Ever since the Internet was accessible to the general public it has been a place with dark corners. We all know they're there (with the possible exception of AOL users), and that all manner of bad stuff happens. I'm not just talking about vegetable porn or offers from Nigerian bankers, I'm talking about sinister groups of malicious hackers who target companies with denial-of-service invasions, worm attacks and worse. Groups like this come close to achieving what many consider impossible - to shut down the Internet.
Realistically these viral attacks only get as far as bringing down a couple of major hubs at a time, though this is no trivial feat. At the height of some recent worm-virus plagues, most of the activity on the Internet was viruses merrily bouncing around and messing up servers.
Around about this time I usually say that these viruses are incompatible with Macs - and they are. However, they can still affect Macs if they're making the Internet grind to a halt. But again, so far that has remained an unlikely outcome.
If there was a virus or a denial of service attack that did succeed in really bringing down the Internet, it wouldn't kill it permanently. I think the worst-case scenario would be that the Internet was fragmented temporarily into islands of connectivity. It would then gradually reconnect within a day or two. But the chances of this happening were still slim - at least until now.
There is a new threat to the Internet, but it is disguised as its saviour. A company called Simbiot Security has had enough of the Internet bullies, and ain't gonna take no more. Its new security product, iSIMS, keeps a watch out for attacks on your network - and when any attack comes it leaps into action; just like the mental Skynet computer in Terminator. Unlike normal security applications such as firewalls, iSIMS first vilifies the attacker by calculating a cost of the interference to the company. It then takes steps to protect your company… by attacking the attacker.
You may be sitting there thinking that this sounds like a great idea - give 'em a dose of their own medicine; rub their noses in it; show 'em who's boss. It's this attitude that starts wars - and a war like this won't be in some faraway desert. It will be on our doorsteps. Like the longest-running battles of history - the Cold War, the Palestine-Israel conflict, Northern Ireland's Troubles, et al - tit-for-tat retaliation is the most effective way to escalate hostilities and prolong the pain. Even if a battle taking place on the Internet is unlikely to cause any fatalities, it's another war that we can do without.
The problem as I see it is that if a company is being attacked, then there's no guarantee that the attacker is even aware of its actions if it's been hacked by a third party. If this automatically instigates an attack on the apparent culprit, what is to say that the culprit won't retaliate further? In fact, I would have thought that using software that's liable to lash out makes the software vendor a prime target for evil hackers. There's nothing like a challenge to rally the finest thinkers of the evil-hacker community.
The problem with retaliation has been examined by a guy called Robert Axelrod with his “Prisoners Dilemma” game. His game is actually a mathematical model to demonstrate the results of different strategies of cooperation, retaliation and forgiveness. It goes like this: two crooks are arrested and interviewed separately. If they both stick to their alibis they score three points each. If one snitches on the other when the other doesn't, the snitcher gets five points. If both snitch on each other they get only one point each. A collection of mathematicians, economists, sociologists were asked to come up with a variety of strategies to play the prisoners' dilemma. Fourteen strategies - seven “good” and seven “bad” approaches - were used and played against each other.
Playing the game over an unspecified number of rounds using a variety of strategies bring out some interesting results. For example, snitching every time is a bad strategy, because you will most likely score only one point per round. Playing a strategy that starts out good, but then punishes the other player if they snitch, works better. However, once the punishment starts, the points drop to the same low-scoring numbers as the snitch-all-the-time strategy. The most successful strategy was a simple one that copies the other player's response in the next round. That way there are no grudges held, retaliation is limited, and forgiveness is rewarded.
Counting up the results of all the strategies played against each other, the highest-scoring ones are nice players. Cooperation works, retaliation works only once, and holding grudges and constant retaliation lead to a lose-lose situation. As my brother-in-law is fond of saying, “It's nice to be nice”.
Here's the surprising bit of the story. Around this point I usually get around to saying how misguided, and moronic PC users are. Imagine my horror when I looked at the specifications for this automated spite machine… it runs on an Xserve. On one level, it makes sense to run an application like this on a stable and secure platform like the Mac. On another, more thoughtful level, it's an insane move that makes the Mac a target for cyber villains. It could be just the thing that nudges virus makers to finally take the Mac seriously.
The prospect of having an automated server that has built-in human weaknesses like revenge and retaliation seems to be a ridiculous idea. The ability to give the bad guys a good virtual kicking might seem fun at first, but it will be short lived. The legality of the technology is still being scrutinized, and if it turns out to be illegal anywhere it would put a spanner in the works for the whole misguided venture. If it was against the law to attack another computer, even a malicious one, in a particular country or even a US state then the software will be a liability. You could theoretically be arrested for your counter strike; your virtual vigilante could be leading you into some very nasty situations.
Just dreaming up a product like this is like inventing an atomic bomb. It's OK for us to have it, but destructive technology will eventually fall into the wrong hands. If I were an amateur cyber terrorist, an easy-to-use product like this would be at the top of my shopping list. MW