Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Government Security

Why Laws Won't Save Banks From DDoS Attacks 80

Posted by Soulskill from the legislative-firewalls-are-less-effective-than-actual-firewalls dept.
kierny writes "Rep. Mike Rogers (R-Mich.) should know better. The chairman of the House Intelligence Committee claimed to told NBC News that the Operation Ababil U.S. bank disruption DDoS campaign could be stopped, if only private businesses had unfettered access to top-flight U.S. government threat intelligence. Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for 'national security' purposes, thus raising the ire of privacy rights groups. Just one problem: Numerous security experts have rubbished Rogers' assertion that threat intelligence would have any effect on banks' ability to defend themselves. The bank disruptions aren't cutting-edge or stealthy. They're just about packets overwhelming targeted sites, despite what Congressionally delivered intelligence might suggest."
This discussion has been archived. No new comments can be posted.

Why Laws Won't Save Banks From DDoS Attacks More

Why Laws Won't Save Banks From DDoS Attacks

Comments Filter:

  • Locks keep out honest people... (Score:5, Insightful)

    by Midnight_Falcon ( 2432802 ) on Friday April 05, 2013 @02:53PM (#43371971)
    And laws stop honest people from doing something. Criminals, on the other hand, are criminals -- and conducting a DDoS attack cannot be stopped by policies and laws alone. There need to be both technical countermeasures, and political ones as well. In a "positive peace" the reasons for conflict are addressed and removed, while in a "negative peace" the only reason conflict is not happening, is well, the cost of the conflict to both sides.

    These folks obsessed with a "negative peace" by making more laws should study history.

    • Re:Locks keep out honest people... (Score:5, Insightful)

      by amiga3D ( 567632 ) on Friday April 05, 2013 @02:56PM (#43372019)

      They feel like they must do something and do it right now. It's more important to appear to be doing something to fix the problem than to actually fix the problem.

      • Re:Locks keep out honest people... (Score:4, Insightful)

        by ackthpt ( 218170 ) on Friday April 05, 2013 @03:14PM (#43372231) Homepage Journal

        Passing laws makes the powerless feel better. You've never heard "There oughta be a law"? What they really should be saying is "There oughta be trained people who know how to track down the criminals and convictions which show the laws already on the books are enforced."

        Good luck enforcing laws overseas.

        • All the bad things will go away if they can just take away free will.

        • This is NOT about helping businesses from being DDos'ed, or hacked, or anything else.

          This is about having businesses be able to legally give lots of juicy customer information to the gov't, preferably under the threat of tax audits of all the executives of said business instead of having to pay for the data like everybody else.

      • They feel like they must do something and do it right now. It's more important to appear to be doing something to fix the problem than to actually fix the problem.

        Too bad there is no possible way for them to actually figure out who is responsible for a DDOS attack, because the headers are spoofed. Also, why the fuck does DNS run on UDP?

        • Too bad there is no possible way for them to actually figure out who is responsible for a DDOS attack, because the headers are spoofed.

          Actually it's often easy because it's only Anonymous and similar that does DDoS for purely political reasons. Most DDoS are cybercriminals extorting money in some way or disgruntled customers seeking revenge, and both can be identified outside the attack itself using regular investigative methods.

          Also, why the fuck does DNS run on UDP?

          Legacy. It also runs on TCP now but started out UDP only.

          • Actually it's often easy because it's only Anonymous and similar that does DDoS for purely political reasons. Most DDoS are cybercriminals extorting money in some way or disgruntled customers seeking revenge, and both can be identified outside the attack itself using regular investigative methods.

            That certainly is the only way to find the source of DOS attacks now. In cases where the malefactor does not attempt extortion, or otherwise brag about their attack, this path of inquiry is impossible. Even when they do find this person, the sticky bit of proving guilt beyond reasonable doubt (remember the court of law) remains tenuous at best. Even if every router on the path of our spoofed packets kept exceptionally (unreasonably) detailed logs, the peer-to-peer nature of IP would require a subpoena fo

      • Re: (Score:2)

        by slick7 ( 1703596 )
        How can the banksters be protected by laws when they are above the law?

    • Re: (Score:3, Interesting)

      by teaserX ( 252970 )
      Locks also keep out lazy criminals. When you can't know who the criminals are that's a fair defense against most of them. This legislation seeks to more effectively determine who/where the criminals are. They can round up all of the car thieves in my neighborhood and it still be stolen if I leave it unattended and running. Legislation that provides consequences for banks that leave the "door" unlocked might be more effective than this "intelligence sharing" which does little to that end. Makell them to lock
      • That analogy doesn't really apply to getting DDOS'd. That's like locking your lobby during business hours so the bad guys can't get in.

