The Marketleap Report
Vol. 1 - Issue #9 - May 18, 2001

The Smell of Vunf - a Very Unlucky Network Failing
By Keith Boswell

Techno-organisms and the network meet too often. Viruses continue to evolve and spread throughout the web. Unprotected networks and computers are either infected or being watched.

This past week, the first e-mail delivered virus that included advertising overwhelmed e-mail servers and networks in Asia, Australia and Britain. The virus not only contaminates the user's machine and sends copies of itself to everyone in the address book, it opens a web browser pointed to one of four adult sites that the virus writers support.

In a few hours, a group of 15-year-olds cobbled together this latest plague to gain attention and have a good time. "Let's go hang out, modify some code we got from the web, and then turn over some trashcans. Oh, the fun we'll have."

Youths and criminals don't have access to high-powered weapons through legal means. But they can go online and have all the tools they need to wreak havoc and destroy data within a few hours. On a Friday night, while you're out or sleeping, they're on the web lurking and prying into computers all over the world.

The e-mail virus works when someone clicks on an attached file that executes the virus. Once the file has infected the machine and found more addresses to send itself to, it slows networks with the amount of traffic that it generates. It snowballs as it replicates and resends.

But danger doesn't lie in e-mail viruses alone. A recent study by Asta Networks found three new types of denial of service attacks. A denial of service attack occurs when a network is crippled and overwhelmed by the amount of traffic trying to access it.

Hackers use e-mail attachments and browser vulnerabilities to infect machines with a dormant virus that causes no damage to the computer. The machine is now a zombie, awaiting instructions from the hacker. Once hackers have infiltrated and infected hundreds or thousands of computers, they can use all the zombies to overwhelm another system. With a single command, the zombie machines simultaneously flood their target with requests.

In recent weeks, security experts have seen much more sophisticated denial of service attacks that only attempt to slow networks considerably. It is estimated that last year, denial of service attacks cost US businesses more than $1 billion.

This past week also saw an interesting automated worm/virus used in connection with the recently ended Chinese/American hacking war that has been fought since an American naval monitoring crew was returned from China.

The tool searched the web for Sun web servers running without a particular security patch. It would then stage an assault from the Sun servers on web servers running Microsoft NT that had not upgraded with a particular security patch.

That assault turned all HTML pages in the main directory into a page supporting the Chinese hackers, slamming our government and our American hackers. Late in the week, the two cyber tribes called good and ended their chicanery.

Imagine the next six months as hybrids of these various attacks are combined, recoded and released into the techno gene pool. The problem is that central security and safety are not a primary concern for doing business online. I don't mean being defensive and proactive alone.

There is no active body working to stop or slow the advancement of tools and software that are meant to exploit the system and potentially cripple it entirely. We monitor all ports and entry points into the country, actively watching for danger. We have teams ready to deploy across the world to respond to viral outbreaks that impact the human population.

If we plan to populate the online world in much the same way we do the physical one, the same scrutiny and oversight must be in place. Without it, infections, marauding gangs, and disrupted business will continue to spread.

Education is critical. Most of the viruses today still need to dupe humans to spread themselves. If we are going to merge commerce and technology, let's train everyone together.

It makes no sense to have a few pace ahead, wait for everyone else to catch up, and make mistakes that damage the entire system. The prescription for success is to slow down and assess where we are and want to be.

This includes education, oversight and regulation. Part of growing up is admitting to change gained from experience and insight. The country doesn't function from freedom alone. Neither can the web.