Tag Archive for IETF

Will Climate Change Sink the Web?

Despite claims to the contrary, climate change is real. Climate change will break critical parts of the Internet within 20 years. That is what a study by Paul Barford, a University of Wisconsin, Madison professor of computer science predicts.

Professor Barford presented his findings at IETF 102. IETF 102 was a meeting of the Internet Engineering Task Force Association for Computing Machinery, the Internet Society, and the Institute of Electrical and Electronics Engineers in Montreal. The study, “Lights Out: Climate Change Risk to Internet Infrastructure,” found that critical communications infrastructure could be submerged by rising seas in as soon as 15 years.

Conventional copper and fiber optic cables

Companies like Google, Microsoft, Facebook, and Cable and Wireless go through enormous costs and efforts to protect undersea cable spanning the continents but once that cable hits the shore it gets converted to conventional cables. The conventional copper and fiber optic cables buried decades ago, carry the signals from the landing points to the interior are not designed to withstand the inundation by saltwater caused by climate change.

Internet landing points that will be impacted by climate change

Popular Science reports that Professor Barford’s research found that climate change will impact more than 4,000 miles of buried fiber optic conduit. These conduits and internet cables will most likely be underwater and become inoperable due to exposure to damaging saltwater. Saltwater causes damage to the cables which reduces their ability to send signals. The cable landing stations where undersea cables connect the U.S. Internet to the rest of the world will also be vulnerable. The study also predicts that water will surround over 1,100 traffic hubs.

Unsersea fiber optic cable landing point susceptible to flooding

Major interruptions

Mr. Barford told Popular Science that this service interruption is likely to become a growing problem within the next 15 years. He warned that communications companies should begin implementing protective measures and solutions soon if they want to avoid major interruptions in the near future.

“Most of the damage that’s going to be done in the next 100 years will be done sooner than later,” says Dr. Barford, the keeper of the Internet Atlas, a comprehensive repository of the physical Internet — the buried fiber optic cables, data centers, traffic exchanges and termination points that are the nerve centers, arteries, and hubs of the vast global information network. “That surprised us. The expectation was that we’d have 50 years to plan for it. We don’t have 50 years.” He also notes “The landing points are all going to be underwater in a short period of time.”

The study is the first risk assessment of the impact of climate change on the U.S. infrastructure of the Internet. It reports that Miami, New York, and Seattle are among the areas where connectivity could be most affected. The Internet in these cities is at risk because cables carrying it tend to converge on a few fiber optic strands that lead to large population centers.

Fiber optic cable conduit susceptible to floodingBut the effects of climate changes would not be confined to those areas and would ripple across the Internet, potentially disrupting global communications. Many of the conduits at risk are already close to sea level and only a slight rise in ocean levels due to melting polar ice and thermal expansion will expose buried fiber optic cables to seawater.

No thought was given to climate change

Much of the infrastructure at risk is buried and follows long-established rights of way, typically paralleling highways and coastlines. The roots of the danger emerged inadvertently during the Internet’s rapid growth in the 1980s before there was widespread awareness of the Internet as a global grid or the massive threats of climate change. Professor Barford says, “When it was built 20-25 years ago, no thought was given to climate change.”

To reach this conclusion, the team combined data from the Internet Atlas and projections of sea level incursion from the National Oceanic and Atmospheric Administration (NOAA).

Fiber optic cableScience Daily says the findings of the study, serve notice to industry and government. “This is a wake-up call. We need to be thinking about how to address this issue.Mikhail Chester, the director of the Resilient Infrastructure Laboratory at the University of Arizona told National Geographic, This new study “reinforces this idea that we need to be really cognizant of all these systems because they’re going to take a long time to upgrade.

ISP responses to climate change

The impact of mitigation such as sea walls, according to the study, is difficult to predict. “The first instinct will be to harden the infrastructure,” Professor Barford says. “But keeping the sea at bay is hard. We can probably buy a little time, but in the long run, it’s just not going to be effective.”

US shore susceptible to flooding

The study called individual internet service providers. They found finding that AT&T (T), Verizon (VZ), and CenturyLink (CTL), at most risk. In response, AT&T spokesman Jeff Kobs told NPR,

AT&T uses fiber optic cable “designed for use in coastal areas as well as being submerged in either salt- or fresh-water conditions,… In certain locations where cabling will be submerged for long periods of time or consistently exposed, such as beaches or in subways, we use submarine underwater cabling.

Verizon spokeswoman Karen Schulz told NPR,

After Sandy, we started upgrading our network in earnest, and replacing our copper assets with fiber assets … Copper is impacted by water, whereas fiber is not. We’ve switched significant amounts of our network from copper to fiber in the Northeast.

