Two decades ago, a 23-year-old Cornell University graduate student brought the Internet to its knees with a simple software program that skipped from computer to computer at blinding speed, thoroughly clogging the then-tiny network in the space of a few hours.
The program was intended to be a bit of cybernetic fungus that would unobtrusively wander the Net. However, a programming error turned it into a harbinger heralding the arrival of a darker cyberspace, more of a mirror for all of the chaos and conflict of the physical world than a utopian refuge from it.
Since then, things have gotten much, much worse, bad enough that there is a growing belief among engineers and security experts that Internet security and privacy have become so maddeningly elusive that the only way to fix the problem is to start over.
“Unless we’re willing to rethink today’s Internet,” says Nick McKeown, a Stanford University engineer involved in building a new Internet, “we’re just waiting for a series of public catastrophes.”
That was driven home late last year, when a malicious software program thought to have been unleashed by a criminal gang in Eastern Europe suddenly appeared after easily sidestepping the world’s best cyberdefenses. Known as Conficker, it quickly infected more than 12 million computers, ravaging everything from the computer system at a surgical ward in England to the computer networks of the French military.
Conficker remains a ticking time bomb. It now has the power to lash together those infected computers into a vast supercomputer called a botnet that can be controlled clandestinely by its creators. What comes next remains a puzzle. Conficker could be used as the world’s most powerful spam engine. Or it might be used to shut off entire sections of the Internet. Whatever happens, Conficker has demonstrated that the Internet remains highly vulnerable to a concerted attack.
“If you’re looking for a digital Pearl Harbor, we now have the Japanese ships streaming toward us on the horizon,” Rick Wesson, the chief executive of Support Intelligence, a computer consulting firm, said recently.
What a new Internet might look like is still widely debated, but one alternative would, in effect, create a “gated community” where users would give up their anonymity and certain freedoms in return for safety. Today, that is already the case for many corporate and government Internet users. As a new and more secure network becomes widely adopted, the current Internet might end up as the bad neighborhood of cyberspace.
The Internet’s original designers never foresaw that the academic and military research network they created would one day bear the burden of carrying all the world’s communications and commerce. There was no one central control point, and its designers wanted to make it possible for every network to exchange data with every other network. Little attention was given to security.
For nearly two decades, efforts to patch the existing network have focused on building sturdy digital walls, but the problem with that approach, some experts say, is that once they are evaded, the attacker has access to all the protected data behind them. “Hard on the outside, with a soft chewy center,” is the way many veteran computer security researchers think of such strategies.
The global computer security industry is thriving, and Microsoft itself began an intense corporatewide effort to improve the security of its software in 2002. But Internet security has continued to deteriorate globally. Even the most heavily garrisoned military networks have proved vulnerable.
That is why the scientists armed with government research dollars and working in collaboration with the industry are trying to figure out the best way to start over. At Stanford, where the software protocols for the original Internet were designed, researchers are creating a system to make it possible to slide a more advanced network quietly underneath today’s Internet. By the end of the summer, it will be running on eight campus networks around the United States.
The new Internet would improve security and add the capabilities to support a new generation of not-yet-invented Internet applications, as well as to do some things the current Internet does poorly — like supporting mobile users.
The university project, Stanford Clean Slate, will not by itself solve all the main security issues of the Internet. But it will equip software and hardware designers with a toolkit to make security features a more integral part of the network and ultimately give law enforcement officials more effective ways of tracking criminals through cyberspace. That alone may provide a deterrent.
This is not the first time a replacement has been proposed for the current Internet. For example, modern Windows and Macintosh computers already come equipped to support a new Internet protocol known as IPv6 that would fix many of the shortcomings of the current IPv4 version.
However, it has languished because of cost, performance and compatibility questions.
That has not discouraged the Stanford engineers, who say they are on a mission to “reinvent the Internet.” Like the existing Internet, the new network would almost certainly have no one central point of control and no one organization would run it. It is most likely to emerge as new hardware and software are built into the router computers that run today’s network and are adopted as Internet standards.
For all those efforts, though, the real limits to computer security may lie in human nature.
The Internet’s current design virtually guarantees anonymity to its users. But that anonymity is now the most vexing challenge for law enforcement. An Internet attacker can route a connection through many countries to hide his location, which may be from an account in an Internet cafe purchased with a stolen credit card.
“As soon as you start dealing with the public Internet, the whole notion of trust becomes a quagmire,” said Stefan Savage, an expert on computer security at the University of California at San Diego.
A more secure network is one that would almost certainly offer less anonymity and privacy. That is likely to be the great tradeoff for the designers of the next Internet. One idea, for example, would be to require the equivalent of driver’s licenses to permit someone to connect to a public computer network. But that runs against the deeply held libertarian ethos of the Internet.
Proving identity is likely to remain remarkably difficult in a world where it is trivial to take over someone’s computer from half a world away and operate it as your own. As long as that remains true, building a completely trustable system will remain virtually impossible.
Mobile Tech Today
2/18/09
By John Markoff
]]>
Sony Pictures Home Entertainment is using a tie-in with the video game Rock Band to promote its DVD of Spectacular!, a TV movie airing on Nickelodeon Feb. 16.