How to bring the Internet down - guaranteed ! Instructions included ...

Well, looks like we can forget scenarios whereby the internet is brought to it's knees by using viruses such as STUXNET or by the government having access to some kind of internet killer switch ... we now have researchers claiming to have identified a sure fire method for crashing the entire global internet system and bypassing virtually every current defense protocol being used.

Seems all it would take would be a 250,000 strong botnet attack.

Source: How to crash the Internet 101

A new cyberweapon could take down the entire internet – and there's not much that current defences can do to stop it. So say Max Schuchard at the University of Minnesota in Minneapolis and his colleagues, the masterminds who have created the digital ordnance.

Schuchard's new attack pits the structure of the internet against itself. Hundreds of connection points in the net fall offline every minute, but we don't notice because the net routes around them. It can do this because the smaller networks that make up the internet, known as autonomous systems, communicate with each other through routers. When a communication path changes, nearby routers inform their neighbours through a system known as the border gateway protocol (BGP). These routers inform other neighbours in turn, eventually spreading knowledge of the new path throughout the internet.

A previously discovered method of attack, dubbed ZMW – after its three creators Zhang, Mao and Wang, researchers in the US who came up with their version four years ago – disrupts the connection between two routers by interfering with BGP to make it appear that the link is offline. Schuchard and colleagues worked out how to spread this disruption to the entire internet and simulated its effects.

Surgical strike

The attack requires a large botnet – a network of computers infected with software that allows them to be externally controlled: Schuchard reckons 250,000 such machines would be enough to take down the internet. Botnets are often used to perform distributed denial-of-service (DDoS) attacks, which bring web servers down by overloading them with traffic, but this new line of attack is different.

"Normal DDoS is a hammer; this is more of a scalpel," says Schuchard. "If you cut in the wrong places then the attack won't work."

An attacker deploying the Schuchard cyberweapon would send traffic between computers in their botnet to build a map of the paths between them. Then they would identify a link common to many different paths and launch a ZMW attack to bring it down. Neighbouring routers would respond by sending out BGP updates to reroute traffic elsewhere. A short time later, the two sundered routers would reconnect and send out their own BGP updates, upon which attack traffic would start flowing in again, causing them to disconnect once more. This cycle would repeat, with the single breaking and reforming link sending out waves of BGP updates to every router on the internet. Eventually each router in the world would be receiving more updates than it could handle – after 20 minutes of attacking, a queue requiring 100 minutes of processing would have built up.

Clearly, that's a problem. "Routers under extreme computational load tend to do funny things," says Schuchard. With every router in the world preoccupied, natural routing outages wouldn't be fixed, and eventually the internet would be so full of holes that communication would become impossible. Shuchard thinks it would take days to recover.

"Once this attack got launched, it wouldn't be solved by technical means, but by network operators actually talking to each other," he says. Each autonomous system would have to be taken down and rebooted to clear the BGP backlog.

Meltdown not expected

So is internet meltdown now inevitable? Perhaps not. The attack is unlikely to be launched by malicious hackers, because mapping the network to find a target link is a highly technical task, and anyone with a large enough botnet is more likely to be renting it out for a profit.

An alternative scenario would be the nuclear option in a full-blown cyberwar – the last resort in retaliation to other forms of cyberattack. A nation state could pull up the digital drawbridge by adjusting its BGP to disconnect from the internet, just as Egypt did two weeks ago. An agent in another country could then launch the attack, bringing down the internet while preserving the attacking nation's internal network.

Sitting duck

Whoever launched the attack, there's little we could do about it. Schuchard's simulation shows that existing fail-safes built into BGP do little to protect against his attack – they weren't designed to. One solution is to send BGP updates via a separate network from other data, but this is impractical as it would essentially involve building a shadow internet.

Another is to alter the BGP system to assume that links never go down, but this change would have to be made by at least 10 per cent of all autonomous systems on the internet, according to the researchers' model, and would require network operators to monitor the health of connections in other ways. Schuchard says that convincing enough independent operators to make the change could be difficult.

"Nobody knows if it's possible to bring down the global internet routing system," says Mark Handley, an expert in networked systems at University College London. He suggests that the attack could cause "significant disruption" to the internet, with an effect greater than the Slammer worm of 2003, but it is unlikely to bring the whole thing down.

"The simulations in the paper make a lot of simplifying assumptions, which is necessary to simulate on this scale," he explains. "I doubt the internet would behave as described."

In the final analysis, the theory and method appears to be sound but will any nefarious hacker (or hackers) out there have the balls to make the "real world" attempt.

Dang, this is some pretty heavy stuff. I wonder when someone, or some group will do this. Im my opinion, now that the general public knows how to do this, it will eventually be done just to see if it is true.

reply to post by tauristercus


Interesting ,,,Should we ATS members give it a try? For the sake of experimental science of course.

It would be a bummer if it couldn't be turned back on though. Just have read books and mail letters again.

Originally posted by ReVoLuTiOn76
Dang, this is some pretty heavy stuff. I wonder when someone, or some group will do this. Im my opinion, now that the general public knows how to do this, it will eventually be done just to see if it is true.

I'm in complete agreement with you.

Now that the "cats out of the bag" and truthfully, given the resources, there are in all likelihood many "groups" around the world who'd most likely be capable of pulling it off.

If it can be done (and now it seems it's very feasible), then someone, somewhere, sometime will most likely attempt it.

Wow - just wow !!!!

It's long been realized that the global internet framework is a hodge-podge of hardware and software thats riddled with numerous exploitable security holes - but never would I have believed that it potentially had such a major Achille's Heel.

Now we just have to wait for the inevitable when some one tries it out

well at least we got a way to bring down skynet.

you probably could do this with a virus. just make a virus that infects 250,000 computers and program it with a trigger which will then DDOS from every computer thats infected. I'm not sure hackers would want to do this though because then they would destroy their playground and actually have to go outside for once in their lives.

I have an even faster way to bring down the internet. Target all utilities, no power, no internet except for the smart souls who have a backup source of electricity. Utility companies are more compliant with government orders than are ISPs, always follow the Hamiltonian for the Energy, ie the path of least resistance.

Originally posted by THE_PROFESSIONAL
I have an even faster way to bring down the internet. Target all utilities, no power, no internet except for the smart souls who have a backup source of electricity. Utility companies are more compliant with government orders than are ISPs, always follow the Hamiltonian for the Energy, ie the path of least resistance.

Nah. All sites are equipped with DC power plants and backup generators. Even if you cut commercial power, site will run no matter what.

This could work. But the attack would have to be well coordinated. As routers come under attack, some will send out distress signals. The statement that its a scalpel and requires precession is an understatement.
I am not saying it could not happen at all. Just saying it would require a different approach on implementation.