Tag Archives: risk management

Metricon 5.0: IT Security Past, Present, Future

The Fifth annual Metricon is today. Invitation-only, about 35 attendees, 10 speakers. Anything anybody says is off the record is, but there may be some things to live-blog.

Route Hijacking: Identity Theft of Internet Infrastructure

Peter Svensson gives an old and quite serious problem some mainstream press in this AP story from 8 May 2010:

On April 25, 1997, millions of people in North America lost access to all of the Internet for about an hour. The hijacking was caused by an employee misprogramming a router, a computer that directs data traffic, at a small Internet service provider.
A similar incident happened elsewhere the next year, and the one after that. Routing errors also blocked Internet access in different parts of the world, often for millions of people, in 2001, 2004, 2005, 2006, 2008 and 2009. Last month a Chinese Internet service provider halted access from around the world to a vast number of sites, including Dell.com and CNN.com, for about 20 minutes.
In 2008, Pakistan Telecom tried to comply with a government order to prevent access to YouTube from the country and intentionally “black-holed” requests for YouTube videos from Pakistani Internet users. But it also accidentally told the international carrier upstream from it that “I’m the best route to YouTube, so send all YouTube traffic to me.” The upstream carrier accepted the routing message, and passed it along to other carriers across the world, which started sending all requests for YouTube videos to Pakistan Telecom. Soon, even Internet users in the U.S. were deprived of videos of singing cats and skateboarding dogs for a few hours.
In 2004, the flaw was put to malicious use when someone got a computer in Malaysia to tell Internet service providers that it was part of Yahoo Inc. A flood of spam was sent out, appearing to come from Yahoo.

The Pakistani incident is illustrated in the accompanying story and video by RIPE.

This problem has been known for a long time. Why hasn’t it been fixed? Continue reading →

Twitter Reschedules

Twitter recognizes that a network upgrade is important, but the role twitter is playing in Iran is more important, and reschedules for 1:30 AM Iranian time. Now that’s risk management!

Would that U.S. states had all rescheduled Diebold and the like to the junk heap after the 2000 U.S. election.

Also notice who twitter’s hosting service is: NTT America. I’ve been predicting for years that the U.S. duopoly’s intransigence would lead to NTT and other competent international ISPs eating their lunch, and I see it’s beginning to happen.

-jsq

Logging to Fund Firefighting?

Got too many wildfires and need somebody to pay?

The forest service’s reasoning is simple: sell trees to loggers, use the money to clear areas of potential fire fuel. What the loggers cut can be potential fuel. With one sale, a fire hazard can be removed and the agency paid so it can remove more fuel.
— US judges order stop to California logging projects, McClatchy newspapers, guardian.co.uk, Thursday May 15 2008

The federal Ninth District Court didn’t think that was so clever, or at least not so legal, and also not the only way:

Two for one always has an attractive ring. But are there no alternative ways of getting money to do the clearing that is imperative? Obviously, there may be. First of all, there is the USFS’s own budget. Does that budget contain any funds that could be devoted to fuel removal? Is every one of its activities so necessary and so tightly allocated that no money could be shifted? We do not know the answer because this alternative has not been explored.
Suppose that the USFS and its parent, the Department of Agriculture, cannot spare a dime. What then? Appropriate appropriations come from Congress. The work of fire prevention is work of the first importance. If the USFS does not have enough, why should not Congress be asked to give it more? Surely the avoidance of catastrophic fire in the national forests must rate a high priority among the needs of the nation.
— No. 07-16892 D.C. No. CV-05-00205-MCE, United States Court of Appeals for the Ninth Circuit, 14 May 2008

Coming soon: eating seed corn to prevent hunger, credit card debt to get rich, and other clever risk management strategies.