Quantcast
Connect with us

30 years ago, the world’s first cyberattack set the stage for modern cybersecurity challenges

Published

on

Back in November 1988, Robert Tappan Morris, son of the famous cryptographer Robert Morris Sr., was a 20-something graduate student at Cornell who wanted to know how big the internet was – that is, how many devices were connected to it. So he wrote a program that would travel from computer to computer and ask each machine to send a signal back to a control server, which would keep count.

The program worked well – too well, in fact. Morris had known that if it traveled too fast there might be problems, but the limits he built in weren’t enough to keep the program from clogging up large sections of the internet, both copying itself to new machines and sending those pings back. When he realized what was happening, even his messages warning system administrators about the problem couldn’t get through.

His program became the first of a particular type of cyber attack called “distributed denial of service,” in which large numbers of internet-connected devices, including computers, webcams and other smart gadgets, are told to send lots of traffic to one particular address, overloading it with so much activity that either the system shuts down or its network connections are completely blocked.

As the chair of the integrated Indiana University Cybersecurity Program, I can report that these kinds of attacks are increasingly frequent today. In many ways, Morris’s program, known to history as the “Morris worm,” set the stage for the crucial, and potentially devastating, vulnerabilities in what I and others have called the coming “Internet of Everything.”

Unpacking the Morris worm

Worms and viruses are similar, but different in one key way: A virus needs an external command, from a user or a hacker, to run its program. A worm, by contrast, hits the ground running all on its own. For example, even if you never open your email program, a worm that gets onto your computer might email a copy of itself to everyone in your address book.

ADVERTISEMENT

In an era when few people were concerned about malicious software and nobody had protective software installed, the Morris worm spread quickly. It took 72 hours for researchers at Purdue and Berkeley to halt the worm. In that time, it infected tens of thousands of systems – about 10 percent of the computers then on the internet. Cleaning up the infection cost hundreds or thousands of dollars for each affected machine.

In the clamor of media attention about this first event of its kind, confusion was rampant. Some reporters even asked whether people could catch the computer infection. Sadly, many journalists as a whole haven’t gotten much more knowledgeable on the topic in the intervening decades.

Robert Tappan Morris, in 2008.
Trevor Blackwell/Wikimedia, CC BY-SA

Morris wasn’t trying to destroy the internet, but the worm’s widespread effects resulted in him being prosecuted under the then-new Computer Fraud and Abuse Act. He was sentenced to three years of probation and a roughly US$10,000 fine. In the late 1990s, though, he became a dot-com millionaire – and is now a professor at MIT.

ADVERTISEMENT

Rising threats

The internet remains subject to much more frequent – and more crippling – DDoS attacks. With more than 20 billion devices of all types, from refrigerators and cars to fitness trackers, connected to the internet, and millions more being connected weekly, the number of security flaws and vulnerabilities is exploding.

In October 2016, a DDoS attack using thousands of hijacked webcams – often used for security or baby monitors – shut down access to a number of important internet services along the eastern U.S. seaboard. That event was the culmination of a series of increasingly damaging attacks using a botnet, or a network of compromised devices, which was controlled by software called Mirai. Today’s internet is much larger, but not much more secure, than the internet of 1988.

Some things have actually gotten worse. Figuring out who is behind particular attacks is not as easy as waiting for that person to get worried and send out apology notes and warnings, as Morris did in 1988. In some cases – the ones big enough to merit full investigations – it’s possible to identify the culprits. A trio of college students was ultimately found to have created Mirai to gain advantages when playing the “Minecraft” computer game.

ADVERTISEMENT

Fighting DDoS attacks

But technological tools are not enough, and neither are laws and regulations about online activity – including the law under which Morris was charged. The dozens of state and federal cybercrime statutes on the books have not yet seemed to reduce the overall number or severity of attacks, in part because of the global nature of the problem.

There are some efforts underway in Congress to allow attack victims in some cases to engage in active defense measures – a notion that comes with a number of downsides, including the risk of escalation – and to require better security for internet-connected devices. But passage is far from assured.

Aircraft problems get thoroughly investigated, resulting in public reports and recommendations for industry to improve performance and safety.
NTSB via AP

There is cause for hope, though. In the wake of the Morris worm, Carnegie Mellon University established the world’s first Cyber Emergency Response Team, which has been replicated in the federal government and around the world. Some policymakers are talking about establishing a national cybersecurity safety board, to investigate digital weaknesses and issue recommendations, much as the National Transportation Safety Board does with airplane disasters.

ADVERTISEMENT

More organizations are also taking preventative action, adopting best practices in cybersecurity as they build their systems, rather than waiting for a problem to happen and trying to clean up afterward. If more organizations considered cybersecurity as an important element of corporate social responsibility, they – and their staff, customers and business partners – would be safer.

In “3001: The Final Odyssey,” science fiction author Arthur C. Clarke envisioned a future where humanity sealed the worst of its weapons in a vault on the moon – which included room for the most malignant computer viruses ever created. Before the next iteration of the Morris worm or Mirai does untold damage to the modern information society, it is up to everyone – governments, companies and individuals alike – to set up rules and programs that support widespread cybersecurity, without waiting another 30 years.The Conversation

Scott Shackelford, Associate Professor of Business Law and Ethics; Director, Ostrom Workshop Program on Cybersecurity and Internet Governance; Cybersecurity Program Chair, IU-Bloomington, Indiana University

ADVERTISEMENT

This article is republished from The Conversation under a Creative Commons license. Read the original article.


Report typos and corrections to: [email protected]. Send news tips to: [email protected].
READ COMMENTS - JOIN THE DISCUSSION
Continue Reading

Facebook

Boris Johnson wins race to become Britain’s next PM

Published

on

Boris Johnson won the race to become Britain's next prime minister on Tuesday, but will face a confrontation over Brexit with Brussels and members of his own party as well as a tense diplomatic standoff with Iran.

The former London mayor easily beat his rival, Foreign Secretary Jeremy Hunt, in a poll conducted among members of the governing Conservative Party.

He is expected to be confirmed as prime minister on Wednesday, when his predecessor Theresa May formally tenders her resignation to Queen Elizabeth II.

It is a triumph for a man who has always wanted the top job, but Johnson, known for his jokes and bluster, is taking over at a time of immense political upheaval.

Continue Reading

Breaking Banner

Mueller’s investigation did nothing to stop the next Russian attack: Cybersecurity expert

Published

on

The special counsel investigation of Russian election interference accomplished almost nothing to prevent further attacks on U.S. democracy, according to a cybersecurity expert.

Robert Mueller's investigation resulted in convictions for former Trump campaign chairman Paul Manafort and his deputy Rick Gates, along with former national security adviser Mike Flynn and others, but the former FBI director had little authority to hold Russian agents accountable for the crimes he uncovered, wrote cybersecurity analyst Robert Johnson for The Daily Beast.

Continue Reading
 

Facebook

How far-right groups use Britain’s extremism definition to argue they aren’t extremist

Published

on

The government’s definition of extremism is so unfit for purpose that far-right groups with clearly dangerous ideology are using it to “prove” that they are not extremist.

I’ve written about this in a new study published by the Commission for Countering Extremism as part of a wider set of research aimed at improving understanding about far-right extremism in Britain.

Continue Reading
 
 
 

Copyright © 2019 Raw Story Media, Inc. PO Box 21050, Washington, D.C. 20009 | Masthead | Privacy Policy | For corrections or concerns, please email [email protected]

close-image
Join Me. Try Raw Story Investigates for $1. Invest in Journalism. Escape Ads.
close-image