ISP Forced Out of Business by DoS

flyhmstr writes "According to a report on ISPReview Cloud Nine have been forced off line and out of business thanks to the actions of crackers deciding to go play with some DoS tools." It's only getting worse. The kids are getting more and more aggressive as time goes on and it gets easier and easier to launch a large scale DoS. As any techie knows, fixing the problem is far easier said then done... but as a frequent recipient of the sharp end of the DoS stick, I sure wish it wasn't an issue.

Comments

whoops

[magicslax]

of course a nice healthy slashdotting right now doesn't help anybody's case. :grin:

Re:whoops

[Tipsy McStagger]

The Register have the text of the announcement at the moment.

Re:whoops

[Alan Partridge]

it's kind of ironic that it's really the ISPs that are to blame for the proliferation of DDOS attacks anyway, they are the ones allowing their users machines to send out ping floods and nasty UDP crap in the first place. ISPs seem eager enough to bump users off for exceeding their (usually unpublished) bandwidth limits, but they couldn't care less about virus and DDOS traffic.

I wonder why?

[Em Emalb]

Can someone please clue me into why people do this? I don't quite understand this mentality. I have never done something bad like this simply because I could. Am I a rarity in this world? Do these kids need a hug? Why would you do this? Feeling "elite" because you can knock down an ISP? Take your energy and do something positive with it. IMO, this is petty and retarded. Maybe these script kiddies can go knock down a hospital or something next, hey why not, it doesn't hurt anyone right? RIGHT? forking iceholes.

Re:I wonder why?

[sphealey]

Can someone please clue me into why people do this? I don't quite understand this mentality. I have never done something bad like this simply because I could. Am I a rarity in this world?

If 1000 people walk down a backstreet past an empty building, 998 will just pass by. 2 will throw a rock through a window and spraypaint the walls.

This just seems to be part of human nature; I haven't seen much change in the percentage of people who behave this way since my childhood (1960's) anyway. The problem is that the world today is so interconnected, and also dependent on technologies whose webs of interconnection are more fragile than we like to think, that the 2/1000 with the desire to damage can do a lot more damage to a lot more people than ever before.

I am a bit discouraged myself about whether or not this can be stopped on the Internet, personally.

sPh

Re:I wonder why?

[Thomas M Hughes]

Part of me thinks it has a lot to do with the online mentality of a lot of people who are powerless in the real world, but feel empowered when online. I'm most likely pulling this out of my ass, but its something I've seen fairly often when hanging around EFnet in years past.

In real life, you can't just take something from someone else, unless you're much bigger than them. When you're online, you just need to have the ability to access a lot of bandwidth. So, if someone has a channel on IRC that I want, I DoS the server, split it and take the channel. Now, supposedly this doesn't happen as much these days, but it used to happen fairly often back in the day.

There's also online cliques, who for lack of better explaination seem to act as online gangs. Loose groups of friends who associate, talk, and dislike the same people. Thus, much like real life gangs, if one gets ticked off at another, they get their friends to make their life hellish for the opposing party. I wouldn't be suprised if they DoS'd a dialup user just in an attempt to knock him offline and went a little overboard. Or were trying to DoS an IRC bot. Or even a webpage.

Of course, I really have no idea what caused this incident. This is mostly just speculation. But I'm fairly certain at least one script kiddie has had similar motives in mind during his mischief. Kids will be kids, and that involves doing stupid stuff that they don't understand the consequences of. That doesn't mean we should string them up, but it does mean we should make efforts to make it more difficult for them to do damage.

Re:I wonder why?

[eXtro]

I've had experience with a couple of little bastards that have done this as well as other things. It's not all that complicated to understand why after talking with one of them at length. They're fairly safe from prosecution, they enjoy the fact that it pisses people off, and revel in the fact that you can't really do anything about it. There are also people who look up for them for their ability to blindly execute a script somebody else wrote.

I don't think writing software of any type should be a crime, but I think in cases where there is clear damage (like this company that went under) the usage of the script should be treated as a criminal matter. This could easily involve conspiracy, vandalism etc. charges.

I was originally tempted to start releasing poisoned scripts, scripts that would work as intended when pointed at local machines but would have undesired consequences (hard disk corruption, file deletion etc) if used against external domains. I'd hate to see somebody harmed through legitimate use of the scripts though (auditing a site you have permission to audit from a remote location for instance).

Re:I wonder why?

[cxreg]

If 1000 people walk down a backstreet past an empty building, 998 will just pass by. 2 will throw a rock through a window and spraypaint the walls.

But this isn't throwing a rock and spraypainting. That's more like trolling Slashdot. This is setting the building on fire. The difference between what these kids do and an arsonist is the FBI actually cares about arson.

Re:I wonder why?

[sphealey]

But this isn't throwing a rock and spraypainting. That's more like trolling Slashdot. This is setting the building on fire. The difference between what these kids do and an arsonist is the FBI actually cares about arson.

I don't disagree, but keep in mind two things: (i) if you have ever done long-term maintenance on a building, you know there is only one real enemy: water. A building can stand for several hundred years if the roof and windows are intact. One broken window that goes unrepaired means the inevitable destruction of the building (ii) "broken windows" is Jane Jacobs' shorthand for what starts a neighborhood, as well as a single building, on the path to destruction.

sPh

Re:I wonder why?

[overunderunderdone]

Can someone please clue me into why people do this?

This is a somewhat larger question than I think you realise and one that people have been struggling to understand for as long as there have been people. Why do people do bad things? Why are they selfish, cruel, malicious? Why do even good people not have the self control to always follow their better instincts? Why do some people not even seem to have those better instincts?

