Slashdot Mirror

← Back to Stories (view on slashdot.org)

SCO Not Lying About DoS Attack

Posted by michael on from the even-a-stopped-watch-is-right-twice-daily dept.

Licensed2Hack writes "The Cooperative Association for Internet Data Analysis (CAIDA), part of the San Diego Supercomputer Center at the University of California, San Diego has an analysis of the recent DDOS on SCO.com. Netcraft also has more information in their article and analysis graphs. Seems SCO was hit with a 50,000 packet-per-second SYN flood peak, which yields approximately 20 Mb/s each way, or about the capacity of a DS3 line."

32 of 615 comments (clear)

  1. It leaves one to wonder... by Infernon · · Score: 2, Interesting

    whether they're inept enough to leave themselves open to this sort of thing or if they're welcoming DDOS attacks with open arms for one reason or another...

  2. Why Nothing Should be Done... by gizmonic · · Score: 5, Interesting

    If any authorities look into this, I am gonna be pissed. I mean, if they can't bother to do anything when the anti-spam sites get attacked, then they better damn well not do anything now.

    Of course, I am of the paranoid type who assumes that SCO would stage a DDoS against themselves just for the publicity, so what the hell do I know?

    --
    WWJD?
    JWRTFM!
  3. It's tough out there ya know by IamGarageGuy+2 · · Score: 5, Interesting

    It's hard to have much sympathy, even though this is a dirty trick played by some h@xtor D00d that has nothing better to do with his time. The only way to beat a scurrilous bunch of deadbeats like SCO is to show to the public the kind of people they really are. Attacking them in this way only makes the Open-Source people look like a bunch of teenage kids that want to take on "The Man".

    --
    Stay tuned for new sig...
    1. Re:It's tough out there ya know by i_r_sensitive · · Score: 4, Interesting
      The problem is that some Open Source people are teenage kids that want to take on "The Man".

      For proof, look around /., they aren't that hard to find.

      Responsible FOSS people are not responsible because they support FOSS, that was very likely a pre-existing condition.

      And FOSS does have allure to children, or the child-like. The underdog, oppressed group, challenging traditional and accepted practice.

      If they are not sophisticated enough to understand the reasons behind FOSS, why should we be surprised if they are unsophisicated enough to engage in irresponsible behaviour.

      Too often the FOSS movement seems to highlight those aspects of itself which attract this element. We too rarely emphasize the responsibility inherent in FOSS. The responsibility to contribute, the responsibility to report bugs, the responsibility to respect other's choices as we wish them to respect ours.

      Do we really want these people identifying themslves with our movement? I suspect not, but until we stop accentuating the us against big corporations et. al., and start accentuating some of the more mature aspects of what we stand for (which are at least as compelling as the other reasons...) we will continue to attract these people, and they will continue to make us look like children.

      I don't know any more about this specific incident than any of you, and I hope none of you reading this know any more than I do... There is no reason to believe that some FOSS advocate perpetrated this, but it is apparent from some of the sentiments expressed that people are considering the possibility and lamenting it, if it turns out to be true. If it does, we need to consider what we can do to make our movement less appealing to the irresponsible.

      --
      "Talk minus action equals nothing" - Joey Shithead, D.O.A.
      "Talk minus action equals /." -
  4. Yes but one fact remains by Rosco+P.+Coltrane · · Score: 5, Interesting

    SCO was hit with a 50,000 packet-per-second SYN flood peak

    If their servers died from a synflood attack, there are 3 possible reasons:

    - The IT guy is a monkey (likely, but still, he would have to be a really daft monkey)

    - The IT guy has time-travelled from the mid-nineties and didn't know about synfloods

    - The IT guy was told to compile a kernel without the synflood protection, so that Caldera/SCO would look like the poor company hit by naughty hackers.

