Feeds

Spooks foils fictional Russian plot

But not entirely far-fetched

The Power of One Brief: Top reasons to choose HP BladeSystem

UK Security Services yesterday breathed a sigh of relief at their last-minute foiling of a "distributed denial of service" (DDoS) attack on the UK by elements of the Russian Security Services.

The attack was due to be launched at 4pm GMT, when a Russian submarine tapped into a transatlantic cable – just off the shore of Cornwall – and prepared to upload a virus onto the UK internet. The virus would have propagated itself to thousands of websites within the UK – and then taken them down key elements of the national network by over-loading them with requests for data.

MI5 retaliated by dropping a "zero day" virus onto the attacker’s operating systems and taking out the submarine. This was the most complex part of the operation, with a window of just half a minute between the Russians tapping into the phone system – and going live with their attack.

OK. So this was just a plot from this week's "Spooks" (episode 2). But in the interests of broadcasting accuracy, the Reg thought we’d give it the once-over.

First, the premise underlying the attack is not so far-fetched. Back in 2007, Estonia found itself under attack, and reports suggest that significant parts of their economic infrastructure, from banks through to government websites, were either taken down or placed under severe pressure.

On a smaller scale, there has recently been a spate of DDoS attacks on websites deemed to be run by or favourable to al-Qaeda. In the case of Estonia, the finger of suspicion has been pointed at Russia – although no official conclusion has ever been reached. NATO are sufficiently worried about the threat to have studied the incident in depth.

When it comes to al-Qaeda, the jury is out as to whether this is the work of US Security Services – or freelance hackers.

The degree of damage that could be done to a country is also up for debate. Unless the DDoS attack could be moved off the web and on to the operating systems of serious infrastructure (such as power stations) the apocalyptic scenarios envisaged by Spooks just could not happen. Mind you, our government’s enthusiasm for linking up systems and e-government, together with their atrocious record on security, means that maybe the worst case scenario is not as unthinkable as we’d like.

"Nul points" for the submarine, which was one of the night’s dumber plot devices. As our in-house expert said: "They'd have a hard time putting a sub on top of a cable covertly - normally a sub which has stayed down for a while only has a sketchy idea of where it is, and similarly the cables aren't accurately mapped or easy for a naval sub to detect. And why bother? It's not as though there's some Great Firewall of the UK located offshore somewhere."

In fact they could probably do just as much damage launching the programme from an internet café in Ealing.

We also wondered whether the Russians would really be so stupid as to mount their attack from the same computer system as the rest of their boat’s operating systems.

As for MI5’s other solutions? A "zero day" virus sounds, um, spooky – but is nothing more than a previously unknown virus for which specific anti-viral software signatures are not yet available. We don’t doubt that the government has a fair few of those secreted away somewhere on its computers.

Halfway through the plot, lead spook, Harry Pearce, toddles off to the Joint Intelligence Committee to ask if the government would agree to take down the internet for a while.

Is any of this remotely possible? A spokesperson for the Home Office told us: "The vulnerabilities exploited by these attackers do not read across to UK networks but lessons were learned about how other countries including the UK may collaborate to help others under attack."

They also confirmed that in extreme circumstances, it would be possible for the UK government to close down the internet. Plans to do just this have been put in place by the Centre for the Protection of National Infrastructure, whose remit includes "reducing the vulnerability of the national infrastructure to terrorism and other threats" and "keeping the UK's essential services (delivered by the communications, emergency services, energy, finance, food, government, health, transport and water sectors) safer".

So two out of three to the makers of "Spooks" – but maybe next time, no submarines. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NSA man: 'Tell me about your Turkish connections'
Spooks ask Dabbsy to suggest a nice hotel with pool
Russia sends SEX-CRAZED GECKOS to SPAAAAACE!
In space... no one can hear you're green...
Indian techies-in-training face down MAN-EATING LEOPARD - and WIN
Big cat causes big trouble at Mumbai college
Carlos: Slim your working week to just three days of toil
'Midas World' vision suggests you retire later, watch more tellie and buy more stuff
Yahoo! Japan! launches! service! for! the! dead!
If you're reading this email, I am no longer alive
Plucky Rockall podule man back on (proper) dry land
Bold, barmy Brit adventurer Nick Hancock escapes North Atlantic islet
Motorist 'thought car had caught fire' as Adele track came on stereo
'FIRE' caption on dashboard prompts dunderheaded hard shoulder halt
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.