Request from the GICC groupto connect.

Consider funnelling your excellent posts to a forum dedicated to only reporting the Y2K glitch arena rather than discussing it.

See also Glitch Central.

Thanks.

-- (y2ktimebomb2000@yahoo.com), March 03, 2000

Answers

Compliance is assumed.

Meanwhile, how many thousands of posts do you estimate will be posted into this archive?

How many UNANSWERED QUESTIONS will finally be answered?

Stay linked...

-- dinosaur (dinosaur@williams-net.com), March 03, 2000.

I'm not Homer, and this doesn't necessarily have anything to do with Y2k, but....

http://www.usatoday.com/usatonline/20000309/2012438s.htm

Link

Page 1A

How the government failed to stop the world's worst Internet attack

By M.J. Zuckerman

USA TODAY

Susan Levy Haskell arrived at her office at the University of Minnesota as usual before 8 a.m. on Monday, Aug. 16, 1999, where she watched at first curiously, then later in horror, as the university computer system came under attack from a massive yet anonymous Internet adversary.

Haskell, the university's computer security coordinator, says that as hours passed the volume of incoming malicious traffic rose from a mere annoyance to an all-consuming electronic dissonance. The Internet connection grew ever less responsive, degrading steadily until the university was cut off from the world.

''It became pretty terrifying to realize how many machines had to be involved. It seemed like hundreds.''

Investigators later determined that 2,200 computer systems, including those at more than 30 universities in the United States, had become unwitting ''zombies,'' serving a still unidentified master computer, which directed the attacks and forced the university off the Internet for two days.

In a matter of weeks after the Minnesota incident,academics and elite computer security firms began spreading the word to clients and colleagues that this newly enhanced ''denial of service'' (DoS) attack was a clear and immediate danger to the Internet.

But it would take more than a month before federal officials at the National Infrastructure Protection Center (NIPC), which is responsible for national computer security matters, to learn of the incident and three more months for them to conclude that it was a threat worthy of a warning to the public.

It is now apparent that throughout the end of 1999,cybervandals were infecting large, insufficiently secured computer systems as zombies and laying the groundwork for a series of attacks last month that rocked e-commerce.

The delayed response and limited distribution of threat information is one of several criticisms being leveled at the NIPC and its sister agencies as the investigation into the attacks progresses slowly, according to recent congressional testimony.

''It was not enough,'' says Jamie Gorelick, the former deputy attorney general, who from 1994 to 1997 directed the administration's creation of the current electronic defense policy.

She and others say the protection center failed, leaving many e- commerce firms unprepared for the attacks Feb. 8-11 that slowed the global Internet by 20% and shut down the world's most popular commercial Web sites and the FBI's home page.

''There needs to be some agile operational capacity in the government, an ability to move quickly to provide warnings,'' she says. ''This doesn't sound at all like what we had in mind.''

Michael Vatis, director of the NIPC, an interagency fusion of federal, local and international organizations based at the FBI, defends his agency's response. It says it permitted the private sector to prepare for the worst while avoiding public hysteria.

''Three years ago we wouldn't have been able to respond at all,'' Vatis says. ''Today we have an effective resource'' for investigating crimes and issuing threat alerts.

Critics say the protection center and its sister agencies have fallen short of the vision President Clinton had two years ago when he issued a plan to ''create a genuine public-private partnership to protect America in the 21st century'' from devastating cyberattacks. The plan called for the private sector, which owns and operates both the Internet and the infrastructure that supports it -- electricity, banking and communications -- to create secure information-sharing centers in which companies could anonymously share threat information, new vulnerabilities and crises data. It also created a Commerce Department coordinating center to work with those industry clearinghouses and the NIPC.

But as the administration seeks $37 million in new spending for cybersecurity, the NIPC and its sister agencies are troubled by confusion within their own ranks as well as a lack of cooperation from companies and other government agencies:

* Other government agencies are refusing to work with the NIPC, privately pointing to the FBI's longstanding reputation for not sharing well with others. ''That's something we're still working on,'' Vatis says.

The Pentagon is the only Cabinet-level agency represented at the NIPC. The Secret Service, Transportation Department and Treasury Department, each of which is designated to have representation at the protection center, refuse to take part. The Department of Energy, which is supposed to play a major role at the center, is not represented. The CIA, which has four slots at the center, has filled one.

