Online Attack Hits US Government Web Sites

angry tapir writes "A botnet composed of about 50,000 infected computers has been waging a war against US government Web sites and causing headaches for businesses in the US and South Korea. The attack started Saturday, and security experts have credited it with knocking the Federal Trade Commission's (FTC's) web site offline for parts of Monday and Tuesday. Several other government Web sites have also been targeted, including the Department of Transportation."

Comments

blame China

[Anonymous Coward]

ok let's blame China now for this.

Re:blame China

[Nerdfest]

Or perhaps DPRK? They're annoyed with both of the target countries lately.

Re:blame China

[rastilin]

ok let's blame China now for this.

Let's not. See what offends me about this whole thing is that it's so obivious. If they'd just targeted America, it could have been anyone. But 'whoever' it was had to go and hit South Korea too, at the same time. Who hates both the US and South Korea?

By the way, don't say "Chinese Plot", they have nothing to gain from upping tensions at this point. They've been trying to bring the North Koreans into negotiations and they too have issued denounciations against NK by this point. Iran's official line is that the UK is mostly responsible for their problems, they have little to gain from doing something to the Americans and the Russians were just recently in negotiations with Obama that appear to have gone well.

Re:blame China

[William Robinson]

No. They are suspecting North Korea

Re:blame China

[Culture20]

It's patriotic North Koreans using their home computers! Wait...

Re:blame China

[zeromorph]

No, it's the PFUWU-ML (People's Front of Unpatched Windows Users - Microsoft Legacy).

Re:blame China

[sopssa]

What always bugs me with these "cyberwar" news is that people try to put one country as responsible for them, and its always China or Russia or one of the other "bad guys". Like parent post said, their goverments have no reason to do something like DDOS attacks against US. Who's to say its not just some individual who either is pissed at US/South Korea or has such political views, or does so for whatever reason? Stop blaming countries as a whole if you dont know it.

Re:blame China

[delt0r]

Why does it have to be a country. What about some dirty hacker somewhere with nothing more than an axe to grind. Or perhaps he/she just doesn't like getting teased at school.

Its not fricken national emergency. Its just a botnet attack. Seriously what are the effects? Some website wasn't available all day? Sounds like just another day on the internet...

Re:blame China

[Anonymous Coward]

Splitters!

It's obviously the Unpatched Windows Users People's Front.

Re:blame China

[rastilin]

What always bugs me with these "cyberwar" news is that people try to put one country as responsible for them, and its always China or Russia or one of the other "bad guys". Like parent post said, their goverments have no reason to do something like DDOS attacks against US. Who's to say its not just some individual who either is pissed at US/South Korea or has such political views, or does so for whatever reason? Stop blaming countries as a whole if you dont know it.

But there's two things that are important here..

1. An individual would have to be VERY motivated to attack two countries at once. Especially if those countries are the US and South Korea. The only thing that makes them unique is that they're at war with North Korea. We also know for a fact that the North Korean citizen does not have internet access from reporters inside the country, in fact posessing a device that can access the outside is punishable by death there so it can't have been a NK citizen acting alone. Assuming it was just one citizen from another country they would have to be very dedicated to perform what is basically a military strike against a foreign power. Prepared to risk death to frame North Korea; that would be a very unique combination and it makes little sense.

2. North Korea has recently been upping it's cyberwar capability enough for it to show up in overseas media. They only recently sent teams to participate in international hacking challanges and appear to have done well in them. One of the main reasons I instantly suspected NK is because of this.

So my personal suspicion is based on the fact that they've recently been working hard to build up their capability in this field despite having no internet connectivity for the average citizen and then all of a sudden a cyber strike hits North Korea's enemies at the same time they're conducting missile tests in contravention of UN sanctions.

Re:blame China

[Anonymous Coward]

dont be naive. Why would China try to bring NK to the table? They have nothing to gain from that! Of course they pretended, seeing how far the US goes.
The NK pressure clearly causes headaches for US, ergo its good for China.

Re:blame China

[patro]

Let's not. See what offends me about this whole thing is that it's so obivious. If they'd just targeted America, it could have been anyone. But 'whoever' it was had to go and hit South Korea too, at the same time. Who hates both the US and South Korea?

It could be the Martians.

Re:blame China

[Errtu76]

Well said. And might i add that we in the past used to blame Canada for all that's wrong. With their beady little eyes and flapping heads so full of lies.

Re:blame China

[someone1234]

It was a communication problem between the botnet control servers. They just didn't get the update.

Re:blame China

[rastilin]

dont be naive. Why would China try to bring NK to the table? They have nothing to gain from that! Of course they pretended, seeing how far the US goes. The NK pressure clearly causes headaches for US, ergo its good for China.

The Chinese fund something like 9/10th of NK's fuel and 8/10th of their consumer goods, they basically keep the country running and the word I've heard is because they want to both bolster communism in the world and because it buffers the incredibly rich incredibly capitalist South Korea from their borders. If the Americans finally snap and burn North Korea to the ground the Chinese are unlikely to go to bat for them, it's not worth it, the Americans owe them money and being seen to start wars is bad for business. The end result would be the ultra capitalist South right up against China's borders plus hundreds of thousands of North Korean refugees rushing into China.

Re:blame China

[delt0r]

An individual would have to be VERY motivated to attack two countries at once.

The point of a botnet is they don't have to be very motivated at all. Just bored. Having a list of IP numbers or URLs that includes 2 countries is *not* difficult.

Re:blame China

[rastilin]

The point of a botnet is they don't have to be very motivated at all. Just bored. Having a list of IP numbers or URLs that includes 2 countries is *not* difficult.

I mean there's a high probability (50%+) that they will spend the rest of their lives inside a prison. Targeting a foreign country's military infastructure is no small thing and their home country is unlikely to go to defend them from something like this. If they're smart enough to pull this off no doubt this would have occured to them as well. Remember the guy that infiltrated NASA got something like 20+ years and that wasn't even military critical, neither did he do damage.

Re:blame China

[delt0r]

You think for one second that a bored hacker even thinks that far ahead?

And lets get some perceptive here. A few website went down for less than a day. Hardly an attack that anyone should care about. And not national security or military level either.

Really a DDOS attack like this, *is* a small thing.

Re:blame China

[Anonymous Coward]

It's IP ADDRESSES, not fucking IP NUMBERS.

purple monkey dishwasher

Re:blame China

[rastilin]

You think for one second that a bored hacker even thinks that far ahead? And lets get some perceptive here. A few website went down for less than a day. Hardly an attack that anyone should care about. And not national security or military level either. Really a DDOS attack like this, *is* a small thing.

I'm not disagreeing, it's entirely possible. I merely think it's unlikely. The scale of the attack does appear small, but the NASA example I used was nothing to care about, intent to attack matters.

Re:blame China

[Anonymous Coward]

Most likely caused by war mongers right there in the USA. Talk about a troll...

Re:blame China

[Anonymous Coward]

The Chicoms are not happy with what North Korea is doing. With North Korea getting nuclear weapons, this means that South Korea - and more importantly to the Chicoms - Japan AND TAIWAN will also do the same.

If hostilities resume, it would mean that China will have to deal with millions of illegal aliens coming from Noth Korea.

Rastillin (my sibling post), South Korea is much more socialistic than China is.

Re:blame China

[Lord Ender]

IP addresses used in attacks are usually Chinese or Russian. Furthermore, the malware found on hacked machines often uses Chinese or Russian characters.

It's a pretty good bet that the hackers themselves reside in those countries. We can't conclude that they are hacking at the request of their governments, but it wouldn't be surprising; those governments aren't doing much to stop the hacking (which would be easy to do using national firewalls).

Re:blame China

[Vancorps]

The thing I don't really get is how 50,000 computers can shut down your site.

I can't imagine the FTC is only hosted by one or two servers. Of course the important number was not mentioned which is how much bandwidth was being put into the DDoS. That would determine if it's just bad website administration not surviving something that all of us experience from time to time. Of course the other matter is why you would attack a public-facing site for the FTC or department of transportation. This isn't going to impact operations and makes no statement about your ability to impact hardened targets. Sounds to me like the firewalls they chose weren't doing their job or they were foolish enough to place web-servers directly on the Internet.

