URL :

Print Icon  Printable Page
Print Icon  Web Page

November 2002

Infosec's Worst Nightmares

The 5 past attacks that haunt us, the 5 fears that trouble us.

BY Ed Skoudis

INSIDE:

5 Biggest Attacks, 1997-2002

   Code Red (2001)
   Nimda (2001)
   Melissa/Loveletter (1999, 2000)
   Distributed Denial-of-Service (2000)
   Remote Control Trojan Horses (1998-2000)

5 Biggest Security Threats, 2003-2008

   "Super" Worms
   Stealth Attacks
   Automatic Update Exploits
   Routing/DNS Attacks
   Combined Cyber/Physical Threats

True, the nastiest Internet-borne attacks of the last five years didn't kill us. But did they make us stronger? We hope so, because the worst may not be behind us.

Guided by more than 200 reader responses to an Information Security mini-poll, we've chosen the five worst security attacks of the past five years and predict the five most ominous threats lurking on the horizon.

The point, though, isn't whether everyone agrees on precisely which past disasters or future menaces make the "Top 5 List." In the shifting war of one-upmanship between black hats and white hats, each significant attack, each diabolic new breed of tool, each previously unused and sometimes unforeseen attack vector fueled the defensive methodologies and technologies that help us blunt the impact of these threats and keep them from repeating on a significant scale.

Battle-tested, we have an opportunity to be proactive about future threats, not simply responding, as we typically did, to the cyber sneak attacks of the past. Guided by the experience of the last five years, we can try to anticipate and thwart the menaces of the next five.

The Five Worst Attacks

What made these five "special?" Each wreaked havoc, shaking many people's confidence in the Internet, from CEOs and CIOs to sysadmins and Webmasters to end users at home and in the workplace. They raised doubts about e-commerce security and made us hesitate to open e-mail. They exploited new or heretofore little-used attack vectors on an unprecedented scale. They startled us with their ingenuity.

Here then, the rogues' gallery of information security: What they did, how they did it, and how the infosec community has responded.

FEBRUARY 2000
The Internet's first big wave of DDoS attacks first brought down Yahoo!, then a who's who of high-profile Web sites: Amazon.com, CNN, E*Trade, ZDNet, Buy.com, Excite and eBay.

  1. Code Red (2001). In July 2001, IDS sensors around the world noticed a massive eruption in incoming HTTP requests. Many infosec professionals, including those at the SANS Institute and The Honeynet Project, set out honeypots to capture and analyze the threat.

    The culprit was Code Red, a worm that spread via a buffer overflow in Microsoft's IIS Web server. eEye Digital Security discovered the original vulnerability, and Microsoft had released a patch a month before the worm was launched. The worm thrived, however, because few organizations had deployed the patch.

    By any measure, Code Red and the soon-to-follow Nimda were our readers' choice for the worst of the worst. The worms received by far the highest mean score among mini-poll respondents, and the most votes (44 percent) for having the greatest impact on IT security among attacks of the past five years (see Figures 1 and 2).

    Code Red spread to more than 250,000 Web servers in less than nine hours. Its speed and pervasiveness grabbed global media attention. Early versions of the worm altered default Web pages with a lame message about Chinese hackers, while later strains just silently lurked on systems, waiting to launch a more damaging attack. Code Red was also gearing up for a massive distributed flood against the IP address of the White House Web site. Most of the damage done by Code Red involved the bandwidth it consumed in its voracious scanning and propagation.

    Code Red taught us some important lessons:

    • The preventable spread of the worm underscored the importance of keeping up with system patches: rapidly identifying their release, testing them on quality assurance systems and moving them into production at a controlled but rapid pace.
    • The experience demonstrated the value of distributed sensors in tracking widespread attacks and honeypots as tools to capture malware.
    • A coordinated response helped contain the worm. The White House flood was thwarted because the ISPs null-routed the targeted IP address. Many ISPs dropped packets destined for this address at the perimeters of the Internet, before any serious bandwidth could get chewed up. The White House moved its Web site to a different IP address altogether to evade the attack.


