An RPG-suitable method for crippling the Internet

[Jd Smith1]

So I was re-watching The Strain last month (and despite the fact that no one in the show grasped that you can reload firearms, it wasn't bad), and I was struck by one aspect: a wealthy evil organization hired a band of hackers to cause Internet slowdowns and blackouts.

That struck me as an interesting aspect to add to a modern-day zombie crisis setting, but the problem is, is that I know very little about the infrastructure of the Net to describe it.

I always figured that if you wanted to disable the Net, attacking physical aspects of the infrastructure at critical junctures would be the way to go.

From a fiction PoV, what would be a plausible-sounding description of a Net-crippling attack that did not involve EMP or Maguffins?

 

[MGibster]

I don't have any suggestions, but I often have difficulty with player character expectations when it comes to what kind of information they can find on the internet. I'm sorry, Hackerman, but Evil Incorporated's highly illegal and unethical experiments on human subjects isn't something you can find out about by hacking the system from the outside. It's almost like they have security protocols in place to prevent that kind of thing.

 

[Greggy C]

So I was re-watching The Strain last month (and despite the fact that no one in the show grasped that you can reload firearms, it wasn't bad), and I was struck by one aspect: a wealthy evil organization hired a band of hackers to cause Internet slowdowns and blackouts.

That struck me as an interesting aspect to add to a modern-day zombie crisis setting, but the problem is, is that I know very little about the infrastructure of the Net to describe it.

I always figured that if you wanted to disable the Net, attacking physical aspects of the infrastructure at critical junctures would be the way to go.

I mean it happens all the time, people write a simple program to bring down, lets say the DNS servers which transform www.somesite.com into their internet address 204.10.130.4 The program requests something from the server but makes it so that server can never respond, so it uses up resources (system processes) to do nothing. Program repeats it thousands of times until the DNS server is spinning all of its wheels on nothing and can't take any more requests from anyone. More programs bring down the rest of the DNS servers. More programs bring all the DNS servers. Now everyone in the world is typing enworld.org but nothing is happening.

 

[Jd Smith1]

I mean it happens all the time, people write a simple program to bring down, lets say the DNS servers which transform www.somesite.com into their internet address 204.10.130.4 The program requests something from the server but makes it so that server can never respond, so it uses up resources (system processes) to do nothing. Program repeats it thousands of times until the DNS server is spinning all of its wheels on nothing and can't take any more requests from anyone. More programs bring down the rest of the DNS servers. More programs bring all the DNS servers. Now everyone in the world is typing enworld.org but nothing is happening.

So you overload DNS servers and the Net draws down to a crawl? Wouldn't that take an army of hackers to have an impact?

 

[Jd Smith1]

I don't have any suggestions, but I often have difficulty with player character expectations when it comes to what kind of information they can find on the internet. I'm sorry, Hackerman, but Evil Incorporated's highly illegal and unethical experiments on human subjects isn't something you can find out about by hacking the system from the outside. It's almost like they have security protocols in place to prevent that kind of thing.

I'm not concerned about the PCs hacking, I just think that an attack on the Net would pair well with a zombie outbreak.

Plus perhaps generate some side-missions.

 

[EzekielRaiden]

You're going to want either a DDOS against critical functions, or some kind of (relatively) minimally-invasive virus that intentionally pulls the kind of stunt that Facebook accidentally inflicted on itself last year, or to exploit some unknown weakness in code that permits the kind of error Greggy C described.

A DDOS is a "distributed denial-of-service" attack. It works by having a distributed (that is, many individual machines that need not be located in the same place) botnet (a large semi-automated network following some kind of commands). DDOS attacks work by flooding; they overload server capacity so no one else can get data in or out. Being distributed makes them harder to fight, as the defender may need to filter thousands or millions of unrelated IP addresses or the like. This is why services like Cloudflare exist, to insulate sites from being directly attacked in this way.

The other is more likely to cause problems if it works at all, but harder to actually implement. Facebook's collapse was caused by a seemingly minor coding error that prevented its servers from forming new connections to outside sources; as existing connections expired, it became slower and slower until eventually the last one expired and it was isolated from the Internet. (Apparently this caused some issues with even reaching the servers to fix them as it messed with their electronic security stuff!) So if you can somehow get some code injected into a critical component, like DNS (Domain Name System, the thing that lets 72.190.205.14 or whatever be accessed via "www.google.com") or certificate verification or the like, you could bring the Net down for a good long while. Couple it with a zombie apocalypse and...yeah the Net ain't comin' back.

