DoS Attacks Persisting, On The Rise

thelizman writes "One of the most basic "hacks" (to use the media's bastardization of the term) is a Denial of Service attack. While not getting you any access to data on a machine, DoS attacks effectively shut down machines by making them inaccessable to others. CNN is carrying and IDG.net story about how DoS attacks are still one of the leading threats on the Internet, and are actually on the rise as the sophistication of the attacks increases." We get them constantly- some intentional, some not. It's really a pain.

Comments

DOS is dead

[Anonymous Coward]

Everyone at my company has upgraded to Windows 3.1. I don't know why Slashdot is still talking about DOS

Re:DOS is dead

[NanoGator]

"Everyone at my company has upgraded to Windows 3.1. I don't know why Slashdot is still talking about DOS"

Though I would agree that DOS is probably inhibiting people from getting data off certain sites off the net, they're talking about DoS.

Here's a question, though: Let's say a company does something that the Slashdot community doesn't like. A link is posted to that site so that people could visit it. Slashdot has enough visitors that most sites come down pretty quickly with that much traffic. Could a company make a case that Slashdot is a DoS attack?

I'm not asking on a moral ground, but could a Lawyer actually get that to court?

To be clear I'm not asking:

- Would they win
- Could they in the ideal world
- Would it be ethical/moral to
- Are they right in doing so

I'm asking if they could present a case and get it to court. Thoughts?

Re:DOS is dead

[issachar]

I'm not asking on a moral ground, but could a Lawyer actually get that to court?

probably not if the judge has any sense at all.

There's a fundamental difference between a DoS or DDoS attack and the so-called /. effect. In the first two cases, the attacks generally come from remote controlled machines or zombie machines and is instigated by a very few number of people, or even just one person. In the case of the /. effect, each and every viewing of the webpage is deliberately instigated by a separate human being.

While most analogies of /. suck, I'll add one more: It's somewhat akin to the difference between a half dozen people chaining themselves to the entrance of a Starbucks and stopping people from entering as a means of protesting globalization and a couple hundred people all trying to get in at once because a radio DJ points out that they're selling double-shot mochas for a penny each.

Re:DOS is dead

[spike hay]

What is really funny is that we're hearing how bad DoS attacks are from /. Slashdot commits numerous DoS attacks everyday. Friggin hypocrites, I'm telling ya.

Re:DOS is dead

[Anonymous Coward]

It's DOS but it's not malcious. They are actual visitors. Putting it on the web is a request to provide some public consumption.

Perhaps they might have a case if in their terms of use they had something about linking in a manner that you know might overburden their servers - but that's a stretch.

Actually, it's not even a DOS. It's not like Slashdot attack sites in a denial or service manner.

Re:DOS is dead

[NanoGator]

"In the case of the /. effect, each and every viewing of the webpage is deliberately instigated by a separate human being."

But what if a Lawyer made an argument along the lines of: "Slashdot intentionally posted a link to their site knowing that an overwhelming increase of traffic would hit my client's servers."? What if Blizzard, for example, attempted to sue Taco because of being flooded with too many hits (or negative emails) from opinions posted on Slashdot?

The difference between Slashdot and a news site such as CNN is that more opinions make their way to the front page. For example, remember the article that said MS kicked Sony out of CeBit? That's not what happened, but that was the view it posted.

Re:DOS is dead

[Traxton1]

One more thing to point out it that a federal US judge did deem it legal to link to a website without the consent of the linked party, and that's just what the editors of Slashdot are doing. The consequence is just sometimes the unintentional DoS.

Re:DOS is dead

[Traxton1]

Here's a link to a related article on Salon. Third paragraph down I think.

Re:DOS is dead

[epsalon]

Ofcourse it's dead. Microsoft has released DDoS (aka WinXP).

Re:DOS is dead

[hoggoth]

> > "Everyone at my company has upgraded to Windows 3.1. I don't know why Slashdot is still talking about DOS"

> Though I would agree that DOS is probably inhibiting people from getting data off certain sites off the net, they're talking about DoS.

I read in Discover about someone with damage his right frontal lobe that couldn't understand humor. I guess you've taken one too many shots to the forehead, huh?

Re:DOS is dead

[jafiwam]

I run some web servers. Not big, but bigger than anything else I have ever seen.

Does anybody have any numbers on how big the Slashdot effect really is? Or have some specs on servers/connections that lasted and those that did not?

I am just curious, either it is real big, or there are a lot of Mickey Mouse web servers out there.

Thanks!

Re:DOS is dead

[compwiz3688]

I don't know why Slashdot is still talking about DOS

Oh, but they did a few days ago (even though it's only a poll).

Re:DOS is dead

[(startx)]

not completely dead, blockbuster still uses a dos based system for cash registers. at least they did when I worked there last year....

(yeah, I know it was a joke, but still)

Re:DOS is dead

[jerrytcow]

I'm asking if they could present a case and get it to court. Thoughts?

Seeing as how Rio (the city in Brazil, not the mp3 player) can sue the Simpsons (yes, the cartoon) for making fun of the city, I'd say that anything is possible. You don't need a legitimate complaint, anyone can sue over anything (and too often does - look at the petswarehouse story that was run last week)

Re:DOS is dead

[rowdent]

Well apparently you don't think news sites provide opinons... That's interesting... I guess all these sites are compiled by completely impartial robots with no bias whatsoever. Dream on! It's impossible to convey a story without bias. At any rate, most of those sites have an opinions section, and slashdot just features theirs more.

Re:DOS is dead

[VPN3000]

Most companies run their websites on Mickey Mouse web servers. I've worked at several large ISP's and none of them really had adequate server power to deal with a /.-like effect.

Nowadays, you can fit a class C worth of websites on a single machine and save a lot of money. So what if you don't survive one day of /. while serving up another 364 days of reliable service. There's no point in being bleeding-edge just to satisfy link sites, such as slashdot..

If you are looking for specs of a /. effect, I think there's some old post by one of the moderators on here somewhere, I leave ye to find it. :)

Regards,
Victor

Re:DOS is dead

[bizitch]

DOS? Come on, get with the times man! Go with the best - OS/2 Warp..

Re:DOS is dead

[NanoGator]

"I read in Discover about someone with damage his right frontal lobe that couldn't understand humor. I guess you've taken one too many shots to the forehead, huh?"

If you read a little closer, I was attempting humor as well.

"Though I would agree that DOS is probably inhibiting people from getting data off certain sites off the net..." -- get it?

Maybe i should have said "...probably inhibiting A LOT of people..."

Oh well.

Re:DOS is dead

[NanoGator]

Heh, it's an interesting coincidence that you brought this up. Not only am I going to Brazil next month (not Rio, though), but I have a friend who was rather upset at that episode.

I don't think that they understand that the Simpsons makes fun of EVERYTHING. There was an episode only a week or two ago showing a CISCO router being held together with band-aids, etc, sort of implying that it was crap.

The reason that this particular case could actually turn into something is that they might make a claim that a show as popular as Simpsons could make people think twice about vacationing in Brazil. I know I wasn't terribly wild about the idea that I could get kidnapped and held for ransom.

I'm a little concerned that if media attention turns to DoS attacks, Slashdot could find itself in a bit of legal trouble for the same reason that the Simpsons is.

Re:DOS is dead

[Anonymous Coward]

He's probably a democrate.

Re:DOS is dead

[Kallahar]

Denial of Service attacks tend to use malformed packets and other malicious tricks. If your server has a web server on it, and it is merely responding to valid requests initiated by real individuals, that's not an attack that is trying to DoS the system. If, on the other hand, slashdot told everyone to send as many pings as possible, all at once, then that would be an attack.

Re:DOS is dead

[dragons_flight]

A brief survey of google pages on the Slashdot effect gives values of 50-500 hits per minute during the period immediately following a post on /.

To my mind that is a lot of traffic, but then my only firsthand experience is with "Mickey Mouse" servers that would probably melt under that load. (Assumming that the connection could actually carry that kinda volume in the first place.)

Re:DOS is dead

[CmdrTaco (editor)]

I believe the problem is usually with bandwidth limitations and not with the actual web server. For instance, a site may be limited to 128 Kb/s up, so it would take a minimal amount of requests to saturate the pipe. I would think most of the servers linked to other than major sites are in the T1 range with around 1 Mb/s, so the bandwidth shouldn't be all that much of a problem unless there are more than a few thousand people accessing at the same time... which there usually are.

Another problem is bandwidth capping, similar to the article on Time-Warner article yesterday. To prevent things like the /. effect from breaking the bank, companies may put hourly limits on bandwidth usage, and when it is exceeded the site is inaccessible.

I can only speculate about the magnitude of the effect, but /. does have over 250,000 unique hits a day. So anywhere between 5 and 25% will follow the links to the target servers. Which puts it in the range of around 12,500 to 62,500 hits within a few hours. Of course, this all depends on the article and I'd be inclined to say something on the front page would attract many more hits than something hidden away such as the article on USPTO advisory nominations.

Re:DOS is dead

[NanoGator]

Why do my posts encourage some people to distill what I said down to one sentence and then oversimplify it?

My paragraph about the difference between Slashdot and CNN was compressed down to 'CNN doesn't opinionate.'

Here is what I said:

"The difference between Slashdot and a news site such as CNN is that more opinions make their way to the front page. For example, remember the article that said MS kicked Sony out of CeBit? That's not what happened, but that was the view it posted."

Notice the sentence in particular where I said that Slashdot offers MORE opinions right away than CNN. I never, ever, EVER said that news sites don't provide opinions. If you had paid any real attention to what I said, you'd note that I made an example where a factual error was made in presenting the story. A very serious factual error. Instead of the headline explaining what really happened, it explained the submitter's point of view about it.

There is a huge difference between that and the stories you read on most places that carry any sort of journalistic integrity. They take extra care to not present details incorrectly.

In any case, thanks for grossly misinterpreting me. I'll give you credit, though. You did offere a very fascinating rebuttal to something I didn't say.

Re:DOS is dead

[NanoGator]

I agree with your points. What saddens me, though, is that I'm not convinced a Lawyer would explain that difference in his case.

Let's try another scenario, though. What if a Slashdot article posted an e-mail address for somebody to write legitimate complaints to. If a small company recieved 300,000 emails, that'd be a bit of a problem. Could a judge see that as an attack?

Re:DOS is dead

[NanoGator]

"He's probably a democrate."

I am not a crate. Even if I was, I certainly wouldn't be a demo model. I demand an apology. :P

Re:DOS is dead

[Sloppy]

You never know what'll get into court, or who will win. Mysterious and unjust things can happen there sometimes. That said, one possible defense for /. might go like this:

For a conventional DDoS attack, the script kiddie relies on other people's computers acting in a predictably (and automatic) bad way. Because the DoSing computers are doing something that is both automatic and justifiably enabled (e.g. ping reply), the users of those computers are not responsible for their ping replies. Having your machine reply to pings is not negligence on your part (whereas installing software known to be gratuitously dangerous and with a really bad reputation (IIS) may be). But if the ping-reply machine owners aren't responsible, then the person who made it happen (the script kiddie) is.

For /. effect, Slashdot is not automatically causing thousands of other computers to send a request to a site. Instead, the human users of those computers are consciously (depending on your attitude of human nature) clicking a link. Since those users made a choice to hit the referenced site they are responsible for the traffic they generate. Thus the responsibility really is distributed, and doesn't rest solely upon /.

Re:DOS is dead

[Monkeyman334]

These are numbers from last year, so I'd imagine they're a little bit higher. Slashdot had 1.2 million page views a day. Between the halt of classic.themes.org and the new one, t.o was getting about 120,000 page views a day. When an article was posted on slashdot saying "help *link*themes.org" it jumped up over 300,000 for a day or so and went down over a week or two to get back to 120,000. The guy that humiliated bernard shiffman also documented his slashdot experience, pretty interesting stuff.

Re:DOS is dead

[rowdent]

Ok, well I apolagise for misinterpreting your comment, but I still contest the opinion that Slashdot is any different from CNN. How many times do you think a headline from CNN concerning topics such as the war in Afghanistan has been exaggerated or presented misleading facts because it makes the American government sound better? Slashdot is to Microsoft as CNN is to Afghanistan. Microsoft is the enemy to many of us, and our biased headlines about it are just as excusable as CNN's headlines about Afghanistan.

Re:DOS is dead

[NanoGator]

"Ok, well I apolagise for misinterpreting your comment, but I still contest the opinion that Slashdot is any different from CNN."

I apologize for being rude in my response.

"How many times do you think a headline from CNN concerning topics such as the war in Afghanistan has been exaggerated or presented misleading facts because it makes the American government sound better?"

Hmm... You mean sensationalism? Fair point. I remember a couple of years ago, late in the year, that the news was keeping a running tally of students getting hurt in football games. They described it as an epidemic. They made it like the parents should be concerned as if YOUR KID MIGHT DIE!!

The injury tally, by the Octoberish time of year, was 7. Now 7 kids taken to the hospital between late August and October is a heck of a lot, I suppose. However, the number was 7 from January 1st. If memory serves, it was after the high school shootings media attention died down.

Basically, the media presented a potential result before establishing it's case. Yep, that's opinionated.

I do think my original idea does still carry some weight, but I understand what you're saying and it is a good rebuttal. Thanks, you expanded my perspective. :)

Re:DOS is dead

[danox]

I think the simpsons has made every country look bad. I am an Australian, and the Australian episode was hard to watch. I didn't so much mind the depiction of our justice system (the prime minister attempts to deliver a punishment to bart, consisting of kicking him in the butt with a giant boot), the worst thing was the accents. Ouch. No one in the world talks like that.

It did make australia look like a bizzare, twisted, barbaric country. Which I guess it is, but not in the way they showed it.

I think brazil should get over it.

Re:DOS is dead

[NanoGator]

"It did make australia look like a bizzare, twisted, barbaric country. Which I guess it is, but not in the way they showed it."

You know, I think you unintentionally brought up a good point. (Or maybe you did intentionally, heh) The Simpsons does that to EVERYWHERE they visit.

I can personally verify this. I've been to Australia, and the Simpsons made an amusing parody of it, but not one I'd take seriously because I know what's true about that episode and what isn't. I've been to Brazil, and know that monkeys don't invade schools and take children. Because of my real life experiences that the Simpsons has made a parody of, I have a basis to figure out when they're just being silly vs. illusrtating something that has at least some truth to it.

It's easy for me to see that the Simpsons doesn't let anybody get away unscathed. I think most people that really love that show feel the same way. They don't take it personally when the Simpsons makes fun of something that hits close to home.

That would be Slashdot's defense. "You can only take it seriously if you have no idea what it is you have wandered in to." I could understand a first time viewer of the Simpsons thinking Rio is a place where monkeys will take your children, but not somebody who has watched more than a couple of episodes.

Slashdot is the same way. Once you've invested a little time into it, you start to realize how much a statement can be weighted.

I hope the law takes that into account. Just because the Simpsons made a parody, doesn't mean that Rio can justifiably ask for damages.

Well that makes me feel better. I think the reason I started this discussion was that I'm concerned about Slashdot getting burned if the Media sets fire to the term "DoS".

Re:DOS is dead

[Anonymous Coward]

80,000 pages and 270,000 hits served in 7.5 hours when I got clobbered. I saw load averages of up to 18 and would have seen much higher if my 1.0 megabit pipe hadn't been utterly and completely saturated for the entire duration.

Re:DOS is dead

[Jester99]

IANAL, #include

90% of crime is intent.
Killing somebody isn't always a crime.
It can be excused -- accidental vehicular manslaughter, for example.
It can be government sanctioned -- in executions, or in times of war.

Killing somebody because they're ugly, now that's a crime.

A DoS attack is "bad" because it is a deliberate assault on a system with the intent of bringing a server down. You send 5,000,000 HTTP requests with absolutely no intention of reading even one of them. Bad dog.

If you had a web monitoring bot or somesuch that went berzerk and pounded a webpage with a million requests, they'd call you an irresponsible idiot, but you wouldn't incur the same wrath as if you had intended to do it.

Likewise, the "Slashdot Effect" is the complete opposite of a DoS attack in intent: A DoS'er tries to force people to not view a website. Slashdot posts links in an effort to promote the viewing of a specific website.

Any (reasonable) court of law (hah!) will see that based on intent, there's a fundamental difference between a DoS attack and a slashdotting.

Re:DOS is dead

[Surak]

I'm asking if they could present a case and get it to court. Thoughts?

Sure. As any lawyer will point out to you, you can sue anybody for anything. You might be liable for their attorney's fees if you lose, but you can sue anyone for anything and even make it to court.

Re:DOS is dead

[El_Nofx]

No, an attack is only when you indent to harm the victim. Say you were giving a friend a ride in your car. If you got into a car accident that wasn't your fault and they were hurt, it wouldn't be an attack and it wouldn't be your fault.
(kind of a bad example but you get the point)

Any judge with his head screwed on straight would see that no harm was meant and the case would be dismissed.

Just because /. has the following it does doesn't mean that if we overwhelm a companies resourses it is an attack.

Re:DOS is dead

[consumer]

The Slashdot effect is pretty wimpy in the grand scheme of things. I worked at a site that got Slashdotted multiple times. We also got traffic from running an ad on AOL. The traffic from the AOL ad was much greater than the Slashdot traffic. Also, consider the size of the Slashdot servers. They have a small handful of Intel servers running basic Apache stuff. That's not an especially powerful system for serving a site, but they manage to handle this traffic all the time. Obviously the sites getting crushed by this traffic have pretty weak performance.

Re:DOS is dead

[jcast]

One nit about a much larger (and more valid) post:

The major networks do not ``take extra care to not present details incorrectly''. They present details incorrectly all the time; what they're careful about is that they're correct details, even if they're presented incorrectly.

Re:DOS is dead

[Anonymous Coward]

Since win3.1 is just an "operating enviroment" not an actual OS, DOS is still around. Its just a shell

Re:DOS is dead

[Anonymous Coward]

That slashdotting *is* a kind of DDOS is first thing that (funnily) came to my mind when reading this news.
The question it is not that it is *really* not a DDOS, but how much time it'll take a lawyer to decide it *is*.
...and lo and behold, he will do so.

Re:DOS is dead

[alexo]

>> You might be liable for their attorney's fees if you lose.

Could you lpease elaborate on that?

I was under the impression that the "loser pays" model is not implemented in North America.

Re:DOS is dead

[Kallahar]

Not if the complaints are justified. If slashdot posted an email address and said "send emails to this guy to clog his inbox" then that would be an attack.

A lot of it comes down to intent, and unfortunately I agree that lawyers and juries probably wouldn't understand the distinction without a good lawyer explaining it :)

Travis

Re:DOS is dead

[tmcmsail]

I work in the government, and we still use DOS. When you use hardware from a few decades into the last millennium, you need to use DOS...

Re:DOS is dead

[Surak]

I was under the impression that the "loser pays" model is not implemented in North America.

Sure. Here in the US, in certain types of liability cases, if you sue someone or some company for damages due to liability and you LOSE, then the judge can (at said judges discretion) make you pay the defendant's attorney fees. It is intended as a deterrent to prevent nuisance lawsuits.

What about Slashdot?

[svferris]

What, no mention of Slashdot DOS attacks?

We even have our own word for it: "Slashdotted".

Re:What about Slashdot?

[Dr Caleb]

Hehehe Yea. That poor Server in Nigeria is still trying to process requests we made to it weeks ago...

Re:What about Slashdot?

[Anonymous Coward]

would the slashdot effect be a DDoS attack?

Re:What about Slashdot?

[Anonymous Coward]

No the term needs to be 'SlashDoSed' not 'Slashdotted'.

Re:What about Slashdot?

[El_Nofx]

ya, over on fark they called it "farked"
They post way more links every day and at least 4 or 5 of them shutdown servers.

Anyone remember when grc got hit with a DDOS, you know what he did? Realized there wasn't a damn thing he could do about it and took a walk on the beach. Then waited 4 days until it quit and got his site back up and running.

Re:What about Slashdot?

[Cro Magnon]

/. doesn't have a monopoly on "slashdotting". I've heard of websites going down after being mentioned on the Art Bell radio show.

Wait until..

[Steveftoth]

someone writes a virus that spreads through the Kazaa or gnutella network. That will be a fun day.

p2p is the biggest ddos mess waiting to happen. If there is a hole in the client, then who knows how far it could spread before stopping.

Re:Wait until..

[dankow]

someone writes a virus that spreads through the Kazaa or gnutella network. I thought Kazaa was a virus.

Re:Wait until..

[Anonymous Coward]

What?

The Kazaa and Gnutella networks are protocols. Protocols can't catch viruses.

A virus may travel via the network but it could travel equally well through email (which is a bit more popular, and more important, than the Kazaa or Gnutella networks). Now if you're talkinga 'bout attacking specific flaws in Kazaa client software, or Gnutella software, then so be it - but that's not the network!

Moderate this fool back to 1.

Re:Wait until..

[T5]

There's a type of DoS occurring now. There are many mpegs that aren't what they claim to be. The downloading of these is a sheer waste of bandwidth, which amounts IMHO to a form of DoS, considering the limitations that the clients can place on overall bandwidth utilization, number of connections, etc.

Re:Wait until..

[Anonymous Coward]

There's no malice though, therefore it's not an "attack"

Re:Wait until..

[user32.ExitWindowsEx]

Brilliant Digital's Altnet (sp?).
Need I say more?

Re:Wait until..

[JanusFury]

You're just mad because you downloaded my file "Britney Spears giving blowjob.mpeg" which was actually a renamed copy of the entire Windows XP Professional ISO.

ph34r, pr0n fiend. 8-)

Re:Wait until..

[Anonymous Coward]

Bah, that's nothing.

Think about what happens when someone finds a hole in the AIM client, or the MSN Messenger client.

Combine that with the IIS hole o' the week and an traditional email virus, and all hell will officially break loose.

Re:Wait until..

[Anonymous Coward]

He said "wait until a virus spreads *through* those networks". He didn't say anything about the protocol catching a virus.

For example, lets imagine a popular Kazaa or gnutella client has a exploitable buffer overflow (not so far-fetched, IMHO). Now lets say a worm spreads, affecting all those clients on the network. A virus (worm, whatever) has spread through the P2P network! And thousands of teenagers downloading porn and mp3s suddenly have their computers commandeered by a DDOS client.

He is right -- it is a big mess waiting to happen.

Re:Wait until..

[Anonymous Coward]

Kazaa and Gnutella are networks used by wankers to steal software as well as music. As we've all learned with things like BO, it's trivial to attach a network-capable executable-attaching program and distribute it over the net along with files people actually want. Do this to a great enough extent, and have people unknowingly replicating the retarded mess, and you'll have an impressive array of computers to use for DDoS attacks.

Moderate this fool back to 0.

Re:Wait until..

[Liquor]

The Kazaa and Gnutella networks are protocols.

No, they are many computers running programs that implement protocols.

Protocols can't catch viruses.

True. Unfortunately, the Kazaa program installs more than one protocol handler - one is the file sharing protocol itself, and another is a 'distributed computing' facility that allows (theoretically only the Kazaa servers, but...) remote control of the machine. Compromising this functionality would allow distributing malware through the entire network.

Now if you're talkinga 'bout attacking specific flaws in Kazaa client software, or Gnutella software, then so be it - but that's not the network!

Well, if you infect all the machines that make up a network using a flaw in the code that creates that network, I'd have to say that the network is infected. And if there is an attack that works on any client, then the first machine compromised already knows the addresses of more machines... worm code that uses the network topology (which is NOT the protocol) could then propagate to the entire network - potentially millions of machines, dwarfing the scale of even the 'code red' worm.

And if that's not effectively spreading through the network, I don't know what would be.

Moderate this fool back to 1.

The parent of your post is not the fool - but you definitely failed to understand the post.

Re:Wait until..

[Anonymous Coward]

Viruses can spread over protocols - in order to exploit specific holes in software.

The "brilliant.net" thing is an open invitation to hackers "wow - the world's largest DDOS!"

Re:Wait until..

[Alsee]

You're just mad because you downloaded my file "Britney Spears giving blowjob.mpeg" which was actually a renamed copy of the entire Windows XP Professional ISO.

C:\>rename "Britney Spears giving blowjob.mpeg" "Bill Gates does you anal.iso"

-

Re:Wait until..

[Steveftoth]

Exactly, if there was a flaw in the client, then someone could write a self propagating virus that listens to the network infecting hosts at an exponential rate.

The Guntella network is not as succectable(sp) to this attack because there are more clients written for it then the Kazaa network.