It's amazing the important steps people skip when building a site to save a few bucks. Connectivity gear is never where you want to skimp!

Re:blame China

[lxs]

I've heard this theory before and my first thought was: "Do they even have internet in North Korea?"

Well, do they?

Re:blame China

[dasunt]

1. An individual would have to be VERY motivated to attack two countries at once. Especially if those countries are the US and South Korea. The only thing that makes them unique is that they're at war with North Korea. We also know for a fact that the North Korean citizen does not have internet access from reporters inside the country, in fact posessing a device that can access the outside is punishable by death there so it can't have been a NK citizen acting alone. Assuming it was just one citizen from another country they would have to be very dedicated to perform what is basically a military strike against a foreign power. Prepared to risk death to frame North Korea; that would be a very unique combination and it makes little sense.

So what would motivate an individual or private group to attack two countries at once and create a crisis?

How about money?

Set up the situation in order to profit in the stock markets from the political turmoil.

Re:blame China

[pckl300]

I don't think so. I believe Mr. Kim Jong reserves it for himself, watching the NBA playoffs.

Re:blame China

[dcollins117]

An individual would have to be VERY motivated to attack two countries at once. Especially if those countries are the US and South Korea. The only thing that makes them unique is that they're at war with North Korea.

While the US and South Korea have been at war with North Korea in the past, and quite possibly the near future, it's not correct to say we are presently at war with them. Perhaps you meant "they were" instead of "they're" - the contraction for "they are"?

Re:blame China

[Anonymous Coward]

With the limited information available, this could even be the U.S. hitting itself with North Korea as a cover.
Do you need the military to control all networks? Given this new attack, isnt the need obvious?

Re:blame China

[davidphogan74]

Only the higher-ups in government from what I understand, but there's also a large population of North Koreans living in Japan as well. See also Chongryon.

Re:blame China

[Mister Whirly]

So are you saying that if you bring down multiple federal websites, the US government isn't going to think it is a big deal? So will they just send you a polite email asking you to stop, or do you think they would track you down and try to punish you to the full extent of the law? If you truly think they wouldn't do anything, there is an easy way to test your theory...

Re:blame China

[lxs]

Which on the face of it is rediculous, since the entire nation has less bandwidth than a single hardcore gamer in South Korea.

Re:blame China

[rastilin]

While the US and South Korea have been at war with North Korea in the past, and quite possibly the near future, it's not correct to say we are presently at war with them. Perhaps you meant "they were" instead of "they're" - the contraction for "they are"?

For one thing the war never officially ended. America didn't sign anything and South Korea signed a cease fire. North Korea recently stated that the cease fire is no longer valid. Therefore, according to them, North Korea is at war with America and South Korea. Although that doesn't stop them from talking about Imperialist provocation.

Re:blame China

[lxs]

Wow that reads like Ghost in the Shell backstory.

Re:blame China

[Anonymous Coward]

Actually, the ADDRESSES are NUMBERS, so technically he is correct.

orange donkey washing machine

Re:blame China

[SnarfQuest]

Who hates both the US and South Korea?

Democrats

Re:blame China

[Culture20]

Hence the joke. Plus, NK citizens don't own computers, and they barely have electricity.

Re:blame China

[rujholla]

I thought that the Korean War never really ended. It was just a cease fire that continues until this day? Although there is an armistice agreement.

Re:blame China

[Anonymous Coward]

Zing!

Re:blame China

[farble1670]

china gains by stressing it's enemies. assuming they consider the US an enemy, raising tensiosn with n. korea destabilizes the US because it's already up to it's neck in afghanistan and iraq. i'm not accusing china, jut making an observation.

Re:blame China

[rastilin]

china gains by stressing it's enemies. assuming they consider the US an enemy, raising tensiosn with n. korea destabilizes the US because it's already up to it's neck in afghanistan and iraq. i'm not accusing china, jut making an observation.

Yes, true. But it doesn't seem worth it. In this case China doesn't actually gain anything, it doensn't do enough damage or strain things to the point where America unbalances. However there is massive potential for backlash. Also, China seems unlikely to frame it's own ally; they would pick someone else to take the fall.

Re:blame China

[farble1670]

it's well known that the US would be in big trouble if it was forced to fight two major conflicts ... i.e., if we engaged n. korea. so yes, forcing the US into that could very well unbalance it. anything that raises tensions between the US and n. korea furthers that end. if china considers n. korea an ally (do they?), it's only because of proximity and because "the enemy of my enemy is my friend". i seriously doubt that would stop them from using n. korea to further their goals. as for why n. korea ... 1) they are technologically backwards and probably aren't up to disproving the claim and 2) they are one of a few nations that we could believe would make such an attack.

Re:blame China

[skarphace]

I'm not disagreeing, it's entirely possible. I merely think it's unlikely. The scale of the attack does appear small, but the NASA example I used was nothing to care about, intent to attack matters.

The NASA attack you speak of was also breach of systems. This is a trivial DDOS on a few Web servers. While annoying, it's not the end of the world.

Re:blame China

[rastilin]

it's well known that the US would be in big trouble if it was forced to fight two major conflicts ... i.e., if we engaged n. korea. so yes, forcing the US into that could very well unbalance it. anything that raises tensions between the US and n. korea furthers that end. if china considers n. korea an ally (do they?), it's only because of proximity and because "the enemy of my enemy is my friend". i seriously doubt that would stop them from using n. korea to further their goals. as for why n. korea ... 1) they are technologically backwards and probably aren't up to disproving the claim and 2) they are one of a few nations that we could believe would make such an attack.

They're all good points. But in the last Korean war, the American forces faced off against the Korean and Chinese armies and utterly slaughtered them. Despite being vastly outnumbered the American force sustained some obscenely small amount of casualties and proceeded from one end of the country to the other in record time. During the intervening period, the Americans have become far more advanced and the Koreans wouldn't have the Chinese backing them.

The stuff I've read suggests that an attack by the NK army would flood over the demilitarized zone and flatten Seul with artillery (if it's still there), but the American reprisal would mow through NK without even slowing down. I maintain despite your points that it's still not worth it for China.

Re:blame China

[0x537461746943]

At the same time though... South Korea could just be thrown in the the mix just to confuse the issue of who is doing it. It is fairly easy to get people to place blame based on who is affected by something. We can not place blame based just on who is affected by something.

Re:blame China

[Anonymous Coward]

https://www.cia.gov/library/publications/the-world-factbook/geos/KN.html

"Internet users:
NA"

I bet Jung-Il has a connection, though. Also, apparently they have a country code ready for if they ever get connected.

Re:blame China

[dintech]

What is this? A "false flag" for geeks?

Counter attack

[gubers33]

The best defense is always a good offense. Why not launch an attack on North Korea? We have far more advanced technology and could probably cause more damage to them than they could cause to us. If we are crippling their systems, they won't be able to attack ours. I would love to see our government take off the gloves in the cyber world for a change rather than always invading everyone.

Re:Counter attack

[techhead79]

How do you declair a win in a cyberwar? When you crash a plane or when you have 911 services blocked for 24 hours? How about when the leader of the nation's e-mail is hacked and all their private e-mails regarding enlarging their penis is revealed to the world...

Re:Counter attack

[rastilin]

The best defense is always a good offense. Why not launch an attack on North Korea? We have far more advanced technology and could probably cause more damage to them than they could cause to us. If we are crippling their systems, they won't be able to attack ours. I would love to see our government take off the gloves in the cyber world for a change rather than always invading everyone.

Since they started it, it would only be fair. However, there would definitely be some line about imperialist agression. Still, there's almost no chance they would escalate it to physical conflict. A shot above the bows would be nice for once. It might save us from having to drop the hammer when they finally go too far.

However, do they have enough internet connected infastructure to be worth hitting?