I'll be up front and mention that I am a christian (Now THAT is a statement to start a flame war on this board - not my intention but my experience is that there are a lot of people that are quite indignant with me for what I believe. But since it IS what I believe [I'm not making it up to start a flame war] & is relevant to your question I don't feel particularly compelled to keep silent.) Anyway, christians (and therefore, I) believe that every single person is 'fallen' and inclined to be 'bad' (or evil to use the old-fashioned term) and do 'bad things' (or sin to use the old-fashioned term). 'Bad' (or evil) ultimately being defined by christians as being selfish - living for oneself rather than for God & your fellow man. Though we are all the same in this regard it is expressed differently in each of us as individuals. The behaviour of these kids doesn't have any particular appeal to me but I think for them it is a way of selfishly having "power" they don't otherwise have. They are probably incapable of doing something positive that would have as much impact or bring them as much or notoriety. But here they are a few, or maybe even one immature kid that brought an entire company staffed by mature, technically astute adults to bankruptcy. Excersising power, having an impact, feels good, feels like importance - and in their self-absorbed state of mind the plight of the people affected does not enter in.

Re:I wonder why?

[Technician]

Nothing has changed. It's the new CB radio of the 1970's. If they didn't like what their neighbor said, and he couldn't identify him, he got a 1KW linear amplifier (not leagal) and ran that on the 5 watt band to deny him the ability to carry on a conversation with anybody. We used to refer to these abusers as being 10 feet tall behind the microphone. Their mission was to dissrupt someone elses conversation in an airwaves ownership battle. Radio direction finding equipment was rare and expensive. Most people couldn't find one and take the time to track someone down. Many times by the time you got close to finding an antagonist, they would finish the flame war and go silent. I had a RDF (homebuilt) and used it against the worst nearby offenders that were overly perseitant at being a pain to somebody. The element of supprise announcing the address of the offender on the air was worth the hunt. Most people were so used to being un-trackable, they got quite bold at being abusive. A positive ID came as a major blow to them. Suddenly they had to worry about angry neighbors attacking and destroying their car, windows, etc. (this happened to an abuser trolling for flame wars on air, his car was totaly destroyed by parties unknown) They were no longer able to hide when the source of the attacks were revealed. With distributed DOS attacks, it is harder to track the offender. Unfortunately this ability to hide the true identity allows abuse to reach further and disrupt more communications than it used to while being harder to track.

Re:I wonder why?

[HiThere]

I, personally, would not put it as high a 0.001. The problem is, it doesn't need to be.

There are two main possible solutions. The legislative and the technical. I would really prefer that a techincal solution were created, though I don't know what form it would take. It would need to avoid any centralized control point. And it would need to be low overhead.

Unfortunately, any real answer would probably involve a redesign of the TCP/IP protocols. And even then ... It's sort of like trying to listen to a conversation at a cocktail party. It may be that the only feasible solution is to reduce the noise. Somehow.

All I can come up with is using one port to receive non-session messages, and only echoing back session cookies to valid addresses. On a second port only accpeting messages with a valid session cookie in the header. This would aid in dropping bad messages quickly, but doesn't do much else for a DDOS.
.

Re:I wonder why?

[overunderunderdone]

Do these kids need a hug?

Actually, this is probably closer to the truth than most people realize.

I will agree with this. These kids are doing this to make themselves feel powerful. They want to feel important, significant. If they were made to feel their significance by the people to whom they should be significant - their parents - perhaps they would be less likely to seek a feeling of power in mindless destruction. Though there is no guarantee - even a person without excuse, loved, cared for, etc. can lack the self-control to tame their baser desires.

If you think about it, you realize it is only possible to hurt someone else (or their property) if you feel like you are hurting yourself.

Now I have to disagree - sort of. Their indulgence in malice and cruelty, their seeking after the thrill of power does them harm. But in their self absorbtion they are only aware of how good it feels to wield that power - to feel important. They do not feel hurt, they feel powerful.

The really sad thing is, when we find someone who is hurting, and has demonstrated this to us by hurting someone else, we hurt them more by punishing them. Thats a human approach, but it will only result in larger problems. When someone hurts us we should help them by giving them a hug... or something :)

Here I have to disagree - for several reasons. First: If someone cannot exersise enough self-control to refrain from hurting others they must be externally controlled by someone else (the state or their parents) - either by actual physical restraint or by the credible threat of punishment. Also, while they still need "a hug" love and acceptance from those from whom it is due - now that is not enough. I don't think their can be healing without honest regret (not just regret for being caught but for being *wrong*) - that is up to the criminal, no one can either force them through punishment or manipulate them through compassion to arrive at that repentance. There also can't be healing without suffering real (depending on the crime even harsh) consequences. Even kids have an inate sense of justice (that I believe is valid) and that even criminals will acknowledge. It does not do the do the victim or society at large - but especially the criminal - any favors by bypassing the requirements of justice. A penitant criminal who has been punished for his crimes can start again. A penitant criminal who has escaped punishment will feel the unfairness of that escape and a continued sense of guilt. He will be crippled in his ability to begin anew. An unrepentant criminal will take either scenario as an excuse to continue in their crime.

WHAT!!

[BryceH]

but as a frequent recipient of the sharp end of the DoS stick, I sure wish it wasn't an issue

ha ha ha.. this comming from the kingpen of DOS .. no /. has never DOS-ed a site... really i swear..

Got to be something more to this than is reported

[johnburton]

First they go offline for days with no information available about why. Then they say they are coming back on line after a "hack" but that they will have to put their prices up. Finally they just appear to just give up and shut down.

It all seems very strange to me.

Re:which side of the law is our community on?

[BgJonson79]

If the scrupt kiddies buy the hardware like we buy the DVDs maybe you have a case, otherwise it seems to me like apples and oranges to me.

must have been the straw...

[Hollins]

They had to have been in a dire position to start with, or merely decided to sell out. This gave them a reason to explain dumping everyone's accounts over to another ISP. They didn't specify how much they made off the deal.

I can't see a healthy, competent ISP being put out of business by dos attacks. Yet.

Re:Extreme?

[arkanes]

They get charged through the nose for all the bandwidth the attack takes. Theres a certain amount of money budgeted for bandwidth, but the a DoS attack hits and suddenly you're running at 100x normal bandwidth cost for however long it takes you to break the attack - that kind of fee can certainly break a company that already lives on the edge.

