IT Employment

Ask something
Discussion Locked

Internet To Shut Down Tomorrow

0 helpful
25 replies

by tomsal 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

By now I'm sure you have read the story or heard about the "critical flaw" found in "the underlying technology for nearly all Internet traffic" (quoted from article).

The British government announced it yesterday (Tuesday) that the vulnerability in core Internet technology exists. If left unaddressed, it could allow hackers to knock computers offline and general cause widespread outages accross the 'net.

Talking to co-workers, one of the guys said he "heard" that the exploit basically can cause routers to restart. Cisco also announced that their most popular routers are vulnerable to this flaw as well. Great Cisco only runs what...50% (conservatively) of the 'net, with its routers?

I know our company is based on Cisco technology and so is our ISP.

So anyone hear about this, what are your thoughts? Should we be concerned for our businesses or how it effects our Internet based customer transactions?

The story I read is at:

http://apnews.excite.com/article/20040421/D822U6480.html

25 replies

by maxwell edison

.
As many of you know, each year the Internet must be shut down for 24 hours in order to allow us to clean it. The cleaning process, which eliminates dead email and inactive ftp, www and gopher sites, allows for a better-working and faster internet.

This year, the cleaning process will take place from 12:01 a.m. GMT on ***** until 12:01 a.m. GMT on *****. During that 24-hour period, five powerful internet-crawling robots situated around the world will search the internet and delete any data that they find.

In order to protect your valuable data from deletion we ask that you do the following:

1. Disconnect all terminals and local area networks from their internet connections.

2. Shut down all internet servers, or disconnect them from the internet.

3. Disconnect all disks and hard drives from any connections to the internet.

4. Refrain from connecting any computer to the internet in any way.

We understand the inconvenience that this may cause some internet users, and we apologise. However, we are certain that any inconveniences will be more than made up for by the increased speed and efficiency of the internet, once it has been cleared of electronic flotsam and jetsam.

We thank you for your cooperation.

Kim Dereksen
Interconnected Network Maintenance staff
Main branch, Massachusetts Institute of Technology

by jkaras

Max inside the article it never posted this so called shutting down of the internet or a scheduled date. It makes sense that this has to happen from time to time but I have never heard of this procedure nor was it taught or talked about in my current studies at school. If this has to happen why during a weekday and not during the weekend? I'll chalk this up to internet hoax and myths and have a good chuckle.

by maxwell edison

.
.....but it's one of those Internet hoaxes, not to be taken seriously, that finds its way into all too many inboxes.

by adam_molina

I don't believe it either. That sounds like a scam to support that flaw. What if there isn't a flaw at all. So they have to come up with a statement to ensure that people will disconnect from the Internet. I haven't taken anything like this at face value and I'm not starting now.

by oz_media

You may know better than I do so I figured I'd ask. I was watching a show about Censorship and they said that shortyly after Bush was elected, he had a team of over 200 users scour the internet for ANY derogatory or negative statements about himself and the Bush family past and have them shut down.

This was reported by a guy with his voice changed and his face fogged so I have to have my doubts. Apparently it was an effort to stop negative propaganda and his history from being aired. Now I know that all this stuff is back on (if it WAS taken off) the internet now but I don't know the credibility of such a statement, have you heard anything similar?

Would this not then become a censorship issue or something?

I don't want a long segue here but I was just wondering if it was common knowledge or just something we hear here or what?

by maxwell edison

.
Of course, I have no inside information to either confirm or deny such a thing, but color me skeptical - no, make that extremely skeptical. In fact, there's a better chance that his national security advisor is an extra-terrestrial. My reason is (I hope) based on simple logic and reason.

Like him or not like him, I think GWB has shown that he doesn't really give a rat's behind what other people may think or say about him, especially his political enemies, as he's guided by his principles (if you like him) or his inflexible agenda (if you don't like him). He just doesn't care what others say. He simply stays focused on what he wants to do and charges ahead, and will let the chips fall where they may. (Recall the "with us or against us" sentiment. Recall the "up yours' to the French.)

Besides, not only does he not have the power to do that, nor is he the type of person to do that, but it would be next to impossible to get it done. It's just down-right silly for someone to suggest such a thing. No wonder his face was blurred out. He's be a laughing-stock otherwise.

by lordinfidel

There are 2 vuln's that were released.

The one involving cisco IOS is with SNMP.
It is loosely tied to the tcp vuln that was discovered earlier.

But if your not running SNMP on the affected device, then you don't have to worry. Cisco has released a IOS update that fixes this vuln.

Next... The tcp sequence number hijacking vuln of the tcp stack itself.

At This time it affects systems that rely on persistent unauthenticated tcp sessions such as BGP.

There are mitigitaing circumstances where if you are using MD5 sigs to protect the traffic, you are not suspectible. If your carrier is not running BGP, it is not susceptible.

If your carrier is running BGP on a isolated VLAN or physically seperated network that can not be contacted by the outside, it is not suscpetible.

So is the net going to come tumbling down? Not likely.

by tomsal

Thanks for the extended information. I only got bits and pieces from the article I mentioned in my post but it didn't go into great detail as to what the vulnerability exactly was or if it was only related to certain protocols.

I also think its unlikely that the whole net will come tumbling down.

Thanks for the info...good stuff.

by joseph moore

I actually contacted the person who found the TCP problem (Paul Watson), and have been e-mailing a couple of times today.

He told me that the paper he is presenting on Thursday, that details exactly what you have to do to exploit this, will be on his website later on, maybe Friday. He said, "I will be posting it on my website shortly after I finish the talk."

Also, he is not overly concerned about the Internet going down, since he knows that many major backbone carriers and ISPs have already taken care of their BGP routers. Enabling the MD5 encryption is, apparently, the way to go.