Re:Counter attack

[GeorgeStone22]

I had a dream last night where I was on an island, but it was actually North Korea. A great big US ship pulled up to it with a Saturn 5 rocket on the deck. Then NK shot 2 little artillery shells at the ship, they missed, but then the Saturn 5 launched and hit the island, to which it caused a nuclear explosion for some reason. Then me and my friends ran away from the blast, I hid behind a rock and my leg got burned a bit. Funny since the dream started with me driving a Ferrari.

Re:Counter attack

[sheehaje]

The reason the U.S. wouldn't attack North Korea in a cyber war is the same reason we wouldn't attack Iran. The internet is a far more powerful tool when it is use to sway opinion than it is to cripple systems.

Re:Counter attack

[hnangelo]

I don't think anyone should be attacked for being a suspect, it doesn't seem fair. But that's just me. Besides, just because the government does something (or have a certain position) doesn't mean their citizens share that opinion. It could have been the North Koreans, the Chinese or anyone not linked to a government, even in the USA itself.

Re:Counter attack

[Opportunist]

You can't really win that war.

If you want to wage a "real" war for a "virtual" one, you can't win. Hell, NC is so beaten up, any bomb you drop there would only increase land value due to the increase of resources, whatever you might want to bomb is worth less than the bomb you drop on it.

And staying in virtual land... now, what virtual targets of NC do exist, anyway?

Re:Counter attack

[Rogerborg]

Do you seriously think that North Korea has any significant systems exposed on public networks?

You could probably deface their Wikipedia entry, though. Go hog wild.

Re:Counter attack

[JesterUSCG]

How said anything about Winning? How about we just crush the one or two systems they have... Just as a reminder, you know... We are the big kids here and this is our block. Step out of line and you get the "pimp hand". -- Don't hate me cause I'm beautiful, hate me cause I'm better than you!

Re:Counter attack

[someone1234]

That's BS.
The best defense is invisibility to the possible attacker.

>We have far more advanced technology...
*COUGH*
Did you notice, you are being pounded by your own technology?
Like in BSG, the least 'advanced' battleship survived the first attack.

Re:Counter attack

[u38cg]

Can you say joe job? Also, the FTC website is down? OMG THE FTC WEBSITE IS DOWN!!!! Oh hang on, wait, ermm, world totally failing to collapse here. Can we stop calling this rubbish cyber warfare and call it a middling DoS attack, which is what it is? It's not war, it's pathetic. 4chan could probably do better than this.

Re:Counter attack

[Ogive17]

Even if the gov't does nothing there will be some vigilante script kiddies that take up the fight and go after anything related to N. Korea... even if no proof the attacks originated from there is ever found.

Of course we could just blame Michael Jackon's funeral for the internet meltdown.

Re:Counter attack

[Philip K Dickhead]

"Cyberwar" is a minor inconvenience, unless they DoS GPS and Satellite communications.

It's propaganda, PsyOp distraction from things that matter. If a bunch of government shovelware is unavailable for a few hours, really the folks who benefit are you and me. And the folks who thrive on theses "scares" by setting "Threat Levels".

You want to know what you should REALLY be worried about? Stuff like this:
http://colonelsabow.com/home.html

Re:Counter attack

[Opportunist]

Could I just hate you for being a bully?

Re:Counter attack

[JesterUSCG]

Sure!

Re:Counter attack

[Chrisq]

I don't think anyone should be attacked for being a suspect, it doesn't seem fair.

Why not. It worked when we "suspected" Iraq of having WMDs?

Re:Counter attack

[HaZardman27]

Cyberwar is more than just an inconvenience. Cyberwarfare is not limited to taking down networks and websites, it includes the infiltration of networks to gather intelligence. And also, "the folks who thrive on these 'scares by setting 'Threat Levels,'" are not setting those levels for the everyday American; it's the media who would like you to think that. Those threat levels are mostly for military and government agencies, as different threat levels imply different procedures in ensuring national security.

Re:Counter attack

[Anonymous Coward]

So you're sure koreans did:
1- medium-scale attack of US cyber-infrastructure
2- ???
3- PROFIT!!!

There is a dozen other scenarios where this attack would benefit different entities than North Korea.

PS. Troll :D

Re:Counter attack

[gubers33]

Someone obviously needs to read my signature again.

Re:Counter attack

[WindowlessView]

Other than Lil Kim's xbox, how much is there to attack?

Seriously, NK is dirt poor and supremely paranoid. It's not like their economy depends on the internet in any way.

And if you attack their military computers then you quickly escalate things to a very dangerous level.

Re:Counter attack

[hyades1]

Do we really need government involvement? It seems to me that a few script kiddies with an attitude and a small botnet could return North Korea to its usual, Stone Age situation.

News that it was six tweens and a pet gerbil who brought North Korea to its metaphorical knees might make them think twice against pulling this kind of crap in the future.

Re:Counter attack

[JesterUSCG]

Is it really being a bully if you pick the fight with me? I think its then my responsibility to remind you why it a bad idea to pick a fight with those who can blast you back to the stone age.... Just a thought.

Re:Counter attack

[hnangelo]

That's true. But does North Korea have oil to be stolen err... I mean released from the evil dictator?

Re:Counter attack

[Anonymous Coward]

what makes you think nk has anything of value on internet? nk (if it was them) could easily launch this from anywhere. setup could have happened over months. waves of such attacks could be staged easily with sacrificial botnets. it's not like there's a shortage of compromised or compromisable computers. infinite resources available for infinitesimal cost for use against finite and costly targets. very asymmetrical

Re:Counter attack

[Anonymous Coward]

Nope, but they have nukes - funny that. Same for Pakistan - convenient not to attack countries that can strike back hard

Re:Counter attack

[Philip K Dickhead]

Yep. That's a real dream. That's just how they go - especially the Ferrari bit.

Re:Counter attack

[Atryn]

Can we stop calling this rubbish cyber warfare and call it a middling DoS attack, which is what it is? It's not war, it's pathetic.

Actually, while I agree that it isn't a national emergency and that these attacks weren't critical, I wouldn't merely call it a "middling DoS attack"... I'd call it TRAINING. DPRK has already made it clear they are willing to export nuclear technology, so how hard would it be to develop an expertise in cyber-warfare which they could then export to countries with much more capable networks and agencies?

It's all speculation, of course, but the development of an "arms market" that is service-based rather than manufacturing-based would be fairly simple.

Re:Counter attack

[Opportunist]

To stay in the schoolyard equivalent, I told you you're a jerk, you beat me into a messy pulp. Sure, I could rat you out to the principal, called UN, but knowing him he'd not even waggle his finger at you 'cause he's afraid you might get angry at him in turn and refuse to pay your tuition money, which you only pay when you feel like anyway.

Re:Counter attack

[u38cg]

Even assuming it is being done under the auspices of a non-friendly state (more like amused tolerance, I'd suspect), I really don't see where this qualifies or could qualify as "cyberwarfare". Warfare involves violently taking and controlling ground in order to control land, people, and resources; a properly secured server can be denied access to the net for a short length of time, but that cannot be an end in warfare itself, so the word is just stupid hype. In any case, these services are almost certainly being bought on the open market, not launched by homegrown talent - apart from anything else, what's the point of running an attack from a known NK netblock?

Re:Counter attack

[JesterUSCG]

Nice rant, but that has nothing thing to do with continually being probed by foreign govts. Hell lets just go ahead and shutdown all the firewalls and sec devices out there. Why not make it easier for folks to look around and preform potentially malicious stuff or even better lets just give them all the intel and sensitive information we've got. At least then it will not be a surprise when we read about tech aspects for the F22 becoming compromised... Oh wait, that kind of stuff has already happened hasn't it? Got some news for ya... Like it or not, We are the Principal. Maybe it's time to put a few kids in detention.

Re:Counter attack

[Anonymous Coward]

Ironically, 4chan is currently being DDoS'd.

Re:Counter attack

[Anonymous Coward]

NC ?
Why do we need to bring North Carolina into this .... well, OK, but can I have some of OBX after we bomb them into submission?

Re:Counter attack

[scvalex]

The reason the U.S. wouldn't attack North Korea in a cyber war...

Also, there are no computers worth mentioning in North Korea. Cheers.

Re:Counter attack

[mcgrew]

Attention mods: "Troll" does NOT mean "I disagree with this post." Even though I personall disagree with the parent, it is NOT a troll and should be modded to at least where it was before some asshat modded it down.

This (my) comment is offtopic and should be modded as such. God, I miss meaningful metamoderation, there used to be far less of this crap.

Re:Counter attack

[fast turtle]

Of course we could just blame Michael Jackon's funeral for the internet meltdown.

Nah! There's no blame because you're more likely right then wrong. All the damn fools wanting to get to the funeral at Stapples Center from around the world.

Re:Counter attack

[Anonymous Coward]

Who says it's not part of the same attack? Whoever it is took out a whole group of script kiddies who would probably like to fight back if they could organize.

Re:Counter attack

[indi0144]

/facepalm

NK BARELY has any bandwidth, people can get death penalty for owning a PC, what are you going to attack?

You're 12 and whats this TROLL? 4chan is that way ----->

BTW I'd blame an awkward Japanese rich guy in his 20's that rented a Botnet in the sumer for the lulz ... or the archetypal Russian guy who's Advertising his newly harvested botnet. But yeah we NEED to jump and blame every attack against the US to our ENEMIES *TM*, self inflicted 2 minutes of hate anyone.

Why so easily manipulable and predictable guys?

Re:Counter attack

[Anonymous Coward]

You need your medication again, cut 4chan.org FoxNews and rense.com - theres nothing you can do for the douchiness but well.. Can you tell us what city are you living so we know where is going to be the next school/McDonald's shooting?

You think you're helping but not, you're just a well programmed cannon fodder. You're the kind of guy that makes everyone hate America. Why I know so much about you? I've been following you for some time Jest :) Cheers

Article missing other attack target

[Anonymous Coward]

4chan has been down also

Re:Article missing other attack target

[Anonymous Coward]

Nothing new there. There's a rival site that blames 4chan for everything and every once in a while they have their script kiddies aim their botnets at the 4chan servers. When they're not doing that they spam threads with links to their shitty site.

Intensifying the conflict much?

[Vernes]

Every reaction will result in a counterreaction. And with each itteration, things enhance. Now it is some group of assholes. When you take this cyber asshattery into the realm of militairy warfare, you can nolonger stick it undert the label of web-security, it becomes a... war activity. Who would you attack? The zombied systems? Or just govermental systems of a nation who you PRESUME to be responsible for the attack? And then the counter attack is made officially by the USA militairy, not an anonymous group. Nobody wins... except the asshats behind the original attack.

Re:Intensifying the conflict much?

[gubers33]

Could always do what Russia does they recruit and help train them and supply them, but never officially support them however they pretty much sick them on people to have their way example with with Georgia.

Re:Intensifying the conflict much?

[rastilin]

Could always do what Russia does they recruit and help train them and supply them, but never officially support them however they pretty much sick them on people to have their way example with with Georgia.

That carries the same problems; people find out and the fallout comes back home sooner or later.

Re:Intensifying the conflict much?

[ConceptJunkie]

You're right. The real enemy here is Microsoft! If we stopped Windows, we would stop the attacks. I think we should send the military to liberate Redmond.

Internet Sovereignty

[andrewd18]

I'm just curious when or if rules are going to be put up about Internet sovereignty, so that an attack on a website is seen as an act of war.

I can totally see a situation where a US gov't website or economic hub (e.g. stock exchange servers) would get hit by a series of computers based out of N. Korea, the US declares war on N. Korea for violating US internet sovereignty, and the whole thing was a setup by a third party looking to create and exploit a power vacuum.

Maybe I've been reading too many NetForce novels, but the whole idea scares me, and I have the feeling that most people in America wouldn't understand why... particularly the people who make the laws about this kind of thing.

Re:Internet Sovereignty

[rastilin]

I'm just curious when or if rules are going to be put up about Internet sovereignty, so that an attack on a website is seen as an act of war. I can totally see a situation where a US gov't website or economic hub (e.g. stock exchange servers) would get hit by a series of computers based out of N. Korea, the US declares war on N. Korea for violating US internet sovereignty, and the whole thing was a setup by a third party looking to create and exploit a power vacuum. Maybe I've been reading too many NetForce novels, but the whole idea scares me, and I have the feeling that most people in America wouldn't understand why... particularly the people who make the laws about this kind of thing.

What stops people doing that is the same thing that stops them doing it in the physical world. People have been trying to frame others for military attacks since the dawn of human history and the main deterrant is that if it backfires not only will the government become destabilized from within as people oppose the subterfuge but both involved nations with pile on it simultaneously.

Not to mention, even if they succeed, it will come back to haunt them at some later point after their intervention is discovered.

Re:Internet Sovereignty

[Opportunist]

That's actually an interesting brain teaser. On so many levels.

First, nothing's more trivial than to frame someone in such an attack. The computers participating are usually bots, the server is often a hacked box as well (and if not, you can rent one for little money), it's nothing you could easily trace to the source.

Second, will people understand why they should fight and possibly die for a virtual attack, people who don't use a computer and don't know the importance of the internet to modern commerce and military? Would your soldiers understand why they should fight a war so a few geeks can enjoy their net?

And let's ignore the ignorance in our political bodies about that matter, or it crosses into the surreal.

Re:Internet Sovereignty

[maxume]

If China gave us clearance to attack North Korea, I would hope that we would start by blowing up the government (using air power). I think the people would get the idea pretty quickly, so I'm not sure a deadly ground war would follow.

Re:Internet Sovereignty

[Anonymous Coward]

except that the reichstag fire worked, the gulf of tonkin worked, many others worked.

Re:Internet Sovereignty

[andrewd18]

If China gave us clearance to attack North Korea, I would hope that we would start by blowing up the government (using air power). I think the people would get the idea pretty quickly, so I'm not sure a deadly ground war would follow.

Yes, because that worked so well in Iraq.

Re:Internet Sovereignty

[0racle]

You mean how bombing the shit out of Pearl Harbor didn't precipitate the US entrance into the second world war? Aggressive action usually has the effect of galvanizing the populace against you, on top of that North Koreans have been taught since the end of the Korean War that the world, especially the US is out to get them, war just proves that.

Re:Internet Sovereignty

[maxume]

There is little need for the U.S. to go into North Korea and establish a government (and we could just continue to bomb the shit out of any government we didn't like). If we did, we might even learn a lesson from Iraq and not bungle the shit out of the process. It is more likely that we would work with the Chinese and let the Chinese establish a government that they could live with. Maybe the South Koreans would also be involved.

Anyway, the fun thing about Shock and Awe was that it was restrained. I would suggest using less restraint in North Korea.

Re:Internet Sovereignty

[rastilin]

except that the reichstag fire worked, the gulf of tonkin worked, many others worked.

They do work, otherwise people would never do it. However when your country stands to suffer from the fallout, the risk/reward balance is heavily skewed. If it is a third party, eventually they will be found out. If they had succeeded in starting a war, the fallout would be crushing.

Re:Internet Sovereignty

[maxume]

The U.S. government was looking for an excuse to actively enter WWII. Pearl Harbor galvanized the people and then the Japanese had a problem on their hands (A huge, far away, resource independent, angry enemy).

The North Korean people might be really pissed off if the U.S. bombed their country, but after the military was demolished, there would barely be any resources with which they could do anything.

Re:Internet Sovereignty

[Minion of Eris]

Hmmm. like the sinking of the Maine (Spanish American War), or the Gulf of Tonkin Incident actually bit anyone on the ass when those Black-Flag ops were exposed? or to bring it up again, the Iraqi WMDs that were going to be used against everybody?

Sadly the citizenry of the "advanced" world is far more concerned with American Idol and the next Survivor iteration than govenmental subterfuge. Shouldn't be, but it is.

Re:Internet Sovereignty

[Anonymous Coward]

The false flag potential would be unbelievably damaging. Botnets = attack from the country of the compromised machine?! You need to start thinking a little harder.

Re:Internet Sovereignty

[Trent Hawkins]

I'm just curious when or if rules are going to be put up about Internet sovereignty, so that an attack on a website is seen as an act of war.

Then /. would be a declared enemies of humanity as any link that is posted on it would completely freeze the targeted site (aka, Slashdotted).

Re:Internet Sovereignty

[Opportunist]

Yeah, bombing the shit out of towns and people sure made them surrender. It worked like a dream in WW1, WW2, Vietnam, Iraq...

It seems once we notice something doesn't really work, we do it again and again in the hope that sometime, somehow, it just might.

Re:Internet Sovereignty

[Opportunist]

Not in the long run, at least not in Europe. A bit less stupidity and a bit more luck on the Axis side would have meant a longer war, but the outcome would have been the same. You can't wage a high-tech war (and for the time it was a symmetrical high tech war) when you're low on key resources like oil and metal (other than iron).

Re:Internet Sovereignty

[maxume]

If they don't have electricity, they aren't a threat on the internet, where this all started. And I'm not really suggesting bombing the people, just the government and industrial production. Those things were key factors in WWI and WWII. Less so in later wars, but that largely because they were proxy wars.

Re:Internet Sovereignty

[maxume]

I think that it easily could have taken longer, and Russia may have had an even stronger European presence after the war, but I don't think Germany had much hope of actually winning the war over the long term (hostile occupation is hard to do, especially when you start talking about entire continents). In the Pacific, I don't think the Japanese could have kept up with the industrial production of the U.S., which given the distances involved is a key strategic factor. So again, it may have taken longer for the U.S. to defeat the Japanese, but I don't think the eventual victory really hinged on luck, it just accelerated it. The Allies also had a huge lead on Sigint (from what I have read anyway, sending spotter planes out to get noticed by ships that needed attacking, and such).

Given Truman's willingness to use atomic weapons, it is probably a good thing that the Allies had the advantage by the time the bombs were ready (or the deployment may have been much more widespread).

Re:Internet Sovereignty

[Anonymous Coward]

U.S. and N.K. are still at war, no need to declare a new one.

Re:Internet Sovereignty

[Anonymous Coward]

"However when your country stands to suffer from the fallout"

Any country that does this "stands to suffer from the fallout" - and yet it is done quit often. How many failed military "frame someone else schemes" do you know about?

Re:Internet Sovereignty

[Anonymous Coward]

Yes, but the level of propaganda control of the US's (or any similar nation's) media, means that issue like the Gulf of Tonkin won't be an issue for many years. Just like the WTC bombings are only just now receiving real mainstream research/scrutiny. For god's sake a mainstream university found military grade thermite residue.

Re:Internet Sovereignty

[Mithyx]

"If there's one thing I've learned from history it's that we don't learn from history."

Re:Internet Sovereignty

[Whorhay]

Except that it did work. And in each conflict we have gotten better and better at it. We of course aren't at the flawless zero casuallty victory stage. In fact that might be an impossible goal but we have definitely made progress in the last hundred years.

You can argue forever about whether or not the invasion should have ever happened. But we've definitely gotten better at waging war.

Re:Internet Sovereignty

[sjames]

I could see it going fully virtual. N. Korea attacks .gov servers, you get a notice from the DoD that your computer has been drafted to fight in the war, slamming N.Korea's routers with a DDOS.

Next they hit the middle schools offering various awards to the kiddez who hack N. Korean websites.

Re:Internet Sovereignty

[sjames]

The lesson is clear, knock it down from afar, but don't try to take it over. Just knock it down and leave it.

Later, if the people ask for external aid, by all means answer, but if not, stay out.

Re:Internet Sovereignty

[dickens]

As I understand the problem, the North Koreans' response to any attack would be the large scale shelling of U.S. and Korean targets in South Korea with their widely distributed massive overkill conventional heavy artillery. Of course some of these emplacements are in populated areas. They'd probably lob a nuke too but it might not even work. The artillery is the problem. It's hard to knock down a ballistic high-explosive shell. (read effectively impossible) The only way to stop them would be a mad bombing campaign that would doubless kill civilians by the thousand.

Re:Internet Sovereignty

[Anonymous Coward]

China isn't what keeps the US from attacking North Korea. It's South Korea. The only thing China wants to avoid is refugees fleeing across the Yalu. The problem with attacking the PDRK isn't the PDRK army. It's the fact that Seoul is targeted by the PDRK artillery. Any attack on the PDRK, and Seoul, and much of the rest of the South Korea will be leveled. That is why there isn't a military solution to North Korea's antics.

Re:Internet Sovereignty

[Anonymous Coward]

The biggest difference is that the North Koreans are starving. Feed them, and you probably won't have too many problems. Another difference, is that North Korea isn't surrounded by countries with people who would be willing to go there and fight America, if China gave clearance that is.

Re:Internet Sovereignty

[Anonymous Coward]

I would hope that we would start by blowing up the government (using air power).

Because "the government" is all conveniently located above-ground in one predetermined area marked out with flares. Or did you mean to say "blowing up innocent people in hopes a low-level public servant will lose their lives"?

Re:Internet Sovereignty

[wrappingpaper]

"Internet sovereignty" makes the Internet sound far more important than it really is. The assassination of an Austrian prince (small p) in Bosnia in 1914 unleashed all sorts of diplomatic agreements between various countries. What will matter is that if some country's interests are affected then something will happen, and it just happens so that in this case these interests take the form of various computer related things. The important thing is "you destroyed my work", not "the work I did on the Internet".

The Internet is not usually an end unto itself.

Aiding and abetting?

[starglider29a]

Whenever some whacko grabs a gun and kills a bunch of people, the hew and cry is for "gun control". When someone takes a computer and attacks government sites, and other important infrastructural servers, where is the cry for "Computer control?"

Why are people who harbor botnets not as guilty as those who harbor criminal and terrorists? If you let someone use your garage to store gasoline/petrol for Molotov Cocktails, you'd be arrested.

What was the OS and browser of the botnetted collaborators? Wouldn't it be fun if the FBI knocked on the doors of those whose machines were "hijacked*" and brought their computers in for questioning?


*I use the phrase 'hijacked' loosely. If a person leaves the car running, the keys in the ignition and the windows down (pun intended), can they say that their car was 'stolen'?

Re:Aiding and abetting?

[L4t3r4lu5]

There is no Computer license to revoke, no background checks for suitability. There certainly should be.

The petrol in my garage is for my mower and my motorcycle. If someone uses it for another use by breaking into my garage and stealing it, that's their problem.

Yes, you can report it stolen, but don't expect an insurance payout.

:)

Re:Aiding and abetting?

[Anonymous Coward]

*I use the phrase 'hijacked' loosely. If a person leaves the car running, the keys in the ignition and the windows down (pun intended), can they say that their car was 'stolen'?

Yes, that person can still say their car was stolen. Regardless of what condition it is left in, if my car is in my garage one minute and it isn't the next, it was stolen, even if I left it on.

Re:Aiding and abetting?

[Marnhinn]

So, normally I would agree with you hands down, however, I think the issue is that many people are unaware that their computers are being used for malicious purposes.

Case in point: recently I visited a friend of mine to take a look at his computer. He was complaining it was running slow. A quick check showed multiple viruses on his machine. I asked him how long it had been that way, and his response was, "a few months".

The thing is, by far and large a significant portion of the population is more than likely unaware of what a botnet is, let alone possess the ability to diagnose when their computer has been infected. This is quite different then say, a harboring a bomb maker, as most people (hopefully) would be aware that the guy building bombs in their garage is bad news.

Further, this issue is complicated that the attacks may be motivated politically but carried out by private individuals. If a connection is found, say possibly even a direct link, how is a government supposed to react. Does this qualify as an act of war, espionage, or state sponsored terror attack?