Until this happens, people won't care what they have to install to get to their beloved free mp3s.

Re:Wait until..

[Anonymous Coward]

Oh, I understood the post. It's strange how people are attracted to rude posturing of knowledge. Must be a tribal thing. Anyway - karma whore testing over with. Sorry for any inconvience.

Re:Wait until..

[Erris]

Kazaa a virus? That brings this dialog to mind:

"You are not an assasin, you are just a grocery boy running an errand."

Kazaa is not a virus, it's just a billboard on an isecure platoform. It may do damage, but it's all due to incompetence and greed.

The biggest threat to the security of the web is Windoze XP. At it's very best, it strains the public net and bombard the happless user with Adverts and other garbage not requested. At it's very worst, the backdoors that are used for all of that shoving will be exploited by porn masters and other nasties. Just hope and pray that the public wrath will turn on those responsible. After 15 years, they give us this and do their best to prevent all other options? Great.

Re:Wait until..

[Anonymous Coward]

What if somebody wrote a little application to respond to every search with a valid result (a result including the word that was searched for) that sent the user to fetch the file from a server that I am attacking. The server need not be running Gnutella, but with millions of people requesting random files from a single IP, I believe that it could dDoS. It's not a virus in the traditional sence, but it does effect the protocol through the use of social engineering and the MASSIVE bandwidth the protocol provides.

--TwinkieStix

Re:Wait until..

[Brendor]

Well someone did post 1/2 of corky romano and label it Star Wars Episode II . . .

Re:Wait until..

[Moonshadow]

Moderate this fool back to 1.

The parent of your post is not the fool - but you definitely failed to understand the post.

Who's the more foolish, the fool, or the fool who replies to him?

*shrug*

Too much 3AM Jedi Outcast...

Slashdot is one BIG DOS attack

[NickV]

/. has gotten more popular! That's probably why we're seeing more DOS attacks! I mean, there's been one (Linux PVRs) today already.

Or, maybe not...

Obvious...

[eli173]

> We get them constantly- some intentional, some not. It's really a pain.

And what about causing them? /. effect? Hmmmm???

aka the Slashdot Effect

[CaseStudy]

Get them? You produce them constantly.

DOS, aka /. effect

[RollingThunder]

We get them constantly- some intentional, some not. It's really a pain.

And create them inadvertently all the time. ;)

Re:DOS, aka /. effect

[clone304]

Are you sure it's inadvertently?

Re:DOS, aka /. effect

[Anonymous Coward]

Really. Such as?

Re:DOS, aka /. effect

[Anonymous Coward]

Such as nothing; he's typing out his ass.

Slashdot DOS

[durstann]

Slashdot doesn't just get DOS attacks, it also creates them. Isn't that what the slashdot effect is all about?

I can't count the number of times a site linked to by slashdot has been unloadable simply because of the number of slashdotters pounding on their server.

This sort of thing isn't limited to Slashdot, though. Any portal/news linking site does it. I'm thinking of Somethingawful and Fark specifically. Somethingawful has even had speed trials to see how fast they can max out bandwidth limits and take a site offline.

They're about to come under one...

[shankark]

a DoS attack no one can resist.... the /. effect of course - with half a million geeks around the world clicking on their mouse in one swift move and crash comes whatever machinery there is buttressing their site ;)

Slashdot

[Rakshasa-sensei]

And /. is one of the worst sources of DoS.

Re:Slashdot

[Anonymous Coward]

The "source" for DOS attacks? Um... I've never heard of a DOS attack that came from one source.

DoS sucks

[El Volio]

Having been on of the admins for a pretty large website (top 50 according to Media Metrix), I can definitely state that DoS attacks are a royal pain. Sure, you can throw infrastructure at a problem and alleviate it, but you can't defeat it -- and they just keep coming. It's the type of attack I've never understood: it doesn't gain the attacker anything (unlike rooting a box), it's nothing but being a hoodlum.

Re:DoS sucks

[edrugtrader]

everyone is a hoodlum to someone...

Re:DoS sucks

[Anonymous Coward]

You! Drop the keyboard! Hands behind your head.

Re:DoS sucks

[Jester998]

"It's the type of attack I've never understood: it doesn't gain the attacker anything (unlike rooting a box), it's nothing but being a hoodlum."

Why do punks spray-paint "JoE wUz HerE" on warehouses? That doesn't gain them anything, either. Likewise, I don't understand their motives. As THHGTtG says, "there [is] always a significant number of people in the Galaxy who [are] not in their right minds."

Maybe it's the recognition they get (the likelyhood is that people who launch successful (D)DoS attacks are bragging about it on IRC 5 minutes later), or maybe they do it for kicks. Either way, this is more of a social/behavioural problem than a technological one. So long as there is a group (no matter how small) who think that bringing down sites is cool, DDoS attacks will persist.

- Jester

Re:DoS sucks

[RFC959]

Spray-painting "JoE wUz HerE" on a warehouse definitely gets you something: public visibility. Everybody knows JoE was there and busy spray-painting...which seems pretty stupid, admittedly, but it's _something_. On a (D)DOS, there's usually not even that level of recognition. (Unless maybe in the kiddie IRC channels?) I don't get it either. I guess they think their willies are big because they made Yahoo unavailable for a few hours.

One point which I think has not been made: not all reports of DOS attacks are reliable. My company's Senior Director of Technology once told our upstream provider that we were being DOS'ed, when in fact we were simply getting more (legitimate) traffic than usual. It also doesn't help that some OSes ship with stack settings poorly chosen for a busy public webserver and a) effectively participate in their own DOS'ing, and b) report possible attacks when in fact no such thing is going on.

Re:DoS sucks

[Anonymous Coward]

"I've never understood: it doesn't gain the attacker anything (unlike rooting a box), it's nothing but being a hoodlum."

That would reason that admins do not know much. If host A trusts host B, you can spoof host's B IP addy while at the same time DOSing host B, hence gaining access to host A.

Host A will think it is talking to host B, A will send to B, but B will not be able to answer, hence host A will not reset the connection.

Of course, it is much harder to accomplish this. You can only send, have to know what is being sent back, and time everything perfect. It can be done, but you have to be good at it, no script kiddies allowed.

A serious fp

[Anonymous Coward]

West side smoke a blunt bitches!!

Attention Slashdot

[crystalplague]

In exchange for the halting of DoS attacks on Slashdot...I demand 1 free subscription to yours truly. If you do not submit to my demand, you will feel the full wrath that is my 31337 |-|@X0r SkI11z.

Muwahahahaha!

Re:Attention Slashdot

[sparkz]

Uh okay, just tell us your nick...

Re:Attention Slashdot

[Anonymous Coward]

you sir are a complete dumb fuck....

Re:Attention Slashdot

[GrandCow]

In exchange for the halting of DoS attacks on Slashdot...I demand 1 free subscription to yours truly. If you do not submit to my demand, you will feel the full wrath that is my 31337 |-|@X0r SkI11z.

Yeah, those 56k modems can be just nasty on a web site.

Re:Attention Slashdot

[sydneyfong]

You're crazy.

Just wait until Slashdot counter attacks with the /. effect!! You know how common it is for the editors here to post flawed information, like... a link to your machine ;-)

Those people whining about DDoS must have be in total ignorance about Slashdot!!!

Stupid script kiddies.

[dadragon]

The thing that really bugs me about DOS attacks, besides the fact that they cause damage and annoy admins, is that they don't show any real talent.

It's not impressive to bring a system to its knees by DOSing it. You do, however have to respect the guy who discovers some huge hole that he exploits on some system and gains access.

You gotta respect him more if he tells you about it, and how to fix it.

Re:Stupid script kiddies.

[oyenstikker]

Respect the guy who discovers some TINY hole and gains access.

Re:Stupid script kiddies.

[JordanH]

• The thing that really bugs me about DOS attacks, besides the fact that they cause damage and annoy admins, is that they don't show any real talent.

Sure, a simple DoS attack is pretty rudimentary, and also not difficult to deal with, generally, but the really effective DoS attacks, DDoS attacks are much more impressive. As you yourself say:

• You do, however have to respect the guy who discovers some huge hole that he exploits on some system and gains access.

DDoS attacks involve gaining access to a lot of machines and coordinating an attack.

The only DoS attacks that make news are DDoS attacks.

• You gotta respect him more if he tells you about it, and how to fix it.

Well, DDoSers generally don't rise to this level of respect. :-)

Re:Stupid script kiddies.

[Goonie]

DDoS attacks involve gaining access to a lot of machines and coordinating an attack.

But if the script kiddie is just using the same rootkit to exploit a bunch of poorly-maintained boxen on cable modems, that's just persistance, not skill.

Re:Stupid script kiddies.

[SoupIsGoodFood_42]

The thing that bugs me is: Why /.? Why not www.riaa.com, www.microsoft.com etc?

For a brief description....

[d_force]

Here's an additional, brief explanation of general DoS attacks for the ones waking up from cryostasis.

-- dforce

At least...

[Veramocor]

At least now a days it a takes a modicum of sophistication to launch a DoS attack. I remember when it was possible to download windows programs to Win Nuke(win 95 vulnerability) people at will.

Its not a "DOS" attack...

[Anonymous Coward]

...its called a slashdotting. ;)

Not about sophistication

[Niherlas]

DOS attacks are rarely about sophistication - it's pure destructive potential. Script kiddies bragging on IRC channels about the number of "zombies" they've managed to acquire via the latest script that some grey-hat with genuine skills has written - eventually the bragging gets to a point where they have to do something with all their proudly acquired toys. Usually against some other l337 haxxOR who has impugned their skills.

Save rather than beating each other senseless (which would be so, so much more preferable), they're compromising systems and using them as their weapons - costing users and admins hundreds of work-hours so they can prove something.

Hell, at least "tagging" doesn't take down the damn company server.

Re:Not about sophistication

[the48thronin]

I find it important to point out the difference between "tagging" and "graffiti". Grafiti is works of art, well planned and executed publicly with a high amount of skill. Tagging is a criminal act done by people motivated by the urge to do damage, or simply make their mark, and does damage to the reputation of legitimate graffiti artists.

Re:Not about sophistication

[Rude Turnip]

Grafiti/tagging...It's all vandalism to the guy whose building/delivery truck was painted on.

Wicked tarded

[DCram]

Why is it that so many people find this amusing? What does it buy the person. I have never quite understood this.

It seems to me that the media has a giant hand in feeding this monster. Someone finds out that this can be done, not very hard, and figures since the media hypes it up soo much it must mean that it will make them elite.

It was the same way when I was growing up and people figured out how to write TSRs and append them to other .exe files. It made them hackers to the media to create a virus. And its not that hard. Do these people realize that it really isnt impressing anyone?

Oh well.. another rambling..

HOW CAN YOU BE LEET WITH DOS

[Burritos]

How can one hack with DOS? You need Linux to be a hax0r

Re:HOW CAN YOU BE LEET WITH DOS

[The trees]

Yes, but anyone can 'haxOr' with linux. Only the truly elite can do it with DOS!

Intentional?

[IronClad]

We get them constantly- some intentional, some not. It's really a pain.

Isn't an unintentional attack an oxymoron? Like an intentional accident?

Re:Intentional?

[NanoGator]

"Isn't an unintentional attack an oxymoron? Like an intentional accident"

If I was doing a ballet move and slapped you in the face, would you rather label that as an accident or tell people that I used my powerful ballet technique to bitch slap you?

Okay, we've made the jokes. (Offtopic)

[CaseStudy]

Allow a few minutes for people composing witty replies to finish up, then let it coast to a stop.

Note to the editors: when you write up an article in such a way as to invite an easy joke response, serious discussion gets crowded out (not to mention wittier humour than what I and everyone else posted).

Re:Okay, we've made the jokes. (Offtopic)

[_DMan_]

Note to the editors: when you write up an article in such a way as to invite an easy joke response, serious discussion gets crowded out

So you're saying the lame Slashdotting = DoS jokes have themselves DoS'd Slashdot?

DoS?

[carm$y$]

We get them constantly- some intentional, some not. It's really a pain.

Does slashdot get slashdotted?

How comes that the hordes that usually take down everything but the reallly big boys trough the (largely adverised) slashdot effect don't take down slashdot itself?

Ok, then why not more often? Reload, people, reload!

Re:DoS?

[Anonymous Coward]

Because they have a really fat pipe?