  2. Nimda (2001). The nation was barely staggering back to its feet a week after the 9/11 terrorist attacks when Nimda hit. I distinctly remember thinking: "How dare you, you little twerp! We're trying to rebuild networks throughout Manhattan as we mourn the loss of thousands of people, and you launch a worm now!?!" Rumors floated that China released Nimda to measure the response of the U.S. to a cyberattack. Not likely, given the nature of Nimda. While it was bad, it had the appearance of being written by a determined amateur, not a nation-state reported to spend $1 billion annually on cyberwarfare capabilities.

    Nimda ripped Windows apart in as many ways as possible, giving us a taste of the future by offering a stunning example of the power of a multi-exploit worm. It compromised Windows boxes in a number of ways, by exploiting and propagating through:

    • Flaws in IIS.
    • Browsers with JavaScript enabled that surf to an infected Web server.
    • Outlook e-mail clients.
    • Activating Windows file sharing, enabling the guest account and adding guest to the administrator's group.

    After taking over a system, Nimda focused purely on spreading, sucking up bandwidth and processor cycles in its wake. From Nimda, we learned:

    • The importance of having incident-response capabilities, and linking them with network management personnel. To block the spread of a vicious worm, you need to rapidly deploy filters throughout your WAN and possibly disconnect portions of your network to limit damage.
    • The importance of disabling arbitrary script execution in e-mail clients and Web browsers.


    3.

  3. Melissa (1999) and LoveLetter (2000). The Melissa virus in March 1999 and the LoveLetter virus in May 2000 share the stage because of the way they exploited e-mail to propagate. Both spread via an application-level scripting language and propagated primarily via Outlook e-mail attachments. Melissa was a Microsoft Word macro virus, and LoveLetter was a VBScript virus.

    When activated through the "Double Click of Doom"--often just before reading the sysadmin's e-mail warning about not opening attachments--each worm harvested the victim's address book to e-mail itself to a new set of victims, spreading exponentially. Although we'd seen worms propagate via e-mail before, the results of Melissa and LoveLetter were far more dramatic because of the efficiency of using the Outlook address book to infect other users.

    Both of these threats brought e-mail service down at many companies, as a flood of bogus messages clogged their mail servers. Some organizations even pulled their networks off the Internet until the danger passed, so they could clean up the worm infestations in their internal environment without getting reinfected. In a number of cases, that meant no Web and e-mail for 24 or perhaps even 48 hours or more. While AV vendors demonstrated their effectiveness in distributing signatures to their biggest clients, many firms and individuals had to wait for virus definitions because of the "Super Bowl toilet flush effect" of everyone trying to download updates at the same time. Melissa and LoveLetter ranked just behind Code Red and Nimda among mini-poll respondents.

    Melissa and LoveLetter were security wake-up calls. The outbreaks spurred two important infosecurity trends:

    • Melissa and LoveLetter energized the business community to beef up security. Many organizations finally got serious about antivirus software--deploying AV not only at the desktop, but also on mail and file servers. Companies that tried to do virus protection on the cheap--ignoring their servers--got burned.
    • The inability of many organizations to respond effectively to the worms gave rise to widespread establishment of computer incident-response teams.


    4.

  4. Distributed Denial-of-Service (DDoS) Attacks (2000). The millennium arrived without incident, and the infosec industry breathed a collective sigh of relief. Y2K barely caused a ripple. Then, a month later, came the deluge. The Internet's first big wave of DDoS attacks first brought down Yahoo!, then a who's who of high-profile Web sites: Amazon.com, CNN, E*Trade, ZDNet, Buy.com, Excite and eBay. All were knocked off the Internet. A single attacker, MafiaBoy, had spread zombie flooding agents to hundreds of machines around the world. We had seen packet floods before and even basic DDoS attacks, but we had never witnessed an attack of this magnitude.

    This DDoS blitz made us realize that the Internet was far more vulnerable--and distributed attacks were far more potent--than we had suspected. By launching an attack from a large group of machines spread across the world, an attacker could use the power of the Internet itself to spread mayhem via DDoS, distributed scanning, distributed password cracking, etc.

    So what did we learn from this onslaught?

    • These attacks underscored the importance of egress antispoofing filters. If your Web server starts spewing packets using a bogus source address, your border router or firewall should drop the spoofed traffic.
    • Incident-response teams realized that they had to work with their ISPs to block packet floods. Your firewall may be a formidable barrier, but you still lose if someone sucks up all bandwidth connecting you to the Internet. Only by rapidly marshaling the forces of your ISP incident-response team can you block massive floods.

