It’s funny how much effort we put into building redundant and reliable systems (e.g.: “cloud computing”) that scale and replicate well – yet they are subject to the simplest of attacks that can disable them.

An old joke from the 90s was to extend the OSI layering model:

I’ve also seen layer 9 described as the “political” layer. It’s silly, but there’s something to it. We can provide segregation at layer 7 or 5 or 4 using a variety of load balancers or firewalls, and self-secured applications, but so what if the system can be attacked at layer 9 by Elon Musk buying your hosting company and fucking it into the ground? One of my old security buddies used to refer to capitalism as a backdoor in all security. Together, over a memorable dinner at The Tabard Inn in Washington, we invented the following koan:

Q: How do you steal the source code for any important application?
A: Ask nicely in the boardroom.

This actually turned out to be prescient, because a few years later Microsoft gave the Chinese government a copy of the Windows source code so they could analyze it for backdoors, and Blackberry (remember them!?) gave the government of India the encryption keys for their communications layer, against the threat of the devices being banned because the government’s security service could not monitor citizen communications.

You probably noticed freethroughtblogs was down recently. In security terms what happened was a lawyer-amplified denial of service attack (specifically a resource consumption attack [RCA] against ftb’s DNS provider) – the response was designed to deflect blame from the provider in case there was some kind of lawsuit regarding who owned and controlled what domain, but because the provider is not adequately staffed and their workflow automatically kicks in, in order to be legally responsive it amounts to a denial of service. Almost certainly there are equal and opposite cutouts that prevent the same workflow from kicking in if someone, for example, attempted to launch a similar attack against truth social. But how deep are those cutouts? Perhaps someone in some operations center would respond more quickly if the attack was launched against truth social, but Sam Harris’ site would be down for days like freethoughtblogs was. Of course the people who design these systems are not designing them for redundancy and accuracy, they are designing them for liability coverage, so the rest of the system is probably also vulnerable to a variety of channel-stuffing attacks. [channel stuffing] Imagine if you simultaneously filed 1,000 such takedown requests, overstressing the inboxes of the overworked underpaid analysts who are expected to process the takedown requests. Or if you amplified all of that by doing a conventional denial of service attack against the provider’s email server. The analytical process for identifying weaknesses in such complex systems is actually pretty simple. Here’s a term that used to be classified (no shit!): target analysis. The idea is that you list the salient properties of the target, along with the weaknesses of those processes, then put your evil hat on and do some combinatorics. By the way: expect AIs to turn out to be pretty good at that sort of thing, since they are fast, creative, and have lots of time on their hands.

One of the interesting facets of the recent attack [documented by PZ:] is that the hosting company’s workflows kicked in, right on schedule, without any analysis of whether or not the attacker was obviously bogus, or the accusation was obviously bogus. “Deathlord Al-Zawahiri” would have rung some bells, if a human had been in the loop. But humans were taken out of the loop for reasons of cost-cutting and, probably, to prevent accusations that the hosting service was specially caring for one account or another. I wonder if my previous posting outlining how DMCA is a framework for denial of service [stderr] had anything to do with it.

How to fix this sort of mess? The obvious answer is: shatter the system. If there were so many takedown requests that the providers were overwhelmed, they would probably do something like require a phone call, responsive email address, verifiable address of an attorney, etc. Those are easily faked, but it’d skim 95% of the problem off the top. The other, better, answer would be to get lawyers to attack lawyers (fun fun fun, except the lawyers coincidentally have the situation arranged so that they make money no matter what and would be perfectly happy to fight World War III as long as the hours are fully billable) I will say that there are conferences attended by sober security professionals and operations specialists, who keep track of the latest emerging problems with services, and who would be preparing to do the legally required minimum to protect their organizations, if there was a significant judgement.

Rob Pike once said: “distributed computing is when a system you don’t know anything about and have never heard of brings your system down.”

Or, as my friend Ron says, “another cloud computing success story!”