Sadly, Laws Won't Do It

[tarsi210]

Sadly enough (and I certainly feel for the ISP), new laws concerning these attacks aren't going to help anyone. For laws to be effective, you actually have to catch the person in question, and with DDOS that's darn tough.

I'm not sure what the real answer is, though. I find myself reading these stories and articles and feeling helpless myself, even though I'm not directly involved. But I am a programmer, and we're supposed to have brilliant solutions to these issues....but I can't come up with one. The underlying structure of the 'net itself is to blame for allowing these attacks, and you know to change that will be like getting all cars to convert to bacon fat gas.

How does one instigate a major industry shift in how we do things? Would it even be worth it, or will we just see these random business fold due to stupid fucking kiddies?

Re:Sadly, Laws Won't Do It

[berzerke]

While I agree that catching the person behind this, and giving them real punishment, is the best solution, it is not the only one.

There have been a couple stories on /. already about those with insecure networks being sued and forced by the courts to shutdown until they can secure their networks. This (and others) ddos is probably coming from insecure computers. Yet, if you track down some of these computers, all but the smallest ISP's could care less that their network is being used to attack someone.

Perhaps some laws that make it easier and cheaper to shutdown the insecure computers will help put a stop to that. Perhaps something similar to the DMCA with regards to copyright infrigement, where if the ISP pulls the plug, they have legel liability protection, only with strong penalities for making a false report.

Re:which side of the law is our community on?

[berzerke]

The unwashed masses out there see both of these as the same thing...

That is the problem. I always try to explain it this way: There are good doctors, and there are bad doctors. There are good lawyers, and there are bad lawyers. There are good cops, and there are bad cops. (etc.) And there are good hackers, and bad hackers.

One ISP is punished for another ISP's mistakes...

[Anonymous Coward]

One of the main reasons DoS attacks work is because of misconfiguration at ISP's. If the ISP's blocked outgoing packets with forged IP src addresses, and known bad packets, then the severity of the problem would greatly diminish.

ISP's don't do this, because either they don't understand it's a problem, or they don't know how, or their poor NAS boxes would collapse if they were asked to filter the traffic, instead of just forwarding it.

Anonymity vs. Accountability

[beamz]

I know this is going to get modded down but this is what the community as a whole gets for having the luxury of being pseudo-anonymous.

There isn't much for accountability when it comes to the net and everyone knows this. Lawmakers are doing very little about SPAM and it's a form of DoS but people cry afoul when some kids were pissed off at someone on IRC and DoS multiple large networks.

If people aren't required to be accountable for ALL of their actions then this isn't going to stop anytime soon. Unfortunately it's not hard to get access to connections with a lot of bandwidth so it's easy to pound anyone into oblivion.

I don't know what the solution is but as more companies get DoS'ed while their livelyhood depends on the net, you'll see more being done.

My question is if it costs companies so much to deal with SPAM, why isn't more being done? Isn't this a similar issue?

Re:Anonymity vs. Accountability

[Bishop]

In her novel, Tea from an Empty Cup, Pat Cadigan predicted a world with 2 Internets. One was 100% accountable. It was the main network used for real bussiness. There was no annonymity. The second network was designed to allow for anonymity. It was an "any thing goes" network where spoofing was the rule not the exception. I would like to see these networks. When I need to get work done I would use the accountable network. When I want to view pr0n I would use the other network. I think having two distinct networks like this would be a good compromise for the privacy advocats, and those tired of DOS attacks.

Ofcourse there are a *few* (as in many) technical difficulties to resolve first.

Register coverage

[Zocalo]

The Register is an effective mirror of the article too, but they also have a *tiny* bit more information.

Same thing happened to me

[gabeman-o]

I run a small ISP, and two of our clients decided to run fragmented DoS attacks and ping floods that consumed the entire 100mbit connection to our main server. Our ISP got royally pissed and cancelled our services with them because it was against their TOS/AUP.

I have moved on to a better ISP that actually filters attacks leaving and entering the network.

Dos for weeks

[f00zbll]

According to the article, the attack was been going on for a couple weeks. Part of me finds this very disturbing and alarming. Considering how many times IPv6 has been posted on /. and the possibility of mediating the problem of distributed denial of service attacks with the new features of IPv6, why hasn't adoption been more rapid? If a group of vandals can bring down an ISP, what's to stop them from repeating it?

Now that the Internet has shown to be a useful medium and is rapidly becoming an utility, it's time to make it more secure and robust against DDos attacks. The technology exist already, the telco's need to take the initiative and make it happen. From this document on ietf.org site:

7. Security consideration
Any public proxy is inherently a source of DOS attack. Rate limiting packet emission as suggested in 3.5 is expected to lower the risks.

Why hasn't this been solved?

[DotComVictim]

A solution to the DOS problem was posed at the Adelaide IETF meeting a couple years ago. Basically, some small percentage of packets randomly selected get ICMP notices from routers, with last and next hop information, that is forwarded to the destination. So if you are getting a large number of packets from a single source, you get proportionally more of these packets, and can use a heuristical engine to model the source, even for DDOS problems. This allows you to trace back to the offending network/ISP and shut off the DOS

Why did no one do this? It requires changes to router firmware, I'm not sure about Cisco firmware upgrades, but I thought they were at least possible. Besides, they could use this as a selling point and declare their old routers obsolete.

Admittedly, the model breaks down under MPLS, since it is difficult to track the cloud, but you can at least track entrance and exit points from the cloud.

Calling it "terrorism"

[prophecyvi]

The Register has a story on this as well, mostly a rehash of ISPReview. Link here.

From that article:

Speaking to The Register a dejected Mr Miszti said: "This is terrorism - pure and simple. I never want to relive the last seven days again.

You're thinking "terrorism? yeah right".

It's too bad (for them) they're in the UK... in the U.S., under the so-called "Patriot Act" this IS in fact terrorism. Read for yourself here.

Re:which side of the law is our community on?

[jas79]

the same side as always.
the 'slashdot community'is against unfair laws , but in favour of good laws.

destroying something without a good reason is just wrong.

Re:which side of the law is our community on?

