Mega DOS tomorrow?

So, slashdot is linking to some news sites that are reporting that
Aleksandr Gostev from Kapersky Labs in Russia has predicted that a large
chunk of the net will be shut down tomorrow.

I thought the ISC comment was pretty funny:

http://isc.sans.org/diary.php

The ISC would like to go out on a limb and predict that the Internet will
not vaporize into a cloud of nothingness this Thursday, but if it does,
it's been our pleasure to help stave off its inevitable annihilation this
long.
--

I didn't want to be the first to bring it up today, but what I _love_ about the MOSNEWS link quoting "Kaspersky" is how the "internet" network of South Korea going down last week was used as an example how the "whole" internet could be brought down.

I'm sorry if SK's network went down [I don't know, didn't hear about it]. I have a problem believing it is a useful case study in the global network.

Deepak Jain
AiNET

Considering the dependence upon the internet in South Korea,
and the well connected nature, it's worthwhile to watch what happens there
for possible future trends here. It's not unusual for at least the
US Domestic market to be behind Asia in a lot of ways..

  I suspect the South Korea issue that was spoken of was
really about what happened in Korea during the ms-sql/slammer
event where it caused a lot of things to stop working due to
dependence upon networking.

  if ms-sql slammer happened again this week, it would still
be a big deal.. i'd have to say, what have you done since then
to prepare yourselves for a large distributed source/dest attack
(which is what it actually looked like).

  - jared

So, slashdot is linking to some news sites that are reporting that
Aleksandr Gostev from Kapersky Labs in Russia has predicted that a large
chunk of the net will be shut down tomorrow.

I thought the ISC comment was pretty funny:

SANS.edu Internet Storm Center - SANS Internet Storm Center
--
e-Jihad Begins Thursday, Internet Predicted to Melt Down by Mid-day

You should probably starting backing up that gig of gmail to local
storage. According to a Russian news site, Kaspersky Labs states that
terrorists will launch attacks which will paralyze the Internet this
Thursday. This tragically coincides with two weeks of script kiddie
attacks (which were scheduled to begin this past Sunday) aimed at
disrupting the Republican national convention. In addition, many college
students are back on campus this week, which provides the e-terrorists and
i-subversives with a veritable candyland of insecure boxes on big pipes.
Faced with this triple threat, our beloved Internet will surely fall.

The ISC would like to go out on a limb and predict that the Internet will
not vaporize into a cloud of nothingness this Thursday, but if it does,
it's been our pleasure to help stave off its inevitable annihilation this
long.
--

Andy

Should have kept reading...

Reply by Handyman (97520) -
"Kaspersky labs says they were misquoted. Quoting from a mail from
kaspersky labs themselves (as found in a repost on the NTBugtraq mailing
list):

A handful of sites are stating that Eugene Kaspersky, founder of Kaspersky
Labs, believes that tomorrow will bring a massive terrorist attack on the
Internet. This is being quoted in a range of ways, ranging from factual
reporting to citing the story as an example of cyber hysteria.

However, Kaspersky is not predicting the end of the Internet tomorrow - or
even in the near future. The story stems from brief comments made
yesterday at a press conference which was dedicated to cybercrime and the
problems of spam.

At this press conference, Kaspersky commented that the possibility of
terrorists using the Internet as a tool to attack certain countries as a
reality. As an example, he cited the fact that a number of Arabic and
Hebrew language websites contained an announcement of an 'electronic
jihad' against Israel, to start on 26th August 2004.

In an interview today, Kaspersky stressed that such information was not
necessarily trustworthy. 'We don't know who is behind these statements.'
He went on to clarify: 'It's not the first time the term 'electronic
jihad' has been used. We've seen this before, with the focus being on
sending racist emails, and defacing and hacking Israeli web sites. But it
is the first time I have seen sites encouraging the use of Internet
attacks against one country as a form of terrorism.'

'As we've already stated many times in the past, it would be easy enough
to use a network of infected computers to launch such an attack. We saw
the impact that Sasser, Mydoom and Slammer had, on the Internet,
businesses and organisations. Just imagine if such an attack was directed
at one country or one critical point in the infrastructure of the
Internet. Computers are a tool - and just like any tool, they can be used
or misused.'

Kaspersky emphasised that the likelihood of a massive attack directed
against Israeli institutions tomorrow is low. However, he believes that
Pandora's box has now been opened. Hackers and virus writers can be
motivated by a range of factors: money, curiosity, or political
conviction. But whatever their motivation, the insecure nature of the
Internet and weak security precautions offer a wealth of opportunities.
'Maybe it won't be tomorrow, or the day after tomorrow - but sooner or
later, terrorists will be using the Internet as another weapon in their
arsenal.'"

And here's the *real* reason why:

XP2 SP2 goes on AU tomorrow...

http://www.neowin.net/comments.php?id=23613&category=main

Might be interesting to see how much of a traffic blip this causes.

The Home Version has been up for a week or so now, hasn't it? It'll be more interesting to see how many businesses temporarily go out of business as they go around disabling the firewall on all of their XP Pro systems...

FYI, Google returns 9,250 hits on the search string:

"imminent death of the net predicted film at 11"

Isn't Microsoft heavily Akamai:zed (or something equivalent)? I am usually
able to download patches at 5+ megabyte/s if I am on an internet
connection able to handle it, so some kind of caching scheme is used
anyway.

Hello! Can anybody hear me?! This the Internet still there?!

Thanks

Jason :slight_smile:

Can you hear me now? (I'm testing my verizon circuits :wink: )

* You're getting kind of fuzzy ... no longer full quieting ... Into the
noise floor.

FWIW, we (Nordunet/Sunet) today saw one of the larger dDoS attacks we've
seen so far in our end of the net, totaling around 2MPPS toward a single
host. It was coordinated, wery well-spread (came in through both transit
providers at equal balance, and almost as much over the REN connection
towards the rest of Europe and some spillage over private peers.) and
persistent. We've had to deploy several layers of null0 routes to fight it,
(our transit providers have been very helpful, btw.) but service to
anything except the attacked host has not been affected much.

Them tax-financed OC192's come in handy at times :wink: