Slashdot Mirror
ISP Forced Out of Business by DoS
flyhmstr writes "According to a report on ISPReview Cloud Nine have been forced off line and out of business thanks to the actions of crackers deciding to go play with some DoS tools." It's only getting worse.
The kids are getting more and more aggressive as time goes on and
it gets easier and easier to launch a large scale DoS. As any
techie knows, fixing the problem is far easier said then done... but
as a frequent recipient of the sharp end of the DoS stick, I sure
wish it wasn't an issue.
of course a nice healthy slashdotting right now doesn't help anybody's case. :grin:
Can someone please clue me into why people do this? I don't quite understand this mentality. I have never done something bad like this simply because I could. Am I a rarity in this world? Do these kids need a hug? Why would you do this? Feeling "elite" because you can knock down an ISP? Take your energy and do something positive with it. IMO, this is petty and retarded. Maybe these script kiddies can go knock down a hospital or something next, hey why not, it doesn't hurt anyone right? RIGHT? forking iceholes.
Sent from your iPad.
but as a frequent recipient of the sharp end of the DoS stick, I sure wish it wasn't an issue
.. no /. has never DOS-ed a site... really i swear..
ha ha ha.. this comming from the kingpen of DOS
"Shut up brain or ill stab you with a Q-tip" Homer Simpson
If the scrupt kiddies buy the hardware like we buy the DVDs maybe you have a case, otherwise it seems to me like apples and oranges to me.
There are four boxes used in defense of liberty: soap, ballot, jury, ammo. Use in that order.
They had to have been in a dire position to start with, or merely decided to sell out. This gave them a reason to explain dumping everyone's accounts over to another ISP. They didn't specify how much they made off the deal.
I can't see a healthy, competent ISP being put out of business by dos attacks. Yet.
They get charged through the nose for all the bandwidth the attack takes. Theres a certain amount of money budgeted for bandwidth, but the a DoS attack hits and suddenly you're running at 100x normal bandwidth cost for however long it takes you to break the attack - that kind of fee can certainly break a company that already lives on the edge.
The unwashed masses out there see both of these as the same thing...
That is the problem. I always try to explain it this way: There are good doctors, and there are bad doctors. There are good lawyers, and there are bad lawyers. There are good cops, and there are bad cops. (etc.) And there are good hackers, and bad hackers.
The Register is an effective mirror of the article too, but they also have a *tiny* bit more information.
UNIX? They're not even circumcised! Savages!
A solution to the DOS problem was posed at the Adelaide IETF meeting a couple years ago. Basically, some small percentage of packets randomly selected get ICMP notices from routers, with last and next hop information, that is forwarded to the destination. So if you are getting a large number of packets from a single source, you get proportionally more of these packets, and can use a heuristical engine to model the source, even for DDOS problems. This allows you to trace back to the offending network/ISP and shut off the DOS
Why did no one do this? It requires changes to router firmware, I'm not sure about Cisco firmware upgrades, but I thought they were at least possible. Besides, they could use this as a selling point and declare their old routers obsolete.
Admittedly, the model breaks down under MPLS, since it is difficult to track the cloud, but you can at least track entrance and exit points from the cloud.
We're on the side that says information is not a crime, but attacking someone is.
Writing a DoS tool is not a crime. Using it on someone else is. What's so hard to understand?
In the UK, the Computer Misuse act is such a catchall, it would be easy to claim damages (less easy to collect though).
Slashdot is known for having a DOS effect, but at least it is people attempting to view a site for its content. Its tough if you pay your hosting company for bandwidth but, at least it's legitimate and its is coming from a lot of users.
The trouble is, so does a distributed DOS. This has a lot of unwitting users too. It is extremely difficult to trace who is giving the orders and the actual attack 'bots run on any suitably unprotected system that happens to have conveniant broadband access to the web. Even the Whitehouse was hit, liuckily the attack 'bot was dumb and a quick switch to a backup IP address solved the problem.
The only solution that I know is to use a private network (as done by several securities exchanges). You can block out all of an exchange's internet access, but you will not hit the private network. Users without a private network connection can fall back to switched circuit connections (i.e., ISDN) when the Internet is down.
See my journal, I write things there
if my business plans didn't work out.
(Read the final paragraphs of the announcement. Why do they stress that they are solvent?)
As usual this is a question of ethics.
It has nothing to do with hackers, crackers, RIAAs, MPAAs or the color green - it has all to do with freedom of information:
- I support freedom of information, and by extension those that help make information free.
- I'm against restriction of information (any kind of information - bad, good, usefull or useless). Naturaly i am by extension against those that try to constrain that freedom.
