Government Industry
The Palestinian-Israel: cyberwar
Military Review, March-April, 2003 by Patrick D. Allen, Chris C. Demchak
Phase 4: Global Learning and Increased Cyber Arms Development and Proliferation. Hacking tools used and improved in the Palestinian-Israeli cyberwar soon appeared in other international and domestic hacks. During the Palestinian-Israeli cyberwar, Israeli hackers developed a new type of DDoS attack tool. Teenage hackers in the United States acquired this attack tool from Israeli hackers and planned a worldwide attack on the Internet to take place on New Year's Day 2001. Had the FBI not been alerted to the plot, the attack might have succeeded in seriously disrupting the Internet on New Year's Day. (36)
During the U.S.-China cyber skirmish, the Carko DDoS attack was launched. (37) Not only did a Carko DDoS agent attempt to crash the target system, he used a buffer overflow attack to enter a new root password, or he installed a back door in the target system while the target system was recovering from the attack. This meant systems that were brought down by Carko attacks needed to be checked for software that would allow later penetrations.
Although DDoS attacks were known and used before this conflict, the ability for one person with limited bandwidth to undertake a large-scale DDoS attack is a fairly recent development. This type of DDoS attack can use a 56-kilobyte modem and an asymmetric digital subscriber line (ADSL) to begin an attack, which is then magnified 10,000 times by net service broadcasters to generate attacks of the magnitude of two thirds of a T1 line. "With tools like these, a 56-kilobyte modem can become a powerful weapon and your bandwidth is irrelevant," notes Ben Venzke, of iDefense. (38) A few coordinated laptop attacks through modems, therefore, can generate a combined attack equal to several T1 lines or even a T3 line. Such an attack can swamp most systems.
In addition to DDoS attacks launched through broadcast sites, there is also a technique whereby hackers place software on other Internet servers and later trigger it at a particular time. These infected servers are called zombies in that they mindlessly participate in DDoS attacks. The FBI discovered that 560 servers at 220 Internet sites had been infected for use in a single widespread DDoS attack. (39)
Overall, the rate of cyber arms development tends to increase during cyber conflicts, just as weaponry develops faster during war. What is more challenging, however, is that the rate of proliferation of cyber arms is much faster than the proliferation of traditional arms.
Policy Implications
Based on these events, there are four national and international policy needs:
1. To decide who will provide security on the Web.
2. To provide legal responses to rapid horizontal escalation.
3. To enforce legal responsibility for hacker citizens responsible for international incidents.
4. To halt proliferation of cyber arms.
Who will provide security on the Web? The main policy question associated with the cost of doing business on the Web is, "Who is responsible for securing the Web?" Is it the large ISP? Corporations? The government? Or will the Internet remain a free-fire zone? (40)