    Also, I might add, there are another aspect to consider : whoever hit SCO with a synflood attack has either:

    - the brain of a monkey

    - time-travelled from the end of the nineties and attacked SCO with what he thought was a really cool unbeatable DoS

    - been told to attack SCO so that SCO looks like the poor company hit by naughty hackers.

    Conclusion: The cause of this DoS was either:

    - 2 particularly stupid monkeys
    - 2 time-travellers
    - 2 suckers paid by SCO

    Dunno for you, but I know where my money would go if I had to bet ...

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    1. Re:Yes but one fact remains by Silvers · · Score: 4, Interesting

      While a single source DoS stream is 'really stupid', a DDoS using hacked machines is notoriously hard to stop and trace.

      Anyway, this is my analysis. When only the WWW server was targetted, the flow was not enough to saturate the link, but there was no syn protection in front of the www server. (or poorly configured, or something along those lines) Mainly because the FTP site was still up and running on the same subnet. But from the report, later on the FTP server was also attacked, bringing up total bandwidth up even higher, possibly killing the link.

      So quite obviously the www server was not protected from syn's nor was the link fully eaten up by these packets. Since the ftp server was responsive until it became a target, as well as the fact that these reports mention that the amount of traffic significantly increased when the ftp attack was launched.

      There's very little to be done about a DDoS if it can saturate your link, but in this case it wasn't completely utilized (atleast until the ftp attack started), and the www server just wasn't getting adequate protection (many firewalls have syn attack thresholds where they will age out syn connections extremely fast and only pass on ones that complete to the server)

      Anyway, just the analysis of a college kid.

    2. Re:Yes but one fact remains by Xenographic · · Score: 4, Interesting

      Pity SCO never bothered to use TCP cookies, which are old news. Live and learn.

      What no one else has mentioned, however, is how SCO came up with those fake signs when the protesters came--you know, the ones assosciating Linux and communism, which you can find photos of on Groklaw--I mean, I have no proof of anything, nor do I accuse them without proof, but I cannot put self-sabotage beyond them any more. It's not like they haven't done things of this nature before.

      Their willingness to use it as PR is also troubling. How ironic, though, that we'd criticize someone for coming clean about an attack when so many who study security wish that companies were more forthcoming about them. On the other hand, this is a DoS attack--no confidential information is at stake--so this is just the sort of attack they probably need not mention...

      My guess is that they plan to use this to (attempt) to discredit IBM in the courtroom. First, presume that someone in the OS community did it (proof not required?), associate IBM and OS, then claim that IBM is part of a conspiracy against them (they already have, actually, in their breifs--I could be mistaken, but I thought that it was one IBM moved to strike since they didn't even state it with particularity [e.g. didn't say who IBM had conspired with])

      Even so, I'm reasonably sure that SCO cannot prevail in the courtroom, especially given how McBride claimed to be expecting the outcome of the last hearing over discovery. So we're pretty sure that SCO won't prevail in the lawsuit--indeed, the counterclaims from IBM may well be the end of them--and we can be pretty sure that IBM won't just buy them out (bad precident). It could be a Pump & Dump--I've seen others who think that someone is painting the tape (trying to keep SCOX share prices up)--but the SEC, at least so far, doesn't appear to think so.

      I just wonder if there's some other "win" scenario wherein SCO doesn't actually win the lawsuit or much of anything else.

      Here's a thought--albeit one terrible, completely, utterly and totally speculative unsupported by any solid evidence--what if SCO's entire purpose here is to discredit Open Source? In that scenario, they don't have to "win" anything--just make sure that we suffer as much as possible while they go down...

      Oh well, I'm not sure how much Darl can hold on. They postponed the earnings report, which the Motley Fool lists as a textbook showing of internal strife. The lawyers and the banks are jockeying for position over the remains of SCO should it lose, according to their agreements which you can find on Groklaw. The court has gone soundly against them thus far in the discovery hearing. It's practically game over if the share price drops low enough, for any reason, according to more agreements with RBC.

      I wonder if Darl can keep it together long enough that SCO even exists for the remainder of the lawsuit, given that it'll take some time?

