DoS Attacks Persisting, On The Rise

thelizman writes "One of the most basic "hacks" (to use the media's bastardization of the term) is a Denial of Service attack. While not getting you any access to data on a machine, DoS attacks effectively shut down machines by making them inaccessable to others. CNN is carrying and IDG.net story about how DoS attacks are still one of the leading threats on the Internet, and are actually on the rise as the sophistication of the attacks increases." We get them constantly- some intentional, some not. It's really a pain.

Comments

Re:DOS is dead

[NanoGator]

"Everyone at my company has upgraded to Windows 3.1. I don't know why Slashdot is still talking about DOS"

Though I would agree that DOS is probably inhibiting people from getting data off certain sites off the net, they're talking about DoS.

Here's a question, though: Let's say a company does something that the Slashdot community doesn't like. A link is posted to that site so that people could visit it. Slashdot has enough visitors that most sites come down pretty quickly with that much traffic. Could a company make a case that Slashdot is a DoS attack?

I'm not asking on a moral ground, but could a Lawyer actually get that to court?

To be clear I'm not asking:

- Would they win
- Could they in the ideal world
- Would it be ethical/moral to
- Are they right in doing so

I'm asking if they could present a case and get it to court. Thoughts?

Not about sophistication

[Niherlas]

DOS attacks are rarely about sophistication - it's pure destructive potential. Script kiddies bragging on IRC channels about the number of "zombies" they've managed to acquire via the latest script that some grey-hat with genuine skills has written - eventually the bragging gets to a point where they have to do something with all their proudly acquired toys. Usually against some other l337 haxxOR who has impugned their skills.

Save rather than beating each other senseless (which would be so, so much more preferable), they're compromising systems and using them as their weapons - costing users and admins hundreds of work-hours so they can prove something.

Hell, at least "tagging" doesn't take down the damn company server.

DrDoS

[ZaneMcAuley]

Distributed Reflection Denial of Service

http://grc.com/dos/drdos.htm

Looks nasty :D

Taco, why do you say such things?

[phoenix_orb]

"One of the most basic "hacks" (to use the media's bastardization of the term)

I read the article several times, and they seemed to call them "attacks" not hacks. So why are you claiming the media bastardizes the term when this author actually uses the correct terminology?

The future of DDoS as told by Gibson

[marekk]

A very engrossing read can be found at Steve Gibson's homepage of his account of the DDoS attack grc.com was subjected to earlier this year.

In effect, Gibson tracked down the 13 year-old attacker by dissecting the zombie program (aka, trojan bot) used in the attacks and created his own version of the undercover bot to monitor the hacker's IRC channels and conversations. As I said before, an extremely interesting read. It really brings out the urgency of Gibson's alerts as to the future of DDoS attacks.

Coincidence?

[Anonymous Coward]

Several raids and house investigations were performed today in holland at several people widely known for their ddos sk1llz.

Dutch people probably know who I'm talking about.

(Dutch articles, couldn't find any translated/english ones yet)
http://www.openbaarministerie.nl/persberi/20 02/040 9afrm.htm
http://nu.nl/document?n=54929
http://w ww.security.nl/artikel.php3?id=2956

Poorly managed networks are a problem too.

[LojaK]

One of the most common problems I've encountered in my years as a systems administrator is poorly managed networks. If a network is designed without the presence of mind anticpating DoS attacks, then frankly, the victim company deserves *some* of the blame for the problem.

One mid-sized ISP I worked for had been operating for 5 years prior to my employ and the network operators had never heard of monitoring tools like MRTG, RRDTool, Netsaint or Big Brother etc etc!

"We do it to ourselves and that's what really hurts" -- Radio Head.

-- Steve.

Starting to get into Commercialization

[BakaMark]

DOS attacks are rarely about sophistication - it's pure destructive potential.

Sometimes you have to wonder about some of the targets of these DOS attacks and how they are organised.

Some of the major ones are obvious, Microsoft, Ebay, Yahoo, etc. But when you start to get to the small to medium sized companies being hit by large DOS attacks, because their systems are sufficiently patched against break-ins, something begins to become worrying.

The questions range from why such a small target for such a large attack, and how the target was selected. Occasionally you get to hear stories about how some small ISP had their lines choked by a huge DDOS, meaning that customers started leaving and going to the competition. There is one other post elsewhere here that identified that a British ISP was put out of business because of the efforts of continous DOS attacks.

Spite sometimes is a factor, but it takes a certain degree of organisation to launch a continous attack such as that. Spite of someone will only get you so far. And there is not that much prestige in taking out a medium sized company. After all within the current climate, medium sized and some large sized companies are finding it harder to remain in business from an economic sense.