* Friction and turf battles between the new cyber-security agencies may be hampering operations. The National Coordinator for infrastructure protection and counterterrorism is Richard Clarke, a White House official, who must get clearance on a case-by-case basis before the NIPC will brief him about investigations.

Vatis says Justice Department guidelines bar the FBI from briefing anyone outside the department about ongoing cases unless the attorney general grants a waiver.

* The Internet community is demanding broader distribution of more timely threat information, beyond the security professionals with whom the NIPC typically deals. ''If you are only spreading the word to specialists, then you are not getting threat information out across the board to small universities or e-tailers,'' says Harris Miller of the Information Technology Association of America, a leading trade association representing 11,000 corporations.

* Though some companies are warming to the idea of sharing information with the government, many complain that they remain uneasy about government efforts to police the Internet.

''Where (the federal government) is completely failing is to be a place people trust'' with delicate information, says Alan Pallar of the SANS Institute, an education facility for computer system administrators that claims 100,000 members. ''Ninety-eight percent of the time they won't share with the FBI because they fear having their (computers) confiscated, that their troubles will become public knowledge and that the agents will scare (clients) to death.''

* The president's plan has created so many entities gathering data on Internet vulnerabilities that it is causing confusion. ''Imagine living in a community where there are seven different numbers to call for 911 services,'' says Mark Rasch, chief counsel to Global Integrity, a leading cybersecurity firm that hosts the financial industry's information sharing center. ''You need to have one number, one place, that everyone trusts.''

Adds Tom Noonan, CEO of Internet Security Systems, probably the fastest-growing firm in its field and a major booster of the NIPC: ''Quite frankly, I'm confused by all these different government groups.''

Word spreads slowly

In the days after the University of Minnesota attack, Haskell says her 911 instinct was to notify academic colleagues or other trusted computer professionals.

One of those she contacted was David Dittrich, director of software engineering at the University of Washington in Seattle. He became the first person to track down and unlock the codes that make the attacks operate.

It was a matter of days before he realized the new attack technique required immediate action. But the wheels of government turn slowly.

Dittrich first alerted CERT, the Computer Emergency Response Team at Carnegie-Mellon University, the nation's premier clearinghouse for data on computer vulnerability. By early September, it began organizing an unprecedented international conference to examine the emerging threat.

Based on CERT's letters of invitation to the conference, a handful of high-end security firms learned of the attack technique, and in October and November the firms quietly briefed clients about the impending threat.

Though the NIPC is a sponsor of CERT and has a liaison for the emergency response team on its staff, it received its first substantial report from CERT in late October. The response team has declined to comment on the apparent delay.

The three-day CERT conference in early November adjourned with this determination: ''There is essentially nothing a site can do with currently available technology to prevent becoming a victim'' of a denial-of-service attack.

The only prevention, the conferees said, was for system operators to update their security precautions to prevent vandals from exploiting known system weaknesses to gain control of their computers as attack ''zombies.''

On Dec. 8, the NIPC sent a note briefing FBI Director Louis Freeh for the first time. On Dec. 17, Vatis personally briefed Attorney General Janet Reno as part of an overview of preparations being made for Y2K.

By that point, several DoS attacks already had occurred, but ''people weren't getting the message,'' Dittrich says. ''CERT and NIPC were really worried. They had obviously been hearing about a lot more intrusions. They went back and recategorized a whole bunch of incident reports going back to April-May time frame, and they started telling me that this is a really big thing.''

But not until the NIPC, working with Dittrich and Mitre Corp., developed a tool for identifying zombies in a system did the protection center decide to warn the public Dec. 30 and post the tool for anyone to download.

By that time, Vatis says, ''someone was setting the groundwork for an attack, and that is when we decided to make a public announcement.''

Electronic 'night of the living dead'

The NIPC was convinced that New Year's Eve ''could be a day for people to start sending marching orders to these zombies. We were afraid that Dec. 31 might become the night of the living dead,'' he says.

''Thanks for giving us plenty of time to prepare,'' says a sarcastic Vinton Cerf, an MCI WorldCom executive who is widely regarded as a founder of the Internet. ''The timing of this all was singularly unfortunate.''

But the protection center gets high praise from many security firms for being the first to provide an effective tool to locate and remove the zombie infections. Vatis says far more damage would have occurred in February otherwise.

