Level 3 Tries to Waylay Hackers
wsj.com
wsj.com
If ICANN or the RIR's (APNIC, RIPE) were vested with the power and responsibility of maintaining botnet-blacklists then that might be better? I just don't think there's any legitimacy in carriers taking on this role.
Anyone have a non-paywalled source that doesn't involve circumventing said paywall? I would prefer to take my page views elsewhere.
The decision was reached after a broad internal review. The Broomfield, Colo., company is taking an aggressive—and some say risky approach—to battling criminal activity. Risky because hackers often hijack legitimate machines to do their dirty work, raising the risk of collateral damage by sidelining a business using the same group of servers. Such tactics also run against a widely held belief that large carriers should be facilitating traffic, not halting it. And carriers are reluctant to create the expectation that they will police the Internet.
Yet with attacks on the rise, Level 3 three years ago decided it is worth the risks. At a rate of about once every few weeks, the carrier is shutting down questionable traffic that doesn’t involve any of its clients. When the source of the trouble is hard to pinpoint, it often casts a wide net and intercepts traffic from large blocks of Internet addresses.
RELATED NEWS
Hard Rock Hotel in Las Vegas Says Hit by Hackers Health Insurer CareFirst Says It Was Hacked Should Washington Allow Companies to Strike Back Against Hackers? Recently, that meant stopping traffic from a powerful network of computer servers controlled by a group of hackers that security researchers dubbed SSHPsychos. The group used rented machines in a data center to hack other computers that could bring down target websites by flooding them with junk traffic. Level 3 blocked a broad swath of the Hong Kong-registered data center’s IP addresses from the Internet.
“Sometimes you have to cut off a finger to save the body,” Mr. Wentworth said.
Level 3 is now opening up about its methods because it wants its fellow network operators to follow its example. The stance, if copied, could change Internet carriers’ traditionally passive approach to defending against attacks meant to overwhelm websites or steal vast amounts of credit card data such as have plagued U.S. retailers for the past two years.
Other large Internet carriers remain wary of playing Internet cop. Swedish Internet carrier TeliaSonera AB says it usually blocks traffic when its network is under attack or its customers request it as a service. AT&T Inc. says Web traffic is often too ambiguous to block.
What may appear as a flood of Internet traffic designed to cripple a company’s Web servers might actually be an unexpectedly busy day for a retailer, said AT&T Chief Security Officer Ed Amoroso. The telecom giant focuses on attacks that target its own network or the systems of its customers and intrudes on third-party traffic only after careful discussion with its legal team.
“We have to be careful, and the carrier industry has to be very careful not to go pushing buttons,” Mr. Amoroso said. “You’re never 100% sure of these things.”
Other companies have tried more aggressive approaches against hackers in the past. Microsoft Corp. moved against botnets in 2013 when it worked with partners to cut off connections to ZeroAccess, a network of more than 2 million infected computers that their hijackers used to defraud online ad networks. Microsoft came armed in that case with a court order.
Level 3 carries traffic to or from about 40% of all Internet addresses, far more than any other network, according to analysis firm Dyn Inc.That means it is often hard for information sent from any website, legal or otherwise, to cross the globe without touching Level 3’s equipment at some point.
The company hunts for hackers by combing through security blog posts and email advisories to get a handle on possible threats. Its software scans more than 45 billion detailed routing logs a day for signs of malicious activity before deciding to act, according to Dale Drew, Level 3’s chief security officer. The security team then spends a few days studying the traffic to decide what can be ignored and what requires immediate action.
Level 3 Chief Executive Jeff Storey on a recent visit to New York. ENLARGE Level 3 Chief Executive Jeff Storey on a recent visit to New York. PHOTO: PARKER ESHELMAN/THE WALL STREET JOURNAL More recently, the company noticed activity that appeared linked to a spate of attacks on retailers’ credit card scanners with software dubbed “PoSeidon,” a play on the term for point of sale machines.
Level 3 watched the attack spreading from network addresses flagged by other security experts to the criminal network’s Russian and European “exfiltration servers,” which collected data stolen from the infected credit card readers.
Mr. Wentworth, the global security chief, watched as an employee reprogrammed Level 3’s routers to misdirect the stolen data while signaling to the broader Internet that it was still on track—intentionally and covertly losing it in Level 3’s network.
‘We’re experimenting with it to see how aggressive we could be.’ —Dale Drew, Level 3’s chief security officer Mr. Drew acknowledges his approach is an uphill battle. Attackers usually keep backup machines and Internet addresses handy—and that is exactly what they did in the case of PoSeidon. Minutes after Level 3 blocked the exfiltration traffic, the attackers appeared to shift to a new set of Internet addresses, forcing the carrier to quarantine even more of the Internet.
Security analysts say the credit card stealing code is still in the wild. Mr. Drew remains undeterred and plans to keep running the program as long as it sees threats worth stopping.
“Everyone rationalizes why they shouldn’t do anything,” he said. “We’re experimenting with it to see how aggressive we could be.”
Write to Drew FitzGerald at andrew.fitzgerald@wsj.com