Slashdot Mirror
DDoS for Fun and Profit
First there's the Microsoft worm, reported earlier, which in addition to all the other damage has apparently knocked Microsoft's Windows XP activation servers (and Bank of America ATMs) off the net. Then we've got a report about the ongoing demise of DALnet, perhaps not the way we expected it to go. And Canada discovers a risk of online voting.
Geez, Dalnet and EFnet are beginning to sound like Apple - they're *always* "going out of business" or something like that.
Wait, the difference is that Apple is still on the net. Heh.
OK, I can see how some script kiddie might think that orchestrating a DDoS attack might be fun but how would he profit from it?
Anyone?
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
from the conspiracy theory dept.:
Just a conjecture, but it wouldn't seem out of step with **AA tactics to take down DALnet in order to curb illegal file sharing.
~Chaltek
I would put money on it that tommorow will be the generally fastest day of the internet all year (not saying much it's january). Everything important will be patched, and all the home pc owners that don't know jack about computers will say, "I don't want to catch that virus I heard about on the news, I better wait a day untill it dies down". Thus more bandwidth for everyone else.
leprkan...
why would they use online voting when they could simply use chad-laden punch cards??
microsoft can't even secure their own servers? How can we expect their OS's to run securely on our servers?
This is from HardOCP.com:
It's 2:20 CST and I'm trying to activate a copy of XP. I need to, because this repair/upgrade (changed mb, disk controller, video, hdisk, NIC, RAM, USB revision, CPU, etc) I can't logon without activation.
Except, I CAN'T ACTIVATE. I am told there is no way ANY copy of XP can be activated in the next 5 hours because of (drum roll)
** Routine maintenance **. I mean, I asked: I said
"You don't have some little stand-alone machine that reads a DVD database so you could stand in line and do it?"
"You don't have a couple hundred "last resort" number ranges? You can call me back tomorrow!!!"
"There's not some guy you can go ask? Ya can't call Bill at home?"
So, I gotta stop my project for some unknown length of time. Good thing I'm not updating a medical drug interaction database, or an available transplant database, or a process flow control system or a hazardous atmosphere measurement system or a BUNCH of other possibilities. In my case, either I miss the superbowl, or my car dealer can't find and order Volvo cars on Monday. Life will continue.
But, I'm still seriously pissed. Call 'em at 888-571-2048 and try for activation.
And let's think about the true meaning of the fact you can't release liability for the consequential damage resulting from negligence. I mean, I have NEVER heard about "routine maintenance" on the 24.7.365 activation promise...
Well, on to the next job...
So torn...should I damn Microsoft for providing easy replicative means to fuck up the net all day, or thank them for providing the means to disable the XP activiation servers?
When your enemy is their own worst enemy, does that make them your friend?
Head...aching...
It's dated January 24. Nothing about April.
DALnet has had practically no public servers available since sometime early December, this thing is no joke.
Does anyone ever check the dates on articles? Or the content?
Uhh...the Slashdot article on the sale of DALnet was a joke, but the DDoS attack on DALnet is very real. Actually, several IRC networks have been getting DDoSed in recent months.
Heh, looks like it took out a big portion of Bank of America's ATM (cash) machines!
Link
I can't believe that BoA has their ATM's on the internet -- anyone know more about how it got to their ATM network?
Feeling of power basically. They want to be "ph33r3d" and to run DalNET (or whatever else) into the ground would make them the most powerful people on DalNET because they have power over everyone else and the network is completely at their mercy.
That this is just an inherent problem in the internet's sociology and architecture isn't really a term in the equation but there you go.
I didn't get any spam today... can you guys do this DDOS thing more often? :)
I do not believe the people responsible for such attacks realize they are being self-destructive. The only end goal of such actions is not to increase security-mindedness in the computer world, but rather scare the normal users, the public, from ever touching the Net. Without the users, companies will be stretched to find the cash to keep up the backbone structure and I am sure it would fall apart. The media hypes anything that is detrimental to the public, including viruses, DDoS attacks, etc. This does nothing but a) scare users off the net 2) make the Net look bad to the public. So are all these kids out there pulling stunts going ahead with the goal of destroying the Net in mind? Even though that seems to be all they know? Interesting, work to destroy the only thing you know. Perhaps I should start a crusade to physically destroy computers too? My actions would teach people they do not *require* their computers to survive right? Just like taking down sites will serve to show people security vulnerabilities?
You know, since 9/11/2001 it seems that every attack of any kind has been labled an act of terrorism.
/-&r-ist/ adjective or noun /"ter-&r-'is-tik/ adjective
Those who start these DDoS attacks are seen less like your standard fare and labled TERRORISTs. I don't see them creating terror. Perhaps we should all take a look at this definition of terrorist from Merriam Webster:
One entry found for terrorism.