She explained that Verizon’s focus on flood risk

really has less to do with sea-level change and more to do with general flooding concerns … For cable landing stations that are very close to the oceans and that have undersea cables, we specifically assess sea-level changes.

A representative of CenturyLink told Popular Mechanics they can handle the problem. The company’s PR rep said that CenturyLink networks are designed with redundancy and can divert traffic to alternate routes when infrastructure goes down.

rb-

Donald Trump Still Doesn’t Believe in Climate ChangeThe Verizon and CenturyLink responses seem to totally miss the point.

The impact of large-scale Internet failures goes beyond Facebook and iTunes. The failure of the Internet would disrupt many real people’s day-to-day services like online banking, traffic signals, and railroad routing; the sharing of medical records among doctors and hospitals, and the growing “internet of things” that includes household appliances to regional grids of electric power production and transmission.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Will Wi-Fi Be Secure This Time

Will Wi-Fi Be Secure This TimeOne event at CES 2018 that was overlooked by many people was the Wi-Fi Alliance announcement of WPA3, a long overdue update to Wi-Fi Protected Access (WPA). This increases the strength of a security protocol that hasn’t been updated in 14 years.

Wi-Fi AllianceThe Wi-Fi Alliance says Wi-Fi carries more than half of the internet’s traffic, so improvements to WPA are good news. The WPA3 update is a response to the evolution of Wi-Fi usage and WPA2 vulnerabilities. There are four improvements to Wi-Fi Protected Access via WPA3 over the current standard (WPA2).

Stronger passwords

WPA3 gets a new layer of protection so its security is not contingent on passwords (as followers of the Bach Seat know, passwords suck). WPA3 is an improvement on WPA2’s largest vulnerability the handshake when the key is being exchanged. KRACK (Key Reinstallation Attack) is a major vulnerability discovered in 2017 in WPA2 and WPA. It exploits the Wi-Fi handshake. KRACK allows attackers to snoop on encrypted data being transferred between computers and wireless access points (WAP).

WPA2 uses a four-way handshake mechanism, starting with a nonce provided by the access point.Brute force “dictionary attacks” are the backbone of the KRACK attack. WPA3 implements IEEE 802.11s, Simultaneous Authentication of Equals (SAE) to provide protection against this flaw. SAE is also known as the Dragonfly protocol. The Internet Engineering Task Force (IETF) describes Dragonfly,employs discrete logarithm cryptography to perform an efficient exchange in a way that performs mutual authentication using a password that is probably resistant to an offline dictionary attack.

This improvement will offer better security even if poor passwords are used. This feature is very useful since we know that users have difficulties creating strong and hard-to-guess passwords. The Wi-Fi Alliance claims WPA3 makes it almost impossible to breach a Wi-Fi network using the current dictionary and brute-force attacks.  Mathy Vanhoef, the security researcher who discovered KRACK, appears very enthusiastic about the security improvements in WPA3.

Secure public Wi-Fi

Secure public Wi-FiWPA3 secured open networks will offer more privacy than ever before. Everything transmitted over today’s open Wi-Fi networks at airports, coffee shop, libraries, are sent in plain text that people can intercept. WPA3 will apply encryption to each user on the public Wi-Fi to eliminate clear text with “individualized data encryption”.

Malwarebytes Lab speculates that WPA3 will include Opportunistic Wireless Encryption. OWE enables connection on an open network without a shared and public Pre-Shared Key (PSK). That’s important because a PSK can give hackers easy access to the Traffic Encryption Keys (TEKs), allowing them access to a data stream. OWE implements a Diffie-Hellman key exchange during network sign-on and uses the resulting secret for the 4-way 802.11 handshake and not the shared, public Pre-Shared Key (PSK) that can be easily exploited. WPA3 will be more difficult for people to snoop on your web browsing without actually cracking the encryption while you’re at Starbucks.

Stronger encryption

WPA3 will use stronger cryptographic algorithms. The new security protocol will use the  Commercial National Security Algorithm (CNSA) 192-bit encryption mandated by the U.S. government for secure Wi-Fi networks. Experts speculate WPA3 will use a 48-bit initialization vector to support backward compatibility with WPA and WPA2  The 192-bit encryption will make WPA3 compliant with the highest security standards and fit for use in networks with the most stringent security requirements. (rb- Ironic – Go to the CNSA site and get an invalid cert warning in Chrome) The CNSS is part of the US National Security Agency.