 

[Tonguez]

The global internet is powered by vast undersea cables. But they're vulnerable. | CNN

On July 29, 1858, two steam-powered battleships met in the middle of the Atlantic Ocean. There, they connected two ends of a 4,000 kilometer (2,500 mile) long, 1.5 centimeter (0.6 inch) wide cable, linking for the first time the European and North American continents by telegraph.

edition.cnn.com

most people (myself included) arent aware that the Internet is still reliant on a network of giant undersea cables

In 2012, Hurricane Sandy slammed into the US East Coast, causing an estimated $71 billion in damage and knocking out several key exchanges where undersea cables linked North America and Europe.
"It was a major disruption," Frank Rey, director of global network strategy for Microsoft's Cloud Infrastructure and Operations division, said in a statement.
"The entire network between North America and Europe was isolated for a number of hours. For us, the storm brought to light a potential challenge in the consolidation of transatlantic cables that all landed in New York and New Jersey."
For its newest cable, Marea, Microsoft chose to base its US operation further down the coast in Virginia, away from the cluster of cables to minimize disruption should another massive storm hit New York.
But most often when a cable goes down nature is not to blame. There are about 200 such failures each year and the vast majority are caused by humans.
"Two-thirds of cable failures are caused by accidental human activities, fishing nets and trawling and also ships' anchors," said Tim Stronge, vice-president of research at TeleGeography, a telecoms market research firm. "The next largest category is natural disaster, mother nature -- sometimes earthquakes but also underwater landslides."
A magnitude-7.0 earthquake off the southwest coast off Taiwan in 2006, along with aftershocks, cut eight submarine cables which caused internet outages and disruption in Taiwan, Hong Kong, China, Japan, Korea and the Philippines.
Stronge said the reason most people are not aware of these failures is because the whole industry is designed with it in mind. Companies that rely heavily on undersea cables spread their data across multiple routes, so that if one goes down, customers are not cut off.

 

[Jd Smith1]

You're going to want either a DDOS against critical functions, or some kind of (relatively) minimally-invasive virus that intentionally pulls the kind of stunt that Facebook accidentally inflicted on itself last year, or to exploit some unknown weakness in code that permits the kind of error Greggy C described.

A DDOS is a "distributed denial-of-service" attack. It works by having a distributed (that is, many individual machines that need not be located in the same place) botnet (a large semi-automated network following some kind of commands). DDOS attacks work by flooding; they overload server capacity so no one else can get data in or out. Being distributed makes them harder to fight, as the defender may need to filter thousands or millions of unrelated IP addresses or the like. This is why services like Cloudflare exist, to insulate sites from being directly attacked in this way.

The other is more likely to cause problems if it works at all, but harder to actually implement. Facebook's collapse was caused by a seemingly minor coding error that prevented its servers from forming new connections to outside sources; as existing connections expired, it became slower and slower until eventually the last one expired and it was isolated from the Internet. (Apparently this caused some issues with even reaching the servers to fix them as it messed with their electronic security stuff!) So if you can somehow get some code injected into a critical component, like DNS (Domain Name System, the thing that lets 72.190.205.14 or whatever be accessed via "www.google.com") or certificate verification or the like, you could bring the Net down for a good long while. Couple it with a zombie apocalypse and...yeah the Net ain't comin' back.

Very good. So say Organization Evil hires a sizeable group of hackers and buys them X numbers of computers and power sources. The hackers set up various sites with these semi-automated computer systems. So one way to fight back (albeit an extreme, apocalypse-only plan) would be to go to said sites and cut the power, or just shut off the system, right?

I would guess that a multi-layered attack would be best, using both techniques. A slowdown coupled with panic-spiked usage and loss of power grid should remove the Net from the survival equation.

I love the Facebook example; the Evil Group could self-harm owned subsidiary providers.

Now, a while back I read that Iraq hindered protests by closing down cell and Net service within their borders. I'm guessing that the government simply told the in-country providers to turn their hardware off, correct?

 

[Jd Smith1]

The global internet is powered by vast undersea cables. But they're vulnerable. | CNN

On July 29, 1858, two steam-powered battleships met in the middle of the Atlantic Ocean. There, they connected two ends of a 4,000 kilometer (2,500 mile) long, 1.5 centimeter (0.6 inch) wide cable, linking for the first time the European and North American continents by telegraph.

edition.cnn.com

most people (myself included) arent aware that the Internet is still reliant on a network of giant undersea cables

snip

Brilliant! Another prong to the attack!

 

[Umbran]

(Apparently this caused some issues with even reaching the servers to fix them as it messed with their electronic security stuff!)

Specifically, the servers that checked whether your ID passcards were allowed to enter buildings were on the same subnet that got isolated. So the security system would read a card, try to ask the servers if it was okay, get no response, and leave the doors locked.

Very much a "do not put all your eggs in one basket" problem.