Re:DoS?

[carm$y$]

Fat pipes are pipe dreams. No pipe is "fat" enough... it's just a matter of how many xDSL connected computers the attaker ()wnz.

Re:DoS?

[Anonymous Coward]

except that a gigabit pipe is a bit more than 1000 megabit pipes sharing the same upstream..

What the hell

[Anonymous Coward]

are they trying to accomplish!?

I don't understand how even a script kiddy could get enjoyment out of the attacks? Espesially when the don't even take down the server/site.

"1, 2, 3, lets go!"

In related news...

[dR.fuZZo]

A recent study has shown that there's a direct correlation between the number of denial of service attacks reported and the number of stories Slashdot posts in a day.

DoSama Attacks

[nucal]

"The threat is a lot worse today than two years ago," said Harris Miller, president of the Information Technology Association of America (ITAA) in Arlington, Virginia. "There are lots of indications that since September 11, the number of DoS attacks have greatly increased."

Nope, all that activity on e-Bay is Osama Bin Laden working on his Pez dispenser collection

Re:DoSama Attacks

[DCram]

still trying to buy a dialysis machine on ebay..
the dumb bastard is using paypal too!!

hey retard go here Global Dialysis

QUICK!!!

[Linuxthess]

Its only a matter of minutes before CNN realizes that they should have blocked the /. - referring links to their article!

-------------

so narrow minded heh?

[atari2600]

Its a pity that a site gets slashdotted when ever its posted or talked about here but that also means the site gets that many number of hits and it wont hurt most of the time to get hits. There is also malice intended when a site goes down due to the slashdot effect.

On the contrary the last time where there were huge attacks against Yahoo, Ebay, Amazon...etc., the DOS attacks resulted in billions of dollars of loss of business to the victimised sites.

I dont want to start a Windows XP or M$ bashing argument but these operating systems are much more popular as desktop OSes and with the advent of cheaper broadband, these machines make perfect hosts to be used as machines to launch remote Denial of Service attacks.

I will not say the nix world is flawless but most of the people who use *nix know how to use it or learn quickly...can you say the same about an unsuspecting 9year child whos using WindowsXP (look ma there are nice colors).

DOS attack traceback and dealing with DOS attacks is a heavy research area. /.ing a page is nothing compared to a DOS or DDOS(distributed DOS) attack.

Re:so narrow minded heh?

[caferace]

On the contrary the last time where there were huge attacks against Yahoo, Ebay, Amazon...etc., the DOS attacks resulted in billions of dollars of loss of business to the victimised sites.

Wow. Do you really believe everything you read?

I'll make you a deal, no strings attached. Quantify your "billions" figure and I'll give you a crisp $20 bill.

Re:so narrow minded heh?

[Anonymous Coward]

People generally don't want to be Slashdotted. It would have cost me a lot of money if I didn't disallow Slashdot referals.

Re:so narrow minded heh?

[drew]

I'll make you a deal, no strings attached. Quantify your "billions" figure and I'll give you a crisp $20 bill.

i realize that i am picking at nits here, but that is an attached string. and in this case a pretty big one, imo....

but i suppose that was your point, wasn't it?

Re:so narrow minded heh?

[Anonymous Coward]

http://www.mazunetworks.com/ddos_library/index.htm l

Keep that $20 for ur lunch - ...

what, no mention of dittrich?

[overbom]

Harumph. An article about DOS/DDOS that doesn't mention Dave Dittrich.

There oughta be a law.

For the script kiddies out there

[until(0)]

Man, there is nothing like a good firewall configuration on BSD... But I am thoroughly sick of all the DoS attacks going around. I would be much more satisfied should an attacker attempt at breaking into my server rather than causing immature server failures due to lack of destructive creativity...

Silly lamers, DoS Attacks are for kids...

DrDoS

[ZaneMcAuley]

Distributed Reflection Denial of Service

http://grc.com/dos/drdos.htm

Looks nasty :D

Re:DrDoS

[Anonymous Coward]

Not to mention the DDoS also found somewhere near that page (to a lesser nastiness).

Having read that back in Janurary, I felt that people should start writing a new protocol (or will it be implemented in the IPv6?) that prevents such a mess.

Re:DrDoS

[Anonymous Coward]

not nearly as nasty as http://grcsucks.com

Re:DrDoS

[ZaneMcAuley]

The above DrDos is only possible by Raw Sockets i believe (correct me if i am wrong)

Re:DrDoS

[Osty]

Steve Gibson is a kook and a crackpot. He's an alarmist, but unfortunately people not "in the know" tend to listen to him (most likely because he is an alarmist). He rails against raw sockets in XP, never bothering to notice that NT (which XP is based upon) has had raw sockets for a long time, and that it's possible to modify the Win9x TCP/IP stack to allow for raw socket-like abilities. Nevermind that raw sockets are only available to administrative users in NT, as with any *nix (problem -- too many users run with administrative rights on NT, which is the equivalent of running as root all the time. This is the true problem, not raw sockets, and should be the one that's addressed). His "Distributed Reflection" DoS is nothing new. Hax0rs and kiddies have been doing it for a while. His GENESIS project is basically poorly-implemented SYN cookie protection. And so on and so on ...

In short, the guy's a nut and only nut's pay attention to him. Try a real security site, like SecurityFocus.

Re:DrDoS

[Kris_J]

I don't think you realise how different servers are to desktops. XP is being used by your average 12:00 flasher, while NT is typically used by the most computer literate person in the company. For every NT box out there you're looking at maybe 50 desktops, many of which will soon be XP. DDOS is a numbers game, so anything that increases the proportion of powerful, badly maintained PCs that can craft any damn packet they feel like this not a good thing.

Sure, SG is paranoid, but in a good way. He hasn't reached the kook level just yet. When he starts promoting cold fusion, then you can back away slowly.

Re:DrDoS

[Anonymous Coward]

Is nastier.

Re:DrDoS

[CaptainStormfield]

When he starts promoting cold fusion, then you can back away slowly.

Unless he really is performing cold fusion, in case you should run away quickly or put on some lead pants.

Re:DrDoS

[Rude Turnip]

He does go on to state that raw sockets are only a problem in administrator mode. The real cause for panic is that under WinXP, every user is administrator by default. Yes, we know that is bad, but the average user has no idea what's going on. To make matters worse, most programs won't run properly under XP if you aren't logged in under an administrative account, especially games.

Re:DrDoS

[Alsee]

The above DrDos is only possible by Raw Sockets

Windows XP! New and Improved! Now with FULL RAW socket support!

The author of the DrDos artical also has a summary explaining how he's been attempting to convince Microsoft *not* to include raw sockets in WinXP for about a YEAR! He even had a phone conference with Microsoft's top Windows XP executives and developers.

For anyone not familiar with raw sockets:
When you use normal sockets any internet traffic you create contains a valid return address. Raw sockets allows you to fill in a fake return address. This makes an internet attack much more dangerous, harder to block, and very difficult to trace back to its source.

Before WinXP, operating systems either did not make raw sockets available, or restricted their use to "privileged" programs. WinXP makes raw sockets freely available to everyone.

-

Re:DrDoS

[linzeal]

huh?

I've had raw sockets for years in Irix, FreeBSD and linux.

Re:DrDoS

[ZaneMcAuley]

Windows 2000 has raw sockets also, Im not sure about NT tho.

Re:DrDoS

[GigsVT]

As root.

In XP, normal users will have raw socket access.

Re:DrDoS

[Anonymous Coward]

Morons don't run Irix, FreeBSD or Linux.

Re:DrDoS

[linzeal]

I thought only admins had access to raw sockets on winxp? Granted most people run everything as admin on those systems.

Re:DrDoS

[Sycraft-fu]

I still agree with the orignal poster that he's a huge alarmist and a sensationalist. Look at his whole shtick on "NanoProbes" (http://grc.com/np/np.htm). He talks about this like it is some new-to-the-world technology. When you read through all the marketing bullshit you come to realise it is nothing more than sending things like empty syn packets and stuff nmap and the like have done for years.

Gibson has a real overinflated sense of his own importance and loves to make it sound like all his discoveries are huge and that the consequences of not obeying his advice are dire. However you begin to notice that he is never mentioned in any of the big security news. He's a smart guy and a deceant programmer, no doubt, but he lets his ego get in the way of his good judgement and has a tendency to exegarate the truth.

Re:DrDoS

[Alsee]

I thought only admins had access to raw sockets on winxp?

Yep, and that's the problem. Everything runs as admin.

-

Re:DrDoS

[Alsee]

Win2000 and NT are usually used by computer professionals who have some clue about security. Smaller market too.

WinXP is used by gramma who is going to run the screen saver attachment on her E-mail. Umpteen million home users. And usually only Root/Admin has access to raw sockets. In XP everyone runs as Admin.

Just imagine if the next E-mail virus hits and several million home computers start flooding the web with packets with forged source addresses. Good luck getting gramma to remove the virus and apply a patch.

-

Re:DrDoS

[ZaneMcAuley]

On the positive side, alot of those do run firewalls and virus scanners that have been made easy to use via the use of wizards etc etcm or alot of them have had somebody set them up for them. The only thing we can do for non computer literate people is to educate them and make the security tools as easy to use as possible.

Prediction

[Anonymous Coward]

I predict the majority of posts here will either say "Slashdot creates DoSes" or "DoS requires no talent".

Taco, why do you say such things?

[phoenix_orb]

"One of the most basic "hacks" (to use the media's bastardization of the term)

I read the article several times, and they seemed to call them "attacks" not hacks. So why are you claiming the media bastardizes the term when this author actually uses the correct terminology?

Re:Taco, why do you say such things?

[NanoGator]

"So why are you claiming the media bastardizes the term when this author actually uses the correct terminology?"

Because the 'media' is a representation of the entire news broadcasting world and not the individual author?

Denials of Service

[trelaneopn]

One of the first widely used DoS scripts was Click nuker, which was packaged with the 7thSphere IRC script. I worked with 7thSphere at the time, and I can safely say if we knew the damage that unleashing DoS on the world would create, we wouldn't have. As an old hacker I beg you to consider what you're doing before you seriously incovienance someone, and cost people money. When I did it, a 28.8 modem used artistically could split 2 efnet servers, now it takes hundreds of machines packeting to knock down a larger server. There is no art in that, only suffering of those effected by it. Frankly I wish that we had never released click, and I believe most of the rest of 7thSphere would agree.

Re:Denials of Service

[The AtomicPunk]

Seems to me PING came out a long time before Click did. :)

Re:Denials of Service

[trelaneopn]

true enough, but ping itself was not designed to deny service.

Comment removed

[account_deleted]

Comment removed based on user account deletion

To what end?

[carm$y$]

Hmmm... call me paranoid, but CNN carrying such an article in a time when a lot of limitations and regulations are attempted on everything even remotely connected to "digital", "internet" and "infrastructure" can't be good.

What better reason to sniff all the traffic, on the backbone? Oh yes, they'll get the mails also, but hey - nobody's gonna read it...

MS-DOS

[knuu]

WRT this: If someone 0wned the Windows Update server and used it for a DoS attack on other servers, would that be called an MS-DoS attack?

Re:MS-DOS

[NanoGator]

"If someone 0wned the Windows Update server and used it for a DoS attack..."

I th1nk the reas0n tha+ hackerZ d0n't use M$ s0ftware iZ +hat m0st 0f everyth1ng they wr1te w0uld have squ1ggly lineZ under it.

Re:MS-DOS

[Anonymous Coward]

I th1nk the reas0n tha+ hackerZ d0n't use M$ s0ftware iZ +hat m0st 0f everyth1ng they wr1te w0uld have squ1ggly lineZ under it.

More to the point, if you hack a M$ system, you can cause it to behave unpredictably, crash, loose data, and generally be too buggered up to get any work done. Unfortunately, no one will know the difference. That's not quite true on NT5, of course. When it comes to reliability, M$ has finally (with NT5) reached the point that Unix was at 20 years ago, when I first started working on Xenix on Altos hardware. Unix, of course, has moved on from there.

I'm not sure if M$ has really carried security as far as Unix had it in 1985. Of course, back then, no one had really thought of security, or code review, or the internet. Ok, so M$ is maybe a bit ahead of circa 1985 Unix security. They've thought about it, and decided it won't help sales.