      Only time will tell.

  5. Then please explain by Jesrad · · Score: 2, Interesting

    Then please kindly explain why the website was still available at http://216.250.128.20/ ?

    --
    Maybe we deserve this world ?
  6. Bandwidth by phorm · · Score: 5, Interesting

    eems SCO was hit with a 50,000 packet-per-second SYN flood peak, which yields approximately 20 Mb/s each way, or about the capacity of a DS3 line."

    And how, exactly, would you prepare for this? Ignoring syn-floods is very simple when it comes to keeping your server alive, but how do you deal with the bandwidth saturation?

    The "each way" would indicate the syns were being replied to (dumb), but they still would have clogged the pipe.

    My question is how this is possible without killing the bandwidth other servers on the subnet, namely ftp.sco.com and others? That was the original reason for the conclusion that SCO was lying, and I've yet to see something that refutes it

    The other question, of course, if it was a DDOS, who did it? A group, or one person slaving many connections? Maybe somebody with a DS3 or two available to spare?
    With the last two, one would think that the outgoing results of such an attack would be noticed?

    Also, again with the main arguement that the ftp was online whilst the www was offline... why does the article say the FTP was down (and first to be attacked)??

    1. Re:Bandwidth by Avihson · · Score: 4, Interesting

      My point exactly on ftp.sco.com, I check them during the incident, and response time seemed normal.

      What bothers me avout the whole incident is that we just have one confirmation that there was a 32 hour attack on SCO.
      Just where are all the zombies? What OS where they running? What vulnerability on the zombies was exploited? Where are the rest of the confirmations that this was a DDOS?

      Answers to the above questions were flying all over the 'net when Microsoft was DDOSed, where are they now? I know more people hate Microsoft than SCO, but the people with the tools to detect the DDoS attacks are vendor neutral.

      An interesting quote from CAIDA:
      "Around 2:50 AM PST Thursday morning, December 11, the attacker(s) began to attack SCO's ftp (file transfer protocol) servers in addition to continuing the web server attack. Together www.sco.com and ftp.sco.com experienced a SYN flood of over 50,000 packet-per-second early Thursday morning. By mid-morning Thursday (9 AM PST), the attack rate had reduced considerably to around 3,700 packets per second. Throughout Thursday morning, the ftp server received the brunt of the attack, although the high-intensity attack on the ftp server lasted for a considerably shorter duration than the web server attack. At 10:40 AM PST, SCO removed their web servers from the Internet and stopped responding to the incoming attack traffic. Their Internet Service Provider (ISP) appears to have filtered all traffic destined for the web and ftp servers until they came back online at 5 PM PST."

      So not only did the ISP filter the traffic for the ftp servers, it seems to have mirrored the ftp server, since I was able to explore the ftp site and also download download an ISO: SCOX Dev CD

      So the Bandwidth to the DDoSed ftp server either was not saturated, or the ftp server was not DDoSed, or maybe, just maybe, it was an inside job!

  7. Silver Lining? by KnightNavro · · Score: 4, Interesting
    They may have actually been attacked, but at least they still look like the news grubbing idiots they are. As the Cadia article points out, it was a SYN attack. From earlier today, SYN attacks are very easy to defend with even the most basic systems.

    Again, even when SCO shows a shred of the truth, it only reveals they're either incompetent or unethical.

  8. Re:ftp? by NecroPuppy · · Score: 4, Interesting

    It also doesn't explain why the NetCraft stats show their connection going dead like a switch was flipped.

    Even with a SYN flood, there should have been a ramp up period of increasing latency, not an "on/off" situation.

    --
    I like you, Stuart. You're not like everyone else, here, at Slashdot.
  9. Re:still doesn't explain everything. by temojen · · Score: 2, Interesting


    Maybe there wasn't actually any syn packets... how hard would it be to make 700 Million ACKs with random destinations and sequence numbers? Doing so would only claim half their bandwidth, leaving them still up but able to cry loudly about being knocked offline by a SYN flood.

