[iwar] [fc:DoS.attacks.getting.scary,.CERT.warns]

From: Fred Cohen (fc@all.net)
Date: 2001-10-23 08:16:04

Next message: Fred Cohen: "[iwar] [fc:Web.hooligans.hurt.search.for.clues]"
Previous message: Fred Cohen: "[iwar] [fc:Terrorism.Heightens.Lawmakers.Desire.To.Expand.Telecommuting]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200110231516.f9NFG4T21208@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Tue, 23 Oct 2001 08:16:04 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:DoS.attacks.getting.scary,.CERT.warns]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

DoS attacks getting scary, CERT warns 
By Kevin Poulsen, The Register, 10/23/2001
<a href="http://www.theregister.co.uk/content/55/22406.html">http://www.theregister.co.uk/content/55/22406.html>

Windows users and Internet routing equipment are the latest pawns of
malicious intruders intent on launching denial of service attacks
online, an expert from Carnegie Mellon's CERT Coordination Center warned
network operators here Monday. 

Attackers have begun favoring particular chunks of Internet address
space that are more likely to contain Windows machines than others, said
Kevin Houle, a researcher with the government-funded center, speaking to
approximately 600 engineers and network administrators at a meeting of
the North American Network Operators' Group (NANOG).  "If I'm an
intruder and I want to install my tools on Windows machines, its very
easy to find subsections of the network to search," said Houle. 

So-called distributed denial of service (DDoS) attacks rely on an
attacker's ability to install malicious agents on a large number of
computers, and use them to simultaneously flood a victim with
overwhelming traffic.  The shift from Unix machines to Windows computers
began in late 2000, said Houle, and has grown noticeably in recent
months. 

The mechanisms for controlling large numbers of compromised boxes have
also changed, said Houle, becoming vastly more sophisticated since DDoS
attacks began in 1999.  Attackers increasingly use IRC -- the Internet's
chat room systems -- to direct attacks, sometimes using domain name
records as a kind of dead drop for directing their agents to a
particular IRC server. 

More disturbing to network operators, attackers have taking over the
machines that route and direct the flow of Internet traffic, to use them
as weapons, Houle said. 

"What we see are routers with default and weak passwords being
targeted," Houle said.  After cracking a router, attackers can use it to
launch straightforward denial of service attacks against an Internet
site.  Because routers can generate enough traffic to impede an end
host, while standing up well to a similar counterattack, it's become a
valued platform for cyber vandals engaged in online skirmishes in the
mostly-juvenile computer underground. 

"If I'm an intruder and I want to be well protected against people
DoSing me, a router is somewhat better than an end host," said Houle. 
The development is foreboding, Houle said, because of the possibility
that attackers could begin targeting the protocols that link routers to
one another, potentially leading to disruptions in the Internet's
fundamental infrastructure.  "This is stuff that's being talked about,
not just within the security community, but also the intruder
community," said Houle. 

Generally, speakers at NANOG agreed that conditions haven't improved
much since February 2000, when a fifteen-year-old Canadian boy used
distributed denial of service tools to flood sites like eBay, CNN.com
and Yahoo! with traffic, knocking them offline. 

In fact, attackers are now able to marshal so many machines in a DDoS
attack, that they seldom bother to tamper with the packets to disguise
their source.  "If you have 200 compromised machines, it doesn't matter
if the source addresses are spoofed or not," said Jason Slagle, network
administrator at Toledo Internet Access, an Ohio ISP. 

© 2001 SecurityFocus.com, all rights reserved. 

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Pinpoint the right security solution for your company- Learn how to add 128- bit encryption and to authenticate your web site with VeriSign's FREE guide!
http://us.click.yahoo.com/yQix2C/33_CAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Web.hooligans.hurt.search.for.clues]"
Previous message: Fred Cohen: "[iwar] [fc:Terrorism.Heightens.Lawmakers.Desire.To.Expand.Telecommuting]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:56 PST