An Anti-DoS Tool That Returns Fire

An anonymous reader submits "Security company Symbiot is about to launch a product that can help companies fight back during a DDoS or hacker attack by launching their own counter offensive. A ZDNet UK story quotes security "experts" questioning the legality of such a product and asking how it will will avoid being fooled by hijacked PCs and spoofed IP addresses..."

Comments

Friendly fire.

[Jaywalk]

For a company that makes a big deal about "thousands of years" of experience, they clearly have not thought this through. A distributed denial of service counter-attack to a distributed denial of service attack? If both sides have massive numbers of machines engaged in sending bogus messages you can be assured of two things: 1) there won't be enough traffic brought to bear on the offending machines to shut them down. 2) It's going to suck down massive amounts of bandwidth.

Can you see the tech guy trying to explain that their company was knocked off, not by the attack, but by the counter attack?

"It's okay, sir. It was friendly fire.

Re:Friendly fire.

[abandonment]

this is the stupidest idea i've heard of in a long time - if you have the network infrastructure to try and launch a DDOS attack, then you probably have the ability to survive and/or defend from DDOS attacks without resorting to insanity like this. Of course, companies in the US will probably love this, it fits well with their governments' 'first strike' foreign policy directives as pushed by Mr Shrub etc

Re:Friendly fire.

[koh]

Hmmm just a thought, but the DOS counter-attack would be issued only from the original target's subnet, so it does make it easier to block...

However, it sure looks like a really bad idea. Someone is getting overpaid out there...

Re:Friendly fire.

[jamshid42]

Actually, could you see if two different companies had an automatic DDoS system like this and someone spoofed their DDoS to attack Company A and made it look like it was coming from Company B? Company A's auto-attack would then attack Company B, which would, in turn, attack Company A. Not only would the continual volleys take out both companies, there would also be a huge impact on the network paths between them.

Re:Friendly fire.

[robslimo]

Agreed.

From the article, According to the company, a response could range from "profiling and blacklisting upstream providers" or it could be escalated to launch a "distributed denial of service counter-strike".

Given that blacklist maintainers have gotten such an unfriendly response from some quarter that they're starting to operate anonymously (google SPEWS for more), launching your own DDoS would put you in deep doo-doo, no matter how white you think your hat is.

-RatOmeter

Re:Friendly fire.

[Znork]

"Effictive? Maybe. Probably more than current methods."

It would be even worse if it was effective. Imagine the first time some joined corps get hit by a distributed reflection DOS attack and their little vigilante group of automated systems take out CNN, AOL, Yahoo, Google, etc in the counterstrike.

Get ready for more attacks

[poptix_work]

This has already been discussed on the NANOG mailing list, the general consensus is that _this_ will be the next
source of attacks against systems as people spoof attacks at it. (Much like smurf attacks)

Some day people will realize the answer is to remove the vulnerable hosts that are being used as attack sources.

Re:Get ready for more attacks

[tessaiga]

Some day people will realize the answer is to remove the vulnerable hosts that are being used as attack sources.

This is the obvious solution (after all, no zombies = no DDoS-nets), but the problem is there's no practical way to achieve it. As things stand today, there's no incentive pushing owners of compromised machines to react quickly to remove them from the net -- there's no financial cost for many home users if they don't do so, and they're shielded from liability by the "I didn't know I was infected" defense.

A second problem is that for the average computer user, it can be very difficult to tell casually if your computer's been infected and is packeting someone else. The fraction of the computer population that checks their firewall to measure their traffic, or goes over the processes running in memory every once in a while, is probably fairly small. This means that infected computers tend to stay infected for a long time. There's also no real, efficient way for a DDoS target to notify thousands of machines about the problem, much less expect a significant proportion of them to respond in any short amount of time.

I think the goal of this approach was to try to make it inconvenient for the compromised machines by taking down their net connection, and thus push the owners to investigate what the problem was. A friend of mine recently discovered that her brother's laptop was riddled with trojans and spyware, after he brought it to her complaining that it was "running slow". Turned out he was oblivious to the problem for a long time until so many processes had loaded down his machine that it was running at 100% utilization even when it was "idle". In the meantime, it was potentially available to be a participant in DDoS attacks. It wasn't until it was inconvenient for him that he took any steps to figure out what was wrong with it.

Of course, many of the other posts have already explained why this particular approach is bad -- everything from spoofing causing innocent victims to be hit with counter-attacks, to the problem of having enough bandwidth to DOS a distributed attack in the first place. The challenge is going to be to develop a practical way of creating incentives for people with compromised machines to fix them quickly.

Endless Loop

[dcocos]

What happens when someone gets smart and creates one that looks for other Symbiot boxes and basicly has them fighting each other?

Pointless

[frenetic3]

Great. So DDoS victims, in addition to having all of their incoming bandwidth wasted, can now spend all their outgoing bandwidth to strike back at their cunning, ruthless assailants -- you know, like all those clever "Dear friends" who "use this Internet Explorer patch now!".

"More than 500.000 already infected!"

-fren

Simbiot or Some Idiot?

[b0r0din]

Yes, let's protect ourselves from attacks by attacking the offenders and wreaking even more havoc. That'll go over well. I don't even want to go into how stupid a proposal this is. Let's start with the first detail: it's probably illegal.

I imagine it'll have some sort of military function, though.

March 31 + 1

[dclydew]

Hrmmm, they go live on March 31 and this sounds too silly to be serious. I vote April Fools Joke.

This is what happens...

[Anonymous Coward]

...when stupid people get venture captial money.

What's really scary about this..

[humankind]

To me, what's really scary about this isn't that the idea is counterproductive, bone-headed, and probably illegal. It's that any company would propose something like this... which leads me to think that this is the type of story that is promoted just to get a rise out of people and we've taken the bait.

The company is obviously trying to jump on the media-whore bandwagon by proposing such an idea, but look who they are and where they're from. Texans' historical idea of security hasn't been impressive.

Shame on ZDNet for creating this troll in the first place. Shame on Slashdot for referencing this troll. Shame on us for being so outraged by it and taking the bait.

We know this idea will never fly. But now we've given this loser company 15 minutes of fame. This story belongs on a Darwin Business Awards list or Fark.com, not here.

Most interesting part: the techniques.

[FooAtWFU]

I found the following the most interesting, for it described how they would respond with "asymmetric responses":

"In these cases, the operations center may call for a variety of efforts, including (1) escalated multilateral profiling and blacklisting of upstream providers; (2) distributed denial of service counterstrikes; (3) special operations experts applying invasive techniques; and (4) combined operations which apply financial derivatives, publicity disinformation, and other techniques of psychological operations."

Now how exactly this will help when you have a few hundred to a few thousand virused zombie machines running a DDoS against you and you have no clue who's behind it... is beyond me.