  10. Still doesn't make sense ? by Jesrad · · Score: 4, Interesting

    But if the website traffic is load-balanced across those multiple servers, wouldn't the server at 216.250.128.20 have been hit by the very same attack ? From the traceroute and DNS queries, it seemed to me that they had just changed their webserver's IP from 216.250.128.12 to 216.250.128.20, and messed up the DNS update and transition.

    --
    Maybe we deserve this world ?
    1. Re:Still doesn't make sense ? by Zocalo · · Score: 3, Interesting
      Possibly. Possibly not. Without detailed knowledge of the precise SCO setup, it's difficult to say for sure, all you can do is take observed data and claims and speculate. Also, keep in mind that there could be multiple load balancers in the mix, the DDoS could have been targetted at an IP address rather than a hostname and so on. It's also possible that they just changed their DNS and stuffed it up. ;)

      But to give you a more specific reply, rather than the general one. Assume that SCO has two load balancers, one on 216.250.128.12 and the other on 216.250.128.12. Behind one IP is a cluster of web servers on 10.1.0.x and behind the other a second cluster on 10.1.1.x. Each cluster is in a different data center for resiliance. This is a fairly typical setup (my employer uses this on its Intranet, only we have three sites). Now someone launches a DDoS SYN attack against 216.250.128.12, but while the total traffic does not flood the network connection, the amount of SYNs arriving is either enough to down the load balancer, or takes out the webservers behind. You will see precisely the effects we got with SCO; adjacent IPs up, the web server down and SCO screaming blue murder.

      Of course, as I said before, that's just supposition based on what's being said and how things can work. It's still entirely possible a significant part of SCOs claims are not exactly what happened of course.

      --
      UNIX? They're not even circumcised! Savages!
  11. Something is missing... by tekspot · · Score: 2, Interesting

    Is it me or these articles do not offer any explanation for "why www.sco.com (216.250.128.12) server is down and ftp.sco.com (216.250.128.13) is still working without any slowdown, even though they are on the same network?"

    If they state that all the available bandwith was consumed by attacks, then all the servers on the network would be unresponsive. So that could not have been a bandwidth issue. Therefore it leaves us with "SCO is a bunch on incompitent morons" version of the events.

  12. Re:SCO Not lying... by corrie · · Score: 5, Interesting

    This statement is false.

    What a nice place to say that, isn't it?

    The CAIDA article states: "The current attack successfully blocked access to SCO web and ftp servers"

    I find that difficult to believe. The Groklaw article mentioned successful access to the FTP server for a few HOURS while the WWW server was not available.

    Then, suddenly, the FTP server was also down, which was after the Groklaw article appeared.

    So basically there two things which makes me wonder about this whole situation:

    • 1. Why is it that the SYN flood did not take out the network at the router level, as opposed to a specific server on the Ethernet backbone?
    • 2. Why was there such a suspicious timing involved with the FTP server also becoming unavailable after the Groklaw article appeared? Why on Earth would the attacker(s) suddenly decided to also attack the FTP server?

    If the main reason for the service being denied was actually the traffic generated by this attack, which is basically what the CAIDA article seems to claim, then there is no indeed no distinction to be drawn between the two servers, and so should have gone down simultaneously.

  13. Re:just another PR trick by hbo · · Score: 4, Interesting
    The headline was SCO Group Web Site Attacked Again Which, it turns out was correct. Lots of folks read Groklaw, or posted to both Slashdot and Groklaw, doubting that the attack was real. As I said over there:


    I haven;t (sic) seen an explanation for the fact the earlier traceroutes stopped at multiple points in xo.net. Thos (sic) seem to indicate that there was filtering going on upstrean from SCO. This is a reasonable response to a DDOS by a backbone provider. That would also explain why there was now (sic) bandwidth problem on other systems close to www.sco.com. The putative attack traffic was never reaching SCO's colo.