Re:MS-DOS

[Anonymous Coward]

When it comes to reliability, M$ has finally (with NT5) reached the point that Unix was at 20 years ago, when I first started working on Xenix on Altos hardware. Unix, of course, has moved on from there.

And maybe, eventually, Unix will finally reach the point that Microsoft was at 8 years ago with Windows 95. That is, an end-consumer usable system.

Re:MS-DOS

[Cynikal]

you know, thats a pretty scary thought.. if someone rooted the update server, how hard would it be for them to post a "you gotta get this now" update to infect every system that does auto update, not to mention the people who update manually.. hmm scary, but interesting notion..

mmmmm... havoc....

Re:MS-DOS

[jonnythan]

Isn't the same thing totally possible with Debian's apt servers, OpenBSD's cvs servers, or Red Hat's update servers?

Re:MS-DOS

[Cynikal]

dear lord, you're right!

nothing is safe!

im serious...

Very annoying

[Anonymous Coward]

I've gotten a couple DoS attacks in the past few months. I suspect they're coming from someone who I was playing a game online with and who wanted an extra advantage. Just last night I was playing BZFlag (quite a fun game, btw) when I was attacked. It makes me hesitant to play games online with strangers, as it could affect the bandwidth of not only me, but others in the house who share a connection with me as well.

The future of DDoS as told by Gibson

[marekk]

A very engrossing read can be found at Steve Gibson's homepage of his account of the DDoS attack grc.com was subjected to earlier this year.

In effect, Gibson tracked down the 13 year-old attacker by dissecting the zombie program (aka, trojan bot) used in the attacks and created his own version of the undercover bot to monitor the hacker's IRC channels and conversations. As I said before, an extremely interesting read. It really brings out the urgency of Gibson's alerts as to the future of DDoS attacks.

Re:The future of DDoS as told by Gibson

[SuiteSisterMary]

Steve Gibson is an idiot.

Re:The future of DDoS as told by Gibson

[Anonymous Coward]

I notice GRCSUCKS and it's maintainer lacks the nads to identify itself. anyone who claims to be debunking ont hat level (weather they are right or wrong) has absolutely no credability if they wont back up thier statements with a visable record of who they are.
Crackpot or not we at least know who Steve Gibson is and what he has done in the past.
I also have a distaste for the persons likening himself to the folks at atrittion.org who would stand by thier words.

Wrong DOS

[global_diffusion]

I think what they are really talking about are "Denial Of Sex" attacks during dates. The methods to protect oneself from DOS are the same as they have always been: Beer, peer pressure and roofies.

Hack or crack?

[Easy2RememberNick]

"One of the most basic 'hacks' (to use the media's bastardization of the term)"

Well isn't that a bastardization of a bastardization???

"Someone who applies ingenuity to create a clever result, called a 'hack'. The essence of a 'hack' is that it is done quickly, and is usually inelegant." reference

"The term 'hacker', in its original meaning, refers to someone who applies ingenuity to create a clever result - usually in a technical sense - called a 'hack'" reference

"The original meaning of the word 'hack' was born at MIT, and originally meant an elegant, witty or inspired way of doing almost anything...Now the meaning has changed to become something of a portmanteau term associated with the breaking into or harming of any kind of computer or telecommunications system." reference

Re:Hack or crack?

[duren686]

Some might say that the original meaning of "hack" is "chop with an axe," making the MIT meaning a bastardisation of that term.

Re:Hack or crack?

[Easy2RememberNick]

Actually I did see that included in one of the definitions of hack.
What does "chop" mean? 8-0

Coincidence?

[Anonymous Coward]

Several raids and house investigations were performed today in holland at several people widely known for their ddos sk1llz.

Dutch people probably know who I'm talking about.

(Dutch articles, couldn't find any translated/english ones yet)
http://www.openbaarministerie.nl/persberi/20 02/040 9afrm.htm
http://nu.nl/document?n=54929
http://w ww.security.nl/artikel.php3?id=2956

Re:Coincidence?

[zmooc]

The fun thing is...everybody seems to know this dude and it had been known pretty widely for some time already that he did it:) I don't get why the police took so long to find him... For the non-Dutch: he DDOSed a widely announced chat-session with our crown-prince and his girl so it made all the headlines. So. My tip to the DDOSsers: don't brag. (and don't DDOS:P)

hrm, more bandwidth for the consumer?

[Sase]

Will there ever be an end to Dos Attacks?

I don't think there can be.

If you look at the TCP/IP, and most importantly IP protocol, there is nothing you can do.

Some would say have a 'supersmart' router that would kill all packets that are from the same host.. but what's the point.. what if the router fills up its buffer?///...

It's like McDonalds at lunch... everyone gets there at the same time.. they all want something, they're going to pay (in a DoS attack, this is what it *looks*like, but its really one person doing this) so the lines get long.. Poor me can't get lunch as fast a possible..
there's nothing we can do to solve the problem unfortunately.

The only real solution is to beef up security on as many systems as possible. Once this is done, a hacker can't get the resources in order to launch a big DoS attack.

This is a really hard task, of course... but maybe security should be more of a main focus on the home desktop systems, especially since broadband is getting so easy to obtain.

Another reason why M$ needs to get their thumbs out of their a$$e$ and release more secure OS's... Open Source is already trying to actively take care of the problem :)

Whee
-Sase

Re:hrm, more bandwidth for the consumer?

[BurritoWarrior]

For stopping these things, or at least ending them fairly quickly, how about an automated "upstream notification" procedure built into web servers, routers and firewalls. Thus, the admin doesn't have to manually notify their provider, the provider gets notified more or less in real time and dynamically adds a rule, and then passes it upstream to the next link. Of course, you would have to have certificates or key pairs that match to have the rule added, otherwise the packet to change the rules gets dropped.

It certainly seems a big step up from what we have now.

Re:hrm, more bandwidth for the consumer?

[illusion_2K]

I agree with you to a certain extent that not a whole lot can be done about the DoS problem. But that's not to say that nothing is being done.

Here's a few links to 'recent' publications on the issue.

MULTOPS: a data-structure for bandwidth attack detection

CenterTrack: An IP Overlay Network for Tracking DoS Floods

The Packetstorm DOS paper contest

(You may need to be a USENIX member for the first two. I didn't check. Sorry)

Re:hrm, more bandwidth for the consumer?

[Sase]

*nod*

However.. what if the traffic is jammed in that particular network?

that would really be dependent on the router too.. and who is to say that the source of these 'keys' are reliable.. i don't mean can be trusted.. the question is if they are competant.. I don't think I would consider myself competant :)

The problem with DoS attacks is that the more cleverly arranged ones are from many many hosts.. this procedure would be almost useless in that case.

Good idea though.. would be a bitch to impliment..

Doing small things left and right are good though. They stop the average DoS attack. In this case, it really is dependant on the good nature of people.

As always, everything comes down to this :)

Re:hrm, more bandwidth for the consumer?

[jd10131]

There are two kinds of *effective* DoS attacks.

1. You find and exploit a software vulnerability... (or you're a skript kiddie, and you grab a 'sploit from some l33t d00d)

2. You obtain some level of control over a large number of systems across several networks. Thus, the DDoS attack.

Both of these scenarios still require some vulnerability to be exploited. So the solution is to patch, patch, patch.

This pretty much eliminates #1. If you didn't patch your box, it's your fault you got killed. (Unfixed vulnerabilities excepted...)

Of course, the solution is flawed when applied to #2, since it is not common behaviour for everyone with a Win* box to update all the time. Behaviour has been proven very difficult to change.

Obviously, these kind of attacks must be prevented closer to the source than the destination. At the destination network, having a router rejecting packets won't be very effective, because your network is still congested.

Installing some form of IDS at an ISP which can kill outgoing DoS attacks would be effective, but only if the attack could be recognised by the IDS without error.

Even so, any new attacks launched would not likely be in the IDS database until after the damage was done.

The most difficult problem would be getting virtually every ISP in the world to sign on.

Without much more advanced protocols, it is unlikely that the DoS problem will go away soon.

Re:hrm, more bandwidth for the consumer?

[Anonymous Coward]

I disagree. DoS attacks CAN be stopped. A DoS is pretty obvious, just because it does fill up buffers with basically meaningless traffic. First, if we made even basic use of caches, many legitimate DoS-like situations would be simply avoided. Now if servers would just pass on to upstream hosts when they are choking, those hosts could manage their traffic a little more intelligently and together isolate the hosts spewing junk traffic. There's some obvious problems and limitations with this, but there are also almost obvious and simple solutions or workarounds. It's really just a question of do we want to fix it.

Will ISPs, who charge for bandwidth, do anything to distribute and manage the load? Not until they absolutely have to. Just like with every other obvious issue in our great country. So I say, "Go forth script kiddies. Go forth and flourish."

Poorly managed networks are a problem too.

[LojaK]

One of the most common problems I've encountered in my years as a systems administrator is poorly managed networks. If a network is designed without the presence of mind anticpating DoS attacks, then frankly, the victim company deserves *some* of the blame for the problem.

One mid-sized ISP I worked for had been operating for 5 years prior to my employ and the network operators had never heard of monitoring tools like MRTG, RRDTool, Netsaint or Big Brother etc etc!

"We do it to ourselves and that's what really hurts" -- Radio Head.

-- Steve.

The definition of HACK

[Anonymous Coward]

So what does hack mean anyway?

1. verb - Gaining access to or "rooting" someones box?

Ex: "I just hacked this windows loser's box."

2. noun - An unqualified person?

Ex: "Don't listen to that guy, he's just a hack."

3. another verb - Programming?

Ex:"It's two in the morning are you still hacking on that code?"

4. another noun - A quick and possibly ugly code fix?

Ex: "Well, its a nasty hack, but at least orders are going through the system now"

5. another verb - Coughing up something?

Ex: "Of course you're hacking up a lung, you smoke two packs a day dumbass."

6. yet another verb - Slicing up something or someone with a sharp object?

Ex: "Wow, look at the way Freddy is hacking up Nancy with his claws!"

Ok, so who's to say what the definition of "hack" really is? Webster? Roget? - come on those guys are hacks.

Re:The definition of HACK

[Anonymous Coward]

7. A really bad journalist (see Jon Katz).

well...

[PsiPsiStar]

you can say that again.

I respect criminals

[Anonymous Coward]

Yeah, I respect them so much that I call the FBI instead of the PD to report the crime.

I get it. We get it. We got it.

[Anonymous Coward]

I'm doing this post anonymously because I don't want to waste k-points on telling everyone this and getting the inevitable mod-down, but I think it's essential:

Everyone knows when a site gets posted on slashdot, the chances are that it'll experience some down time as it's receiving too much traffic. Yes, we know it's the slashdot effect. But don't repeat it over and over again for christ's sake. I honestly would of debated spending any of my mod points on the first of the jokes, let alone the fifth or so, yet they still seem to get encouraged with positive points.

Redundant and off-topic applies to all of you who keep cracking the same lame-ass, repetetive, trite as all fuck joke.

get real

[atari2600]

and i dont have a life - getting a life is overrated like sex is. :P

Academically boring

[Tim Ward]

I went to a talk by Roger Needham (a few years ago now, I don't know if this is still his view) on secure protocols. Lots of interesting stuff on strategies for designing secure protocols and algorithms, and theoretical attacks and so on.

But just passing mention of DOS attacks - these are boring to academics because they are easy to do and impossible to counter so there's no research to do and no papers to write.

(I paraphrase slightly, and I probably remember the details wrong anyway, so any flaming should be directed at me, not Roger.)

Re:Academically boring

[Luminous Coward]

But just passing mention of DOS attacks - these are boring to academics because they are easy to do and impossible to counter so there's no research to do and no papers to write.

You should take a look at Peter Reiher's work (UCLA). Namely a project on detecting DDoS attacks by observing traffic at routers near the source of the attack (sponsored by DARPA) and another project allowing routers to filter IP packets with spoofed source addresses (sponsored by the NSF).

Starting to get into Commercialization

[BakaMark]

DOS attacks are rarely about sophistication - it's pure destructive potential.

Sometimes you have to wonder about some of the targets of these DOS attacks and how they are organised.

Some of the major ones are obvious, Microsoft, Ebay, Yahoo, etc. But when you start to get to the small to medium sized companies being hit by large DOS attacks, because their systems are sufficiently patched against break-ins, something begins to become worrying.