His larger worry now was for smaller places, like normal companies that do use BGP. Those are the targets now, not AOL!

For example, my company does use 2 routers that are BGP neighbors on our Internet side. Are we concerned? Sort of. It depends if attacks start up this weekend, after Paul gives his talk and details this at a security convention in Vancouver (http://www.cansecwest.com/)

Nevertheless, I can't wait to read his paper on this when he posts it. I asked for an advanced copy, but he was unable to do so, due to the convention and his obligations there.

by tomsal

So what is the URL to Mr. Watson's site. The side of me that is ever curious and ever seeking to learn more is very interested in reading this paper on the details of the exploit.

by oz_media

I don't think Cisco runs 50% of the world internet routers at all, I'm sure in North America they are quite popular btu I run three servers at home not a single Cisco. The two company's I net for, no CISCO. My ISP, NO Cisco.

I only know of ONE major company in my portfolio that has used Cisco routers and that was a hospital who hired four Cisco staff when building thier new network.

I know the number is high but I wouldn't think it's close to 50%.

by lordinfidel

that it is just not cisco IOS that is vulnerable.

They are just the first to say they are vunlnerable, there is a difference there.

The underlying attack vector is the tcp non-authenticating scheme.

There are 2 vulns discovered, the 1st is with SNMP and the second is with BGP. Neither of which are Cisco IOS specific.

So if your routers are running BGP sessions and are not using MD5 auth, I bet you that you are vuln to the tcp transmission attack.

This is not a minor thing that is just attributed to cisco. It's the fact that tcp sequence numbers are pseudo random and can be predicted if you know the underlying OS of the remote device.

I know that at the major PNAP's they have already begun contacting their customers who are running unsecured BGP sessions to set up MD5 keys with them.

This is regardless to whether or not you are running a cisco router, bay router or (god forbid) any one of the lower end piece of crap routers.

by tomsal

Well I suppose you are right, but I wasn't really meaning it as hard fact - though I do know Cisco is HIGHLY popular and yes several Fortune companies use Cisco equipment. Either way, I really don't care if the world uses them or just my company and ISP - it doesn't mean that much to me, it was just a comment.

The point being as LordInfidel posted, its not only Cisco that is vulnerable anyways.

Actually we didn't have cisco until a about 8 or 9 months ago. But I won't say what we did use...lol..it was one of those "piece of crap" routers/hubs.

Anyway, I feel better now..I was concerned my online gaming would be affected tomorrow night. ;)
lol

by lordinfidel

The SNMP vuln is Cisco Specific, but will probaly cause other vendors to check their snmp implemintation. The SNMP vuln is a distinctly different vuln from the tcp seq num vuln that can compromise bgp sessions.

The Cisco IOS vuln, in my opinion, is greatly mitigated if you are not running authenticated SNMP on your routers.

The BGP session vuln is another story alltogether since it is vendor neutral and affects all platforms.

So if your running BGP without MD5 sigs, contact your BGP peer(s) now and change it.

If your running a cisco device with unauthenticated snmp on it, either disable it, or install the latest IOS.

by oz_media

I know I was quick to jump on that one, you guys have taught me well ;-)

Anytime I've made a comment that is construed as a statement, i get corrected by more than one person. I am just getting used to nit-picking myself.

You had a valid question and it wasn't insane based on whet you'd heard that's why my only comment was regardng your statement and didn't address your actual question. Learned that one here too. :-P

Didn't mean to give you a hard time,
OM

by oz_media

I had my doubts as I do with all so called 'coming out of the closet' reporting.

These mysterious people keep surfacing and saying he said...my life in is jeopardy so blur my face out etc.

It was right after watching a Canadian documentary where 75 reporters were filing suit on the US government for censorship. they had been told striclty NOT to provide any information about Bush's past or family history when related to Iraq stories. They were also blacked out from most of their reports sent to US agencies as they were not allowed to air such reports. morover they said the people supposedly reporting from front lines is crap, NO reporters are allowed anywhere near front lines until after the matters are resolved and then each report has to be forwarded to White House authorities for clearance into the US.

Their Canadian and Iraqi news stations are also scared to show most reports because they don't want the repercussions from the White House.

Now this may seem irrelevant but to see such censorship and then someone claiming he had inside info about how BUSH has combed the internet and removed similar reports was all too coincidental. I just wondered what you had heard as you are always staying on top of these issues as much as you can, which I am learning to respect.

Thanks for your input again, it's nice to finally have some discussions without the flaming, from both sides of course.

by cactus pete

OK...

If you have no additional parameters, I'll take that bet.

Of course, you'd have to tell me where it is, at least. Want me to try it Sunday afternoon?

by pgm554

There are well known exploits to hack and screw with Cisco routers.

I had a class with Laura Chappel 2 years ago and we leaned how to crash a Cisco router using a malformed packet attack(Christmas Tree Attack).

It was a known flaw that Cisco had known about for a while,so this ain't all that new.

I also believe some idiot kid out of Canada a few years ago ran a program that crashed a lot of Cisco routers in the Northeast.

So BFD,here's another one.

by tomsal

Oz , I have always enjoyed your contributions on these forums and I like how you are consistent with your delivery and stand by your views no matter who is posting what.

Thanks for your post.

Its all good man!

by oz_media

Well, I was awake all night, I just couldn't imagine what was going to happen to the Internet.

This smorning a page didn't load. TR was slow as molasses, I called the front desk and they said all was fine with the connections. I couldn't log into my webmail. Having come to Vancouver for a day or two, I felt I would be in deep doo do when I saw my client. I

I asked the hotel's netadmin to reboot his routers and everything worked again. My client's site is fine, I can log into my own server and my routers are OK, phew!

You really had me going Tom! ;-)

This discussion is closed to new replies.