How Hackers Can Shut Down A Website

Remember a few decades ago when there was a plan for everyone to flush their toilets at the same time, and drain the water supply, just brie
President & CEO, The Enterprise Group
April 28, 2011

Remember a few decades ago when there was a plan for everyone to flush their toilets at the same time, and drain the water supply, just briefly. It didn’t work so well, due to the problems of timing and communications, but the idea was a valid one.

Do anything in huge orders of magnitude beyond what the systems were designed for and they crash. McDonald’s noontime rush for burgers would be devastated by the arrival of six busloads of tourists all at once.

Now imagine getting thousands—or millions—of computers to hit the same web site all at once. The servers simply overload and must shut down. The site has just been hit with a DDoS: Distributed Denial of Service attack.

DDoS is one of the most popular forms or cyber-attack since it is relatively easy to do, and causes a lot of disruption. “Anonymous” as the hacker group names itself, sympathized with WikiLeaks and used this approach in its attack on MasterCard’s site—as retaliation for MasterCard shutting off credit to WikiLeaks.

Russia allegedly used a form of this called “crowd-sourcing” to shut down most of the servers in its former “state” of Estonia. Why? To prove to the independent minded Estonians that Russia could still control some aspects of their lives. This kind of attack is in international news every week, somewhere in the world. For those who are interested, go to Google Alerts and create an alert for “DDoS” and one for “Distributed Denial of Service” but choose the weekly report, because you’ll get a lot of reports.

Sites sometimes get overloaded for valid reasons, as did the first on-line broadcast of the Victoria’s Secret Lingerie Show a few years back. This sometimes happens legitimately when commercial Web marketers underestimate the demand for access to their site.

Now, hackers act in groups, and can use “armies of zombies”—computers whose administrative control they have taken over via worm viruses—to do this same thing, but far more accurately and destructively. This is a very dangerous potential threat.

There is very little that the site can do to protect itself. If it shuts off traffic, it is self-defeating. If it shuts down and goes off line, the hackers have won. In fact, no one is quite sure what can be done, except to try shutting off the attacks at “choke points” in the network of master routers and switches that control the Internet. Even this is a problem, because it could ripple into larger problems.

At least the U. S. government is now taking this kind of threat seriously, which it didn’t do for most of the past decade. Federal cyber threat agencies have been created in the Department of Homeland Security and the Department of Defense and are being staffed. Our nation’s military relies so much on the information infrastructure that an attack on GPS (Global Positioning Systems) or on the Internet would cripple many essential government/military functions. The FBI is actively going after cyber-criminals.

Is there anything you can do? Use the best security available to protect your systems. Be vigilant and report intrusion attempts and probes to your Internet Service Provider. Don’t open emails and especially attachments of unknown origin or that look suspicious in nature. No joke or cartoon is worth exposing your computer to malware. And finally, pray, because nobody has yet devised a solid defense against a DDoS. That’s the price of “progress,” I guess.

President & CEO, The Enterprise Group