If you had never heard of a DDoS attack before, after last week’s assault that hobbled Twitter, Netflix and other internet networks you’d know how dangerous they can be. A distributed denial of service (DDoS) assault is one of the ways to bring a website down, by sending millions of requests to the host server so that it get overloaded and just stops letting anyone through.
It all sounds like very much like a science fiction movie – which is because sci-fi often uses technology the average Johan or Jabu have never heard of – but it is all too dangerously real.
Instead of attacking sites like Twitter, Netflix, Amazon, Spotify and Reddit directly, Friday’s onslaught targeted a company called Dyn, which provides domain name server (DNS) registries — kind of like the telephone book for servers on the internet.
By a strange fluke of fate, the terrible influence DDoS attacks have on news organisations, and therefore freedom of speech, was the subject of a scary presentation by George Conard at the Media Party Africa on the same day this kind of attack became front page news. Conard works for a subsidiary of Google’s parent company, now called Alphabet, on Project Shield, a service provided by Google to news sites to prevent them being attacked. There are some 45m DDoS attacks a year, and about 50% of news organisations experience such attacks, he told the journalism conference in Cape Town. Terrifyingly, there are websites that sell “network stressing” services – as they are euphemistically advertised on these sites – for as little as US$5.
Project Shield is a good-will service that Google offers to news sites, which are often the victims of such DDoS attacks when they publish exposes or investigations, allowing “bad guys” – as the security industry just as euphemistically calls them – to exact revenge.
One estimate put last Friday’s disruption at $110m in lost revenue and sales – which is part of the reason “bad guys” do it to news sites. Would-be readers can’t read the investigation, while the site loses revenue. It’s a cruel two-sided sword.
Even more terrifying is that a chunk of the devices used to execute the DDoS are devices like digital video recorders (DVRs) and CCTV video cameras, which are online and have poor security; or are too “dumb” to have any security. These devices make up the so-called internet of things (IoT), which is a vast network of things like connected DVRs (like DStv’s Explora), fridges, baby cameras, web-cams, and a range of sensors.
Where hackers once used their skills to show off their prowess at circumventing security, it shifted in the last decade to financial imperatives, from sending spam to 419 emails. Black hat hackers, as they are known, have infiltrated millions of computers and turned them into “bots” – for robots – as part of vast “botnets”.
I’m going to use the word terrifying again because you no longer have to create your own botnet, you can merely rent it – the dark web is filled with such pricelists. Now, DDoS has evolved to similar levels where Conard warns you don’t have to have any technical skills to buy an attack. You buy the service (with BitCoin), type in the website address for the “network stressing” (which the hacking sites don’t require you to prove ownership of) and down does press freedom.
We can thank our lucky stars Presidunce Jacob Zuma and the Guptas don’t know how to do this.
This column first appeared in Financial Mail
