Internet providers are being asked to change protocols to protect computers from falling victim to hackers to be used in big time cyber-attacks. The governments cyber security defense department wants to work with networks like Virgin Media and BT to rewrite standards to help restrict a tactic used by hackers to pretend to be other computers in order to use them to attack online. This is also called spoofing. Dr. Ian Levy explained what is in the works:
Distributed denial of service attacks, which employ this method, have been used in numerous high profile incidents in the past fortnight, included an unprecedented hack that brought down Netflix, eBay and hundreds more popular websites. We think we can get to a point where we can say a UK machine can’t participate in a DDoS attack. We think that we can fix the underpinning infrastructure of the internet through implementation changes with ISPs and CPSs.
Their plan involves changing to the BGP, or Border Gateway Protocol and SS7, Signaling System 7 standards that have been used for decades now. They are also widely used for routing traffic. They also want to stop providers from re-routing UK web traffic and help prevent text message scams.
The ISPA or Internet Service Providers Association says that the GCHQ is applying an easy fix system to a more complex system than they are realizing:
Internet providers are working on their own fixes for such insecurities, because we don’t like DDoS on our networks either. No one country can fix this. International cooperation and working together is the solution and it won’t be fixed overnight.
He did say that the industry would be open to any suggestions on how to fix these well-known problems the BGP has, and that it would also accept funding from the intelligence agency for the hefty price it’s going to take to fix these issues.
Why so expensive? A great deal of hardware will need upgrading to make sure the changes are made throughout the world. It was also noted that the government of the UK is more than welcome to fund the project, as the NSA does in America.
Many researchers warned that changes would pose a privacy threat by re-routing traffic and won’t be able to prevent these DDoS attacks from happening.
“GCHQ doesn’t really have the trust of industry,” online security researcher Dr. Steven Murdoch said.
He added that these changes wouldn’t be able to stop DDoS attacks all together, it will just move the problem to other countries.
This all comes after the UK government launched its five-year cyber security strategy, which boosting cyber security funding by 1.9bn, and includes implementing a national firewall.
While this looks good for the UK, how will other countries fare in the cyber security storm that now takes place online between criminals and law enforcement. While it will limit cyber criminals in the UK, other countries might become victims as this traffic is being routed into other countries.