- Which side of the law am i on?
Neither side. My ethics are independent of the law.
Going back to this specific case, i'm against however did the DDoS attacks because they went against other people's freedom to give and receive information.
Or in this case...
Programs don't kill servers, malformed packets kill servers.
+++ UGUCAUCGUAUUUCU
There is a world of difference between trying to maintain our fair use rights or exposing bad "security" methods and launching a DDoS attack against ANYONE.
:( )
This is not a black and white issue. A DoS attack is both illegal and imoral, as what you are doing hurts a large group of people. Exposing bad security in e-book files will help people in the long run. (Although it will help the copyright holders and not us
As for the general population, it depends entirely on what the media reports. They can report that "hackers" have cracked a protection scheme, or they can report that a digital protection scheme was proven inadequate. Both are technically true, but each favors one group as the good guy. Unfortunately, since news is an entertainment forum, the first is more likely to be reported.
Until the general population is tech savvy enough to understand these issues, the media will have complete control over their opinions.
Cheers,
Phathead
I saw a comment in here blaming the Internet's end-to-end design for the ability for individuals to cause such interruptions to service. BUT...
With all the designs available to us today, as engineers, we should be able to employ traffic shaping devices to limit the amount of load any given site can generate on the net. Cache, throttle and filter. We build routers that can switch ungodly amounts of packets per second (obviously enough to flood the link to Cloud 9's boxes.
So why can't Cloud 9 invest in a few black box traffic shapers (I know they exist) to smooth out the requests?
Just where is the point of failure, anyway?
As long as we continue to design our edge devices to be layover victims, we'll always have these problems. The network delivers, the computer abides. Well, perhaps the computer shouldn't be so quick to respond.
-b-
We had a DOS issue once,
Kinda funny actually, poorly done, we tracked down who it was, Unknown to the dimwit on his dads T1 (at home his dad was playing hosting provider) The admin at his upstream was a friend of mice accross town, I called paul up and said hey what you trying to pull here, he chuckeled and said I know, I know, I just saw the traffic, you wanna know who it is, you want me to cut him off ?, I said nah, leave him up, I dont want him to know I know, My friend kindly gave me his name and address,
I showed up at around 3:30 since I figured it was they guys kid, and he should be out of school by then, I took a friend(witness along) I didnt want this punk saying I beat him up or anything. I had a cell phone in one hand and rang the bell with th other, he came to the door and I said, right now the Police number is on this phone, I am good friends with a detective there(true) now, you either pull the plug on your end or I press send and well see how long it takes for them to come and pull the plug permanetly, although I dont think you dad would be real happy, I thought this kid was going to wet his pants, Ive only seen somebody so scared a few times, he fell back over a chair in the foyer and took off ? I looked at my friend and it was all we could do to keep a srtaiht face.
He came back 20 seconds later and said its off, and the n stared to enquire about if I was going to tell his dad, I said no but Im sure the bill from your provider will, He was on a transfer pricing plan and this had been going on over 2 weeks while I was on vacation.
I have "Knoked on doors" twive one was a 2 hour drive but I had other business in that area , most certainly the most effective DOS stoppages Ive ever had.
Maybe we should form an allicance of Administrators geographically dispersed to start knocking on their doors, sort of an Administrators Militia , you knock on his in BFI and Ill knock for you when you need it. Police scare the shit out of most of these script kiddies, probably more the fear of knowing being arrested is not something easy to hide from the parents that pay for their computers and bandwidth.
Sig went tro...aahemmm.....fishing........
The problem is that sysadmins see the scans from these kiddies and ignore them (those that even have a portsentry or similar application in place). If you saw someone walking around your house and trying the doors and windows, you'd call the police right away, wouldn't you?
So why do the kiddies get off free? Sheer apathy from most of the sysadmins in the world.
When you get scanned, you have the address (if it's not spoofed), you can send a mail to abuse@domain. But most people don't, because It's too much hassle or we can't be bothered or no harm was done.
Script Kiddies will have a far harder time when admins start practising zero tolerance.
----- Documentation is worth it just to be able to answer all your mail with 'RTFM' - Alan Cox.
Although the news item does not justify saying that the ISP was going out of business because of DOS attacks (they were still financially solvent), perhaps the owner decided he had had enough of the problems from vandals. A well-run business will shut down and leave the neighboorhood when windows get broken repeatedly before they loose all of their money.
Computer vandalism -- This will not decrease until we (as the technical community -- including management) decide to make some changes. Without changes, it will only get worse.