[bwt]

We're on the side that says information is not a crime, but attacking someone is.

Writing a DoS tool is not a crime. Using it on someone else is. What's so hard to understand?

Obstruction?

[hughk]

As far as I can see, the script k1dd13z, are intentionally interfering with a business. Treat it as any other kind of commercial blockade and if they persist, let them be sued.

In the UK, the Computer Misuse act is such a catchall, it would be easy to claim damages (less easy to collect though).

Slashdot is known for having a DOS effect, but at least it is people attempting to view a site for its content. Its tough if you pay your hosting company for bandwidth but, at least it's legitimate and its is coming from a lot of users.

The trouble is, so does a distributed DOS. This has a lot of unwitting users too. It is extremely difficult to trace who is giving the orders and the actual attack 'bots run on any suitably unprotected system that happens to have conveniant broadband access to the web. Even the Whitehouse was hit, liuckily the attack 'bot was dumb and a quick switch to a backup IP address solved the problem.

The only solution that I know is to use a private network (as done by several securities exchanges). You can block out all of an exchange's internet access, but you will not hit the private network. Users without a private network connection can fall back to switched circuit connections (i.e., ISDN) when the Internet is down.

Re:Obstruction?

[tomblackwell]

Have you tried recently to sue a 14-year-old in Singapore or Russia or South America?

I would make such an annoucement

[Florian Weimer]

if my business plans didn't work out.

(Read the final paragraphs of the announcement. Why do they stress that they are solvent?)

Simple filtering should stop this?

[Twylite]

I could be a little out of date (maybe even a lot ;) ), but last time I checked you could do a lot of calming of DoSing by implementing proper packet filtering on routers.

IIRC most DoSing relies on the kiddie hiding their source address (so that they can't be traced). So ensure that the router closest to the kiddie knows all the IPs it is allowed to accept, and rejects (and logs) all others.

This puts an onus on ISPs to handle the situation. Any ISP which doesn't react immediately to a DoSer from it or a downstream stands to lose (all of) its uplink(s).

Most port handling equipment can handle quite complex filtering on its own, knowing the IP allocated to a port and filtering all packets without that as its source. Port handlers typically forward to a router anyway, so its easy for an ISP to say "that interface talks to that rack, which can use IP range X to Y, so filter everything else". Immediately your script kiddie is limited to faking addresses of other users in the range.

This screws up a number of DDoS attacks I know of (where the reply to an unwitting host causes shit for the replier), and makes it a lot easier to trace the kiddie at least to within a limited number of possibilities.

If the ISP supplies a link to another ISP it must ensure it toes the line. Bulk links to corporate customers or anyone with a range of IPs (rather than just one) at the other end of the link can usually be handled like dial-ups: port handlers filter out bad source IPs.

Does anyone know of technical and/or political reasons why this can't work? If there are no technical problems then maybe an IETF policy committee needs to make it a standards issue.

Re:which side of the law is our community on?

[evilviper]

Can't speak for the rest of the slashdotters, but I don't want them to be prosecuted... I want the insecurity to be repaired, which is what we've always wanted.

What happens in the business world with the DMCA, they would arrest who-ever pointed out that DDoSing was a possibility. Just the opposite of the solution.

Besides, it's a trivial fix... The only problem is that nobody takes the initative.

Ethics

[Aceticon]

As usual this is a question of ethics.

It has nothing to do with hackers, crackers, RIAAs, MPAAs or the color green - it has all to do with freedom of information:

- I support freedom of information, and by extension those that help make information free.

- I'm against restriction of information (any kind of information - bad, good, usefull or useless). Naturaly i am by extension against those that try to constrain that freedom.

- Which side of the law am i on?
Neither side. My ethics are independent of the law.

Going back to this specific case, i'm against however did the DDoS attacks because they went against other people's freedom to give and receive information.

Re:Ethics

[Em Emalb]

I think a lot of people are like this.... until someone comes along and does something horrible to them. Then they change their toon fast. I am not saying this against you Aceticon, but you know it's true. People scream for freedoms until they get abused by it and then the song changes. Just a thought.

Re:which side of the law is our community on?

[(H)elix1]

Or in this case...

Programs don't kill servers, malformed packets kill servers.

We're in the grey area.

[phathead296]

There is a world of difference between trying to maintain our fair use rights or exposing bad "security" methods and launching a DDoS attack against ANYONE.

This is not a black and white issue. A DoS attack is both illegal and imoral, as what you are doing hurts a large group of people. Exposing bad security in e-book files will help people in the long run. (Although it will help the copyright holders and not us :( )

As for the general population, it depends entirely on what the media reports. They can report that "hackers" have cracked a protection scheme, or they can report that a digital protection scheme was proven inadequate. Both are technically true, but each favors one group as the good guy. Unfortunately, since news is an entertainment forum, the first is more likely to be reported.

Until the general population is tech savvy enough to understand these issues, the media will have complete control over their opinions.

Cheers,
Phathead

Re:which side of the law is our community on?

[ReelOddeeo]

Writing a DoS tool is not a crime. Using it on someone else is.

I agree. In support of that viewpoint, I would give the following example counter argument.

Guns are bad. Nuclear weapons are bad. Let's remove them both from the military. Studying how these things are built and used is not a worthwhile endevor. Since we don't believe in attacking someone for no reason, we don't need any weapons. We also don't need to study how offensive weapons might be used against us. Therefore there is no reason for their existance. Let's just pass a WMCA (Weapons Millenium Contraband Act) law and outlaw anyone even thinking about how weapons work or how reinforcements might be vulnerable to weapons.

(Disclaimer: I don't own anything which was designed to be used as a weapon; lest someone pigenhole me into a certian group.)

Slave to our own inadequate design?

[Wanderer1]

I saw a comment in here blaming the Internet's end-to-end design for the ability for individuals to cause such interruptions to service. BUT...

With all the designs available to us today, as engineers, we should be able to employ traffic shaping devices to limit the amount of load any given site can generate on the net. Cache, throttle and filter. We build routers that can switch ungodly amounts of packets per second (obviously enough to flood the link to Cloud 9's boxes.