    We should resist the temptation to believe that everything SCO says is a lie, just because most things are. This could blind us to real threats from SCO, if they exist.

    --

    "Even if you are on the right track, you'll get run over if you just sit there" - Will Rogers

  14. Advertising times two... by johnlcallaway · · Score: 1, Interesting
    The UCSD Network Telescope monitors distributed denial-of-service attacks worldwide using a novel backscatter analysis technique.
    WOW... What a PR bonanza. SCO gets all kinds of press opportunities because of the DDoS, and the company they pay to monitor the SCO system proves that it was a DDoS attack and gets to have gazillions of people view the web site that talks about their product that proves the DDoS actually happened.

    That's like reading MSN for unbiased news about M$....
    --
    I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
  15. Re:SCO Not lying... by DavidMoore · · Score: 2, Interesting

    The peaks are large, but the majority of the time the load is much lower. 4,000 pps syn flood is under 1.5 Mbit/sec. So plenty of room for other traffic. SCO had both bandwidth problems from having a relatively small pipe and server load from the syn flood.

  16. Magic Looking Glass. I see Jane, Little Darl, Etc. by unic1 · · Score: 2, Interesting

    I saw a lot more indepth analisis on Groklaw yesterday. I was especially interested in a VERY CLEVER Analisis where connections were instant even on there main webserver untill the packets reached level 3 of their tcp/ip stack.Untill SCO woke up to the fact that they were busted and had their ISP block all traffic.
    Funnily enough I have just been studying the stack for my CS Degree so I followed this line of enquirery with interest. As far as their ftp server stats, I just put this down to the /. and Groklaw effect of people analising their b*llshit claims.
    Maybe this magic telescope of theirs can find their stolon IP for them. I would love them to try and use this as an excuse to avoid discovery. ( Sorry your honour but those GNU/Linux Commie's destroyed all our proof).

    Red eye's at night, hackers delight. Red eye's in the morning, proffessors warning.

    --
    Red eye's at night, Hackers delight. Red eye's in the morning, Professors Warning.
  17. Re:Shoes by Trepalium · · Score: 5, Interesting

    Okay, I'm willing to accept they were DDoSed. An upstream provider blocking it at the router level makes sense too. But I'm still not willing to accept that SCO isn't lying. What about their Intranet being brought down by this? What about the customer support services being brought down? This could be caused by gross incompetence, an inside job, or complete and utter lies. Choose one, none are flattering to any company, especially one that claims to sell an 'enterprise class' operating system.

    --
    I used up all my sick days, so I'm calling in dead.
  18. Cry Wolf by LuYu · · Score: 4, Interesting

    That is what one gets when one keeps crying wolf!

    Unfortunately, the number of words in that sentence did not exhaust the immense volume of even the big lies told by SCO.

    I hope the wolf is IBM.

    --
    All data is speech. All speech is Free.
  19. This is more bullshit from SCO by spitzak · · Score: 4, Interesting

    The "attack" did not come from any open-source symphasizers.

    After 24 hours the main argument that SCO was faking this was that their ftp server was up. It was very common knowledge and you can be absolutlely certain the hacker was reading the news about the hack. What happened then? Suddenly the attack slowed to the main server and it started up with double intensity to the ftp server! Look at the damn graph and see what other conclusion you can think of.

    Any Leet SCO-hating fanatic would have doubled the attacks on the main server, or perhaps attacked every machine *except* the ftp site. That would have been the most clear "I hate you SCO and I'm going to mess with you as much as possible" attack. If they hated SCO they would want their attack to match the insults being directed at SCO as much as possible.

    Instead the attack suddenly switched to be as exactly as possible a refutation of the publicity about the attack.

    There is no question what the motives of the "attacker" are. And it is absolutly disgusting that SCO can get positive publicity for this nasty little stunt.

    1. Re:This is more bullshit from SCO by Anonymous Coward · · Score: 2, Interesting

      If they hated SCO they would want their attack to match the insults being directed at SCO as much as possible.