The questions range from why such a small target for such a large attack, and how the target was selected. Occasionally you get to hear stories about how some small ISP had their lines choked by a huge DDOS, meaning that customers started leaving and going to the competition. There is one other post elsewhere here that identified that a British ISP was put out of business because of the efforts of continous DOS attacks.

Spite sometimes is a factor, but it takes a certain degree of organisation to launch a continous attack such as that. Spite of someone will only get you so far. And there is not that much prestige in taking out a medium sized company. After all within the current climate, medium sized and some large sized companies are finding it harder to remain in business from an economic sense.

Here's the god DOS attack

[CrazyJim0]

Picture what Kazza is doing... Hijacking Gnutella... Just think if all those Gnutella clients were doing a DOS :)

Just think if someone made a P2P client that allowed you to send browser commands through their computer :)

Re:Here's the god DOS attack

[Anonymous Coward]

"Just think if someone made a P2P client that allowed you to send browser commands through their computer"

See: Outlook Express

Our own webserver

[yoink!]

Through by no means has our little webserver been hit by DoS attacks (it is way to low profile, and not listed under any search engines), we nonetheless get about 3000 hits monthly trying to exploit a windows-based webserver.

We have been lucky that we run Apache on a Linux box, which also happens to be on a DSL line, limiting upstream bandwidth. And although 3k hits is minimal, there are only about 10 regular users of the website, which is maintained for downloading test files for music production inside our group only. All the exploits are rediculously similar, each one trying to access C:\ or D:\ or a Windows NT directory. I'm sure that this must be very common... and I can't image what these major sites must deal with on an hourly basis.

I find it sad though, that altogether too many webservers are managed by people who just aren't worried about this type of happening. The web remains the wild-west of the electronic frontier, brothels ;-) and all. Since many of us are against a global policing body, we, at the very least, need to make sure the alarms and defences on our own properties are capable and effective.

Re:Our own webserver

[talks_to_birds]

"...we nonetheless get about 3000 hits monthly trying to exploit a windows-based webserver..."

um..

It's called "Nimda".

It has nothing to do with a DDoS.

It's become one of the incessant background white noises of the internet.

Hell, I get more than 3000 of those a month, at home on my dialup...

t_t_b

Re:Our own webserver

[yoink!]

I need to rid some Karma anyway... but hey dude... I thought I made it clear in my post that it wasn't DoS or DDoS attacks. You should read what people say. The first sentence is indicative that I understood this before I even began to rant in a fragmented and train-of thought fashion.

Why always blame the scriptkiddies?

[Sarin]

Why does everyone allways accuse the scriptkiddies of performing DOS attacks - or worse they call it hacking a server with a DOS attack?

I mean it takes some cunningness to 0wn a couple of hundred machines with a simple dail-up aol account..

Some companies hire blackhat people to DOS their competitors once in a while, think of mail-servers. Other groups DOS certain sites because of their ethical/political/religious backgrounds. So now all of a sudden every "malicious" computer user is a scriptkiddie?

The only scriptkiddies in these stories are the journalists that form their conclusions according to a certain script that's allways used when it's a story about something "evil" with computers.

Don't be a scriptkiddie yourself by making these hollow statements

Re:Why always blame the scriptkiddies?

[Soko]

Why does everyone allways accuse the scriptkiddies of performing DOS attacks - or worse they call it hacking a server with a DOS attack?

I mean it takes some cunningness to 0wn a couple of hundred machines with a simple dail-up aol account..


Some one needs to brush up on thier definitions:

Script Kiddie n. (skript kiddee): A person who uses software tools written by someone else to exploit known security exploits in operating systems and/or server software. A person who poses as being knowlegeable about computers and how these exploits affect said computers. See JeffK.

And cunningness? To use Goolge? Come on. 3 pages into that search and I'd be in fear of my NT machines, were they not patched and behind an industrial strength firewall.

Some companies hire blackhat people to DOS their competitors once in a while, think of mail-servers. Other groups DOS certain sites because of their ethical/political/religious backgrounds.

So you want me to think that groups like these morons are capable of formulating a root exploit in order to DOS thier enemies? Right.I don't know of anyone who has half a brain that would help them do such a thing. Ergo, if they've zombied servers for DOS attacks, they're 5kr1p7 k1dd13z.

So now all of a sudden every "malicious" computer user is a scriptkiddie?

Not all, but most are. There are a few Black Hats out there who can pick apart any system they choose with tools of thier own creation. Those are the people who can strike terror into a network admin's heart - they find things that aren't known security holes, and are therefore almost impossible to stop.

The only scriptkiddies in these stories are the journalists that form their conclusions according to a certain script that's allways used when it's a story about something "evil" with computers.


See the definition above.

Geez, you're defensive. Wonder why....

Soko

Local Mirror

[vip223]

To avoid the /. effect, maybe it would be a good idea for the /. editors to create a local mirror of the sites they feature, because obviously they can handle the load of all of us lemming clickers. Josh

Re:Local Mirror

[Fat Casper]

RTFFAQ:

Slashdot should cache pages to prevent the Slashdot Effect!

Sure, it's a great idea, but it has a lot of implications. For example, commercial sites rely on their banner ads to generate revenue. If I cache one of their pages, this will mess with their statistics, and mess with their banner ads. In other words, this will piss them off.

Of course, most of the time, the commercial sites that actually have income from banner ads easily withstand the Slashdot Effect. So perhaps we could draw the line at sites that don't have ads. They are, after all, much more likely to buckle under the pressure of all those unexpected hits. But what happens if I cache the site, and they update themselves? Once again, I'm transmitting data that I shouldn't be, only this time my cache is out of date!

I could try asking permission, but do you want to wait 6 hours for a cool breaking story while we wait for permission to link someone?

So the quick answer is: "Sure, caching would be neat." It would make things a lot easier when servers go down, but it's a complicated issue that would need to be thought through in great detail before being implemented.

Answered by: CmdrTaco Last Modified: 6/14/00

correct this offtopic mod

[Anonymous Coward]

steve gibson has no professional credability in the area of network security. the above link is entirely on topic.

Hmm..

[Peridriga]

CNN is now wondering why...
After publishing a story on DOS attacks it is receiving a DOS attack on the story about DOS attacks...

EGRESS FILTERS are STILL not implemented by ISPs

[Medievalist]

/.
Best Current Practice recommends egress filtering for all networks. Are yours in place?

The big problem with DOS and DDOS is the untraceability provided by networks who do not prevent address spoofing with egress filters. If traffic is traceable, criminals get caught.

Before anyone's knee jerks, let me point out:

1) this is not a performance issue. Routing hardware and software (LRP for example) is widely and cheaply (compared to line costs) available that can implement egress filtering without any noticeable effect on line speed. Face it, processors are faster than telecommunications.

2) Egress filters do not improve a repressive regime's ability to finger political dissidents.

3) Egress filters are unlikely to impact privacy - unless what you are trying to keep private is destructive activity. Post a real example if you disagree.

4) I know it's not a cure-all. It's a necessary first step, though.

While Congress milks the entertainment industry for campaign funds in exchange for "digital rights management" facism, they ought to be mandating specific monetary penalties for businesses that do not implement egress filters, and for ISPs that do nothing about hundreds of Code-Red infected nodes on their cable farms. I shouldn't have to pay Comcast if my bandwidth is being principally used by criminals to fill my firewall logs.

I post this every time the subject comes up; next time I'll just make a flippin' link to the BCP RFCs. I'm sure you'll all be relieved.

--Charlie

Ingress filtering. Piece of cake.

[sudog]

Spoofed attacks could be stopped if more ISPs did simple ingress filtering. Most don't.

Partial Solutiuon

[sneakerfish]

Every leaf router should drop packets with a return address that is not in its internal IP space. So if I am the netadmin for www.xyz.com and my address space is x.y.z.0/255.255.255.0, then I should have a rule that any packet leaving my network should have a proper, ie x.y.z.0/255.255.255.0, return address.

Ever ping a the broadcast address of some network then look in the ARP cache?

You call that funny?

[Anonymous Coward]

You have a really fucking low threshold for what you consider humor.

I bet you find that when someone spells 'Microsoft' with a dollar sign that it's so hilarious you shit your pants.

I AM BILL GATES OF BORG. RESISTANCE IS FUTILE.

Hahaha. So funny you'll die from a seizure.

DRDoS vs. DR DOS

[yerricde]

Distributed Reflection Denial of Service

Why do the names of these service-denial attacks tend to coincide with the names of 16-bit embedded PC operating systems? For example, the generic term "DoS" (denial of service) collides with "DOS" (disk operating system). The term "DRDoS" (distributed reflection denial of service) looks like "DR DOS" (Digital Research disk operating system).

first post

[Anonymous Coward]

fp

Coming soon

[Milinar]

DoS for dummies

Stephen Barkto? Is that you?

[Erris]

It's the type of attack I've never understood: it doesn't gain the attacker anything.

Sure it does! Can't make Hotmail work right? Well, just blast away everything else from AOL to Yahoo with spam. Don't like what Slashdot is saying about your "product"? Just sign up 100 troll accounts and flood the comments with enough highly moderated garbage to try a saint. Denial of someone else's service is good when you are a twisted greedhead that wants to own everything and tell everyone what to do.

Negligence on Microsoft's Part?

[Anonymous Coward]

Since 99% of these attacks come from compromised windows boxes... could Microsoft be held liable? Afterall, there new "security" push has them publicly saying that they were not doing a good enough job before...

Re:Negligence on Microsoft's Part?

[drizuid]

since when do 99% of these attacks come from compromised windows boxes. I do believe you are mistaken.

Need power to get ISP's to cooperate

[PhotoGuy]

One of the biggest problems in DOS attacks, is that you just can't get the attention of major ISP's or backbones to trace and solve the problem.

We had major DOS attacks on our site for ages. But when the customer of a major national ISP is the source of it, try getting ahold of someone at that company to track the problem. They just won't respond to these things, in our experience.

I think that for any company to provide internet service, they should be *required* by law, to cooperate in tracking and stopping DOS attacks from their customers. There needs to be a consistent, predictable, and workable national policy for this.

If someone calls me with threatening phone calls, I *know* it's possible to get the phone company to cooperate, track, and isolate the problem, even if it originates with another phone company. The same should be true with ISP's.

Re:Need power to get ISP's to cooperate

[zoftie]

Solution is IPv6, it offers many features that would put stop to many iditotic nightmares IPv4 brings to life, like spoofed ips, no multicast, address space. Underlying idea of the internet is dead because internet has evolved into something much too large for specifications written almost 30 years ago.
enough said - it will not come - pipes are never replaced, even if they add led to the water. What makes me think that routers will be replaced...

Agreed

[Anonymous Coward]

Steve Gibson wouldn't know his ass from a hole in the ground.

Steve Gibson's a fool

[Anonymous Coward]

You of course realize that the DDoS capability Steve Gibson is ranting about is present in ALL modern operating systems (ie NT4.0, windows 2000, windows XP, all Unices, MacOS X etc.)
I am so sick of people attacking Microsoft for things they aren't even doing wrong, the ability to open raw sockets is a good thing that can and has been abused, but if anything microsoft has been holding out on this feature (yes, its a feature) for too long already.

Also, I wouldn't quote anything by Steve Gibson on Slashdot if you value your reputation.

better get another lawyer!

[Erris]

But what if a Lawyer made an argument along the lines of: "Slashdot intentionally posted a link to their site knowing that an overwhelming increase of traffic would hit my client's servers."?

That's called public discourse! Do something wrong, people will talk about you. Make a real monster out of yourself and they might stop and stare. People are free to say and think what they might. It's part of what free speech is all about.

If you don't want the public entering your web site, or building for that matter, you had better not make it public. If it's public, we might presume that you want visitors.

If your layer can't tell the difference between many people visiting a site and an attack of broken Windoze machines, they don't know the difference between a protest and rolling a bus into a building. They might not know their ass from a hole in the ground either. Find another one.

Re:better get another lawyer!

[jcast]

they don't know the difference between a protest and rolling a bus into a building.

You mean like the Palestinians?

*ducks*

2 Easy solutions to solve most DoS attacks

[Phasedshift]

The easy things to solve most DoS attacks are to:

1. Turn off directed broadcasts on all interfaces. This will prevent a situation, where you have a person sending one packet, and the network replies with many DUP packets.. If the person changes the source address in the packet they are sending, the remote network (with directed broadcast enabled) will send its replies to whoever you want. i.e. someone can use this to do a smurf attack. So, for every one packet someone sends, an untold amount of addresses could respond to the source address of the packet. Disabling this is quick and easy in most cases.

