Julius Genachowski, chairman of the Federal Communications Commission, said Wednesday that failing to meet the “challenges” of cybersecurity will mean the U.S. will “pay the price in the form of diminished safety, lost privacy, lost jobs and financial vulnerability — billions of dollars potentially lost to digital criminals.”

The FCC chair called on Internet users, providers and policymakers to address multiple “cyber threats,” including botnet attacks, domain name fraud and IP hijacking.

---

Botnet Attacks

---

In a botnet operation, one computer can control millions of other computers via software called “malware” downloaded unbeknownst to the user. Those computers can then be directed to visit a specific website, overloading it with traffic in what’s called a Distributed Denial of Service (DDoS) attack. Botnet attacks can be devastating to the average consumer, said Genachowski.

The FCC is working to prevent them by teaching Internet users about botnets and the risk they present. Genachowski called on Internet Service Providers (ISPs) to form a voluntary “industry-wide code of conduct” to help educate customers on identifying botnet attacks and on how to handle them.

Genachowski said such an ISP-sponsored program must be done “in a way that doesn’t compromise users’ privacy.”

---

Traffic Highjacking

---

The second form of cyberattack the FCC has its eye on is IP hijacking. According to Genachowski, there’s a weakness in the way the Internet was built that nefarious types can exploit, causing traffic to be redirected through a network it wouldn’t normally encounter.

“The Internet is a network of networks,” said Genachowski. “Connectivity between these networks is based on an implicit trust that is the Internet’s biggest strength, but can also be a major weakness.”

Genachowski highlighted the risk of IP hijacking by pointing to a 2010 incident, when 15% of Internet traffic was redirected through mysterious Chinese servers for approximately 18 minutes. That caused an “incalculable” cost in terms of intellectual property and data loss, he said.

IP hijacking could be fixed if ISPs voluntarily “adopted more secure routing standards,” Genachowski said, adding that they could reduce the cost of these upgrades by performing them during other routine maintenance procedures.

“The benefits of ISPs taking these steps to eliminate accidentally misrouted traffic would be enormous,” said Genachowski.

---

Domain Name Fraud

---

Domain name fraud happens when a “bad actor” change the identifying information of a website on the Domain Name System (DNS), which is a sort of phone book for the Internet. An Internet user can be directed to a website that looks fine, but is actually fraudulent — and is stealing the user’s personal data, such as credit card information.

“A report by Gartner found 3.6 million Americans getting redirected to bogus websites in a single year, costing them $3.2 billion,” said Genachowski.

How does the FCC plan to fix domain fraud?

According to Geenchowski, DNSSEC, a more secure version of DNS, would address DNS’s security shortfalls. It was adopted with privacy in mind, said Genachowski, and he urges all broadband providers to voluntarily start implementing it as soon as possible.

---

The Future of Cybersecurity

---

The FCC is following President Barack Obama’s lead, who in his 2013 proposed budget put aside money for a great deal of cybersecurity programs. In that budget, the president called cybersecurity an “emerging threat,” alongside nuclear war and terrorism.

Do you think the U.S. or other countries are prepared to deal with large-scale cyberattacks? What can be done to better protect the Internet from cybercriminals? Sound off in the comments below.

Image courtesy of iStockphoto, PashaIgnatov

More About: cybersecurity, cyberwar, fcc, internet