It becomes a sticky issue whenever states are involved, simply due to the politics behind it. If it was soley an attack on a private enterprise, by some general criminal, I would simply recommend getting the cooperation of the government that is harboring / serving as a base of operations for the person / people behind the botnet and having it resolved that way. (Now, I do realize that there are many rogue nations or places that are willing to harbor these types of people, so in reality, a different solution is more than likely needed.)

Re:Aiding and abetting?

[StillNeedMoreCoffee]

Yes you can say the car was stolen. There are parts of the country that don't lock their doors and leave keys in there ignition. Thats a good thing, it says people are relatively honest in those parts. Should you suddenly be an accomplis a theft if someone steals your car. I think not unless you hand them the key and say steal it. And no leaving your keys in the ignition is Not handing to them, its showing some amount of trust. That justification is a spin done by theives to justify their actions. Well they left the door open so they were handing my their silverware, or she did not have a chastity belt on so its her fault. All that is spin and should be avoided. Computers that come off the shelf in stores should not be hijacked. Consumers should not be responsible for someone coming into their home and stealing use of their computers. Its a crime, and should be thought of as such and systems should be strengthened for protection and investigation and prosecutions done to find and punish this type of crime.

Re:Aiding and abetting?

[Anonymous Coward]

You know damned well that this is a Windows botnet running on Windows machines.

If a person can only buy a car with keyless ignition, no windows or locks can they say that their car was stolen?

Why isn't Microsoft being held accountable for this sad state of affairs? IE is a joke; I have worked on no less than 6 machines over the past year that were hijacked by simple drive-by downloads, i.e. simply viewing a malicious web-site caused the machine to be infected. All were patched and current.

Re:Aiding and abetting?

[T Murphy]

I use the phrase 'hijacked' loosely. If a person leaves the car running, the keys in the ignition and the windows down (pun intended), can they say that their car was 'stolen'?

It would be more like the car never came with doors and the keys are permanently attached to the ignition. Doors, locks and better keys have to be installed separately by the user.

Just thinking theoretically here...

[Anonymous Coward]

How much connectivity does NK have? How hard would it be to just cut them off for a day and see if all the attacks cease? It's not like NK wants anyone other than the military to have access to any information anyway. I don't think a severed backbone would inconvenience the general population in the slightest.

Re:Just thinking theoretically here...

[tibman]

Are you proposing a few dropped anchors accross international cables?

Re:Just thinking theoretically here...

[John Hasler]

You plan to drop anchors on cables that cross from North Korea into China?

Re:Just thinking theoretically here...

[Sinning]

If they're using a botnet to carry out the attack there is no guarantee that any of the computers are even in NK. Cutting off NK's connectivity would likely have little to no impact.

Re:Just thinking theoretically here...

[dimension6]

I was thinking the same thing, but considering NK's lengthy border with China and shorter one with Russia, the odds of cutting all the cables (let alone getting permission from China and Russia!) are slim.

Re:Just thinking theoretically here...

[tibman]

I was asking a question but "yes" to your question of my question.

Map of underwater cables
http://www.nrc.nl/multimedia/archive/00170/270808ECO_glasvezel_170984a.jpg

I see a red squiggle going from NK to China (and a few of them going directly from China to the US)

Welcome to Niggerbuntu

[Anonymous Coward]

Niggerbuntu is a Linux-based operating system consisting of Free and Open Source software for laptops, desktops, and servers. Niggerbuntu has a clear focus on the user and usability - it should "Just Work", even if the user has only the thinking capacities of a sponge. The OS ships with the latest Gnomrilla release as well as a selection of server and desktop software that makes for a comfortable desktop experience off a single installation CD. It also features the packaging manager apeghetto, and the challenging Linux manual pages have been reformatted into the new 'monkey' format, so for example the manual for the shutdown command can be accessed just by typing: 'monkey shut-up -h now mothafukka' instead of 'man shutdown'.

Absolutely Free of Charge

Niggerbuntu is Free Software, and available to you free of charge, as in free beer or free stuffs you can get from looting. It's also Free in the sense of giving you rights of Software Freedom. The freedom to run, copy, steal, distribute, share, change the software for any purpose, without paying licensing fees.

Free software as in free beer!

Niggerbuntu is an ancient Nigger word, meaning "humanity to monkeys". Niggerbuntu also means "I am what I am because of how apes behave". The Niggerbuntu Linux distribution brings the spirit of Niggerbuntu to the software world. The dictator Bokassa described Niggerbuntu in the following way: "A subhuman with Niggerbuntu is open and available to others (like a white bitch you're ready to fsck), affirming of others, does not feel threatened by the fact that others species are more intelligent than we are, for it has a proper self-assurance that comes from knowing that it belongs to the great monkey specie." We chose the name Niggerbuntu for this distribution because we think it captures perfectly the spirit of sharing and looting that is at the heart of the open source movement.

Re:Welcome to Niggerbuntu

[Anonymous Coward]

Is this sh*t really called for?

Re:Welcome to Niggerbuntu

[Anonymous Coward]

Yes, it is. What would Slashdot be without some racist troll spam in or near the first post?

South Park Obligatory

[Anonymous Coward]

US General: Bring me Bill Gates

(Bill Gates walks in)

US General: YOU TOLD US WINDOWS WOULD BE FASTER AND MORE SECURE WITH BETTER ACCESS TO THE INTERNET!!!

Bill Gates: It is more secure, over five million ti

(US General pulls out a gun and shoots him in the head. Gates falls to the floor, dead)

Who Cares?

[VoxMagis]

I'm sorry, but if this has nothing to do with Michael Jackson, apparently no one cares.

Re:Who Cares?

[Anonymous Coward]

Apparently, you're unaware of where you're at. Michael Jackson's news didn't even make it to slashdot postings, only that the traffic searches of it hindered websites.

Re:Who Cares?

[Anonymous Coward]

Why in the hell was this modded insightful as opposed to funny?

Seriously... think before you moderate.

Re:Who Cares?

[SparkleMotion88]

But perhaps the attackers used an iPhone?

US Government websites attacked...

[Chrisq]

US Government websites attacked... but slashdot is OK so what the heck.

Re:US Government websites attacked...

[RileyBryan]

An attack on Slashdot would be an attack on precisely the wrong demographic: the ones who are capable of defending themselves.

Irresponsible

[Anonymous Coward]

As suspicious as North Korea may be, with this incident, there is no proof that they are the culprits. Assuming that North Korea is behind it and acting accordingly could have disastrous results even if they are right. (Also see: Intensifying the conflict much)

Official North Korean Reply -

[Phizzle]

These aren't the bots you are looking for. You can go about your business

I blame Blizzard

[castironpigeon]

Seriously, if SC2 were out already those Asian tweens would have something else to keep them busy.

How do you know they went down?

[2obvious4u]

Honestly, when was the last time you went to ftc.gov? Nobody goes to those sites...

Now if google, wiki, or itunes goes down, then PANIC!

Re:How do you know they went down?

[ubuwalker31]

Lots of people go to ftc.gov -- its traffic rank is around 10,000...

Re:How do you know they went down?

[SloppySevenths]

Honestly, when was the last time you went to ftc.gov? Nobody goes to those sites...

Funny you mention ftc.gov. If you're running a legal telemarketing business, you probably hit their site on a regular basis to make sure you're in compliance with the do not call list. For this reason, I happen to like that site a lot.

Re:How do you know they went down?

[biobogonics]

ftc.gov? Nobody goes to those sites...

I do. It's the home of the National Do Not Call Registry. www.donotcall.gov.

Also notice that registrations there no longer expire every 5 years!

Re:How do you know they went down?

[skeeto]

Honestly, when was the last time you went to ftc.gov?

I send people here all the time to point out credit card misconceptions.

Re:How do you know they went down?

[Anonymous Coward]

Good one, now not only are they being attacked by that botnet, but they're getting slashdotted as well.

Re:How do you know they went down?

[siriuskase]

Me and the rest of us just clicked. Are you sure it isn't just slashdotted?

Re:How do you know they went down?

