【经济学人】互联网攻击-崩溃测试 | 2016.10.29 | 总第716期

关注这里

每天进步一点点

收获成长和自信

翻译 | hua外音

审核 | 阳光下的冰叶

小编 | 澜意

Crash testing

崩溃测试

Recent attacks on the internet could be a prelude to far worse ones

不祥的前奏：互联网攻击

Oct 29th 2016 | From the print edition

2016.10.29 |印刷版

“SOMEONE is learning how to take down the internet.” This was the headline of a blog post Bruce Schneier, a noted cyber-security expert, wrote in mid-September. It looked prescient when, on October 21st, Dynamic Network Services (Dyn), a firm that is part of the internet-address system, was disrupted by what is called a “distributed denial of service” (DDoS) attack. (Essentially, a DDoS floods servers with requests until they can no longer cope.) For hours, hundreds of sites were hard to reach, including those of Netflix, PayPal and Twitter.

网络安全专家布鲁斯·施奈尔于九月中旬发表博客头条，“有人正准备搞垮互联网。”10月21日，动态服务提供商Dyn公司被所谓的“分布式拒绝服务”（DDoS）攻击一事件证明了该博文的预见性。（本质上是一个DDoS洪水服务器反复发送请求直到Dyn公司无法处理。）数小时内，包括网飞、贝宝和推特在内的数以百计的网站无法被访问。

The attack on Dyn was only the latest in a string of similar ones. On September 20th, for instance, the victim was Brian Krebs, an American journalist who often reports on internet criminals. The server where he hosts his blog became the target of one of the largest DDoS attacks on record (it was bombarded with data equivalent to almost half a percent of the internet’s entire capacity). Most of the other recent digital assaults, however, were more discerning—as if the attacker “were looking for the exact point of failure,” Mr Schneier wrote in his blog post.

Dyn遭受的攻击只是近期一系列类似攻击事件之一。比如一名名为布莱恩·克雷波尔的美国记者（他经常报道网络犯罪）在9月20日就成为了受害者。他管理博客的服务器成为史上最强的DDoS攻击的目标（将近整个互联网一半流量的连续轰炸）。近期大部分的数字攻击都很有针对性，正如施奈尔先生在他的博客中写道，“犹如攻击者正在准确定位故障点”。

It is not clear who the attackers are, although security analysts suspect they are either Chinese or Russian. At any rate, all the attacks used the same software, called Mirai, whose source code has been leaked online. It mainly scours the internet for devices such as webcams, digital video recorders and home routers in which easy-to-guess factory-set passwords (“12345” or even “password”) have not been changed. The program then turns those it can gain access to into a huge army of digital slaves that can be directed to inundate targets with requests. Shortly after the attack on Dyn, XiongMai Technologies, one of the biggest makers of webcam components, announced it would recall some products and provide owners of others with software updates to improve security.

尽管安全分析人士怀疑攻击者是中国或俄罗斯人，但是详情仍无从知晓。无论如何，所有攻击使用的都是一款名为Mirai的软件，其源代码已在网上泄露。它主要搜索未重置的易获取出厂设置密码（“12345”甚至“password”）的网络设备，如摄像头、数码视频录像机和家用路由器。这样，只要通过程序发送请求就可以击垮目标，好像号召了一支数码奴隶大军一般。大型摄像头组件制造商之一-雄迈科技在Dyn遭受攻击不久后，宣布将召回一些产品为其所有者提供经软件更新后的产品以提高安全性。

This may help, but not much can be done in the short run other than to appeal to owners of internet-connected devices to change their passwords. To fix the problem properly, Mr Krebs argued in a blog post, the makers of such devices, collectively called the “internet of things” (IoT), would all have to recall vulnerable systems and change their careless approach to security. Since this is unlikely to happen, regulators may have to step in. Indeed, the European Commission is already working on legislation to require better security in IoT devices. Lawsuits against negligent device-makers would also help.

除了呼吁联网设备用户更改设备密码（有一定效果），短期内并没有什么更好的办法。克雷布斯在一篇博文中表示，想要合理解决这个问题，“物联网”，即网络设备的制造商，应当召回脆弱的系统设置并升级低端的安全防护。当然，这种做法不太实际，所以也许监管机构不得不将介入此事。事实上，欧洲委员会已经就物联网设备高安全需求方面提出法案。对粗心大意的设备制造商所提起的诉讼应该也有帮助。

As for the goal of the attacks, it could be something other than to take down the internet. Many fret that such virtual weapons could be turned to full blast just before or on November 8th, when America will elect a new president and House of Representatives, and also many senators and state governors. A DDoS could not paralyse voting machines, for hardly any of them are connected to the internet. But striking all kinds of websites, from those of online media to the government’s, could spread chaos—and the feeling that the elections are somehow being “rigged”.

也许，互联网攻击的意图不只在于搞垮互联网。期待您的翻译，您可以将翻译留言到文章底部，第二天会有详细解析哦。DDoS攻击虽然不能使那些几乎没有连接到互联网投票机器瘫痪，但它能通过那些报道政府的网络媒体攻击形形色色的网站从而散播混乱，选举也许会在某种程度上“被操纵”。

【经济学人】金融危机与格林盼斯|2016.10.01|总第688期

经济学人l马云是如何征服中国互联网的l2016.04.09l总第531期

【经济学人】互联网之刺！ | 2016.10.08 | 总第704期