4 ms·

Let me guess. Instead of thinking how to solve this on protocol level the solution is to use more Google services. Reading. ... Yep. The article even includes

Let me guess. Instead of thinking how to solve this on protocol level the solution is to use more Google services. Reading. ... Yep. The article even includes the obligatory "try harder" bit about security.

freehunter 6y ago
Exactly right. Security has been on a path of “layer more complexity over inherently insecure protocols” and it’s not going to stop any time soon because selling more products/services is worth too much money. There’s a lot of work and very little money in replacing outdated networking protocols with smarter/more secure protocols. And there’s very little punishment (from customers or regulators) for suffering from massive cyber attacks, even if you expose the sensitive information of people who never even chose to give you their information (like Equifax). There’s no punishment or reputational damages from having your network traffic rerouted from a BGP attack. The consumer pays all the cost and they don’t even change their behavior after paying that cost, so why would companies bother? Normally this is a situation where governments would step in and protect their citizens, but... well there’s just too much money on the line. So the programmers get the blame and the customers pay the price and security vendors make another $100 million and we do it all over again next month.
- gambler 6y ago
  I get the feeling the government will step in and regulate soon: https://www.atlanticcouncil.org/programs/scowcroft-center-for-strategy-and-security/cyber-statecraft-initiative/breaking-trust/ https://www.atlanticcouncil.org/programs/scowcroft-center-fo...
viraptor 6y ago
What's your proposed idea at the protocol level which solves the "I'll just saturate your pipe with garbage packets" case? That was the Mirai problem and I can't imagine a protocol solution. These are real, fully controlled endpoints. Even when we have solutions to some issues (authenticated BGP), people don't implement it and there's nothing Google can really do about that. (Apart from not accepting traffic from those ASes?)
- Nextgrid 6y ago
  Make it harder to generate garbage packets? BCP38 on the ISP side would solve IP spoofing and UDP reflection attacks. Stronger liability laws for both ISPs and end-users who deliberately expose vulnerable systems to the internet would help too.
  - viraptor 6y ago
    2 issues: I mentioned Mirai which was not spoofed or reflected - just lots of devices and real sources. Garbage traffic as in something you didn't request. And the liability may work in one country, but you can't put a liability on ISPs internationally. Unless you want to end up in a situation where the US tells China their ISP is liable for spam traffic and hear that a US ISP is liable for traffic deemed illegal by the party. Anything but dumb pipes is going to be extremely complicated internationally.
    - Nextgrid 6y ago
      > just lots of devices and real sources. Lots of devices deployed by someone, set up by someone, and someone is paying the internet bill for those devices to be online. Maybe the ISP should be talking to that someone, even in an automated way where vulnerability scanners cut off their access and they need to manually re-enable it after having disconnected the offending device? > US tells China their ISP is liable for spam traffic I think most countries would agree that certain behaviors are undesirable. The damage & waste of time caused by spam and malware transcends political and religious opinions for example. The solution doesn't have to be a legal liability per-se, simply a code of conduct that all ISPs agree to and anyone found to be in breach will get cut off by the others. They're not necessarily on the wrong side of the law, but for all intents and purposes their business is done because nobody will peer with them.
      - viraptor 6y ago
        > cut off their access and they need to manually re-enable it after having disconnected the offending device? Sure. That's a possible meatspace solution and was used by some providers. It's not a protocol level solution though. > simply a code of conduct that all ISPs agree to and anyone found to be in breach will get cut off by the others Totally. Same thing could be applied to phone spam. It seems that nobody's that interested in it though.

freehunter 6y ago

Exactly right. Security has been on a path of “layer more complexity over inherently insecure protocols” and it’s not going to stop any time soon because selling more products/services is worth too much money. There’s a lot of work and very little money in replacing outdated networking protocols with smarter/more secure protocols. And there’s very little punishment (from customers or regulators) for suffering from massive cyber attacks, even if you expose the sensitive information of people who never even chose to give you their information (like Equifax). There’s no punishment or reputational damages from having your network traffic rerouted from a BGP attack. The consumer pays all the cost and they don’t even change their behavior after paying that cost, so why would companies bother? Normally this is a situation where governments would step in and protect their citizens, but... well there’s just too much money on the line. So the programmers get the blame and the customers pay the price and security vendors make another $100 million and we do it all over again next month.

gambler 6y ago
I get the feeling the government will step in and regulate soon: https://www.atlanticcouncil.org/programs/scowcroft-center-for-strategy-and-security/cyber-statecraft-initiative/breaking-trust/ https://www.atlanticcouncil.org/programs/scowcroft-center-fo...

viraptor 6y ago

What's your proposed idea at the protocol level which solves the "I'll just saturate your pipe with garbage packets" case? That was the Mirai problem and I can't imagine a protocol solution. These are real, fully controlled endpoints. Even when we have solutions to some issues (authenticated BGP), people don't implement it and there's nothing Google can really do about that. (Apart from not accepting traffic from those ASes?)

Nextgrid 6y ago
Make it harder to generate garbage packets? BCP38 on the ISP side would solve IP spoofing and UDP reflection attacks. Stronger liability laws for both ISPs and end-users who deliberately expose vulnerable systems to the internet would help too.
- viraptor 6y ago
  2 issues: I mentioned Mirai which was not spoofed or reflected - just lots of devices and real sources. Garbage traffic as in something you didn't request. And the liability may work in one country, but you can't put a liability on ISPs internationally. Unless you want to end up in a situation where the US tells China their ISP is liable for spam traffic and hear that a US ISP is liable for traffic deemed illegal by the party. Anything but dumb pipes is going to be extremely complicated internationally.
  - Nextgrid 6y ago
    > just lots of devices and real sources. Lots of devices deployed by someone, set up by someone, and someone is paying the internet bill for those devices to be online. Maybe the ISP should be talking to that someone, even in an automated way where vulnerability scanners cut off their access and they need to manually re-enable it after having disconnected the offending device? > US tells China their ISP is liable for spam traffic I think most countries would agree that certain behaviors are undesirable. The damage & waste of time caused by spam and malware transcends political and religious opinions for example. The solution doesn't have to be a legal liability per-se, simply a code of conduct that all ISPs agree to and anyone found to be in breach will get cut off by the others. They're not necessarily on the wrong side of the law, but for all intents and purposes their business is done because nobody will peer with them.
    - viraptor 6y ago
      > cut off their access and they need to manually re-enable it after having disconnected the offending device? Sure. That's a possible meatspace solution and was used by some providers. It's not a protocol level solution though. > simply a code of conduct that all ISPs agree to and anyone found to be in breach will get cut off by the others Totally. Same thing could be applied to phone spam. It seems that nobody's that interested in it though.