Easier IoT security

The WPA3 update simplifies setting up secure Wi-Fi connections for devices that don’t have a graphical user interface. This is critical the secure the 30.7 billion IoT devices that will be on the network by 2020. The new protocol will add Device Provisioning Protocol (DPP) which sets up a simple, secure and consistent method for securing devices with limited or no display. NetworkWorld reports that You will be able to tap a smartphone against a device or sensor and then provision the device on the network.

What happens to WPA2 devices

So far, most manufacturers have been quiet about legacy device support. We do know that future W-Fi certified WPA3 routers will be backward compatible to support WPA2. The question remains whether current WPA2 devices will be capable of connecting to WPA3.

WPA2 devices are not immediately obsolete. The Wi-Fi Alliance explained that current WPA2 devices will be able to connect with WPA3 hardware. The Alliance also announced that it will continue to do security tests on WPA2 to further protect wireless networks. WPA3 is not an immediate replacement for WPA2

Even after you get a WPA3 enabled router, you’ll need WPA3 compatible client devices—your laptop, phone, refrigerator, security camera, industrial temperature sensor, or anything that connects to Wi-Fi—to fully take advantage of the WPA3 features. The good news is that shiny new router will accept both WPA2 and WPA3 connections at the same time.

Even when WPA3 is widespread, expect a long transition period where some devices are connecting to your router with WPA2 and others are connecting with WPA3. Once all your devices support WPA3, you should disable WPA2 connectivity on your router to improve security.

rb-

I am suspicious about the NSA link to the new WPA3 encryption. The NSA has introduced weaknesses in other encryption protocols.

Until we get our hands on real hardware, it is safe to speculate that like all things Wi-Fi, backward compatibility will cost your performance. What will the impact of one legacy device have on the capabilities of the WAP? Have a pair and turn off 802.11, 802.11b, WEP, and WPA connections on your current router.

It’s about time to update WPA. But as the 802.11n process proved, if you want to get nothing done, turn it over to an industry consortium. Andy Patrizio at NetworkWorld explained that’s where standards go to die because everyone wants their IP used so they make money off every sale. The end result is nothing gets done.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Apple favors IPv6 as IPv4 Dries Up

Apple favors IPv6 as IPv4 Dries UpThe American Registry for Internet Numbers (ARIN) has reported that the IPv4 well is just about dry in North America. On 01 July 2015, ARIN had to refuse a request for a block of IPv4 addresses. The ARIN statement says that there are still a few IPv4 numbers available in smaller block sizes. But for all intents and purposes, there are no more unassigned public IPv4 addresses. As of July 18, 2015, the ARIN IPv4 Deletion page reports only 335 /24 IPv4 address ranges are available. It is time to start looking at IPv6.

Will have an impact on the large enterprisesThe good news, according to FierceEnterpriseCommunications, is the IPv4 drought isn’t yet affecting most of the internal networks of enterprises. But it’s just a matter of time before it starts to have a greater impact on the largest of enterprises. Microsoft (MSFT), for instance, found it was out of IPv4 addresses a few weeks ago. And for the first time in ARIN’s history, they denied a company that requested a large block of IPv4 addresses. Tom Coffeen, chief IPv6 evangelist at Infoblox, in a statement to FierceEnterpriseCommunications explained:

Though the IPv4 well has run dry and threatens service providers, the sky hasn’t yet landed on enterprise networks … Most enterprises still rely on private IPv4 for their internal networks. The small number of public, routable IPv4 addresses required to connect enterprise networks to the Internet is typically provided by the ISP, making IPv4 much more critical for Internet services providers.

IPv6One company that is reacting to IPv4 scarcity is Apple (AAPL). Apple’s latest operating systems – iOS 9 for iPhones and iPads and OS X El Capitan for Macs are designed to take advantage of IPv6. The new operating systems select the fastest connection with the lowest latency, whether IPv4 or IPv6, using the Happy Eyeballs algorithm, explained David Schinazi, the CoreOS networking engineer at Apple. Devices use the Happy Eyeballs algorithm to decide which protocol to use, as many applications use a “dual-stack” approach to networking, making available both IPv4 and IPv6 connections.

FierceMobileIT says this worked out to be a 50/50 split between IPv4 and iPv6 in iOS 8 and OS X Yosemite, but for the new OSes, IPv6 will be chosen by the algorithm around 99 percent of the time, according to Apple beta testing. Apple’s Schinazi wrote in a post on the Internet Engineering Task Force mailing list that Apple considers IPv6 mainstream.

