Back in November 1988, Robert Tappan Morris, son of the famous cryptographer Robert Morris Sr., was a 20-something graduate student at Cornell who wanted to know how big the internet was – that is, how many devices were connected to it. So he wrote a program that would travel from computer to computer and ask each machine to send a signal back to a control server, which would keep count.
The program worked well – too well, in fact. Morris had known that if it traveled too fast there might be problems, but the limits he built in weren’t enough to keep the program from clogging up large sections of the internet, both copying itself to new machines and sending those pings back. When he realized what was happening, even his messages warning system administrators about the problem couldn’t get through.
His program became the first of a particular type of cyber attack called “distributed denial of service,” in which large numbers of internet-connected devices, including computers, webcams and other smart gadgets, are told to send lots of traffic to one particular address, overloading it with so much activity that either the system shuts down or its network connections are completely blocked.
As the chair of the integrated Indiana University Cybersecurity Program, I can report that these kinds of attacks are increasingly frequent today. In many ways, Morris’s program, known to history as the “Morris worm,” set the stage for the crucial, and potentially devastating, vulnerabilities in what I and others have called the coming “Internet of Everything.”
Unpacking the Morris worm
Worms and viruses are similar, but different in one key way: A virus needs an external command, from a user or a hacker, to run its program. A worm, by contrast, hits the ground running all on its own. For example, even if you never open your email program, a worm that gets onto your computer might email a copy of itself to everyone in your address book.
In an era when few people were concerned about malicious software and nobody had protective software installed, the Morris worm spread quickly. It took 72 hours for researchers at Purdue and Berkeley to halt the worm. In that time, it infected tens of thousands of systems – about 10 percent of the computers then on the internet. Cleaning up the infection cost hundreds or thousands of dollars for each affected machine.
In the clamor of media attention about this first event of its kind, confusion was rampant. Some reporters even asked whether people could catch the computer infection. Sadly, many journalists as a whole haven’t gotten much more knowledgeable on the topic in the intervening decades.
Morris wasn’t trying to destroy the internet, but the worm’s widespread effects resulted in him being prosecuted under the then-new Computer Fraud and Abuse Act. He was sentenced to three years of probation and a roughly US$10,000 fine. In the late 1990s, though, he became a dot-com millionaire – and is now a professor at MIT.
The internet remains subject to much more frequent – and more crippling – DDoS attacks. With more than 20 billion devices of all types, from refrigerators and cars to fitness trackers, connected to the internet, and millions more being connected weekly, the number of security flaws and vulnerabilities is exploding.
In October 2016, a DDoS attack using thousands of hijacked webcams – often used for security or baby monitors – shut down access to a number of important internet services along the eastern U.S. seaboard. That event was the culmination of a series of increasingly damaging attacks using a botnet, or a network of compromised devices, which was controlled by software called Mirai. Today’s internet is much larger, but not much more secure, than the internet of 1988.
Some things have actually gotten worse. Figuring out who is behind particular attacks is not as easy as waiting for that person to get worried and send out apology notes and warnings, as Morris did in 1988. In some cases – the ones big enough to merit full investigations – it’s possible to identify the culprits. A trio of college students was ultimately found to have created Mirai to gain advantages when playing the “Minecraft” computer game.
Fighting DDoS attacks
But technological tools are not enough, and neither are laws and regulations about online activity – including the law under which Morris was charged. The dozens of state and federal cybercrime statutes on the books have not yet seemed to reduce the overall number or severity of attacks, in part because of the global nature of the problem.
There are some efforts underway in Congress to allow attack victims in some cases to engage in active defense measures – a notion that comes with a number of downsides, including the risk of escalation – and to require better security for internet-connected devices. But passage is far from assured.
There is cause for hope, though. In the wake of the Morris worm, Carnegie Mellon University established the world’s first Cyber Emergency Response Team, which has been replicated in the federal government and around the world. Some policymakers are talking about establishing a national cybersecurity safety board, to investigate digital weaknesses and issue recommendations, much as the National Transportation Safety Board does with airplane disasters.
More organizations are also taking preventative action, adopting best practices in cybersecurity as they build their systems, rather than waiting for a problem to happen and trying to clean up afterward. If more organizations considered cybersecurity as an important element of corporate social responsibility, they – and their staff, customers and business partners – would be safer.
In “3001: The Final Odyssey,” science fiction author Arthur C. Clarke envisioned a future where humanity sealed the worst of its weapons in a vault on the moon – which included room for the most malignant computer viruses ever created. Before the next iteration of the Morris worm or Mirai does untold damage to the modern information society, it is up to everyone – governments, companies and individuals alike – to set up rules and programs that support widespread cybersecurity, without waiting another 30 years.
Scott Shackelford, Associate Professor of Business Law and Ethics; Director, Ostrom Workshop Program on Cybersecurity and Internet Governance; Cybersecurity Program Chair, IU-Bloomington, Indiana University
Trump’s 2020 campaign distances itself from absurdly violent pro-Trump video
A brutal video clip depicting Donald Trump shooting and stabbing media characters and political opponents was shown at a conference for his supporters, the New York Times reported Sunday.
In the internet meme -- taken from a scene in the movie "Kingsman: The Secret Service" -- the US president's head is superimposed on a man opening fire at people whose faces have been replaced with the logos of outlets including CNN, the Washington Post and NBC TV.
As the rampage continues inside the "Church of Fake News", the Trump character strikes late senator John McCain on the back of the neck and torches the head of Senator Bernie Sanders, a Democratic presidential rival.
‘Crazy as a bag of hammers’ Lindsey Graham mocked for calling Trump’s too-late sanctions on Turkey a ‘game changer’
As Kurd civilians are slaughtered in Syria after Donald Trump opened the door for Turkey to invade, Sen. Lindsey Graham (R-SC) came under withering ridicule for happily announcing the president's agreement to levy economic sanctions of Turkey as a "game changer."
The South Carolina conservative has been harshly critical of the president's decision to move U.S. military personnel out of Syria where they have served as a bulwark againts a Turkish invasion, and now that the slaughter has begun, Graham has been seeking a way to lessen the damage as people are slaughtered.
Late Sunday, Graham tweeted, "Just spoke with President @realdonaldTrump. I applaud his decision to work with Congress to stop Turkeys aggression in Syria through crippling economic sanctions. This decision by President Trump will be a game changer -- in all the wrong ways -- for Turkey."
Kurdish forces warned they’d go to Putin and Assad if US withdrew: Former Trump envoy
Now that President Donald Trump has made it clear that he will abandon Kurdish resistance fighters to be persecuted and killed by Turkish forces, the erstwhile U.S. allies are moving to cut a deal with Russian President Vladimir Putin and Syrian dictator Bashar al-Assad to ensure their protection — all but wiping out U.S. support in the region.
Not only was this broadly predicted by experts, but according to The Daily Beast, former anti-ISIS special envoy Brett McGurk was warned explicitly by Kurdish officials last year that this would happen if America did not secure a deal to contain Turkey and ensure the Kurds' continuing security.