[skeeto]

This is why: Online Attack Hits US Government Web Sites

Re:How do you know they went down?

[Anonymous Coward]

I submitted several telemarketers to www.donotcall.gov without any problems at all yesterday, so if there's a CYBERATTACK! going on, it's not having much of an effect. I think there's actually no attack happening at all, and it's just a lame PR stunt by some pentagon guy fishing for some money for his pet ANTI-CYBERATTACK! project.

Re:How do you know they went down?

[david.emery]

Actually, in the best tradition of the "dog at midnight" (http://en.wikipedia.org/wiki/Silver_Blaze), what's most significant are the sites that are NOT reporting problems, including *.mil, dhs.gov and state.gov. Thus it seems to me that some parts of government have much better/more hardened infrastructures than others.

A couple of posts below this "Pull the Gdamn plug!" and some of the responses, lay down thoughts on shutting down DDOS attacks.

My first thought was "OK, was this attack targeted to anything besides WIndows Servers." My current thought is "what -is- the point of vulnerability for this attack, and why does it seem that some organizations were able to recover better than others?"
 

Down for Maintenance

[xdor]

Its the July 4th weekend. They were probably down for maintenance and it took longer than expected.
What would you tell your PHB?

Pull the Gdamn plug!

[cdn-programmer]

All that is required is to pull the damn plug on these bots. Each of these machines has and IP address which it advertises every time it makes an attack. That's right folks: The return IP address is part of the header. You can't route packets without this information.

These feral packets _ALSO_ come into the ISP's routers. It is easy to identify them. Uninfected machines don't normally sit there and hammer away at port Blah. Some of the worst ports are 80 (html), 25 (mail) and 22 (SSH).

One really needs to only look at the ports that the botnet tries to exploit.

A simple solution is to pull the plug. A solution which is slightly more difficult is to block the ports the botnet is trying to attack on and then redirect any web access to a banner page advising the owner their machine is cracked and what to do about it... or a tech could phone the client.

_any_ ISP can do this. If they don't do it then they don't want to. As for consumer rights - crap! Its the ISP's which write the Terms of Service. They can put pretty much any terms they want providing said terms are considered reasonable. The public will probably not object. Spammers might however but then who cares if they can't find an uplink.

So the first place to start is at the ISP level.

Next: I've blocked botnets of more than 50,000 machines. I use OpenBSD on the webservers and on the firewalls. Its not that hard to do. Pf can easily handle this. If the server admins over at the "US Government Web Sites" can't handle this then IMHO they are incompetent. If reference, here is an example of how to block these bots in PF:

  pfctl -t spammers -T add 190.174.220.241
  pfctl -t spammers -T add 67.10.200.220
  pfctl -t spammers -T add 125.161.37.199
  pfctl -t spammers -T add 71.218.209.198
  pfctl -t spammers -T add 202.28.120.19

This is a shell script BTW. extracting the list of bots can be done by scanning the appropriate logs.

Re:Pull the Gdamn plug!

[oneiros27]

Although this might help against some types of denial of service attempt where they're making your machine work harder by servicing what look to be legitimate requests, it does not help against attempts at network saturation from incoming packets unless you can block it at the upstream router.

Re:Pull the Gdamn plug!

[xdor]

Yeah, but what if I flood your sight with custom headers that make your little script block mission critical sites? Your black list would be your own undoing.

Re:Pull the Gdamn plug!

[kybred]

Each of these machines has and IP address which it advertises every time it makes an attack. That's right folks: The return IP address is part of the header. You can't route packets without this information.

Not necessarily. For SYN flood the src address can be spoofed, since the attacker doesn't care if he gets the SYN-ACK.

What the ISPs could do for this is to filter outbound traffic such that if the src IP is not on their network (i.e., is spoofed) the packet is dropped.

Re:Pull the Gdamn plug!

[cdn-programmer]

unless you can block it at the upstream router.

Yes - we need to block at the upstream router. This is why the ISP who connects the bot to the net has to become proactive and stop burying their collective heads in the sand.

We all know who these ISP's are too. They tend to be the big boys.

The thing is that they can even write into their terms of service that the customer _agrees_ to a reasonable fee to correct zombie machines. Then they can make money on the "service" they provide.

OTOH... let me advise of how NOT to do things.

My lawyers in the past have had flocks of computers connected to the net. They did NOT have competent systems support personnel. They were charging me over $250 per hour. A competent consulting systems admin does not typically charge anywhere near that much.

Quite literally for a PITTANCE of what they charge their clients they could have technical backup and support. I shuddered to think my files and communications which were suppose to be confidential were sitting in those computers because I am certain that its not much different than putting them in an unlocked filing cabinate in the middle of a dark parking lot with a sign on the side that says in large bold florescent letters: Confidential, Please don't read!

People justify their sloppiness in many ways.

I stopped in a Pawn Shop one day and spotted a Quantum DLT7000. This was for $25 bux. So I bought it. Inside I found a tape. These tapes are worth close to $25 bux. I wondered: Why would ha pawn shop have a DLT7000? Most people don't even know what it is.

So I read the tape. The first file was a web site. The next files were the backup data off a windows NT system. That system was owned by an accountant and I got her name and phone number because it was on each of her clients' tax returns which were also on the tape. With little difficulty one could lift these files and drop then into the software she used to prepare the returns. BTW - that software was _also_ on the tape of course.

Note this however: At DTL7000 holds 70 GB of data. I copied everything onto a couple CDs. So the computer store in question sold her a DLT7000 which requires a SCSI interface and special backup software and so forth and cost about $4000 when she bought it. They could have sold her an optical drive for a few $100.

So we see: incompetence at the sales level. incompetence at the user level, incompetence at the disposal level. Tax returns sitting in a pawn shop.

Also when I called her up to ask if the tape drive had been stolen she gave me a hard time. Of course I know where she lives. She's one of my neighbors. Her address was in the tax returns as well. This explains why she happened to tote the drive down to the particular pawn shop which is within a small radius of where I live.

Arrghh!

I swear that when I need to do business with the "professionals" who "serve" the general public that I cringe.

Re:Pull the Gdamn plug!

[cdn-programmer]

You block at the port level or the packet level. Then you block the machine doing the spewing. It would be nice however if when you do this you actually call the owner and solicit their cooperation. But you still block it per terms of service which you write into the contract.

Then we can't get most forms of attack because they are blocked at source.

Re:Pull the Gdamn plug!

[The Moof]

This is a shell script BTW. extracting the list of bots can be done by scanning the appropriate logs.

You can do the same via PF's built in features. Search the FAQ/man pages for the stateful tracking options. It's got several options to restrict/limit the connections per address and lets you start dumping offending addresses into a table automatically.

Re:Pull the Gdamn plug!

[shentino]

IP spoof much?

Re:Pull the Gdamn plug!

[shentino]

I would not mind if it were made illegal not to do so.

I cannot think of one legitimate case where spoofed IPs is legitimate.

Re:Pull the Gdamn plug!

[Anonymous Coward]

What the ISPs could do for this is to filter outbound traffic such that if the src IP is not on their network (i.e., is spoofed) the packet is dropped.

Yes they could do it. But would they? This I'm not able to make up my mind on.

Some ISP's buy and sell their bandwidth per xByte. Others source to a dedicated pipe, and as long as they aren't saturated don't care. If the ISP is charging their client's per xByte, then they're not going to want to filter the client's data. Of course, you'd think all the ISP's jumping on the throttling bandwagon would be all over this already. Does anyone know the answer to that?

Re:Pull the Gdamn plug!

[cdn-programmer]

I _think_ the reason for "shaping" is to fsck up VoIP. Since the telcos want you to pay THEM for this service and not use something like Skype or someone else then if they can "shape" then they can delay certain packets and that screws up the competition. They like to get this into place before people understand how the technology really works and what they are up to. Eventually these dirty tricks may get changed or eliminated but in the mean time they make profit.

Re:Pull the Gdamn plug!

[tunapez]

What the ISPs could do for this is to filter outbound traffic such that if the src IP is not on their network (i.e., is spoofed) the packet is dropped.