2. If using a Cisco enable:
ip verify unicast source reachable-via rx
which will ensure that the source address of packets received on the interface have source addresses that are reachable over that interface. Have it enabled on all gateway routers, so that when customers try to issue a DoS attack against someone else, the source address of the packets have to be their own, or the packet is dropped. They can't just send a bunch of ICMP echos to a /16 off of a router that has directed broadcast enabled, and change the source to someone else.

Unfortunately both of those methods require somewhat cluefull network admins... Also, some things have legit uses (load balancing outbound traffic is a good reason not to have "ip verify unicast source reachable-via rx" enabled, in certain circumstances (i.e. the customer has 2 providers, with 2 seperate IP blocks, each only known through one provider, they can't really do equal cost load balancing on incoming traffic, but they can do equal cost on outbound)).

Again, the issue is having cluefull network admins.. There will always be people out there getting around it, but you can make it a lot harder for them to do it, and you can drastically lower the amount of DoS attacks that happen.

./configure make ping MS

[simetra]

I was thinking.... if the make scripts for various stuffs included a ping... Say for example ping that Linux counter project at the end of each Linux install... perhaps they would have a more accurate representation of the number of installs, IPs, etc. You could also through in a ping or sendmail to Microsoft telling them you've found the way out!
Just a thought....

Re:Bastardizations...

[Anonymous Coward]

No.

Why are you moderating this down? Maybe this guy's a bit flamish, but his point is both valid and ontopic. Propogating (what you may perceive to be) the improper usage of a term isn't slowing down the adoption of that usage any.

God bless K5

[inerte]

I learned what's an editorial comment there. Let's see:

"One of the most basic "hacks" (to use the media's bastardization of the term) is a Denial of Service attack.

You mean the hacker term or the Denial of Service term? Clarify.

-1

While not getting you any access to data on a machine,

And since when is this the bastard hacker term meant to be? Hacker, by the media, would mean "cracker", and crackers don't want "information". Hackers do, crackers want to cause confusion (unless information == fast money/recognition)

-1

DoS attacks effectively shut down machines by making them inaccessable to others.

Yeah? And how does this happens? Another assumption I understand all anacronyms out there.

-1

CNN is carrying and IDG.net story about

No comments.

-1

how DoS attacks are still one of the leading threats on the Internet, and are actually on the rise as the sophistication of the attacks increases." We get them constantly- some intentional, some not. It's really a pain.

Oooooh, finally the meat. That's what the news is about, not the opinion from who whatever wrote/published this article.

-1.

Grammar errors from me are a bonus.

Effective DOS attacks would make news too....

[billstewart]

DDoS attacks make news more than single-machine DOS attacks for two reasons - one is that taking over a few thousand machines is a pretty impressive task for a Skriptz Kidd13 with too much time on his hands, but it's Been Done Now. But the other is that doing a non-distributed DOS attack on a server that's big enough to be interesting is pretty hard. Taking over a single average-quality-administation machine isn't hard, though it's harder than scribbling the front page of a web server, and even that makes news some times (e.g. the Central Stupidity Agency scribbles.) But taking down a big site means either attacking a bunch of heavily-administered machines hard and fast enough to outrun the administrators, or coming up with a really subtle and nasty attack, or finding a big security hole, or else just using a big bunch of zombies to do the job. Most vandals go for the latter approach.

Wish

[smagruder]

I wish they would call this kind of attack a DoL (Denial of Liberty) or a DoC (Denial of Commerce). By disrupting our online work, whether it's for social, political or commercial reasons, these evil ones are practicing a soft form of terrorism.

Re:Wish

[Anonymous Coward]

Ask ashcroft how he want his puctuation with that:
BIG E, or little e, kay?
Thanks

no, moderate YOU back to 0

[Anonymous Coward]

read the post again, dumbass. he's talking about spreading of viruses and opportunistic zombie-type programs through stupid people opening anything and everything who are USING such p2p tools.

Goddamnit, more and more I've been really amazed at what gets modded up and what is hidden at one and below. Wake up you fucking dimwit moderators.

DoS as self-defense against "bad guys"

[DocSnyder]

it doesn't gain the attacker anything (unlike rooting a box)

Sometimes DoS can be a not-really-fine but very effective method of self-defense. In Germany we have a quite big problem with spam advertising dialers - little programs which redirect a w1nd0z3 box's internet dialup connection to an extremely expensive special number which is normally used for phone sex or premium services. One short connection can cost up to 900 € (that's no joke, there's no limit), and as some dialers hide well while replacing the default connection, some people got a phone bill of more than 10000 € at the end of the month.

During the second halfth of March, I got about five of these dialer spams each day. Other people got even more. The web hoster - a company selling these dialers - didn't act against any incidence of spam, the download accounts remained open for weeks regardless of any complaints. Their uplink... well, UUnet. As the discussion on the Usenet forum "de.admin.net-abuse.mail" went on, even the web hoster's boss himself joined and couldn't understand to be responsible for knowingly tolerating his customers abusing his service - of course he made a lot of money even by spamvertised dialers.

About a week ago, some spam victims were completely fed up. As the legal methods didn't work at all, the dialer should be made unavailable by distributed mass-downloading. The threat escalated in a clear message to the site maintainer - either go against your spamming customers or see your dialer being downloaded until the server blows the whistle.

The story appeared on Heise News which has a quite large reader base in Germany, to be read by lots of angry people whose inboxes were full of dialer spam. The "Heise effect" was enough for the site maintainer to become really scared - lots of DSL and broadband users started to download the dialer not only once but as often as they could. The web server became too busy to serve dialers even to people who would want it. The company selling these dialers didn't have any choice - either stop supporting spammers or have their dialer server slashdotted until it blows the whistle. Only a day later the company's boss agreed on getting rid of and seeking legal action against spamming customers.

A few days later, another spam went around, advertising a dialer hosted on an Eastern-European web server. Same game: the spam victims squeezed the dialer out of the web server as many times as possible. The site got hosed so badly that even a few hours after the spam incident, the dialer was no longer available.

As a result, if you really want to hit a spammer, DoS^H^H^H/.ing his web site - especially large files or CGI scripts - has finally proved as much more effective than blacklisting, LARTing or anything else (which still remains useful, though). Even big providers will notice a gigabyte-large traffic peak towards only one target.

Re:DoS as self-defense against "bad guys"

[marauder404]

Good story; thanks for telling it.

Re:DoS as self-defense against "bad guys"

[borud]

although what you describe in this case is a very "benign" form of DoS, in that it is limited to a very specific target and probably does not cause a lot of "collateral damage", you are doing something very dangerous in that you condone activities that can be labeled as acts of vandalisom and/or terrorism.

if you ask the palestinian suicide bombers they will tell you that they are committing acts of terrorism as a form of self defence. in their eyes they are applying the last desperate measure available to them since their conventional military capabilities are significantly below those of Israel.

to these people the means are justifiable exactly the same way you find DoS justifiable to get rid of spammers.

I've been on the receieving end of many huge DDoS attacks for no other reason that running an IRC server. usually they don't even have an axe to grind with me; they just want to take over some channel and in order to do that need to split up the net for a significant period of time. a conflict between a few people that at times has affect as several hundred thousand people.

just a few weeks ago a few kids from Iceland DDoS'ed my IRC server for almost 6 hours -- just so they could try to take over some channels, collide off a few users etc. the tragedy is that while they hurled about 100Mbit/sec at my server, they indirectly DoS'ed other sites since my server responded to spoofed packets.

at best DoS is an illegal act of vandalism. in the worst case it might be considered an act of terrorism. the problem is that given the vast difference in how the authorities react to different attacks, a lot of naive people are starting to think that it is a legitimate means of achieving various goals.

if you condone DoS you are no better than the people who condone terrorism.

I can certainly understand your frustration with spammers and the authorities' impotence when it comes to dealing with them, but I can guarantee you that NOTHING will change unless you push the authorities to deal with the problem.

If you directed your efforts toward the authorities instead of stooping to the lowest level, even below spammers, you would do some good. what you are doing is providing a short term relief from one spammer. sure it probably makes you feel like you've achieved something, but the unpleasant truth is that you have just become something even more loathsome than the spammers: a terrorist.

DoS is never justifiable, just as terrorism is never justifiable.

Re:DoS as self-defense against "bad guys"

[Anonymous Coward]

The most glaring problem with your fscked-up analogy is that people don't have reset buttons; also, no amount of money, resources or positive thinking can return a person to life after being vaporized by a bomb. If somebody DoS'es your server intentionally or accidentally, for whatever reason, you can always pursue a legal remedy, and (theoretically at least) be fully remunerated. Dead people don't have that luxury.

Sorry your little IRC server got hosed and the f-servers couldn't serve up the pron; unfortunately, it goes with the territory these days. But don't ever confuse the taking of another's life with simple vandalism.

You sound like John Ashcroft.

Re:DoS as self-defense against "bad guys"

[arivanov]

What you are describing is not DOS. This is pushing "fair" use to its "fair" limits. Yes. I can use all of my spare DSL bandwidth to screw someone over. Actually with QoS deployed on my gateway Linux or BSD box I would not even notice it.

And it sounds like a jolly good idea. Methinks I need to write a HowTo so people who are not that profficient in Linux/BSD admin can do it. Let's face it the relevant parts of Linux and BSD docs are nightmarish and they are not end-user material.

Brgds,

Use the the /. effect luke!

[idontneedanickname]

Well i'm not the first person to point out that scrpit kiddies r the cause of the DoS's but as long ass they can download the progs from any given "security realted" website they're no gonna stop!
So now i urge u find every site out there that has these progs freely availible and post a link on /. so we can use the /. effect on them to force them to take the stuff off their website....!!!

WE'RE A MASS, WE HAVE POWER!!

or at least write them an email..i mean come on that's the least u can do...well of course u could do nothing but....

Re:Use the the /. effect luke!

[idontneedanickname]

true, but if every /. reader does it within 1h it will work
but if only a couple of ppl do it then guess whose pc won't work for some percuiliar reason...
but don't fear, /. is here
i would require planning or a couple dozen pc's with "rapid email ditribution programs" or DoS tool of their own ot do it.

--3\/!1 l33+

whoa

[Anonymous Coward]

that's a lot of work for someone to do to trash someone else. almost like the infamous stalkedbyseth...

Re:whoa

[Anonymous Coward]

true... i just wasted 10 minutes reading some of that trying to figure out what was goin on, maybe imitating grc.com's messed up style isn't the best tactic.

A suggestion for anyone running Apache...

[ShaunC]

The htaccess directives in this example will eliminate the noise from your error_logs. They'll also redirect inbound Nimda or CodeRed requests to Microsoft. Not that Nimda or CodeRed grok the 302 Found replies, but it's nice to dream of giving M$ a taste of their own medicine :)

(I tried to post the directives here, but the lameness filter wouldn't let it through.)

-s

Re:A suggestion for anyone running Apache...

[Anonymous Coward]

to do this do i add it to httpd.conf ?

How about MS-DoS

[rsborg]

Why do the names of these service-denial attacks tend to coincide with the names of 16-bit embedded PC operating systems?

Are you saying that Microsoft wrote a denial of service attack called MS-DOS (aka multi-source denial of service)?

Re:How about MS-DoS

[Hydrogenoid]

What about IBM's purely coincidental DoS?

Band-aid for Spoofed IP addresses

[mcrbids]

What really gets me is how easily this problem can be (largely) remedied.

A router for an ISP is resonsible for (typically) routing to/from a certain range of IP addresses.

Configure the router to simply not route packets coming "from" the local network interface that's not in the designated IP range!

So if it's coming from ISPs network, the return address on the IP packet had better be one of ISPs network addresses, or the packet goes to the bit bucket, better yet logged.

This step ALONE, which costs almost NOTHING in latency or price would make dealing with DDoS or actual hack attempts SO MUCH EASIER!

Of course, you could "spoof" a neighbor computer, but at least you could trace things down to the ISP and neighborhood...

-Ben

Re:Band-aid for Spoofed IP addresses

[J'raxis]

Do people even bother spoofing to hide their identities anymore? I thought the most common usage of spoofing was just so the machine doing the DoS doesnt have to get the reply traffic dumped on it (therefore it can send more echo requests or SYNs or whatever since it doesnt have to process the echo replies or ACKs or whatever).