So why can't Cloud 9 invest in a few black box traffic shapers (I know they exist) to smooth out the requests?

Just where is the point of failure, anyway?

As long as we continue to design our edge devices to be layover victims, we'll always have these problems. The network delivers, the computer abides. Well, perhaps the computer shouldn't be so quick to respond.

-b-

Re:which side of the law is our community on?

[-brazil-]

Besides, it's a trivial fix...

Technically trivial, perhaps. Administratively, it is extremely non-trivial, and that's just as big a factor. Please get off the "If I can do it in my home network of three machines, it must be just as easy to do for the whole internet" horse.

Knock on their door

[CDWert]

We had a DOS issue once,
Kinda funny actually, poorly done, we tracked down who it was, Unknown to the dimwit on his dads T1 (at home his dad was playing hosting provider) The admin at his upstream was a friend of mice accross town, I called paul up and said hey what you trying to pull here, he chuckeled and said I know, I know, I just saw the traffic, you wanna know who it is, you want me to cut him off ?, I said nah, leave him up, I dont want him to know I know, My friend kindly gave me his name and address,

I showed up at around 3:30 since I figured it was they guys kid, and he should be out of school by then, I took a friend(witness along) I didnt want this punk saying I beat him up or anything. I had a cell phone in one hand and rang the bell with th other, he came to the door and I said, right now the Police number is on this phone, I am good friends with a detective there(true) now, you either pull the plug on your end or I press send and well see how long it takes for them to come and pull the plug permanetly, although I dont think you dad would be real happy, I thought this kid was going to wet his pants, Ive only seen somebody so scared a few times, he fell back over a chair in the foyer and took off ? I looked at my friend and it was all we could do to keep a srtaiht face.

He came back 20 seconds later and said its off, and the n stared to enquire about if I was going to tell his dad, I said no but Im sure the bill from your provider will, He was on a transfer pricing plan and this had been going on over 2 weeks while I was on vacation.

I have "Knoked on doors" twive one was a 2 hour drive but I had other business in that area , most certainly the most effective DOS stoppages Ive ever had.

Maybe we should form an allicance of Administrators geographically dispersed to start knocking on their doors, sort of an Administrators Militia , you knock on his in BFI and Ill knock for you when you need it. Police scare the shit out of most of these script kiddies, probably more the fear of knowing being arrested is not something easy to hide from the parents that pay for their computers and bandwidth.

Hold on there...

[Shoten]

Now, I don't doubt that Cloud 9 was/is a great ISP, but I have to take their statements with just a wee grain of salt. I don't see anything there that indicates that they came under any worse of a DoS attack than scores of ISPs before them...why is it, then, that this particular ISP decided to just pack up and die over it? Something smells a little funny here, and I can't just take their attribution of the business failure to hackers as gospel.

No technical solution, it's an apathy thing...

[anthonyclark]

The problem is that sysadmins see the scans from these kiddies and ignore them (those that even have a portsentry or similar application in place). If you saw someone walking around your house and trying the doors and windows, you'd call the police right away, wouldn't you?

So why do the kiddies get off free? Sheer apathy from most of the sysadmins in the world.

When you get scanned, you have the address (if it's not spoofed), you can send a mail to abuse@domain. But most people don't, because It's too much hassle or we can't be bothered or no harm was done.

Script Kiddies will have a far harder time when admins start practising zero tolerance.

Re:No technical solution, it's an apathy thing...

[Legion303]

The authorities won't do anything to offending script kiddies unless you can show a certain dollar amount of damages. Most admins probably don't bother calling the feds because they know the feds won't do a thing.

-Legion

Re:No technical solution, it's an apathy thing...

[macemoneta]

Even on home cable, it's not feasible. I had done this when I had gotten 1-2 scans a day. I never received a response to the report. A few trojans ago, the scan rate picked up (now over a dozen a day). It's gotten to the point where I just turn the monitoring for scans off (still watch for unauthorized access). This is just me at my home PC; it would be a full time job to keep up with this. It's just not feasible.

We need an automated tool for collecting the scan data, and depositing it in a repository. The respository can perform the correlations to track these to the source nodes. Higher level (towards core) IPSs can take the lower level (towards edge) ISPs off net until the DoS is terminated.

If done properly, but still mostly manual operation, a DoS would last at most an hour. The problem is getting cooperation between companies and organizations that are business competitors. You need a third party independant organization (jointly or government funded) to manage the repository and request the service deactivation.

Of course, then the repository would itself become the target for attack...

Re:No technical solution, it's an apathy thing...

[pclminion]

The problem is that sysadmins see the scans from these kiddies and ignore them (those that even have a portsentry or similar application in place). If you saw someone walking around your house and trying the doors and windows, you'd call the police right away, wouldn't you?

You know, for a while I thought this would be a good idea. First, I set up MySQL with a DB and some tables to store information on portscans. Then, I downloaded portsentry, and hacked it slightly to make entries in the database whenever I was scanned. Then, I wrote some PHP to let me look at the results via a webpage.

The result? I have learned that I'm scanned anywhere from 3 to 50 times per day, from all over the world. I tried emailing abuse@... as you suggest, many many times, with no results.

Now, I have learned some interesting things by doing this:

1. Most scans are on ports 21 (ftp) or 23 (telnet). It's hard to prosecute someone, or even get them in trouble with their ISP, simply for trying to ftp to you.
2. Most scanners are scanning from hacked accounts. ISPs are unwilling to shut down these accounts for lack of proof, and to avoid pissing off a customer.
3. All the scanners are quite easily blocked by portsentry.

I no longer try to do jack sh*t about portscanners. My pleas have gone unanswered, and I simply don't care anymore. Once I have a true firewall, I'll care even less. Let them scan me.

This will never stop until ...

[gewalker]

Although the news item does not justify saying that the ISP was going out of business because of DOS attacks (they were still financially solvent), perhaps the owner decided he had had enough of the problems from vandals. A well-run business will shut down and leave the neighboorhood when windows get broken repeatedly before they loose all of their money.

