Please conjecture. If the entire net went down, what would it effect and what could we expect?

Lovely grim scenario. While it is possible, it is SOOOOO improbably you'd be better off worrying about nuclear strikes. There are a lot of crafty crackers and virus writers, cyber criminals, whatever you want to call 'em. There are also a lot of guys in my line of work standing in their way, just like cops and street thugs. While I'm down in the trenches, there are security researchers thwarting these guys all the time. Are they able to circumvent the security measures? Sure. It's a constant cycle. We prevent, they circumvent, we stop them, ensure they can't do it again, and the cycle restarts.

But the whole premise the internet was founded on back in the days of ARPANet when they came up with the packet switching network was that there could not be a single point of failure. A completely redundnant network, so that no matter what, you can get your data through. While that vision has not been totally implemented, the only way you'll lose the internet is if there is a total power outage. You may not be able to get to a certain location reliably, like when the trans-atlantic cable was cut recently, but if you really need to get the data through, you can.

As for what it would effect, the previous posts hit it right on the head. But like I said, there are much better things you can waste energy worrying about, like planes falling out of the sky on your head, than the internet going away. If it does, get ready for army's of zombies walking the streets. That odd twitching in their thumbs? Residual habitual behaviour from texting or playing video games.

[Rick]

When 911 happened and the towers collapsed, we had an office across the street that housed one of our server farms. Unfortunately, it served Wall Street. The damage to both hardware and cabling was catastrophic. Everyone has seen the pictures. The servers were removed, cleaned, reprogrammed and reinstalled in temporary quarters served by cables laying in the street. All that came back on line mere minutes before Wall Street opened for business. No one, not even the perpetrators were aware of how close it was to ecommerce coming to a halt. Could it happen? You bet. Do we know how to make repairs in record time? Yes.

Most major companies have established disaster recovery programs in place. They pay companies like Microsoft, IBM and Sun a premium to "Hot Ship" products. As an example, if I have signed a hot ship agreement with IBM that means if I lose a mainframe then IBM will ship me their next available unit. It might be sitting on the dock ready to ship out to you but I get it. OR..the next one manufactured goes to me if one isn't on the dock. It's part of a much broader disaster recovery/business continuity program that most major corporations have in place. All designed to prevent the scenario you describe.

[Alpine_Sapper]

When 911 happened and the towers collapsed, we had an office across the street that housed one of our server farms. Unfortunately, it served Wall Street. The damage to both hardware and cabling was catastrophic. Everyone has seen the pictures. The servers were removed, cleaned, reprogrammed and reinstalled in temporary quarters served by cables laying in the street. All that came back on line mere minutes before Wall Street opened for business. No one, not even the perpetrators were aware of how close it was to ecommerce coming to a halt. Could it happen? You bet. Do we know how to make repairs in record time? Yes.

Most major companies have established disaster recovery programs in place. They pay companies like Microsoft, IBM and Sun a premium to "Hot Ship" products. As an example, if I have signed a hot ship agreement with IBM that means if I lose a mainframe then IBM will ship me their next available unit. It might be sitting on the dock ready to ship out to you but I get it. OR..the next one manufactured goes to me if one isn't on the dock. It's part of a much broader disaster recovery/business continuity program that most major corporations have in place. All designed to prevent the scenario you describe.

That, and the major companies are geographically dispersed anyway. For example, I used to work for a company that had 8 MAJOR datacenters in 4 countries. So if you hosted with us, whether you used our equipment or colo'ed your own, you could have a server farm in DFW, TX, and redundant failover solution in LA, CA, and a third tertiary solution in Chicago. If you were an international customer? Put up a config in London, one in China, and another in the US. With a little creativity, you can set that config up to be totally redundant and AUTOMATICALLY failover if there is an issue. And with "cloud computing" (the new industry buzzword) it's all dispersed across clusters of farms anyway, already geographically diversified. They'd have to take down the WHOLE infrastructure to really take you offline. Makes DDoS's harder to execute, etc. etc. Now, if they can just get cloud computing so that it is in line with PCI or HIPPA compliance, we can move forward like an express train.

[doren]

I work for Kroger so I can tell you how my store and most in the company function. Do we use the Internet for day to day operations? Yes, but it is not critical for the stability of the company. Most of our corporate information transfers are done through dial up off the net. Even if the phone systems went down our servers can store data without need for data transfer for months. So as long as we still have power the stores will still be open.

For Kroger, If we had power, but no Internet, you would be looking at a 5-10% loss in productivity. Sure it hurts, but not enough to close stores over.

[Rick]

Yep. We had data centers in Ft. Wayne, Indiana, Silver Springs, Md, Tampa, Fl. and San Angelo, Tx.

We performed quarterly DR tests and were contracted to a hot site in Philly. We picked a date/time and flew a full copy of our backup tapes to Philly and brought them up on line to test recovery. So even if one of our data centers got squashed we could put it back on line in a day or two at the hot site. We performed an autopsy on every test to determine what went wrong and what areas of improvement could be added. Interesting job.