1) Although technological solutions are useful and necessary, they are not enough. The trusted network model does not work in the real world. There must be rules, accountabilty and penalties (without penalties, nothing stops me from continuing to break the rules).
2) Many network rules exist, some are poorly enforced.
3) Because of packet-spoofing. Some (D)DOS attacks can be nearly impossible to shutdown. We need to make sure only legitimate packets can Internet at large. Without this rule, tracking down the vandal and applying the penalty is not practical. If packet spoofing were eliminated, it would be possible to identify culprits at a modest cost.
4) Accoutability needs to be improved by everybody. If Nimba2002 is released tomorrow, Microsoft should be expected to make it well known, and supply a fix. Network servers should be patched. People running compromised server should be cut-off until they get fixed. These things happen by and large in a haphazard fashion today. The problem needs to be addressed at the source whenever possible.
4) Penalties need to be commensurate with violation. A hand-slap for vandalism does not deter, a death-sentence for jaywalking deters, but it not justice either.
5) Then maybe we should get rid of junk email for an encore.
The slashdot effect has been analyzed:
Traffic increase from slashdot effect
Increase in hits and bandwith requirements of a Linux related story being featured on Slashdot
Analysis of several stories making it to the frontpage of Slashdot and other newslogs.
Especially the second link shows that the Slashdot effect can look very much like a DDoS attack. The severance depends on the story, probably on the time of day and of course on the link and hardware powering the /.ed site.
If you pay by the gigabyte for your webtraffic (who doesn't), the /. effect can be a financial DoS attack much more than a technical DoS.
/.
Back in the day, before the Internet went commercial, if you abused your connection your upstream provider (typically a bunch of long-hairs at a land-grant university) would cut you off. If they didn't do it, their upstream provider would cut them off.
Currently, there is no real penalty for large ISPs who do not implement egress filtering (which prevents IP source spoofing) and/or refuse to co-operate in tracking down DOS sources.
The anti-spam vigilantes have been partially effective in cutting off ISP service to the worst spammers; perhaps something similar is needed to influence the ISPs who refuse to implement egress filters.
--Charlie
yeah, but that was before the release of Windows XP. This would never have happened if raw socket access was unavailable!
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
You're far to direct to get any attention, alas. You deserve an upmod for sure.
To reiterate and expand:
The DoS-ers are causing material and practical harm to the equipment of others.
The LiVid guys etc. are doing something useful and practical with something that they own.
The two situations are _diametrically opposed_.
FP.
(I don't mind being redundant if it helps some people get the point!)
Also FatPhil on SoylentNews, id 863
Compare this to stuff like DeCSS, Felton's work on SDMI and the rest. Showing why something doesn't work or getting additional functionality out of a product just isn't the same as maliciously depriving a business of the resources it requires to survive.
It isn't hard to explain but what is hard is getting the message out when Disney and the like are spouting their propaganda at 11 and with the simple fact that this isn't a bullet issue for the proverbial Joe Average.
I don't want knowledge. I want certainty. - Law, David Bowie
Counterargument to your very silly counterargument:
Doctors study illness not to cause it, but to cure it.
I know that politicians, when dealing with computer technology, like to follow your facetious argument. The problem is that the general public has a hard time realizing programs are more like a leatherman multitool (wide purpose) and less like an EEG machine (one purpose). I've used Word to doodle, or play games (it's quite fun mangling the program using VBScript). Is it a crime for me to do so? After all, the same skills have been used to write virii or munge the security of a LAN.
I understand the twin concepts of responsibility and accountability: those are what keep me from considering any hacking. I've almost always known how to break security on any computer system I used; those two ethical precepts kept me from actually doing it (despite often strong temptation to the contrary). And if they were taught in public schools- and made to stick- script kiddies probably would be managable.
This is not to absolve network admins of their responsibility (to have a good firewall, practice proper security, etc). I just think that maybe we need consider the possibility that where the slashdot community stands isn't pro or con, but a sensible and logical medium.
Do you like Japanese imports?
*All* of my servers block all traffic to/from private IPs - except subnets they know - and block outbound traffic not from an externally visible IP that they own; they've done this for years, it's a fairly simple set of ipchains/iptables rules. The 2.4 kernels have a heap more options such as automatic martian (alien packet, ``it can't have come from there'') assassination.
Oh, and they complain in the logs, which are monitored. They also use tools like portsentry to temporarily block all traffic from IPs that sniff them.
And they all stay updated (thanks Mandrake, even if it's not quite as simple as Debian).
These things are all easy under Linux, presumably most BSDs, and probably not that difficult under Solaris, HP-UX, OS/X et al. But Windows? Hmmm...