        • Re: (Score:2)

          by teaserX ( 252970 )
          You're taking that too literally. There are measures they can take to directly defend against the DDOS ( CloudFlare comes to mind) that are more effective than any access to threat intelligence. That access will be abused by both the government and private business.
          • I get it. I'm just pointing out that there is actually very little that can be done to protect against a DDOS attack. I don't think it's a matter of negligence on the bank's part (or at least not in the same vein as traditional unpatched vulnerabilities).
      • I would argue that legislation that provides consequences for banks recklessly gambling with people's savings accounts, handing out mortgages they know will result in foreclosure, and executives vying for short-term profit and bonuses over long-term stability of the global financial system would increase consumer confidence and cause these DDoS issues to be abated more quickly than the measures you suggest.

    • DDOS wouldn't be possible without a botnet, perhaps preventing the latter will prevent the former. Anti-virus, better session awareness from the OS, and good networking practices can all go a long way here.

    • These folks obsessed with a "negative peace" by making more laws should study history.

      They already have.. Those who die with the most marbles win.

      • Re: (Score:2)

        by slick7 ( 1703596 )

        They already have.. Those who die with the most marbles win.

        Those who die with the most marbles are still dead. FTFY

    • When DOS is outlawed, only outlaws will have C:\

      oh wait, this is about DDOS?

      never mind

    • So today, in class, you guys 'n gals studied 'positive peace' and
      'negative peace'?

      Sigh -- if your only tool is a hammer etc.

      • Actually, about a decade ago for studying that topic personally....but yes, the overarching point being that Anonymous/other DDoSers out there are upset at banks and the international financial system. Their being upset comes from deep frustration in that, these banks and institutions brought the world to a global financial panic, yet the people inside them, directors, managers etc -- all made tons of money. Meanwhile, homes are foreclosed upon and Joe Schmo is footing the bill.

        In a positive peace, some

    • and the honest people weren't a problem to begin with. I keep trying to figure out how they plan to get criminals to submit to a background check before buying their gun in a back-alley or stealing it from someone down the street.

      "I'm sorry, but there is a 5 day waiting period before you can steal that. We have to run a background check on you. Sorry, government regulations."

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Friday April 05, 2013 @02:55PM (#43371999)
    Comment removed based on user account deletion

    • Re:And laws helped cause it (Score:5, Insightful)

      by amiga3D ( 567632 ) on Friday April 05, 2013 @03:01PM (#43372105)

      The end result of all these wars is that individual liberty is collateral damage. The war on Drugs, on Terror, on Child Porn, etc., means that innocent people pay the price while the thing they war against never goes away. One unwinable war after another.

    • There simply is not enough cash for this to ever be an option. It does not matter what laws they enact, when only 2% of all US money is actually backed by physical currency you can never have a vibrant physical cash economy.

  • Let's focus on the important part (Score:5, Funny)

    by quietwalker ( 969769 ) <pdughi@gmail.com> on Friday April 05, 2013 @02:59PM (#43372073)

    ... I don't think 'rubbished' is a legitimate word.

  • What's needed is a big lawsuit by a big bank against Microsoft for willful negligence. (Def: Intentional performance of an unreasonable act in disregard of a known risk, making it highly probable that harm will be caused.") Knowingly distributing operating systems which are known to be remotely exploitable to attack other systems fits that definition.

    Microsoft's EULA doesn't protect them here. The victim is a third party, not their own customer, and not a signatory to the EULA. Nor does this require a c

    • What the hell are you going on about? Odds are the DDoS is taking down the target network before a single packet reaches anything running Microsoft software. Actually, the reason it's a DDoS is because packets aren't reaching anything running Microsoft software (clients and servers). You'd be making a tiny bit of sense if you said Cisco, but that would be like suing the New York City because the roads can't accommodate every single person in the country visiting NYC at once.

      • Re:Sue Microsoft for willful negligence (Score:4, Interesting)

        by amiga3D ( 567632 ) on Friday April 05, 2013 @03:20PM (#43372289)

        I think he's talking about all those windows peecee's slaved into botnets because of their defective by design OS and are used in DDos attacks such as this. It all starts with malware ya know and Windows is the most pervasive form of malware on the planet.

      • Re: (Score:1)

        by in10se ( 472253 )

        Not that the idea of a lawsuit against Microsoft is likely, but I think the OP is referring to the source of the attack - not the target. The point is that many DDOS attacks are created by zombie computers, many of which run Microsoft operating systems.

        • If we take this rhetoric one step further, are there not a lot of illegal (i.e. non-EULA applicable) copies of Windows that are part of this and are likely also used in the creation of said malware? I could see Microsoft argue that the root of the problem is software users not abiding by EULA and the blame would thus be shifted towards those who 'failed' to enforce software copyright, etc.
      • Read that again. They're talking about Windows being a breeding ground for zombies that carry out these attacks. But yeah, stupid reasoning nonetheless. Trying to litigate our problems away is part of the problem, not the solution.

  • No matter how justified that deterrent is made (by creating it as a law). To stop the most determined people from doing what they will do.

