Diagram of Stachledraht attack

Diagram of Stachledraht attack (Photo credit: Wikipedia)

Why should government intervene in the economy? One reason is so-called externalities like pollution whose producers shift their costs to society. And Distributed Denial of Service (DDoS) attacks -- like the one on April 11 that crashed Mt. Gox, the exchange that carriers 80% of Bitcoin transactions and slashed the electronic currency's value by 72% -- create big externalities.

These DDoS attacks -- in which networks of PCs taken over by a "bot herder" -- the computer that controls the bots -- overload a targeted organization's web site with fraudulent traffic -- are quite common.

In March, Spamhaus -- it tracks email spammers -- and Cloudflare, its service speeds up web sites and protects them from hackers, were attacked by a DDoS. As CNET wrote, the attack sent 300-gigabits-per-second of traffic "into the networks of companies including Spamhaus, Cloudflare, and key Internet switching stations in Amsterdam, Frankfurt, and London. It was like 1,000 cars trying to crowd onto a highway designed for 100 vehicles at a time."

In September 2012, Bank of America, JPMorgan Chase, PNC, U.S. Bank, and Wells Fargo were among the U.S. banks that were slowed by DDoS attacks, according to Information Week. 1,000 of their customers filed related complaints with Site Down -- noting that they could not access their "checking, savings, and mortgage accounts, or bill-paying and other services, via the affected banks' websites and mobile applications."

Botnets do much more than just DDoS attacks. According to my April 14 interview with Amichai Shulman, Imperva's chief technology officer, botnets "are mostly used for SPAM, attacking other servers, stealing credentials and credit cards, committing bank account fraud and recently for penetrating organizations and taking out sensitive business data."

DDoS attacks are so common that it raises the question of why nobody stops them. And the answer can be found in their economics. Simply put, preventing DDoS attacks and more generally shutting down the botnets behind them cost more than the economic loss to the victims of these attacks.

More specifically, stopping DDoS attacks like the one that afflicted Spamhaus, depends on blocking fake Internet Protocol (IP) addresses.  The people who try to run the Internet -- called the Internet Corporation for Assigned Names and Numbers (ICANN) -- long-ago developed rule BCP38.

BCP38 was supposed to require checking the validity of an IP address before accepting its traffic. CNET described the rule by comparing DDoS attacks to the Postal Service trying to block huge piles of junk mail from a particular ZIP code. "If you're sending a letter from San Francisco, the new rule might say, your return label needs to sport a valid northern California address, not one falsely purporting to originate in Hong Kong or Paris."

BCP38 described how ISPs could detect and ignore forged IP addresses but it has not been adopted rigorously. Doing so would require costly hardware upgrades, employee and customer training, and router reconfiguration.

And ICANN advisory board member Paul Vixie, told CNET, "There's an asymmetric cost-benefit here. The provider that takes the time to secure its networks makes all the investment, while other providers get all the reward."

Meanwhile, the cost of DDoS attacks are small -- particularly for large banks. According to Arbor Networks, over a three year period, the typical DDoS attack costs an enterprise nearly $305,000 depending on the expected number of attacks during that time and their average duration --varying from two to 24 hours.

For someone whose PC is part of a botnet, there is no cost or interruption of service. And the steps needed for that individual to detect whether their PC is being used for these attacks and taking it off the botnet are costly and time-consuming.

As Shulman explained, "In general once your computer is infected and become part of the botnet it disables anti-virus software on that computer so detection becomes very difficult. Some enterprise security solutions can assist in detecting computers that are part of the larger known botnets. Tools such as next generation firewalls or next generation malware detection may at some point detect the outbound command and control channel from the infected machine."

It's hard to find out whether your PC is part of a botnet and quite annoying to take it off once discovered. "Once you know that your computer is in fact part of a botnet there are usually removal procedures that involve booting from a clean disk with anti-malware software or at the worst case reinstalling operating system," said Shulman.

Stopping DDoS is a job for government regulators who should require ISPs to upgrade their networks -- for example, by making them comply with BCP38. That's because of Vixie's asymmetric cost/benefit for the ISP and other somewhat unwitting participants in the DDoS attack.

As Phil Turner, Chief Technical Director of IntegraLink, a collector of automotive data, explained in an April 14 interview, in a DDoS attack, "The owner/user of the computer doesn't have any reason to care that they are part of the botnet since its function is not compromised. The ISP servicing that computer has little financial incentive to care. Yes, there is a little more traffic on their network, but this is still a drop in the bucket compared to media streaming."

As Turner said, "The party that really cares is the target of the attack and they can filter the fraudulent traffic that accounts for 90% of their total -- making its effective bandwidth 10% of normal and voila we have denial of service."

Turner speculates that regulation could fix the problem. As he said, regulators could "transfer costs by creating incentives for the originators -- the individuals creating the traffic or the ISPs putting the traffic on the Internet -- to run software capable of blocking any particular endpoint."