      Or perhaps they were trying to disrupt SCO's operation, and so upon reading the ftp server was up was like "oh shit i missed that" and moved to that instead.

    2. Re:This is more bullshit from SCO by FreeTheFurniture! · · Score: 2, Interesting

      ...or perhaps they wanted credit for the attack. Hacking is often about glory (not revenge, not money). Whoever it was probably just wanted to be sure everyone knew it was for real.

  20. Re:awwww... by acidtripp101 · · Score: 2, Interesting

    You realize that netcraft runs FreeBSD, right?

    --
    Not Free(as in beer). Free(as in "I'm free to beat you over the head for being a dumbass")
  21. Re:Shoes by Anonymous Coward · · Score: 1, Interesting

    There's also the fact that some HTML doctypes on sco.com changed from 4.01 to XHTML during the outage. That's the sort of thing that happens in a scheduled upgrade, not an attack. There may have been a real DDOS (after all, Microsoft presumably has its own backdoors in windows, eh?) But SCO appears to have had foreknowledge of it. Who the hell puts out slick press releases talking up the severity of the attack while the attack is on going? That's not the behaviour of a normal company.

  22. Backscatter from where? by ajc314159 · · Score: 5, Interesting

    Pardon my ignorance, but if they took the web server offline at 10-something am, then what was producing the backscatter of ack packets? Was the ISP doing this for them? Why on earth would they bother? And if there was no machine there to respond to the syn flood for hours, then where was the backscatter coming from?

    Also, I thought most zombie machines were compromised MS boxes. Are there networks of thousands of 0wned linux boxes out there that script kiddies are nuking each other with?

    Wating for enlightnement...

  23. These attacks may have nothing to do with Linux... by borgheron · · Score: 4, Interesting

    Sites get attacked every day. Yahoo.com had it's share of attacks back in the day and so did any number of sites.

    The fact is that improperly maintained or administered sites *will* be hacked or DoS attacked by evil-hackers simply to prove that they can do it. SCO is simply a convenient target for some adolescent idiots like so many other sites.

    There is no evidence that these attacks are in any way connected to the recent Linux spat and are not some independent idiot who doesn't care one way or the other.

    Also, as a community we should discouraget this kind of behavior, but it is also a mistake for any individual, company or judge to believe that the actions of a few wayward individuals reflects the sentiment of the entire community.

    I mean, just because someone uses Windows and hacks Linux sites, does this mean that *all* Windows users hate Linux?? No, I know some people who use both and they love Linux, but use Windows for work and they like it too. Contrary to popular belief Windows users are as rabid and often are *more* rabid and fanatical than Linux users. I personally have spoken to people who believe that Microsoft deserves to overcharge the workd for everthing because, in his mind, they have "won" and that is thier "reward".

    So you see... I believe that, while it's unfortunate the SCO is being attacked, it's not necessarily connected with Linux.

    Perhaps SCO should secure thier site better.

    GJC

    --
    Gregory Casamento
    ## Chief Maintainer for GNUstep
  24. Re:Shoes by Trepalium · · Score: 3, Interesting

    Especially one that claims law enforcement is looking into it. Generally in these cases, you don't want to spook the attacker until the authorities can track him/her down. The press release just gives the attacker forewarning so he/she can start covering up their tracks.

    --
    I used up all my sick days, so I'm calling in dead.
  25. Re:IRC servers get bigger DDoS attacks by Frennzy · · Score: 2, Interesting

    Maybe they should outsource their hosting..to, oh, say...the admins at Lindows.com?

    I do find it amusing (and quite possibly ironic), though, that you host an IRC server, and yet don't mention the fact that IRC is the main channel for zombie attacks.

    You mention the router as the 'suffer'ing entity. Well, the router is designed to route packets. That's what it does, and it does it well.

    It's layer 8 that causes the problems...and those problems are augmented by layer 8 making calls into layer 7.