Computer vandalism -- This will not decrease until we (as the technical community -- including management) decide to make some changes. Without changes, it will only get worse.

1) Although technological solutions are useful and necessary, they are not enough. The trusted network model does not work in the real world. There must be rules, accountabilty and penalties (without penalties, nothing stops me from continuing to break the rules).

2) Many network rules exist, some are poorly enforced.

3) Because of packet-spoofing. Some (D)DOS attacks can be nearly impossible to shutdown. We need to make sure only legitimate packets can Internet at large. Without this rule, tracking down the vandal and applying the penalty is not practical. If packet spoofing were eliminated, it would be possible to identify culprits at a modest cost.

4) Accoutability needs to be improved by everybody. If Nimba2002 is released tomorrow, Microsoft should be expected to make it well known, and supply a fix. Network servers should be patched. People running compromised server should be cut-off until they get fixed. These things happen by and large in a haphazard fashion today. The problem needs to be addressed at the source whenever possible.

4) Penalties need to be commensurate with violation. A hand-slap for vandalism does not deter, a death-sentence for jaywalking deters, but it not justice either.

5) Then maybe we should get rid of junk email for an encore.

Re:I'd like to know

[RC514]

The slashdot effect has been analyzed:

Traffic increase from slashdot effect
Increase in hits and bandwith requirements of a Linux related story being featured on Slashdot
Analysis of several stories making it to the frontpage of Slashdot and other newslogs.

Especially the second link shows that the Slashdot effect can look very much like a DDoS attack. The severance depends on the story, probably on the time of day and of course on the link and hardware powering the /.ed site.

If you pay by the gigabyte for your webtraffic (who doesn't), the /. effect can be a financial DoS attack much more than a technical DoS.

Egress filtering and ISP responsibility

[Medievalist]

/.
Back in the day, before the Internet went commercial, if you abused your connection your upstream provider (typically a bunch of long-hairs at a land-grant university) would cut you off. If they didn't do it, their upstream provider would cut them off.

Currently, there is no real penalty for large ISPs who do not implement egress filtering (which prevents IP source spoofing) and/or refuse to co-operate in tracking down DOS sources.

The anti-spam vigilantes have been partially effective in cutting off ISP service to the worst spammers; perhaps something similar is needed to influence the ISPs who refuse to implement egress filters.

--Charlie

Re:This can't be the whole story...

[3am]

yeah, but that was before the release of Windows XP. This would never have happened if raw socket access was unavailable!

Wouldn't want to be the script kiddie who did this

[Bloody Peasant]

Think about it: you've just brought down a major ISP, sent their sysadmins to the unemployment lines, and now they have plenty of time on their hands, probably have copies of all the logs, and nothing better to do than go through them with a fine tooth comb to find who messed up their lives.

Nosiree, I would not want to be in those script kiddie shoes. Not that I'm saying the sysadmins would stoop to anything illegal, but there's lots they can do legally if they find out who's behind the attack.

Re:which side of the law is our community on?

[perrin_harkins]

We're on the side that says information is not a crime, but attacking someone is.

You are on that side, but not everyone is. I've seen stories about companies that Slashdot criticizes fill up with comments along the lines of "I'm DoS'ing them now, and here's the script I'm using." Never heard a word of protest about this from the Slashdot editors before.

Re:a potential way to stop them

[TBC]

Rant mode on:
The majority of DDOS attacks could be tracked if only more ISP's would put outbound packet filtering on. I am not a transit ISP, so there is never a reason for me to send a packet with a source IP address that doesn't belong to one of our assigned address blocks. There is no way for that packet to get back to me. The problem is that it requires a more powerfull router to support the filtering. If more ISP's implemented filtering, at least you could track exactly where DDOS attacks are comming from.

Reason for going out of business.

[chrispe]

In the post the C9 said that they had 1000s of business offline for days. Now with commercial customers many ISPs give some type of compensation for down time. If they had 1000s of commercial customers down for that long some of them may have been banks, hospitals, government agencies and other companies that need there feed. It is very possible that this attack causing all service to be down for a long time could have caused a lot of underlining problems

Re:Got to be something more to this than is report

[spazimodo]

http://www.theregister.co.uk/content/6/23770.html

"...What followed was first a Firewall password brute force attack resulting in successful hash and destruction of the firewall,"

If they leave their firewall accessible to any sort of brute force password attack, its a good bet they don't know what their doing and would have no idea how to stop a DoS attack.

I agree with some of the other posts suggesting that this DoS was just a handy beard, and that they were in some sort of financial difficulty.

There's a new sheriff in town

[QuantumG]

Legal action has largely been considered the only way to use force on the Internet. To do this you need to know who someone is and it is very costly. If you know who they get their Internet connection through there are laws in effect that you can use to shut them down. I think this is the latest proof that non-legal force is a reality on the Internet and it is directed towards the weak link in the legal chain. ISPs have to co-operate with law enforcement or legal copyright bullies to shut down attackers like this and they are likely to be attacked in this way. Let it be known: There's a new sheriff in town and he can force you off the net.

Re:which side of the law is our community on?

[fatphil]

You're far to direct to get any attention, alas. You deserve an upmod for sure.

To reiterate and expand:

The DoS-ers are causing material and practical harm to the equipment of others.

The LiVid guys etc. are doing something useful and practical with something that they own.

The two situations are _diametrically opposed_.

FP.
(I don't mind being redundant if it helps some people get the point!)

Re:which side of the law is our community on?

[Decimal]

Writing a DoS tool is not a crime.

This is true, if you know your boundries. You would get an "illegal operation" message if you tried to access more than 640K of memory.

Re:which side of the law is our community on?

[Flower]

Taking the article at face value, a business has had to close because it was being deliberately assaulted by vandals. I can point out people who are now out of work, customers who have lost a service they wanted, resources wasted, etc., etc.. This wasn't "our" stuff that was being abused. It was a bunch of regular Joes and Janes out their being deprived of a service they purchased.