    Unfortunately, these attacks remain a major threat, in large part because ISPs have been slow to deploy DDoS countermeasures or ramp up their incident-response capability.



    5.

  5. Remote Control Trojan Horse Backdoors (1998-2000). In July 1998, the Cult of the Dead Cow hacker group caused quite a stir with the release of Back Orifice, a Trojan horse that installs a backdoor on Windows 95/98/NT target machines to allow a remote attacker to have complete access. Armed with this point-and-click tool, even unskilled attackers could dupe a user into installing Back Orifice, giving the attacker complete control of the victim's machine. With Back Orifice, an attacker can do just about anything a user sitting at the keyboard can do: access sensitive files, delete or modify critical data, and even reconfigure the system.

    Functionally, Back Orifice was virtually identical to many commercial remote control and administration tools, such as Symantec's pcAnywhere and Computer Associates' ControlIT, as well as the free Virtual Network Computing (VNC). Some folks with limited budgets even used Back Orifice for legitimate system administration. (Cult of the Dead Cow claims it developed Back Orifice for this purpose.)

    Because of its ease of use and hype surrounding it, Back Orifice was rapidly adopted and used by script-kiddies to attack systems. Its success spawned many similar remote-control tools, such as SubSeven, NetBus, Hack-a-Tack and Back Orifice 2000 (BO2K). This threat remains with us today, as crackers continue to develop newer and more powerful Trojan backdoors that evade detection, bypass personal firewalls and disguise the attacker's actual location.

    Back Orifice and its cousins underscored the importance of educating users about not running untrusted software, as well as the criticality of widely deployed antivirus software.


Were these your top five? Perhaps not. There were a number of other nasty choices. Among the top runners-up:

  • The massive problem in Internet Explorer's trust of certificates, revealed in August 2002.
  • The gaping SNMP hole discovered by researchers at Oulu University in Finland in February 2002.
  • VeriSign's issuance of valid code-signing certificates to people posing as Microsoft employees in January 2001.

Though these cyberassaults collectively inflicted billions of dollars in damage and spread fear globally, the net effect was, at least to some degree, better security. Stronger infosec policy and practice and new technologies helped counter these threats, and prepared us for the attacks to come.

The Future: 5 Things That Keep Me Up At Night

So, what five security nightmares will we be talking about five years from now? True, we've learned something from the past. Most organizations deploy at least basic security measures, users are more security conscious, and ingenious infosecurity technologies give us new ways to fight clever attackers.

Is this enough? Not likely.

Not everyone takes history's lessons to heart, and Code Red demonstrated that knowing about a threat doesn't mean people are going to do anything about it. Tight budgets restrict deployment of security tools and limit resources that should be expended on best practices. We can try to anticipate the insidious attacks, but there are brilliant, albeit ill-intentioned people with plenty of time on their hands to craft the most damaging types of exploits.

The worst may be yet to come. I'm often asked, "What potential computer attacks keep you awake at night?" Well, here they are.

  1. "Super" Worms. The threat of "super" worms looms large. Mini-poll respondents gave the highest mean score to these yet-to-be-seen menaces, and more than 36 percent considered them the single greatest threat (see Figures 3 and 4).

    The worm propagation vector is just too juicy for attackers to pass up. No other mechanism allows for the rapid and widespread distribution of malicious code, with virtually no way to trace the attacker. Be on the lookout for worms that spread even faster, have even more malicious capabilities and mutate as they spread. This coming breed of super worms will use zero-day exploits to simultaneously target multiple operating systems, seriously impacting our ability to detect, respond and recover.

    To prepare for these coming super worms:



    2. New tools are enabling attackers to compromise systems, virtually without a trace of what they did.

  2. Stealthier Attacks. Attackers are raising evasion to an art form. New tools are enabling them to compromise systems, virtually without a trace of what they did. A variety of advanced techniques make this possible:


  3. Exploiting Automatic Update Features. Major software vendors, including Microsoft and Apple Computer, offer services that allow users to automatically update their software across the Internet. By transparently downloading the latest fixes and features, these automatic update tools help reduce lag time in deploying security patches.