IPv6 is now mainstream instead of being an exception, there are less broken IPv6 tunnels, IPv4 carrier-grade NATs [network address translations] are increasing in numbers, and throughput may even be better on average over IPv6

The author reports that testing performed by Apple shows that the new OSes should use IPv6 addresses around 99 percent of the time. Apple operating systems have supported IPv6 by default for Mac users as part of the OS X 10.2 Jaguar release in May 2002.

Mr, Schinazi cautioned that both OSes are in beta so things might change for the final versions. “If this behavior proves successful during the beta period, you should expect more IPv6 traffic from Apple products in the future,” he added.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

IPv6 is 20 Years Old

IPv6 is 20 Years OldNetworking’s little brother is growing up. IPv6 turned 20 is years old this month. The IETF IPv6 Operations groups’ mailing list noted that the first independent IPv6 connection was established between sipper.pa-x.dec.com and ottawa.inria.fr in 1995.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Who Runs The Internet

Who Runs The InternetWhile no one “owns” the Internet (for now, despite republican plans) there are a handful of companies that control the Internet. Unless you are a techno-geek, these six organizations that control how the Internet works, most likely fly under your radar.

 

International Telecommunications Union

United Nations International Telecommunications UnionThe first organization that is actively trying to take over the functions of the Internet is the United Nations International Telecommunications Union (ITU). The ITU in my and many other opinions an outdated, pointless throw-back to the days of the telegraph, with policies to match. I covered the last power grabs by the UN’s ITU here.

Internet Architecture Board

Next is the Internet Architecture Board (AIB). The IAB is the overseer of the technical evolution of the Internet. The IAB supervises the Internet Engineering Task Force (IETF), which oversees the evolution of TCP/IP, and the Internet Research Task Force (IRTF), which works on network technology.

Internet Architecture BoardThe IAB declared a major strategic move for the Internet. The Internet Architecture Board is calling for global encryption on the web (which I have covered many times from my Bach Seat) to become the norm across the Internet in a move to lock down the privacy and security of information exchange according to Dark Reading.

Internet Engineering Task Force

Internet Engineering Task Force

The Internet Engineering Task Force (IETF) develops and promotes voluntary Internet standards. It is most well known for the standards that make up the Internet protocol suite (TCP/IP). It is an open standards organization, with no formal membership or membership requirements. All participants and managers are volunteers, though their work is usually funded by their employers or sponsors. The IETF is also well-known for its RFCs or Request for Comment documents like RFC RFC 1918 and RFC 873.

Internet Society

Internet SocietyAnother organization that shapes the Intertubes is ISOC. The Internet Society (which I am a member of) was formed in 1992 by Vint Cerf and Bob Kahn. ISOC was formed to provide a corporate structure to support the Internet standards development process.

Internet Corporation for Assigned Names and Numbers

The Internet Corporation for Assigned Names and Numbers (ICANN) is perhaps the most critical organization that helps run the Internet. ICANN coordinates the distribution of IP addresses and the Internet’s Domain Name System (DNS). IP addresses are the numbers that are assigned to every computer on the Net to uniquely identify each device. There are two types of IP addresses, IPv4 and IPv6. The web has run out of IPv4 addresses (which I covered here and here) and is very slowly being replaced with IPv6 addresses. ICANN doles out these addresses.

Internet Corporation for Assigned Names and NumbersICANN also manages the Domain Naming System (DNS) on the web that converts IP addresses to names. DNS makes it possible to remember www.google.com, which is easy for humans to remember instead of remembering https://web.archive.org/web/20150507211330/http://74.125.224.72/, which is easy for computers to deal with, to get to Google.

The U.S. government funds ICANN. They Feds have gotten heat from around the globe after Eric Snowden’s revaluations about global spying operations. The role of ICANN is changing.

Internet Service Providers

on rampThe only group that makes money on the Internet but does not help run the Internet (yet) are the Internet Service Providers (ISP). ISP’s control nearly everyone accesses it. The gatekeepers to the web are ATT (T), Comcast (CMCSA), Charter (CHTR) and Time Warner Cable (TWC) are the biggest names of ISP’s. ISP’s “perform” two key functions. First, they provide last-mile connections, that is the connection to your home or business to their offices, which we all over-pay for. Next, they provide back-haul or backbone services that move your email across the town or across the globe. The ISP’s also make money on these ISP-ISP connections.

Right now the FCC is considering the future of the Internet during its Net Neutrality decisions. If the ISP’s get their way, it is likely that homes and businesses will be required to pay the ISP’s more money to maintain the crappy service we already get.

 

Six shadowy organizations that run the Internet infographic

rb-

Let’s add this up big business telecom money + millionaire politicians = the 1% screwing the rest of us. Get involved, save the Internet, get in touch with your alleged representatives and tell them NO MORE. 

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.