The sheriffs of the wild web

The internet has its very own magnificent seven. They are a group of security experts across the globe who can reboot cyberspace if it comes under attack. Jerome Taylor discovers more

On a Thursday evening in December a remarkable attack by a shadowy group of hackers briefly paralysed Twitter. For two hours anyone who typed www. twitter.com into their internet explorer's address bar was re-routed to a simple black screen showing a green flag and the words: "This site has been hacked by the Iranian Cyber Army."

Beneath the flag was a line of Persian poetry which read: "We shall strike if the leader orders, we shall lose our heads if the leader wishes."



The attack caused ripples of excitement within the online community but it was largely thought to be a one off. Yet a month later the same group launched an equally bold assault on Baidu, China most popular search engine. For more than four hours a website with handles 60 per cent of the world's most-populous nation's web searches was completely inaccessible.



Both instances employed a specific type of hack known as a "DNS attack" and together they provoked an avalanche of discussion among cyber security experts.



DNS stands for Domain Name System and in many ways it is the beating heart of the internet. Computers are only able to read numbers, which means that every website address is given an individual numerical code (known as an IP address) which is stored on two vast servers at opposing ends of the United States.



When we type in a web address, the DNS acts like an enormous digital phone book, matching up website names to the correct numbers and ensuring that we actually reach the website we want to get to rather than an impostor site. Without it, trust in the internet – the most important concept in cyber security – would be broken. A world without DNS would create online anarchy because we would never know whether the website we were visiting – be it a bank account, Facebook, our email or a government site – was real or a fake.



The Iranian Cyber Army's attacks were significant because they had successfully broke into the DNS system and rerouted traffic away from Twitter and Baidu.



The assaults only targeted two websites and the damage was quickly rectified. But it begged a series of frightening hypotheticals: what if cyber criminals were able to take control of DNS? What if they took the whole system offline?



For a number of years such a prospect had been causing sleepless nights at the Internet Corporation for Assigned Names and Numbers (Icann), the non-profit independent body which effectively regulates internet addresses. A significant attack on the DNS system could cripple the internet, sending the world back to a pre-digital dark age. In the words of Bryon Holland, CEO of the Canadian Internet Registration Authority: "If DNS were to stop working, it would render the Internet effectively non-responsive."



Icann realised that if the DNS system was ever brought down, someone would have to be given the job of bringing the world back online. You couldn't entrust that responsibility to a single group of experts based in one facility because the internet was supposed to be a truly global entity, universally accessible and outside the reach of a single sovereign state. It would also be much easier to steal the tools needed to rebuild the internet if they were all hanging up in the same shed.



So last month, in an announcement that could have come straight out of a Dan Brown novel, Icann announced that the internet would be protected by seven "guardians" on three different continents whose job would be to reboot the internet if the DNS system was ever critically impaired.



The announcement sent bloggers and conspiracy theorists into apoplexies of feverish speculation – here is a secret Lord of the Rings-style fellowship of gallant internet knights poised to protect the internet from total annihilation. The reality might be a little less sexy but it goes right to the heart of whether the internet could ever fail.



Icann itself describes the key holders as "an elite international circle of trust charged with restarting the internet in the event of a global catastrophe". Seven people, including Paul Kane, a British cyber expert from Bath, have been given smart cards in tamper-proof evidence bags which they must keep safe at all costs. Each card contains a portion of coding which will enable technicians to restart the DNS system should it be taken over. The other card holders are based in Canada, Trinidad and Tobago, Burkina Faso, the Czech Republic, China and the United States.



In the event of a catastrophic attack on the Domain Name System, at least five of the seven card holders would need to travel to one of two secure facilities in the US to reboot the system.



The exact locations of the facilities are not published but it is thought one of them is in a heavily guarded compound in Virginia whilst the other is on the west coast somewhere in the desert, possibly Nevada.



Speaking about his newfound responsibility, Mr Kane says he has placed his card in a secure facility. But he is keen to stress that the chances of him ever needing to use it are very small.



"It is so unlikely that I'll ever be called upon but at least the process has been thought through for a full disaster recovery mechanism being in place," he told the BBC.



But how vulnerable is the internet? Would it even be possible to bring down the DNS servers? Tim Stevens, an expert in cyber security at the Centre for Science and Security Studies, King's College London, says conspiracy theorists and cyber security hawks often overstate the vulnerabilities of the internet. But he adds that it is always worth planning for the worst-case scenario.



"In the States you'd have to bring down the west coast and the east coast DNS servers to remove total functionality and to do that would take an enormous amount of planning, not to mention insider knowledge of how these systems operate," he says. "It's so unlikely. But given this is all part of security planning you do prepare for the worst. Security is not perfect and it never will be, but generally speaking these new keys seem to be quite sensible."



The most salient question to ask is what could be gained from bringing down the internet. Criminal groups may specialises in DNS hacking to steal money but they need the internet to be fully functional if their schemes are to work.



Equally, a stealth attack from a sovereign state on the DNS servers in the US would inevitably cripple that country's own ability to use and trust the web.



"At the moment it's highly unlikely that a nation state would launch an attack like that against the United States," says Stevens. "I know there's an awful lot of concern in DC about the Chinese, about the Russians. But really neither Russia nor China want the internet to go down either. We would only be talking about exceptional circumstances, you'd be looking at a situation where relations between two states have broken down to such a degree that war is inevitable."



Two years ago this month Russian and Georgian forces fought a brief but bloody battle over the breakaway republic of South Ossetia. Cyber security experts watched the conflict with interest because it provided a window into how future wars will be fought in cyberspace as well as on the battlefield.