    Should banks be protected from attack? I would say in a perfect world were banks were innocent and served a purpose other then gambling on your own investment into them. Maybe.

    But as it stands now, banks should be left out in the cold to defend themselves, and in ways that don't violate our laws. They need no more special justifications placed in our society for them.

    • No matter how justified that deterrent is made (by creating it as a law). To stop the most determined people from doing what they will do.

      Should banks be protected from attack? I would say in a perfect world were banks were innocent and served a purpose other then gambling on your own investment into them. Maybe.

      But as it stands now, banks should be left out in the cold to defend themselves, and in ways that don't violate our laws. They need no more special justifications placed in our society for them.

      What are you talking about? Murder is illegal. I haven't been murdered! Therefore the law is working!

      • Yet people get murdered every day. It's a shame. But the deterrent for murder applies generally equally to all, or at least thats the principle. Technically grandmothers have no more deterrent applied to them then 30 year old single males.

        • Also the reason you have not been murdered yet probably has more to do with your general niceness, averageness, location (not in a slum) etc.. but I know nothing about you to make such assumptions, the law has a lower bearing then many factors on whether you get murdered or not =P

          • Also the reason you have not been murdered yet probably has more to do with your general niceness, averageness, location (not in a slum) etc.. but I know nothing about you to make such assumptions, the law has a lower bearing then many factors on whether you get murdered or not =P

            Hah. I was just being facetious when I made that comment. But I do try to be courteous.

    • No matter how justified that deterrent is made (by creating it as a law). To stop the most determined people from doing what they will do.

      The title is misleading because it implies that the law is intended to be a deterrent, but the summary makes it clear that the law being talked about deals with allowing the sharing of information about the attacks. So, it's not another law making DDoS illegal, it's a law allowing information about DDoS to be passed around.

      Yes, another deterrent law would be useless. A law that allows those who are being attacked to share data about how they are being attacked is not.

      But as it stands now, banks should be left out in the cold to defend themselves, and in ways that don't violate our laws.

      Some of those banks have my money in

      • Thanks for the clarification of the title, How come thats not legal already. AFAIK know and after working in the IT industry and with software like SNORT publishing blacklists with comments like "spammer, ddosser" is perfectly legal for anyone.

        As far as your right to want the money you invested in your great gambling casinos of the new world order, great for you, I have a differing opinion, and I doubt we'll ever see eye to eye on that. I never believed banks were for security when I was a kid, and after wa

        • I guess the better question then is. Should banks have more priorty with law enforcement hunting DDOSers then netflix. Or a single youtuber?

          In my opinion all 3 parties should have the same priority. The best argument you could make for changing that priority is severity of attack as in how damaging it is to how many parties. In this case your argument for special protection rings true, but it should also ring true if those DDOSers are targeting something other then a bank. So the fact that it is a bank by i

  • Therein lies the rub ... (Score:4, Informative)

    by gstoddart ( 321705 ) on Friday April 05, 2013 @03:13PM (#43372211) Homepage

    Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for 'national security' purposes

    These people want this information shared for their own purposes.

    This has nothing at all to do with protecting banks from DDoS -- it's about ensuring government access to all of our data. If they can get private industry to hand them data they can't collect on their own then they can circumvent other laws.

    I agree with the assessment that no law is going to make this kind of attack hitting from all over the world (and probably on zombie computers) go away.

    These people just want the total surveillance world that scares the rest of us.

  • If terrorist surveillance information isn't enough, then the banks will have only one logical next step: operate their own armed aerial drones.

  • Laws without respect and/or a gun won't protect you from anything.

    It goes without saying, but I'll say it anyway, Many laws, like CISPA, RICO, etc., deserve no respect, and sometimes it takes a gun to remove them from the books, or to keep them from being put there in the first place when majority rule fails.

  • I'm ashamed to say that Rogers is my congressman. I've even voted for him several times. As much as I'd like to vote for someone who excels in all areas, to bad our choices are normally choosing between an idiot and a half-wit.
  • Given that a lot of these problems stem from inherent design flaws with our current Internet protocols, perhaps we ought to start improving upon the 20 and 30 year old protocols we've been relying on. Fundamental scale and design flaws will continue to empower bad people to do bad things so long as it continues to be nearly effortless. BGP, DNS, IPv4... You can only build on a foundation for so long before its age and brittleness beings to cause serious problems.
  • "Military intelligence" just met its match in the oxymoron sweepstakes.

  • This is coming from the guy that boasted on Twitter how much money he received from lobbyists that support CISPA... A truly devoted corporate **ahem** civil servant. It's no surprise that 2 out of 3 people would rather have a colonoscopy than the current congress.

    http://boingboing.net/2013/03/23/congressman-boasts-on-twitter.html [boingboing.net]

Slashdot Top Deals

Some people only open up to tell you that they're closed.

Close