Main Entry: terrorism
Pronunciation: 'ter-&r-"i-z&m
Function: noun
Date: 1795
: the systematic use of terror especially as a means of coercion
- terrorist
- terroristic
Usama and his bunch are terrorists.
The people responsible for this attack are more akin to electronic warriors. Whether or not they are right in their methodology OR targets makes them no more and no less. Yes, they are criminals, but I really don't think any such attack against any company that experiences so many can be called a "random act of terror". It's more like a concerted effort to destroy said company.
Had they issued some sort of demand with a threat of physical violence, I'd change my opinion, but as it stands the people responsible are criminals/warriors.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
I hope the people who are responsible for this attack (which is technically terrorism) are thrown in jail. It will likely be a long sentence.
I seriously doubt Bill Gates and other Microsoft programmers will spend any time in jail at all over this.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Of course the modified version someone else now crafts that starts spreading sometime next week might actually aim to do some persistent damage, but this version didn't.
In fact, you might even regard this as a blessing in disguise. The worm spread on a Friday night/Saturday morning, when least business would be affected. As of this morning, most ISPs now have filters in place, so any follow up isn't likely to do much damage, and it will now be hard to launch a really destructive attack using this particular vulnerability in future.
- Fzz
When will the ISPs start getting off their respecitve behinds and start doing something about this? With the broadband ISPs subnets accounting for so much of the destructive power of these DDoS attacks, they have a responsibility to at least attempt to ameliorate their impact.
It's not hard to set up simple routing rules to at least curb some of these attacks. Hell, a lot of ISPs still even route spoofed IP packets out of their networks - this is nowhere near acceptable. Realistically, there is no real application for a constant stream of ICMP traffic coming from a single node - there should at least be a maximum allocatable bandwidth for ICMP set at the ISPs gateway. Obviously UDP and TCP based floods are more difficult to manage, but throttling ICMP based floods would be a step in the right direction.
All this is IMHO, of course - users have a responsibility to secure their machines, obviously, but it's going to be a hell of a lot easier to secure a few gateways and routers than a million home PCs.
From http://www.msnbc.com/news/864184.asp
Within a few hours, 25,000 back-end database servers had been infected, said Oliver Friedrichs, senior manager with Symantec Corp.'s security response team.
If they where truly 'backend', they wouldnt of been infected. This is because of all those open and live MS SQL servers.
Seems the US military managed to leave an unpatched SQL server open to the world...
Post 9/11 Godwin's Law corollary: As a Usenet discussion grows longer, the chances of a comparison involving terrorism or bin Laden approaches one.
I therefore declare this thread over and whatever ideas you meant to express discredited.
I guess it's good that Kevin Mitnick has started his own consulting firm. Hmmmm.
3 /0 1/20/1254218&mode=thread
http://interviews.slashdot.org/article.pl?sid=0
Let me try my first profit post:
1) Free Kevin
2) Start Consulting Firm
3) (cough... cough)
4) Profit!
Seriously - I'd hate to be Kevin Mitnick right now... There's probably 20 different gov't agencies all getting the warrants right now. "This much havoc can only come from ONE man!" Mwuwuwuwahahhahaha.
Like Teddy with an elephant gun.
Whoever might be thinking that this is just your typical round of script kiddies attacking dalnet is dead wrong. DALnet is in more that serious trouble -- for the most part it's already dead.
As a DALnet vetran and an op of one of the top 20 channels (#80s-cartoons), I can tell you that almost all of the major channels have now moved to other networks for good. Ever since the begining of december we had outages that would last anywhere from 4 days to a WHOLE WEEK where no one could connect to a single server in the network.
The gaul of some people is pretty amazing. Apparently, these current DDos attacks have been orchestrated by some one (or group of people) that are holding the DALnet network ransom and are demanding that dalnet pays them X amount of money to stop the attacks. Mind you, these attacks have been going on for about 2 months now, and these people still aren't in custody of law enforcement. It just goes to show you that the only thing that seems to get the FBI involoved in computer crimes is corporate cash. I guantee you if such an attack was launched against a commercial website, the feds would snag these fools within one day; But since this is a non-profit organization, they seemingly don't give a shit.
A lot of the big channels from DALnet have gone to EFnet. The irony in this is quite painful (Since DALnet was initaly formed by disgruntled people from EFnet trying to escape shitty service in the first place.)
One plus about leaving DALnet on to greener pastures has been zero PM spam on the new networks at least. Well, for now.
"The Wright brothers were the first to fly with a heavier-than-air machine, but boy did they have a lousy plane"
Just one quick point I forgot to make...
Note that hardly any of viruses, worms, etc cause any real damage. Imagine the harm you could do if you really wanted. Imagine if code-red wiped the drive. Imagine if this SQL worm spread really slowly and randomly modified the SQL database. If it wasn't detected for ages, yet had slowly deteriated the database over a matter of months hence rendering backups next to worthless.