As Russian tanks poured into South Ossetia they were accompanied by a sustained cyber assault on Georgia's internet, crippling the country's communication network at a crucial time. Russia has not admitted responsibility for the hack attacks but it is widely accepted that at least one of its internal security services and possibly the military was behind it.



A full-scale war between two superpowers is perhaps the only event that would herald a major attack on the internet itself. In which case, we should heed the words of Norm Ritchie, Canada's internet key card holder, who says that in such a scenario, "we probably have bigger things to worry about than the internet".



How vulnerable is the net?

Icann's key holder system aims to protect the internet against the DNS hijackers, but are there more prevalent threats to connectivity?

In 2008 two underwater cables were severed bringing internet blackouts to 15 countries in the Middle East and Asia – 80 per cent of Indian connectivity was hit, triggering market panic. Sabotage? No, satellite images identified two ships that had dropped anchors on fibre optics.

An al-Qa'ida plot to attack Telehouse Europe – the UK's leading internet hub – was uncovered in 2007 by Scotland Yard. The attack may have rendered much of the UK without internet, but server farms are built with security in mind, away from airports and in reinforced buildings.

The Melissa virus in 1999 "wreaked havoc on government and private sector networks" according to the FBI. The ILOVEYOU bug in 2000 infected 1 in 10 net-connected computers, causing billions-worth of damage. Anti-viral software has improved vastly since and terrorist electronic attacks are nullified by experts. A virus capable of bringing down the internet would face the greatest minds in the field.

Social engineering – manipulating people to divulge confidential information – is commonplace but is often for personal gain, not destruction. But with 8 per cent of internet traffic said to be fraudulent, threats to security do exist – DNS hijacking, viruses, or physical damage – and Icann's cautious approach is warranted.

Anthony Pearce

PROMOTED VIDEO
Life and Style
ebookNow available in paperback
Life and Style
ebooksA superb mix of recipes serving up the freshest of local produce in a delicious range of styles
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Recruitment Genius: PHP Developer

    £25000 - £40000 per annum: Recruitment Genius: A PHP Developer with knowledge ...

    SThree: Associate Recruitment Consultant

    £18000 - £23000 per annum + OTE: SThree: SThree are seeking Associate Recruitm...

    Recruitment Genius: Senior Software Engineer - PHP

    £33000 - £50000 per annum: Recruitment Genius: This is an exciting opportunity...

    Opilio Recruitment: Field Marketing Manage

    £25k - 40k per year + Benefits: Opilio Recruitment: A fantastic opportunity ...

    Day In a Page

    Homeless Veterans appeal: 'You look for someone who's an inspiration and try to be like them'

    Homeless Veterans appeal

    In 2010, Sgt Gary Jamieson stepped on an IED in Afghanistan and lost his legs and an arm. He reveals what, and who, helped him to make a remarkable recovery
    Could cannabis oil reverse the effects of cancer?

    Could cannabis oil reverse effects of cancer?

    As a film following six patients receiving the controversial treatment is released, Kate Hilpern uncovers a very slippery issue
    The Interview movie review: You can't see Seth Rogen and James Franco's Kim Jong Un assassination film, but you can read about it here

    The Interview movie review

    You can't see Seth Rogen and James Franco's Kim Jong Un assassination film, but you can read about it here
    Serial mania has propelled podcasts into the cultural mainstream

    How podcasts became mainstream

    People have consumed gripping armchair investigation Serial with a relish typically reserved for box-set binges
    Jesus Christ has become an unlikely pin-up for hipster marketing companies

    Jesus Christ has become an unlikely pin-up

    Kevin Lee Light, aka "Jesus", is the newest client of creative agency Mother while rival agency Anomaly has launched Sexy Jesus, depicting the Messiah in a series of Athena-style poses
    Rosetta space mission voted most important scientific breakthrough of 2014

    A memorable year for science – if not for mice

    The most important scientific breakthroughs of 2014
    Christmas cocktails to make you merry: From eggnog to Brown Betty and Rum Bumpo

    Christmas cocktails to make you merry

    Mulled wine is an essential seasonal treat. But now drinkers are rediscovering other traditional festive tipples. Angela Clutton raises a glass to Christmas cocktails
    5 best activity trackers

    Fitness technology: 5 best activity trackers

    Up the ante in your regimen and change the habits of a lifetime with this wearable tech
    Paul Scholes column: It's a little-known fact, but I have played one of the seven dwarves

    Paul Scholes column

    It's a little-known fact, but I have played one of the seven dwarves
    Fifa's travelling circus once again steals limelight from real stars

    Fifa's travelling circus once again steals limelight from real stars

    Club World Cup kicked into the long grass by the continued farce surrounding Blatter, Garcia, Russia and Qatar
    Frank Warren column: 2014 – boxing is back and winning new fans

    Frank Warren: Boxing is back and winning new fans

    2014 proves it's now one of sport's biggest hitters again
    Jeb Bush vs Hillary Clinton: The power dynamics of the two first families

    Jeb Bush vs Hillary Clinton

    Karen Tumulty explores the power dynamics of the two first families
    Stockholm is rivalling Silicon Valley with a hotbed of technology start-ups

    Stockholm is rivalling Silicon Valley

    The Swedish capital is home to two of the most popular video games in the world, as well as thousands of technology start-ups worth hundreds of millions of pounds – and it's all happened since 2009
    Did Japanese workers really get their symbols mixed up and display Santa on a crucifix?

    Crucified Santa: Urban myth refuses to die

    The story goes that Japanese store workers created a life-size effigy of a smiling "Father Kurisumasu" attached to a facsimile of Our Lord's final instrument of torture
    Jennifer Saunders and Kate Moss join David Walliams on set for TV adaptation of The Boy in the Dress

    The Boy in the Dress: On set with the stars

    Walliams' story about a boy who goes to school in a dress will be shown this Christmas