Another week, another couple of security holes -- and this time they're not from Microsoft. Instead of affecting an application or operating system, these problems threaten the entire Internet. The easy one to fix is in Cisco routers and switches; Cisco has a patch that blocks the problem. Good thing, too, because that one poses the more immediate threat.
The other vulnerability is with the Transmission Control Protocol -- the TCP in TCP/IP. TCP is used everywhere on the Internet. And the best way to solve that problem may be to throw money at it.
Put simply, the TCP vulnerability makes it possible for an attacker to shut down a TCP session after guessing a random number. It could be used to shut down communication between two routers on an Internet backbone. That, in turn, could knock out whole chunks of the Internet until the routers recover and rebuild their routing tables. Enough of these attacks at once could wreak havoc.
That's the threat. And it's been known for nearly 20 years. But the risk seemed minimal -- how likely was it that an attacker could successfully guess a random number between zero and 4,294,967,295, anyway?
But over the years, researchers discovered that the random number isn't all that random. And that many routers can be shut down without guessing the exact number -- just hitting around the right number will do it. And that faster networks let an attacker make more guesses: If attackers use hundreds or thousands of zombie PCs for the attack, the guesses can come orders of magnitude faster.
Today, that number-guessing attack is still no simple slam-dunk. But now it's actually conceivable. And it's getting easier every day.
And the fixes? There are several -- with names like IPsec, RFC 1948 and RFC 2385 -- and they've been around for years too. Some use encryption. Others make the numbers harder to guess.
But they all require trade-offs. With some, security improves but performance suffers. Or reliability drops. Or reliability can be restored, but that causes a performance hit.
Which do we choose -- security, reliability or performance?
That's easy. Anytime you can convert another class of problem into a hardware performance problem, you can solve it. Other kinds of problems are technical -- and usually hard to fix. Performance problems just cost money.
Improving hardware performance is cheap. Thanks to Moore's Law, it gets cheaper every year. And it's one of the few things in IT that can be reliably priced. So you can figure out exactly what the cost is to solve a performance problem by buying faster hardware.
Will you pay that price? Maybe not. But it's not a technical issue. Any problem you can transform into a hardware problem is one that can be solved -- by throwing money at it.
Back to the TCP flaw: We all bemoan security problems on the Internet. We now have a looming threat in the form of this number-guessing attack. The Internet backbone is largely at risk because the routers running it don't have the computing power to run encryption-based protocols like IPsec, which could block not only number-guessing attacks but many other threats as well.
What would it take to develop a more efficient, new TCP security protocol that doesn't cause IPsec's performance hit? We don't know. We don't even know if it's possible.
But what would it take to roll in faster hardware for all of the Internet's backbone routers? Just money. Lots of money, it's true, and we'd be paying the tab in the form of higher Internet bills. But for once, we can actually calculate the price of a secure Internet infrastructure.
Will we pay that price? Maybe. But if we won't throw money at this problem, we've really got no one else to blame when some number-guessing attacker finally brings down the Internet.