Paths2Trust

3 minutes on TV News

No, it wasn't 60 minutes... it was just 3 minutes... on Denver's TV2, "the Deuce".  I was invited for an interview on Nina Sparano's INTERNET CAFE to talk about what the department of homeland security is up to to protect cyber-space. 

It isn't possible (or even appropriate) to go into deep technical detail on a TV session for a general audience.  So I gave a quick overview of the problem of DNS hijacking.  Homeland Security has been really concerned that the fundamental layers of the internet are vulnerable to attack (BGP & DNS being the 2 chief interests).  The fact is, you can put up all the firewalls, IPS and other protections on your web or email, but they won't do any good if people don't even get to you because your domain has been hijacked.

So I gave a quick overview of the problem:  What it is, what happens, why it is so bad...  Then a brief bit on the security extensions DNSSEC that the DHS has been helping to fund and promote.  Finally, who's deploying it (.gov is the poster child, as well as .org and others) and how it will roll out over the next couple of years. 

It was fun, and seemed to go well.   And it really makes you think when you have to delete all the techno-babble and boil the conversation down into the fundamental questions and motivations and priorities.  Maybe this is an exercise for any technical pundit to do now and then.  Talk technology without going into the technology details.  See if it plays in Peoria.  Or Denver. 

Here's TV2's blog on the story.

DNS attack or DDoS attack? Waddayathink?

Yesterday I said I had my doubts that the Twitter situation was a DNS attack because a lot more sites than Twitter would have gone offline.  (comment was posted at Byron Acohido's blog.)  DNS is like that.  DNS servers serve up the IP addresses of LOTS of sites from a single server, not just one.

So, I did a DIG against twitter.com and found out that it was hosted by DYNECT (DYNDNS).  Tom Daly of DynDNS and I have conversed in the past, and he had written to us at Secure64 that they weren't under attack.  He even posted some comments about it http://dynamicnetworkservices.com/journal/AboutDDoSAttacks.

 I can't agree more that people seem to confuse DNS attacks with DDoS attacks in the press.  Probably because that letter "N" looks so much like that letter "o".  Or not. 

So it will probably still be awhile before we get some real data from twitter about what really happened.

On a related subject:  There's been some comments on CircleID  about how unlikely it is that this was a political DDoS attack against one person. 

He's ba-a-a-a-a-a-ackkk; twitter twitter

Wow!  It's been way too many months since I've written anything here.  My bad.  I'd make lame excuses about being busy and traveling and such, but such is life.

Recent news:  I actually got invited to be on the local news in Denver for a short live interview on the twitter outage.  It was fun!  I actually had people write to me to say they saw me on TV.  How cool is that? 

And the subject:  why should people care about DDoS attacks against twitter.  And in 3 short minutes on the air, I explained that twitter isn't just a social networking site, that it is becoming a legitimate communications medium -- witness the reports about demonstrations in Iran that came from facebook and twitter.  When you pick up the phone, you expect a dial tone.  What if it isn't there?  When you tweet, you expect it to work.... and what if it isn't there?  Besides, it's not just twitter.... DDoS can be directed against anyone's servers.  It's not common, but it is nasty.  So don't just look at someone else's misfortune, look at what would happen to your business if your DNS were to get DDoS'ed.  And don't wait for it to happen, it's too late by then.  Do something about it now. 

It's too bad security isn't an issue until after you're attacked......

Next.... what really happened at twitter?  What got attacked?  There are some conflicting reports out there.