Compare this to stuff like DeCSS, Felton's work on SDMI and the rest. Showing why something doesn't work or getting additional functionality out of a product just isn't the same as maliciously depriving a business of the resources it requires to survive.

It isn't hard to explain but what is hard is getting the message out when Disney and the like are spouting their propaganda at 11 and with the simple fact that this isn't a bullet issue for the proverbial Joe Average.

Re:DoS and Spam

[mpe]

A skript kiddy is pretty safe, as are spammers

Depends, if a spammer is trying to sell a real product they should be perfectly possible to track down.

Re:which side of the law is our community on?

[Catiline]

Counterargument to your very silly counterargument:

Doctors study illness not to cause it, but to cure it.

I know that politicians, when dealing with computer technology, like to follow your facetious argument. The problem is that the general public has a hard time realizing programs are more like a leatherman multitool (wide purpose) and less like an EEG machine (one purpose). I've used Word to doodle, or play games (it's quite fun mangling the program using VBScript). Is it a crime for me to do so? After all, the same skills have been used to write virii or munge the security of a LAN.

I understand the twin concepts of responsibility and accountability: those are what keep me from considering any hacking. I've almost always known how to break security on any computer system I used; those two ethical precepts kept me from actually doing it (despite often strong temptation to the contrary). And if they were taught in public schools- and made to stick- script kiddies probably would be managable.

This is not to absolve network admins of their responsibility (to have a good firewall, practice proper security, etc). I just think that maybe we need consider the possibility that where the slashdot community stands isn't pro or con, but a sensible and logical medium.

Kill the martians!

[leonbrooks]

i came upon an interesting article that talks about a reverse firewall

*All* of my servers block all traffic to/from private IPs - except subnets they know - and block outbound traffic not from an externally visible IP that they own; they've done this for years, it's a fairly simple set of ipchains/iptables rules. The 2.4 kernels have a heap more options such as automatic martian (alien packet, ``it can't have come from there'') assassination.

Oh, and they complain in the logs, which are monitored. They also use tools like portsentry to temporarily block all traffic from IPs that sniff them.

And they all stay updated (thanks Mandrake, even if it's not quite as simple as Debian).

These things are all easy under Linux, presumably most BSDs, and probably not that difficult under Solaris, HP-UX, OS/X et al. But Windows? Hmmm...

Shortlist of private IP subnets to drop: 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.127.0.0/16; there are a few others you could use as well.

Do a traceroute 192.168.99.99 from your box (try a few other private IPs as well) and see what happens. From here, RadioWAN don't filter, EfTel don't filter, Paradox don't filter, and AlterNet only drop private IPs after a few hops into their LAN (hey, at least they don't route it!), which is all very sad from a bullshit-deterring POV.

Re:which side of the law is our community on?

[renehollan]

"...as far as I can tell there is no legitimate use for a tool designed specifically for DoS attack.

Of course there is: to test the robustness of a piece of equipment against such attacks.

There are ways to deal with DDOS attacks, but, unfortunately, they require the cooperation of most parties involved in the aggregation of "hostile" traffic toward a given target. It does no good for the target to simply drop "hostile" packets, because upstream "friendly" traffic might still get congested. The upstream routers need to be told to stop forwarding the "hostile" traffic.

And this raises two problems: 1) How do you deploy the software to an existing router infrastructure to allow this back-propagation of "stop forwarding hostile traffic to me" messages. 2) How do you identify traffic as "hostile"?

There are techniques for guessing what traffic is actually hostile, based on packet signatures (often the source address is spoofed, the attack is distributed, or otherwise useless), without dropping too much friendly traffic. It is better, though, to lose some friendly traffic, rather than all of it -- failing gracefully, as it were.

But retrofitting a standard DDOS defense will prove to be difficult, given the diversity of players involved (and this is one area where IP carrier consolidation would be a good rather than a bad thing) -- just look at the difficulty in bootstrapping IPv6 in the network.

Re:Extreme?

[sql*kitten]

Do they really need to go out of business? Heck, if the company is "solvent", it seems to me they could find a way to survive

Maybe they just thought, it's not worth it. Why work your ass off to build a company if people, maybe even some of your own customers, are just going to pointlessly destroy it? There are easier, saner ways to earn a living.

Re:which side of the law is our community on?

[Tassach]

Of course, we reserve the right to define what are "good laws" and what are "bad laws", and in what cases a particular law that we consider "bad" is suddenly "good" or vice versa...

It's pretty easy to tell good laws from bad ones, using objective standards:

Good laws protect individual freedoms and provide a level playing field for everyone.

Bad laws destroy liberty and favor special interests over the good of the whole.

This is not the first time!

[wackysootroom]

CP/M Was also forced out of business by DOS.

Martial Law. . ?

[Fantastic Lad]

I recently watched one of the high-end news shows which ran an hour documentary on hackers and the net.

For one section, they had cameras sit in on a bunch of young military techies studying the logistics of combating a huge hack-attack; like nuclear power plants being shut down or hacked into danger zones. Airlines losing planes. That kind of thing.

I've been pondering just how exactly the developed nations could be whammied into a state of martial law. The current world situation doesn't have enough momentum to actually put thousands of Americans in prison camps. And the forces which drove the Nazis just aren't there. ("We are descendants of superior Aryans from space!" -No joke.) People today, while easily manipulated, haven't been sold that kind of propaganda, but it remains quite clear that a form of undeclared fascism (That is, "freedom", so long as you eat shit, breath shit, think shit, absorb shit media, and work too hard, and don't mind being overseen by Shirow-style O.R.C.S. with machine gunes, in order that you be reduced to the position of Zombie-like Serfdom), this it seems to me, will be the natural conclusion given the forces of greed and corporate evil moving in the world today.

Choice means that people might not buy your product. Remove choice, while maintaining the illusion of a free society, and bingo! You have the perfect consumer; driven because s/he still believes in the American Dream, but a serf nonetheless, whose task it is to pour wealth into the coffers of the powerful. And to be miserable for those who eat misery. . .