Are you saying he should have 2 computers when he only needs one???? Not everyone can throw around money.
The Microsoft servers are a different story. They should have lots of backup systems running because they serve millions of people. Not to mention this is caused by a security flaw they carelessly created.
This guy is hardly being hypocritical.
Unless, of course, he did the install 30 days ago, and waited to install NOW. Point is, this really doesn't matter, and this guy can kiss my ass -- "I gotta stop my project for some unknown length of time" sounds like the lamest excuse I've ever heard. Maybe he's gotta make a run to Krispy Kreme. Regardless, XP allows you 30 days grace (beta versions 14 days).
Well, I can see why Bruce Perens added you to his foes list.
The 30-day grace is for an initial install. For hardware changes the rules are different:
Source: Service Pack 1 Changes to Product Activation. So apparently the guy had the nerve to install new hardware on an XP system that didn't have this service pack applied.
The take home lesson here: until the activation servers come back up, you should not install any new hardware on an XP system or your machine will be rendered inoperable. Unless you've installed SP1 first. In that case you can install your new hardware and cross your fingers that the MS activation servers are back up within 72 hours.
There have been at least two, possibly three or four, occasions where DALnet just shut down completely for a period of at least a few days (this latest one being in the range of like a week). After the first "big" DALnet shut-down, it seems a lot of channels moved to other networks; most of these channels have even gained numbers. Seems even if DALnet does return, a lot of the channels that left it will stay on their new-found networks. The few anime channels that came back to DALnet are very slowly gaining back their numbers, but they're nowhere near the levels they used to be. As of right now, the highest count is 51 users, which is really low for a DALnet anime channel. Highest warez channel count is 68, which is also really low for a DALnet warez channel. And even the MP3 channels, which probably were some of the biggest channels on DALnet, have lost major numbers. I seem to remember them being in the area of like 600+; current count is 166. So yeah, DALnet has really been taking it in the ass.
General consensus around the parts i hang out seems to be that losing DALnet wouldn't be such a bad thing. We'd all move our channels to other networks, and be done with it. Chat channels would really love EsperNet or IRCnet, and warez/MP3/ISO/PlayStation/etc. channels have a half-dozen networks to choose from, most notably EFnet (though i despise it). Anime channels would thrive on Aniverse. DALnet was great, but, unless things see a really dramatic improvement, i think there are many that would agree that it needs to be put out of its misery as soon as possible.
What has made this all really lame has been the fact that DALnet hasn't really said anything about this. Their eZine (the DALnetizen) has truly been the opposite of helpful throughout this whole ordeal. It seemed as though DAL was almost oblivious to what was happening. There would be a paragraph about Christmas, a paragraph about the benefits of PHP, a paragraph about poems, a paragraph about some new op or something, and then tucked away in a little corner would be a little sentence or two along the lines of "ps dalnet si getitng ddosed pls bare w/ us thx". After this most recent attack, however, they've started to get their act together a bit, and have posted a lot more information regarding the situation. Information can really be helpful to their users, if they want to keep them.
Also not helping the situation are rumours(?) to the effect that the DALnet administration has resorted to childish finger-pointing, and have pretty much detached themselves from each other. DALnet isn't really doing a very good job of assuring its user base that it'll be alright. :/ Hopefully, if DALnet is to survive, this will be remedied.
And, finally, the biggest blow to DALnet has been the de-linking of several of its (best) servers. Almost all of the "good" servers, the ones that everyone had as their first picks, have disappeared. Even the "fall-back" servers seem to be gone. Evidently DALnet is picking up a few new (or renamed, maybe, i can't be sure myself) servers, even in light of the attacks, however.
So DALnet's fate is really unknown. No one can be sure, but for now it's functioning, at least in the sense that it has the ability to carry users. Who knows, though, it could be down again tomorrow.
and in addition to needing to piss and shit like crazy, I just became too paranoid to go to the bathroom.
That set me thinking -- windows XP activation is 30 days, right ? If you don't activate, what happens in 30 days ? It demands you activate or it locks up.
How many people when installing or starting up a new computer for the first time ignore the activation because they've got to try it out right now ? A lot. What day was 30 days ago ? December 25th. What day probably features more people opening up new computers than any other ?
Perhaps they didn't try to attack the activation servers specifically, but simply thought of bringing down the net to stop the wave of Jan 25th activations, and got the activation servers as a lucky bonus.
One entry found for terrorism. /-&r-ist/ adjective or noun /"ter-&r-'is-tik/ adjective
Main Entry: terrorism
Pronunciation: 'ter-&r-"i-z&m
Function: noun
Date: 2001
: any activity against which more extreme measures are desired than current law permits. commonly used to argue that due process and public debate are unwarranted in this instance.
- terrorist
- terroristic
sic transit gloria mundi