Here's the god DOS attack

[CrazyJim0]

Picture what Kazza is doing... Hijacking Gnutella... Just think if all those Gnutella clients were doing a DOS :)

Just think if someone made a P2P client that allowed you to send browser commands through their computer :)

Our own webserver

[yoink!]

Through by no means has our little webserver been hit by DoS attacks (it is way to low profile, and not listed under any search engines), we nonetheless get about 3000 hits monthly trying to exploit a windows-based webserver.

We have been lucky that we run Apache on a Linux box, which also happens to be on a DSL line, limiting upstream bandwidth. And although 3k hits is minimal, there are only about 10 regular users of the website, which is maintained for downloading test files for music production inside our group only. All the exploits are rediculously similar, each one trying to access C:\ or D:\ or a Windows NT directory. I'm sure that this must be very common... and I can't image what these major sites must deal with on an hourly basis.

I find it sad though, that altogether too many webservers are managed by people who just aren't worried about this type of happening. The web remains the wild-west of the electronic frontier, brothels ;-) and all. Since many of us are against a global policing body, we, at the very least, need to make sure the alarms and defences on our own properties are capable and effective.

correct this offtopic mod

[Anonymous Coward]

steve gibson has no professional credability in the area of network security. the above link is entirely on topic.

Need power to get ISP's to cooperate

[PhotoGuy]

One of the biggest problems in DOS attacks, is that you just can't get the attention of major ISP's or backbones to trace and solve the problem.

We had major DOS attacks on our site for ages. But when the customer of a major national ISP is the source of it, try getting ahold of someone at that company to track the problem. They just won't respond to these things, in our experience.

I think that for any company to provide internet service, they should be *required* by law, to cooperate in tracking and stopping DOS attacks from their customers. There needs to be a consistent, predictable, and workable national policy for this.

If someone calls me with threatening phone calls, I *know* it's possible to get the phone company to cooperate, track, and isolate the problem, even if it originates with another phone company. The same should be true with ISP's.

DoS as self-defense against "bad guys"

[DocSnyder]

it doesn't gain the attacker anything (unlike rooting a box)

Sometimes DoS can be a not-really-fine but very effective method of self-defense. In Germany we have a quite big problem with spam advertising dialers - little programs which redirect a w1nd0z3 box's internet dialup connection to an extremely expensive special number which is normally used for phone sex or premium services. One short connection can cost up to 900 € (that's no joke, there's no limit), and as some dialers hide well while replacing the default connection, some people got a phone bill of more than 10000 € at the end of the month.

During the second halfth of March, I got about five of these dialer spams each day. Other people got even more. The web hoster - a company selling these dialers - didn't act against any incidence of spam, the download accounts remained open for weeks regardless of any complaints. Their uplink... well, UUnet. As the discussion on the Usenet forum "de.admin.net-abuse.mail" went on, even the web hoster's boss himself joined and couldn't understand to be responsible for knowingly tolerating his customers abusing his service - of course he made a lot of money even by spamvertised dialers.

About a week ago, some spam victims were completely fed up. As the legal methods didn't work at all, the dialer should be made unavailable by distributed mass-downloading. The threat escalated in a clear message to the site maintainer - either go against your spamming customers or see your dialer being downloaded until the server blows the whistle.

The story appeared on Heise News which has a quite large reader base in Germany, to be read by lots of angry people whose inboxes were full of dialer spam. The "Heise effect" was enough for the site maintainer to become really scared - lots of DSL and broadband users started to download the dialer not only once but as often as they could. The web server became too busy to serve dialers even to people who would want it. The company selling these dialers didn't have any choice - either stop supporting spammers or have their dialer server slashdotted until it blows the whistle. Only a day later the company's boss agreed on getting rid of and seeking legal action against spamming customers.

A few days later, another spam went around, advertising a dialer hosted on an Eastern-European web server. Same game: the spam victims squeezed the dialer out of the web server as many times as possible. The site got hosed so badly that even a few hours after the spam incident, the dialer was no longer available.

As a result, if you really want to hit a spammer, DoS^H^H^H/.ing his web site - especially large files or CGI scripts - has finally proved as much more effective than blacklisting, LARTing or anything else (which still remains useful, though). Even big providers will notice a gigabyte-large traffic peak towards only one target.

Unintentionals are still a problem

[billstewart]

Unintentional attacks do happen - that article on Slashdot pointing to www.myserver.org instead of www.myserver.com, or some TV commercial giving out your 888 number instead of the correct 877 number or whatever, or having somebody type your phone number into their ginsu-fax-o-matic by accident and having the thing keep calling you. Yes, it wasn't deliberate, but it feels just about the same.

Some DDOSer once cracked one of my DSL lab machines and was pinging home to his box at MIT - except it wasn't really MIT, he'd gotten the byte order wrong on his IP address somehow and was trying to phone home to Japan.