SCO Not Lying About DoS Attack

Licensed2Hack writes "The Cooperative Association for Internet Data Analysis (CAIDA), part of the San Diego Supercomputer Center at the University of California, San Diego has an analysis of the recent DDOS on SCO.com. Netcraft also has more information in their article and analysis graphs. Seems SCO was hit with a 50,000 packet-per-second SYN flood peak, which yields approximately 20 Mb/s each way, or about the capacity of a DS3 line."

Comments

If they know all of this....

[Jaysyn]

.... where did the synflood come from?

Jaysyn

Who cares?

[Dragonshed]

SCO's like the boy who cried wolf too much. Why should people care when he actually gets bitten?

still doesn't explain everything.

[xsecrets]

Why on earth did SCO respond to 700 million syn packets? if there was even a moderate level of syn protection turned on they would have just droped the majority of those packets. and the bandwith usage would be half.

If they are actually telling the truth, ...

[burgburgburg]

which is an extraordinarily large leap of faith considering that lying for Darl, David et. al. is like breathing for you and I, then it means that the nicest thing one could say is that they have incredibly bad sysadmins. As Groklaw pointed out, there are lots of tools out there to protect against Syn flood attacks.

The cause that fits much better with their general operating pattern is that they purposely left themselves open to this attack to present themselves as the poor, innocent victims of the evil, Constitution-burning, enemy combatant, Open Source villans.

I'd buy that one.

Re:bad for open source

[kirun]

Well, we can tell people we didn't want it.

You don't win arguments by silencing your opponent (which is what DDoS is), you win them by being right. All evidence so far is the OSS community is right.

Whoever launched these attacks has made everybody look bad. Annoying SCO isn't going to make them say "Hey! Let's be nice now!". Their business model is now suing people. It's not as if their software was selling much.

If you're reading this DDoS dude, don't do it again, mmkay?

Shoes

[Overly Critical Guy]

Man, this whole thing sure is a lot of shoes in a lot of Slashdotters' mouths.

Re:Shoes

[A Binary Rebel]

This is probally going to get me labled as anti-linux forever on /. but why is this modded troll? Its true.

I am as anti-sco pro-linux anti-ms as anyother /. junkie. But I also learned a long time ago to never point fingers and to never speak to soon.

This should be modded up to at least neutrel.

Re:just another PR trick

[madprof]

The Slashdot headline was "Security Experts Doubt SCO's Claims of DoS"...well there are lots of "experts" around here it seems, and they all thought it was a PR stunt.

How anyone could see PR value in this is beyond me.
The opinions that matter to SCO are those of the people who control the purse strings at companies who use Linux heavily. They are not about to jack in Linux/pay up because some script kiddies were playing games.
It just doesn't make sense that a company would fake a DDoS attack.

Re:just another PR trick

[Trepalium]

Maybe because the timing of it all was just too damn convenient. It happened couple days after RBC deciding there's something fishy about the contingency agreement, losing against IBM's motion to compel discovery, their stock prices have been dropping, and everyone's expectations that they will not be able to get anywhere near profitable this quarter without some very creative accounting. Of course little of this made it into the same press that prints SCO's outrageous accusations and 'open letters'.

All this happens, and then SCO suddenly becomes 'victimized by all these EVIL Open Source people', virtually guaranteeing the press won't report on SCO's other misfortune because it's 'unimportant' compared to this. Morover, they get to make Open Source people look like terrorists and bad people, and try to make it look like people should not be using software developed by these 'evil people'.

Why?

[etymxris]

Is every Christian responsible for the bombing of abortion clinics? Is every Muslim responsible for honor killings? Is every Linux user responsible for these attacks?

I have little doubt that they were attacked. What seems strange to me though is that they were entirely giddy over the affair. They even went as far as issuing press releases about it. I haven't heard of any company that jumps to release PR about DDOS attacks so quickly. When forced to explain reports of DDOS attacks, a company may release a statement that clears the issues. But the first reports of these attacks came from SCO themselves. This is what raised suspicion, justifiably.

But people shouldn't jump to conspiracy theories so quickly. Doubt of their veracity, sure? Conviction that they are lying--not justified.

Re:just another PR trick

[Trepalium]

Not exactly. I merely believe that SCO will stoop to any low in order to exploit a situation. I believe SCO's managment are opportunists in the worst sense of the word. I believe that lies are just as valuable to these people as truth is, and they will use whichever suits their purpose best.

I know there are "Open Source people" who could and/or would stoop so low as to mount a DDoS attack on SCO. However, the fact that SCO's site isn't getting DDoSed all the time is a fairly good indicator that this 'undesirable element' is in the minority. There's a few of these kinds of jackasses in any crowd, and I wouldn't be surprised if SCO unknowningly had one or two in their midst.