Shortlist of private IP subnets to drop: 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.127.0.0/16; there are a few others you could use as well.
Do a traceroute 192.168.99.99 from your box (try a few other private IPs as well) and see what happens. From here, RadioWAN don't filter, EfTel don't filter, Paradox don't filter, and AlterNet only drop private IPs after a few hops into their LAN (hey, at least they don't route it!), which is all very sad from a bullshit-deterring POV.
Got time? Spend some of it coding or testing
Of course there is: to test the robustness of a piece of equipment against such attacks.
There are ways to deal with DDOS attacks, but, unfortunately, they require the cooperation of most parties involved in the aggregation of "hostile" traffic toward a given target. It does no good for the target to simply drop "hostile" packets, because upstream "friendly" traffic might still get congested. The upstream routers need to be told to stop forwarding the "hostile" traffic.
And this raises two problems: 1) How do you deploy the software to an existing router infrastructure to allow this back-propagation of "stop forwarding hostile traffic to me" messages. 2) How do you identify traffic as "hostile"?
There are techniques for guessing what traffic is actually hostile, based on packet signatures (often the source address is spoofed, the attack is distributed, or otherwise useless), without dropping too much friendly traffic. It is better, though, to lose some friendly traffic, rather than all of it -- failing gracefully, as it were.
But retrofitting a standard DDOS defense will prove to be difficult, given the diversity of players involved (and this is one area where IP carrier consolidation would be a good rather than a bad thing) -- just look at the difficulty in bootstrapping IPv6 in the network.
You could've hired me.
It's pretty easy to tell good laws from bad ones, using objective standards:
Good laws protect individual freedoms and provide a level playing field for everyone.
Bad laws destroy liberty and favor special interests over the good of the whole.
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
CP/M Was also forced out of business by DOS.
For one section, they had cameras sit in on a bunch of young military techies studying the logistics of combating a huge hack-attack; like nuclear power plants being shut down or hacked into danger zones. Airlines losing planes. That kind of thing.
I've been pondering just how exactly the developed nations could be whammied into a state of martial law. The current world situation doesn't have enough momentum to actually put thousands of Americans in prison camps. And the forces which drove the Nazis just aren't there. ("We are descendants of superior Aryans from space!" -No joke.) People today, while easily manipulated, haven't been sold that kind of propaganda, but it remains quite clear that a form of undeclared fascism (That is, "freedom", so long as you eat shit, breath shit, think shit, absorb shit media, and work too hard, and don't mind being overseen by Shirow-style O.R.C.S. with machine gunes, in order that you be reduced to the position of Zombie-like Serfdom), this it seems to me, will be the natural conclusion given the forces of greed and corporate evil moving in the world today.
Choice means that people might not buy your product. Remove choice, while maintaining the illusion of a free society, and bingo! You have the perfect consumer; driven because s/he still believes in the American Dream, but a serf nonetheless, whose task it is to pour wealth into the coffers of the powerful. And to be miserable for those who eat misery. . .
Anyway, it was interesting; the documentary basically said the following:
One military analyst basically said, with a straight & serious face, that in the event of a huge digital attack, "Declare martial law. Shut everybody down and take control of the situation. That'd be my recommendation."
Hmmm.
I don't know how true the above is, but the fact that it was being sold by a respected authority voice, indicates that they're trying to soften people up for just such a turn of events.
-Fantastic Lad
They're monkeys hurling feces. They will stop if they think a bigger monkey will kick their ass. That's why they're not firebombing people, because if they did that they'd get caught. But the cop monkeys don't understand DoS attacks so there is no fear of reprisal. Look at how monkeys deal with the issue. Do you really think humans have any better a handle on it?
As someone who was put in this same situation at the end of '99. I can only say -- if the big boys were concerned -- it would not be a problem. Although its not a trivial problem, dynamic blocking rulesets on bordergate routers who get a rush of ICMP (or other sorts) of traffic to a single target would not be hard to block.
.ca. After the attack our ISP was quick to disconnect us with no alternatives we closed our doors (noone else in town wanted to touch us).
My small ISP which had been doing okay had been stranded without an uplink after a 150Mbit attack took out sprint links in our part of
After the attack we were quick to contact the NOC of a few schools with unused 'open' blocks who refused to claim responsibility (of the DDoS packets) or fix the problem. About a month and a half later they had FBI knocking on their door after the ebay/yahoo etc attacks.
The question --
Do you think DDoS could be a tool for the bigger ISP's and players to squeeze smaller guys (ISP/ASP) out of business? I know that one quite is a stretch.
What other reasons have kept ``Tier-1'' networks from implementing fixes?