As I said, we did that test 4 times a year. Outages are a constant threat but not having the capability to recovery is not an option.

[Rick]

Doren - That's interesting. We also had dial up to our servers for a long time but we eventually removed them so hackers "could not" access them. It was a real pain to loose remote connectivity but it did provide another layer of security.

Even if you have dial up capability, you are still accessing over the public switched network which uses the internet. So even dial up could be interrupted depending on the distance your dialed call travels. Local, EAS and some LD calls would be intact but long haul ran across our backbone and unless we could re-route traffic to other cable/microwave/satellite facilities there would still be an impact.

[Scoobywan]

Makes you wonder why...

if conficker opens up all sorts of security vulnerabilities on an infected system, why not just write a "good virus" to use those holes to go in and clean the infected systems. It could in theory work mostly the same way conficker does, but instead of searching for systems to infect, i could search for infected systems to clean. We are in a spot when it comes to legal systems (both government and corporate) that makes the virus writers have the upper hand. A virus writer doesn't worry about the legalities of infecting millions of systems, but in order to start cleaning infected systems you have to go through mountains of paperwork. I say, write a cleaner virus, set it loose, and watch the guy that wrote the original virus get sloppy and get caught due to the attack the human ego. This is either a really smart idea, or a really dumb one... I'll let you guys tell me which

[Alpine_Sapper]

*shrug* they already do something similar to this. All OS'es have an update function. If you have WUS turned on for automatic updates, you probably already have the patches for conficker and the Microsoft Malicious software removal utility has probably already cleaned your system. Updated antivirus signatures, updated anti-spy/malware databases and a valid tool to use them, and an updated firewall with a valid ruleset should keep you safe, as long as you don't go clicky-clicky on teh pr0n too much. However, there are a lot of systems that people just install the OS, bring it online with an always on connection, and then go surf whatever site they feel like, exposing them to every piece of malicious code in the book. They don't bother to patch the OS to the latest hardening level because it's too much work, too many reboots, or they just don't know they are supposed to.

Ignorance is bliss, your box is a zombie in a botnet. Welcome to the Internet.

I saw statistics 3-4 years ago where a couple SecResearchers put some unpatched windows desktop machines on the network without a firewall. All of the machines were compromised fully and under someone else's control (via a automated script) in less than 20 minutes.

However, as far as writing a virus to clean a virus? roflmao.

You can't even disclose a vulnerability you found to the people who wrote the software without being persecuted nowadays, which is why many security researchers turn to full disclosure. Also the reason the crackers subscribe to the same 0 day vulnerability lists the Admins do.

[bulrush]

I'm a computer programmer and have been using the internet since 1987, before the World Wide Web existed. Let me try to clear things up.

ENTIRELY COMPROMISED??? Wow. Well, first kiss your electric service goodbye - at least a few nuclear plants may go critical as well.

Only things attached to the internet would be affected. As a critical service, nuclear power plant control systems are NOT connected to the internet, though some personal computers in the plant would be. If THAT PC is then connected to the power plant control system, then we might have a problem. But the power plant will not likely be compromised.

Same goes for cable T.V., satellite communications, and, obviously, the internet itself.

Again, only if those computers were physically (I mean via a land line or wireless line) hooked to the internet.

Your personal computer files may well be gone or corrupted by the time it's fixed.

True, if your own PC was turned on AND connected to the internet. The virus is software and needs a powered up computer to do its work.

Your bank accounts may be drained, and forget about that tax refund you were expecting. Don't expect to use your ATM or credit cards. Stock markets will be closed as will banks. Mass communiations will be virtually shut down. Grocery and department stores will be ringing up your orders on adding machines as long as the food supply holds out - don't expect resupplies to arrive any time soon. Mail delivery will be even slower than it now, though you may not notice.

I seriously doubt many traffic control computers are hooked to the internet. That hardware is so ancient, some of it is still from the 1930's in large cities, that it is wholly incompatible with the internet hookup hardware. I admit that somewhere in Europe (Finland?) someone hacked a digital road sign, but that's only because the sign was brand new, and was compatible with some type of wireless LAN device. The road crew simply didn't change the default password, and the hackers simply looked up the default password on the mfrs website.

As far as bank accounts being drained, the hacker would have to have your account number, and your password, and the bank would have to offer online services, in order for them to do damage. But, hackers have hacked into banks before, though the banks try to keep it quiet.

Traffic controls will go haywire on most major city roads and in the air as well. Expect your flight to be cancelled. Most railroad and commercial marine traffic is managed by computers also. Don't forget your roadmap - no more G.P.S.

GPS signals come from satellites which are generally not connected to the internet.

National security files will be compromised as will national security itself. The military depends on computers for everything. Police and public safety forces rely on networks every second of the day. Don't waste your time calling 911. Oh, don't waste your time trying to call anyone else either, 'cause your home phone and cell phone will be useless.