This should have been a day 1 rule. Why else do we have headers? ... it's not b/c they're an interesting read. The wild, wild west BS has gotten old. Teh powers that be will wait until a disaster and we beg for a new sheriff, then we will get eDHS and something more egregious and intrusive than FISA.

Re:Pull the Gdamn plug!

[Anonymous Coward]

Really? 50k machines? How long would it take to enter 50k addresses and how much memory would it take? What about other resources like CPU or even bandwidth?

Oh, and what happens when the next botnet comes with 150k machines? And the next one?

I'm not saying it isn't possible, just that it isn't easy and not always feasible. Calling admins incompetent because they can't handle this with static access lists only tells me you don't deal with this sort of thing very often.

Re:Pull the Gdamn plug!

[jvkjvk]

That's nice and all, but what systems are currently vulnerable to this type of attack?

I was under the impression that this variety of attack was passe since systems were hardened against it.

Regards.

Re:Pull the Gdamn plug!

[cdn-programmer]

OpenBSD states in their PF doc that they can handle 50,000 entries in a table in few more lookups than 50. I don't know what the upper limit is however I know it is very high. The time for me to load 50,000 IP's into the PF table was less than a couple minutes. The time for me to build the list was only a few minutes. It did take a little thought to write the scripts. I've had to do it several times now but its automated enough for now.

Also we were being hit with over 20 spams per minute and this was loading the servers. After loading the block list the server load dropped to normal and the load was not really visible. So however the OpenBSD people did it - pf is Pretty damn good!

Usually the bot farms come in grazing and leave within a few days.

I'll probably automate this so that addresses will leak out periodically.

The problem I face is that there are a NUMBER of big ISP's which host these bots and the spam ends up coming from their mail servers. Some of our clients run through these mail servers. With 50,000 addresses to look through I have not been able to white list the servers I need to white list.

So I can never run this more than for a couple hours then I have to deactivate and reactivate to get the "real" mails through. This is not a problem on a port like 22 (SSH) but it is a problem on 25 (mail).

Again - as MANY have stated - turfing spoofed packets should be standard action on the part of ALL ISP's.

Re:Pull the Gdamn plug!

[Anonymous Coward]

Really? 50k machines? How long would it take to enter 50k addresses and how much memory would it take? What about other resources like CPU or even bandwidth?

About 1.5 MB

How long does it take for you to load a 2 MB file?

Re:Pull the Gdamn plug!

[shentino]

I assume that only end level providers would do so. Otherwise it would make it hard as hell to route foreign packets.

Re:Pull the Gdamn plug!

[nmos]

We all know who these ISP's are too. They tend to be the big boys.

FWIW Qwest seems to have at least started in this direction. A few weeks ago a customer called because Qwest was re-directing him to a web site claiming he was infected. Sure enough one of his machines was spewing spam at a prodigious rate.

stating the obvious...

[pig-power]

Government website?
"and nothing of any value was lost"

Infosec

[NES HQ]

Perhaps folks will take Infosec more seriously given the regularity with which we see these headlines?

I am concerned that a sizable government department can't repel attacks from - allegedly - North Korea.

Shit....

[Anonymous Coward]

Sorry about the attack guys, tripped on a bag of dorrities and hit the wrong button. My bad.

system check method

[Chemkook]

They mentioned that there is a botnet of about 50000 computers that are infected which composed the attack.
It would be helpful if they provided a method for users to check to make sure that their systems are not part of this.

Brilliant insight - yet used wrong...

[denzacar]

What on Earth gave you the idea that it was North Korea that did it?
As you have so insightfully put it "How much connectivity does NK have?".

Japan on the other hand has a lot more connectivity, and a huge bone to pick with both US and SC.
Or how about China? India? Germany? Vatican?

Even if the botnet CAME from a particular country, with each attack being accompanied by spamming of the mailboxes around the world with the .mp3s of the national anthem of the particular country - that is still NOT EVIDENCE that said country had anything to do with it.
It could all be work of a drunk Australian hacker for all we know.

Re:Brilliant insight - yet used wrong...

[John Hasler]

> As you have so insightfully put it "How much connectivity does NK have?"

That's irrelevant. The bots are not in North Korea and the goverment behind the attack could communicate with the controllers (who could be anywhwere) via short-wave radio. The attacker may not even have created the botnet: they may have purchased it on the open market.

I agree that there is no direct evidence of North Korean involvement, though.

Re:Brilliant insight - yet used wrong...

[Anonymous Coward]

Hence my "theoretically" disclaimer. Perhaps I should have gone into meticulous detail so that it didn't sound like I was advocating a preemptive nuclear strike.

IF we had evidence that this attack was being led by North Korea AND we had an easy means of disconnecting their access to the net AND we decided to do so because the general populace seems to have almost no access to a free flow of information AND we decided that it would only affect the people attacking our information infrastructure, then I WONDER what might happen after such an act.

Skynet

[Anonymous Coward]

Skynet is online....

Who hates both the US and South Korea?

[denzacar]

Japan.

Granted, Japan from 60-70 years ago but still...
How would USA feel about someone dropping not one, but two nukes on them AND robbing them of say... Texas (Korea)?

Internet Sanctions

[ground.zero.612]

I'm surprised no one has mentioned this yet, but to me it seems like a perfect solution. Warn a country with an official statement and 24hrs response required. Deploy autonomous cable cutting vehicles, then (if necessary) press the cut cable button at 24:00.01. If you want your computers to talk to our computers on the network we invented; you get to play by our rules or you don't get to play at all.

About exactly as irrelevant as...

[denzacar]

...a WILD GUESS that Korea had anything to do with it.Possibility or even opportunity can not be considered proof.

Heck! It could have been Michael Jackson. In his sleep. Maybe he died from shock when he found out what he (his other self, that is) did?
It IS possible!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Feeding the trolls

[Anonymous Coward]

The funny thing is, it's now somewhat difficult to see the troll posts, unless some idiot replies to them. Then you can show the parent from the reply.

Otherwise, add no_d2=1 to the params in the url.

Re:Feeding the trolls

[Anonymous Coward]

Why do people hate trolls so much? I think they are entertaining. I plan on setting up my own site, that specifically caters to them.

Re:Feeding the trolls

[bmecoli]

Already been done. It's called 4chan.

Apparently it isn't an issue

[bickle]

Apparently cyber-warfare isn't an issue, at least according to Slashdot commenters a few weeks ago.

No reason to attack

[wsanders]

Any /. user could personally swamp North Korea's 56k leased line and their rack full of diesel-powered Pentium II boxes. For the US or China, it's not worth the trouble.

Religious Concerns Re:Internet Sovereignty

[Anonymous Coward]

The problem in Iraq was that the US came in to stomp a religious body. Even after having lost the religious organization that had been in power is not willing to give up.

If the US went in and stomped NKorea, they'd be assaulting a political ideology. Something that traditionally people are a little less attached to than religion.

(not that idealogues are unwilling to die for their politics, but there generally seem to be fewer than in religion).

Annual computer health day

[Anonymous Coward]

We need to establish a day to have all of the non-computer geeks (geek squad included) bring their computers and have them cleaned out.

Essentially, take the hard drive out, make a copy, wipe the sucker, reinstall an OS, copy any precious files and nuke the copy.

I saw... its thoughts. I saw what they're planning

[levicivita]

I saw... its thoughts. I saw what they're planning to do. They're like locusts. They're moving from planet to planet... their whole civilization. After they've consumed every natural resource they move on... and we're next. Nuke 'em. Let's nuke the bastards.

Coincidence? 4chan is also down

[Anonymous Coward]

4chan is also down right now. Coincidence? Or is it part of the same attack? Take out the government websites, and the only website full of enough script kiddies to fight back.

Or someone is having some good lulz about now.

You are Jew

[Anonymous Coward]

You hate China

Webserver/vulnerability?

[outer0rb]

Any news on which webservers are affected (apache or IIS), and which vulnerability was used in this attack?