    But these features are a double-edged sword. An attacker could compromise a vendor's Web site or redirect requests for updates to the attacker's own machine. Then, when users contact the compromised site to download updates, they really receive the attacker's malicious software instead of the vendor updates. Who needs a worm when you can utilize a vendor's own auto-update Web site to spread your malicious code?

    In the past six months, Apple and music player WinAmp were both plagued with security vulnerabilities in their update features, though there were no reports of widespread exploits. Apple and WinAmp fixed the problems by implementing code-signing and repairing buffer overflows, but this attack vector remains quite unsettling.

    To defend against this potential threat, carefully control the software that's installed on systems inside your network. Employees should be prohibited from installing any nonbusiness software applications. You can enforce such policies using software inventory tools, such as Microsoft's SMS or LANDesk Software's LANDesk. Alternatively, you could deploy your own internal update servers, like Microsoft's Software Update Service, which lets you choose which packages and patches get installed. You can protect your network by testing all patches for sniffers, unusual traffic or strange port usage before approving the updates.



  4. Attacks Against the Routing or DNS Infrastructure. The Internet is glued together by two critical pieces of infrastructure--the routers that make up the Internet backbone and the DNS servers that resolve domain names into IP addresses. If an attacker could successfully undermine the Border Gateway Protocol (BGP) used by the backbone routers to share routing information, or tear apart DNS servers at will, the Internet itself could come unraveled.

    With these extremely juicy targets, attackers are very carefully combing through the code of major router vendors and DNS suppliers. They are looking for buffer overflows and other problems that would let them crash or even gain administrative access to such systems. Routing code is highly complex, and may have some significant problems, although few significant holes have been identified to date. DNS software has been plagued with buffer overflows in the past, and could have similar problems in the future. If attackers find what they are looking for in routing or DNS attacks, much of the Internet could be rapidly disabled.

    To prepare for this type of attack, make sure your systems can't be used as jumping-off points to target others:

    • Harden your publicly accessible routers and external DNS servers. Your organization's DNS servers are among the most security-sensitive machines in your whole environment, ranking right up there with your firewalls and authentication servers.
    • Keep your DNS servers patched, and carefully monitor them for attacks.
    • If you're responsible for ISP security, make sure your incident-response team can rapidly contact your upstream provider to coordinate your response to a massive router attack.


    5. If an attacker could successfully undermine the Border Gateway Protocol (BGP) used by the backbone routers to share routing information, or tear apart DNS servers at will, the Internet itself could come unraveled.

  5. Simultaneous Cyber and Physical Terrorist Attacks. This is the double nightmare--a massive computer attack that disables millions of systems conducted in tandem with a physical terrorist assault against one or more cities, such as a bombing or biological attack. On Sept. 11, 2001, telephone communication virtually melted down in several East Coast cities, forcing people to turn to e-mail to verify the safety of colleagues and loved ones. The Internet (as well as TV news) proved to be an excellent vehicle for learning about the attacks as they happened. By sending a super worm, breaking BGP or disabling DNS, an attacker could cut off one of our critical communications channels just when we need them the most.

    Getting ready for this one is certainly difficult:

    • Procure backup communications capabilities for your disaster recovery and computer incident-response teams. Get them two-way messaging pagers in addition to cellphones.
    • Make sure that your physical security folks are an integral part of your computer incident-response team.
    • Create attack scenarios with your physical security team, and walk through them to ensure all assignments and roles are understood in advance.

All this may sound alarmist, but given the trajectory we're on, there's every reason to believe that a determined attacker may temporarily disable major portions of the Internet in the next five years. Using the techniques described above, along with several others that didn't make the Top 5 list, an attacker could bring the Internet infrastructure down for a couple of days.

While that's a cause for concern, it wouldn't be the end of the world. Consider this comparison: almost every year, a major snowstorm shuts down one or more U.S. cities. Yet we cope. The storms are disruptive and dangerous, but they're not Armageddon. We may be headed for a giant Internet snow day. Get your shovels ready.

ED SKOUDIS is VP of security strategy at Predictive Systems. He is the author of the interactive CD-ROM, "The Hack-Counter Hack Training Course: A Network Security Seminar," and the book, Counter Hack: A Step-by-Step Guide to Computer Attacks and Effective Defenses (Prentice Hall PTR, 2001).




November 2002 Table of Contents

Copyright 2002 TechTarget