Anyway, it was interesting; the documentary basically said the following:

1) Security basically doesn't exist and isn't getting any better. Information systems are open to those who understand how.

2) The possibility of a huge disaster is ever-present and continues to grow as we become more dependant on I.T.

One military analyst basically said, with a straight & serious face, that in the event of a huge digital attack, "Declare martial law. Shut everybody down and take control of the situation. That'd be my recommendation."

Hmmm.

I don't know how true the above is, but the fact that it was being sold by a respected authority voice, indicates that they're trying to soften people up for just such a turn of events.

-Fantastic Lad

uh...no?

[MemeRot]

They're monkeys hurling feces. They will stop if they think a bigger monkey will kick their ass. That's why they're not firebombing people, because if they did that they'd get caught. But the cop monkeys don't understand DoS attacks so there is no fear of reprisal. Look at how monkeys deal with the issue. Do you really think humans have any better a handle on it?

Does this seem suspicious?

[foofboy]

Seeing a isolated snapshot of the situation doesn't provide alot of information, so I'm a little confused. How is it possible that a DOS alone could drive an ISP out of business. Was it really a healthy business that was destroyed by a DOS, or was this the straw that broke the camel's back. It was mentioned that they did have insurance, but that the insurance wouldn't cover "rebuilding their network". "[A] Firewall brute force attack [resulted in] successful hash and destruction of the firewall" = bad password, no backups. I'm just trying to figure out what kind of DOS can lead to the destruction of an otherwise healthy network and company. The press release paints the picture of a smoking crater, but of course, it's all just data. There's no defense against the various flood attacks, but they should be easiest to trace, and temporarily filtering the flooding IP's should prevent widespread damage. Any ISP admins care to comment.

Other than saving face, ("Hackers did it" vs. "unchecked spending did it"), is there any practical advantage to claiming that evil hackers destroyed the business. Something just doesn't add up.

Not fixing DDoS problems a tool for big business?

[netsplit]

As someone who was put in this same situation at the end of '99. I can only say -- if the big boys were concerned -- it would not be a problem. Although its not a trivial problem, dynamic blocking rulesets on bordergate routers who get a rush of ICMP (or other sorts) of traffic to a single target would not be hard to block.

My small ISP which had been doing okay had been stranded without an uplink after a 150Mbit attack took out sprint links in our part of .ca. After the attack our ISP was quick to disconnect us with no alternatives we closed our doors (noone else in town wanted to touch us).

After the attack we were quick to contact the NOC of a few schools with unused 'open' blocks who refused to claim responsibility (of the DDoS packets) or fix the problem. About a month and a half later they had FBI knocking on their door after the ebay/yahoo etc attacks.

The question --

Do you think DDoS could be a tool for the bigger ISP's and players to squeeze smaller guys (ISP/ASP) out of business? I know that one quite is a stretch.

What other reasons have kept ``Tier-1'' networks from implementing fixes?

Re:which side of the law is our community on?

[Tim C]

No, a terrorist probably wouldn't, but a hobbyist chemist might, just to see if they can.

Likewise, no a cracker probably wouldn't write a cracking tool/DoS tool/whatever unless they were intending for it to be used, but I might. Maybe I want to see what's involved, maybe I want to gain some sort of insight into how they're developed and how they work, the better to secure my own system(s). Hell, maybe I just have some time to kill, and can't think of anything better to do with it.

Knowledge should not be illegal. The use of that knowledge to the detriment of others is an entirely different matter, and should not be confused with the mere possesion of that knowledge.

Cheers,

Tim

DoS my arse

[Dynamoo]

DoS my arse - Cloud 9 were the ISP for my wife's company, and if their experience is anything to go by it's not suprising they went bust.

Let's start with the awful customer service, unreliable connections, awful customer service, immoral and possibly illegal business practices, awful customer service and awful customer service.

Her firm had a problem with the mail relay, it's only a small firm and they'd left the relay open and some spammers had found it. Cloud 9 terminated their connection without notice of any kind, and when finally they found a human being to talk to (they like to do their tech support by fax) they basically tried to blackmail her firm into handing over control of their domain, hosting etc etc to Cloud 9 before they'd reinstate the service. Needless to say, they got dumped very quickly indeed and went to Demon.

Frankly they're a shitty outfit and they've got their just rewards.

Re:Wouldn't want to be the script kiddie who did t

[matt_wilts]

>Not that I'm saying the sysadmins would stoop to
>anything illegal, but there's lots they can do
>legally if they find out who's behind the attack.

I wouldn't be so sure. Here in the UK it would seem that the Data Protection Act would stop the hacker's ISP from handing over details. See this recent story from Silicon where a UK ISP has refused to cooperate over hacking allegations.

Yet another case of UK law helping the miscreant & not the victim.

Matt

Re:which side of the law is our community on?

[bwt]

Oh, B.S.

Please post a link to one of these posts.

A small ISP's viewpoint.

[Harik]

I just want to firewall ports around 6667 to keep people from getting in IRC wars

Seriously though, I could care less about the proliferation of DoS/DDoS tools. What bothers me is that the ISPs where this crap is coming from have never been blackholed by the rest of the community. It's not THAT hard to implement a widespread policy of filtering source packets, and that cuts down on a LOT of the methods used by the skript kiddiez.

The pathetic part about it all is it was already a problem in '95, and source-filtering was strongly recommended then. Soon after, no ip directed broadcast became also strongly recommended. Sadly, I can still get a 250:1 return on a forged ICMP ping (thankfully, their outgoing bandwidth is only a T1)

The real culprits are the people too lazy or inept to be allowed to run a network.

--Dan

Use Honey pots

[AaronW]

One solution to the problem would be to establish randomly distributed honey pot computers which act as if they're infected by one of the various script-kiddie trojans. Log everything that happens to those computers, but do not allow those computers to actually perform DoS attacks (the script-kiddie probably won't know the difference).

After collecting evidence, the perpetrator should be fined and prosecuted. It would likely cost nothing to the tax payers since it could fund itself from the fines imposed on the perpetrators. If it's just a kid, then hold the parents responsible.