Thus, if someone is going to crack 10.1.2.3 to use to DoS someone else, it doesnt matter if they can spoof outside their own network, or only over 10.1.2.4 as long as the reply traffic is not coming back to them they dont care.

Re:Band-aid for Spoofed IP addresses

[sysop]

This is trivial on a Cisco router using CEF;

Just add:

ip verify unicast reverse-path

to customer-facing interfaces.

Unintentionals are still a problem

[billstewart]

Unintentional attacks do happen - that article on Slashdot pointing to www.myserver.org instead of www.myserver.com, or some TV commercial giving out your 888 number instead of the correct 877 number or whatever, or having somebody type your phone number into their ginsu-fax-o-matic by accident and having the thing keep calling you. Yes, it wasn't deliberate, but it feels just about the same.

Some DDOSer once cracked one of my DSL lab machines and was pinging home to his box at MIT - except it wasn't really MIT, he'd gotten the byte order wrong on his IP address somehow and was trying to phone home to Japan.

Getting Skr1p7 K1dd13Z to go after Spammers :-)

[Anonymous Coward]

We'll probably never get rid of the script-kiddie types showing off about how 31337 they are, until they're redirected to some equally anti-social use for spare time and testosterone that annoys somebody else (:-) So how can we use them productively? Can they be talked into bothering spammers instead? Currently a large number of school machines in Korea seem to have open relays or proxies and high-bandwidth connections that are being abused by spammers - could the Kiddiez go 0wn them and use them to take down the spammers who've been abusing them, or take down the machines in China that the spammers like to get their replies on?

In a less anti-social vein, is basically a system designed to let spammers DDOS themselves - it replies to SMTP v...e....r....y....sl....o...w....l...y, and won't bother the occasional smtp sender that accidentally sends mail to a teergrubed address, but if you're trying to send lots at once, all your sessions get stuck.

I see DoS going away VERY SOON!

[Dark Coder]

I ran into this new company: TippingPoint Technologies, Inc.

This company makes wirespeed "bump-in-the-wire" IDS/firewall (and I think virus checking) up to 2.1 Gbps.

No point of attack to aim at.

DoS, something we could all laugh about (soon).

Comment removed

[account_deleted]

Comment removed based on user account deletion

Dictionary attack

[Anonymous Coward]

to use the media's bastardization of the term

You know, I keep telling people that "gay" means "happy", but nobody wants to listen, they insist on bastardizing the term. Whenever I use it in conversation to mean happy, I get strange looks. These idiots around me insist on using the word to mean "homosexual", but my trusty 1960's dictionary VERY CLEARLY states that it means "happy".

Duh. Language is defined by HOW PEOPLE USE IT, period. If 99% of people use "hack" to mean a certain thing, then guess what, THATS WHAT IT MEANS, by definition of how languages are defined.

My advice to all these whiny people on /. who think that using "hack" in its original computer-related meaning makes them superior to others: GET OVER IT ALREADY.

Re:Dictionary attack

[Anonymous Coward]

I feel like using the term "whiny-ass little bitch" to describe you. May I? After all, if that's how people use the term ...

Respect an intruder?

[Anonymous Coward]

Would you respect the guy who discovers you forgot to lock your door, and gains access to your house?

What if you locked everything, but he had a nifty picking mechanism and knew how to use it?

What if he just had a big hammer? OK, that's kinda like DoS; ignore that.

Frankly, I respect the guy who keeps his distance.

Re:Respect an intruder?

[dadragon]

What if you locked everything, but he had a nifty picking mechanism and knew how to use it?

But that's not what I'm talking about. I'm talking about a guy who sees something wrong with the lock. Not how to get around a perfectly good lock.

An analogy; you're talking about somebody using a dictionary attack against a machine. I'm talking about somebody who sees that the lock cylander is busted.

roofles

[Anonymous Coward]

HAHAHAHA I'm rolling.

HAHAHAAHHAHAHA

The Slashdot Effect Solution

[Q2Serpent]

Why doesn't slashdot make a local mirror or a page on their servers, good while the story is on the front page? I mean the slash servers can obviously handle the pressure...

There are other alternatives too. Like automatically checking google to see if google has a cache entry, and providing a second link there. Or maybe copying the page to something like freenet. Use your imagination.

I understand that for a lot of pages and sites that fall within reach of slashdot destruction, the material is copyrighted. But isn't this just creating a cache of the page? This doesn't seem much different than an ISP transparently proxying all of the web connections via squid and caching their own pages...

Well anyway, there are things that can be done. Why not look around?

Re:The Slashdot Effect Solution

[Glytch]

Already answered.

Re:EGRESS FILTERS are STILL not implemented by ISP

[Craig Ringer]

Actually, my ISP (iiNet) just implemented them. The article below says they block sat users (yeah, unfortunate side effect) but goes on to point out that it is in fact basic 'net responsibility.

http://whirlpool.net.au/article.cfm/794

Re:EGRESS FILTERS are STILL not implemented by ISP

[zoftie]

> 4) I know it's not a cure-all. It's a necessary first step, though.

no it is postponing the inevitable. I want my multicast dammit! I want to have power of billion dollar broadcast stations in my home. Haven't we paid enough for that technology to work properly?

3 UK ISPs have been DOSed off the net

[blowdart]

This year, 3 ISPs and a web hosting firm in the UK have been DOSed off the net

First, in January was Cloud Nine. They said it was so bad it trashed firewalls, and the network had to be rebuilt.

This was quickly followed by Tiscali. (Although they're such a spamhaus, the net probably only noticed because the amount of spam from the UK dropped)

Then soon after Donhost, a web hosting firm had 2 client web servers taken out in January.

Finally, yesterday, edNET was attacked, which caused, according to them a "catastrophic network failure". The attack here was via telnet ports.

Re:3 UK ISPs have been DOSed off the net

[Anonymous Coward]

"First, in January was Cloud Nine [theregister.co.uk]. They said it was so bad it trashed firewalls, and the network had to be rebuilt."

Yes, it is well known fact that DOS attacks
bore through correctly configured firewalls
and destroy hardware.

"Finally, yesterday, edNET [theregister.co.uk] was attacked, which caused, according to them a "catastrophic network failure". The attack here was via telnet ports."

Oh boy: those open telnet ports are bad news.
And for more than one reason...

In any case if they invested the effort of
hiring someone who knew how to use iptables
and linux or even crapass BSD they wouldn't
have these problems.

Man are you wrong

[Seenhere]

Academically boring? No research?

As just one example that made its way into the popular press see this .

Geez.

--Seen

Re:Academically boring, says who.....

[anonymous cupboard]

Please remember that Mr. Needham is now running Microsoft's Research Lab in Cambridge. If the Win family of operating systems were not so easy to misconfigure and thus infect, or so prevailant, there would be no big DoS problem.

Impossible to counter? Not necessarily.

[step]

Well, DDoS works because a large number of attacks can be concentrated on one host, causing a total shutdown of the target.

One simple way to prevent this: Have a large number of hosts in the DNS RR for said site, and either loosely synchronize them (P2P networks come to mind) or perhaps tunnel valid requests to a secure, central site unknown to the public.
In this case, attacking one of the publically availanle sites via DDoS does not effect much. One of the hosts in the RR doesn't work, but if there are 10 hosts that would be a disruption for only 10% of all accesses.Attacks on the central site are very difficult, as its address is unknown and appropriate filters would be in place.

This idea certainly isn't perfect; it works for web sites, but hosts that are necessarily unique (such as corporate firewalls) could still be attacked. But it shows that there are indeed research opportunities and solutions that can be (at least theoretially) put in place with current technology.

My SANS Paper on DoS

[rjbrown99]

I wrote a white paper on the topic of Denial of Service attacks and presented it at the annual SANS Network Security Conference in October of 2001. I never released it publicly, but now seems to be a good time. My paper is now available for review at http://www.netpr.com/tools_resources/#netpr.

Please have a look. I think we provided a nice overview of some of the steps required from a high-level and low-level to combat DoS attacks.

If you'd like to email me about the paper, feel free to contact me at rjb@SPAMAWAYnetpr.com. Obviously remove the SPAMAWAY from the email. -Robert

GPL'd tool to detect DoS attacks

[ckotso]

Heya,
I recently released the first stable release of a GPL'd tool
to detect DoS attacks coming through a router. It is called Panoptis,
it can be found here,
and it's using Cisco NetFlow accounting data provided by (most) routers.
If you want, give it a try -- any feedback at all will be useful.

--C

Re:DOS is dead - PATENT PENDING

[Anonymous Coward]

A method of denial of service wherein said denial
of service is caused by the effect of multiple
unsolicited responses by average web users reading
a web site which contains a link to the DOS site
through electronicaly delivered inflammatory
reviews and/or citations of the target DOS site.

This patent will be licensed at $5.00 US for every
hit delivered to the DOS site. By clicking on the
link in your favorite news site you agree to the
following terms and conditions.

1. Your cash payment will be received and invoiced
before you click the next link.

2. You agree that your email address belongs to
whatever company owns this patent.

3. You will donate all living offspring to the
Office of the Patenter of the Peoples Democratic
Republic of the United States.

4. You agree to give up all right of recourse
under law of any nation that you are a citizen
of.

5. You belong to me!!!!!!

DDOS for profit

[K7001]

Although DOS attacks are simple it would be harder and potentially ver profitable to hold websites to ransom with it.
a DDOS attack against charles schwab the online share trading exchange took their systems down for 3 days , (their weekely turnover is approx 2bn USD) , other e-tailers could also be held to ransom over this as well.
Additionally , government websites have been DDOS'd by activists (i believe recently the FBI i response to one of their sites being attacked in this manner crashed the clients web browsers).
Anyway DDOS can be much more than a lame piece of vandalism.

self regulate

[Martin S.]

We need to stop DoS attacks [and defacements], we need to educate the script kiddies into being more responsible and professional.

The script kiddies conducting DoS attacks think they are being clever and aiding the movement towards Internet Freedom and Openness, however they are playing into hand of the establishment.

DoS attacks are perpetuating the view amoungst the establishment that the internet is a wild unregulated place, that must be controlled, that it must be regulated.

Legislation like the DMCA in the US, and pressures for similar laws in the EU are a direct result of this type of threat.

If we truely value our freedom and the openness of the net, we need to self regulate otherwise the situation will get worse for all geeks and not just the grey/black hats.

Re:self regulate

[thunderbee]

You are so right, and it is so late already...

Steve Gibson

[_Laban_]

Here's a nice page about Steve Gibson's "discoveries" as a security expert: http://grcsucks.com/ Pretty lame name, but a good read.

Re:DOS is dead [OT]

[Anonymous Coward]

Arachne? I never had a hard time viewing sites in dos! *snickers* download it here and let your msdos/drdos/freedos browsing fun begin!

DOS attacks on /.??

[psycht]

We get them constantly- some intentional, some not. It's really a pain.

No, its just people refreshing trying to make first post.

I wish someone would dDoS spam sites

[Pegasus]

I was shocked a few days ago when i found sites that offer mass mailing utilites for free. Jeez, these guys must be _at_least_ dDoSsed, altough i'd rather rip their heads off ...

Re:First Fucking Post

[Anonymous Coward]

./ effect in work: Could not locate remote server.
you have any mirrors?

Re:EGRESS FILTERS are STILL not implemented by ISP

[Luminous Coward]

Face it, processors are faster than telecommunications.

The architects of IPv6 disagree. They did away with fragmentation inside routers and made the header size constant to shave a few milliseconds off every packet. With the advent of Tbps optical links and optical routing, processors are about to bite the dust.

Re: scarlet fish

[Medievalist]

>>Face it, processors are faster than telecommunications.

>The architects of IPv6 disagree. They did away with fragmentation inside routers and made the header size constant to shave a few milliseconds off every packet. With the advent of Tbps optical links and optical routing, processors are about to bite the dust.

I was speaking of current reality, not hypothetical future conditions. Failure of network architects to implement the Best Current Practices (rfc2827/BCP38 and rfc3013/BCP46) can't be excused in the name of future implementations of backbone protocols running on purely hypothetical hardware.

Certainly long-haul communications protocols should be designed without unneccessary overhead - and what is "unneccessary" as opposed to "reserved for future enhancements" is another argument - but all that has absolutely nothing to do with what we're talking about.

--Charlie