''You know, I'm sensing a little bit of doublespeak here,'' Vatis says. ''Business is saying, 'We don't want the government telling us what to do; we can fix this ourselves.' And I agree. But then I hear people saying, 'Gosh, government didn't warn us loud enough.' ''

''People have been saying for a long time that it's going to take an electronic Pearl Harbor for people to take security seriously,'' he says. ''There's a kernel of truth there because we live in an event- driven society.''

-- March 9, 2000 (In@the.news), March 10, 2000.

good article. this forum suffered dos attacks. closed now. can't defend against. phil greenspun take note.

-- (reading@nd.thinking), March 10, 2000.

Technology concerns...

http://www.washingtonpost.com/wp-srv/WPlate/2000-03/12/215l-031200- idx.html

Link

From Internet Scientist, a Preview of Extinction

By Joel Garreau

Washington Post Staff Writer

Sunday, March 12, 2000; Page A15

A respected creator of the Information Age has written an extraordinary critique of accelerating technological change in which he suggests that new technologies could cause "something like extinction" of humankind within the next two generations.

The alarming prediction, intended to be provocative, is striking because it comes not from a critic of technology but rather from a man who invented much of it: Bill Joy, chief scientist and co-founder of Sun Microsystems Inc., the leading Web technology manufacturer.

Joy was an original co-chairman of a presidential commission on the future of information technology. His warning, he said in a telephone interview, is meant to be reminiscent of Albert Einstein's famous 1939 letter to President Franklin Delano Roosevelt alerting him to the possibility of an atomic bomb.

In a 24-page article in the Wired magazine that will appear on the Web Tuesday, Joy says he finds himself essentially agreeing, to his horror, with a core argument of the Unabomber, Theodore Kaczynski-- that advanced technology poses a threat to the human species. "I have always believed that making software more reliable, given its many uses, will make the world a safer and better place," Joy wrote in the article, which he worked on for six months. "If I were to come to believe the opposite, then I would be morally obligated to stop this work. I can now imagine that such a day may come."

Joy enjoys a level-headed reputation in the industry. "Nobody is more phlegmatic than Bill," said Stewart Brand, an Internet pioneer.

"He is the adult in the room."

Joy is disturbed by a suite of advances . He views as credible the prediction that by 2030, computers will be a million times more powerful than they are today. He respects the possibility that robots may exceed humans in intelligence, while being able to replicate themselves.

He points to nanotechnology--the emerging science that seeks to create any desired object on an atom-by-atom basis--and agrees that it has the potential to allow inexpensive production of smart machines so small they could fit inside a blood vessel. Genetic technology, meanwhile, is inexorably generating the power to create new forms of life that could reproduce.

What deeply worries him is that these technologies collectively create the ability to unleash self-replicating, mutating, mechanical or biological plagues. These would be "a replication attack in the physical world" comparable to the replication attack in the virtual world that recently caused the shutdowns of major commercial Web sites.

"If you can let something loose that can make more copies of itself," Joy said in a telephone interview, "it is very difficult to recall. It is as easy as eradicating all the mosquitoes: They are everywhere and make more of themselves. If attacked, they mutate and become immune. . . . That creates the possibility of empowering individuals for extreme evil. If we don't do anything, the risk is very high of one crazy person doing something very bad."

What further concerns him is the huge profits from any single advance that may seem beneficial in itself. "It is always hard to see the bigger impact while you are in the vortex of a change," Joy wrote. "We have long been driven by the overarching desire to know that is the nature of science's quest, not stopping to notice that the progress to newer and more powerful technologies can take on a life of its own."

Finally, he argues, this threat to humanity is much greater than that of nuclear weapons because those are hard to build. By contrast, he says, these new technologies are not hard to come by. Therefore, he reasons, the problem will not be "rogue states, but rogue individuals."

Joy acknowledges that to some people, this may all sound like science fiction. "After Y2K didn't happen," he said, "some people will feel free to dismiss this, saying everything will work out."

Joy is less clear on how such a scenario could be prevented. When asked how he personally would stop this progression, he stumbled. "Sun has always struggled with being an ethical innovator," he said. "We are tool builders. I'm trailing off here."

) Copyright 2000 The Washington Post Company

-- (worth@a.read), March 15, 2000.