Don't get sick or injured. Medical services will be delayed and your records may not be available.

Doctors and ERs will not deny service just because their computers are down. They will do the best they can without their records, and will rely on YOU to report any and all medications you are taking, so they don't prescribe something that will kill you.

Ken is mostly right, IF the service is connected to the internet. However, really old systems, or critical systems, are simply not internet compatible.

Your safest bet is to power off your computer and unplug the internet cord (whether it's DSL, cable, wireless, dial-up, or something else). Your next safest bet is to install a firewall (some are free) and run it while you are hooked up to the internet. It will prevent unauthorized connections to your PC.

[Alpine_Sapper]

Actually, the road sign incident happened in Austin. Twice. And yes, that was because some idiot forgot to secure physical access to the machine and failed to set, not change, a default password. No big shock.

However, as for the systems you refer not being directly connected to the internet, well, I'll just say it's amazing what a network scanner can turn up.

[bulrush]

Oh yeah. Programmers can capture the virus code itself, and look for a date. If there was really a date in the virus, that's why they might have mentioned April 1. If not, then it was the media simply making things up.

[bulrush]

Actually, the road sign incident happened in Austin. Twice. And yes, that was because some idiot forgot to secure physical access to the machine and failed to set, not change, a default password. No big shock.

It happened in Europe too. The perp put a picture of himself on the sign.

However, as for the systems you refer not being directly connected to the internet, well, I'll just say it's amazing what a network scanner can turn up.

True. But how do you know what mailing address the actual PC is at? The IP should resolve to the mailing address of the person/company who owns the IP, and that would be the same address of the user's PC ONLY if the user had the same physical address as the person who registered the IP.

For example, I work in west Michigan, but my work PC IP resolves to Chicago in a WHOIS lookup. My company downs the domain my IP is a part of, yet my company address does not appear in the WHOIS lookup. Why is that?

[Alpine_Sapper]

Oh yeah. Programmers can capture the virus code itself, and look for a date. If there was really a date in the virus, that's why they might have mentioned April 1. If not, then it was the media simply making things up.

If you read about what's going on with confickr, there's all kinds of questions regarding it in the media, but, it's because the security researchers who are reverse engineering it don't really know what it's going to do yet. It's using a scripting language (probably TCL) to recieve communications from the botnet controller, most likely checking in with an IRC server. However, as the code has undergone several revision on the fly while running rampant in "the wild", no one can really predict what is coming next. All they can do is put a preventative plan in place and sit back and watch.

[Rick]

Those guys have invested quite a bit in time and resources. I can't imagine that there isn't a payoff at the end of this rainbow. I'd be far more concerned about ecommerce with this one.

[Alpine_Sapper]

It happened in Europe too. The perp put a picture of himself on the sign.


However, as for the systems you refer not being directly connected to the internet, well, I'll just say it's amazing what a network scanner can turn up.
True. But how do you know what mailing address the actual PC is at? The IP should resolve to the mailing address of the person/company who owns the IP, and that would be the same address of the user's PC ONLY if the user had the same physical address as the person who registered the IP.

For example, I work in west Michigan, but my work PC IP resolves to Chicago in a WHOIS lookup. My company downs the domain my IP is a part of, yet my company address does not appear in the WHOIS lookup. Why is that?

I'm not saying it didn't happen in Europe. All I was saying is that it's happened here domestically quite a bit. Austin's zombie messages were just one example, and that even after it happened, the hole was STILL not secured.

What WHOIS reports, and the physical address of a machine, is irrelevant. What is relevant is how the system identifies itself once you connect. If I access an IP and I get "San Antonio Metropolitan Traffic Control System" as a banner, with the standard "Unauthorized Access Prohibited" blurb, and I can find a vulnerability to let me in (or not) I don't care what the physical address of the machine is. I'm also savvy enough to tell the difference between a desktop and a server. I've been doing this a little longer than you have, and from a networking standpoint, as well as OS administration and hacking out lines of code. It doesn't even matter to me if you are in west Michigan. If I can pwn your box, I'm now connected to the network legitimately and have as much access as your workstation does to launch further deeper penetrating attacks.

You can agree with me or not, you can believe me about what I say or not. All I'll say in regards to the above is that I do penetration testing and vulnerability scanning daily as part of my job requirement. I also do data forensics on NT and *nix systems. I'm certified in what I do as well, and I damn sure didn't test king my certs.

[Gray Wolf]

Zone Labs (Zone Alarm) has a free firewall. Also if you want to see if all major software you have is up to date with patches, here is a outstanding site that has a free scan. I'm sure bulrush is very familiar with this site. It stays on top of all the vulnerabilities.

http://secunia.com/

[Scoobywan]

for the geeks in the group...

http://mtc.sri.com/Conficker/
An Analysis of Conficker

http://mtc.sri.com/Conficker/addendumC/