Slashdot Mirror
Was This the First Denial of Service Attack?
An anonymous reader writes "Way back in 1974, Dave Dennis, then aged 13, decided to try out the -ext- TUTOR command on the PLATO system at the University of Illinois, and see if he could cause all the terminals of other users to go offline. It worked. And he never got caught. Of course, the powers that be eventually caught on and fixed the -ext- command so terminals by default didn't automatically receive -ext-'s sent from other locations."
Yes
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
The first recorded denial of service was performed by a 13 year old, who was basically using a "script kiddie" technique? Well, color me surprised.
And last post...
-ext- :D
So, let me get this right. You could more or less get a list of addresses, and they would accept commands without question if you just typed in the commands and the right address? Sounds like the worst security system ever.
Taxation is legalized theft, no more, no less.
What does DoS stand for? Denial of Service. Getting everybody kicked off the system certainly sounds like denying them access to that computer service to me. Just because a DoS is usually performed by a network flood of some kind doesn't mean that's the only way to do it. Heck an idiot tripping over the power cord to the server is technically a DoS if people loose access.
Back in the 19th Century (in the US anyway), mail *recipients* paid postage to get their mail from the local general store. Political figures and others who might have a negative following would receive scores of blank letters and have to pay for them. The objective was to either crowd out the legitimate communications or bankrupt the recipient. Traditionally, one could place an ad in the local paper explaining that he or she would no longer receive letters at the store, which would free them from their obligation.
I'd rather have someone respond than be modded up.
The earliest one I know of was by the smartest man I ever knew (and the strangest). He was my mentor. In the IBM 360 days this guy used to write code .. COMPLEX code in binary on the roller bars on the front of the console because he was too lazy to logon. He made IBM's code more efficient by eliminating all modularization. It was more efficient to just have one big super efficient kernel, so he redesigned their system, and got something like 140% efficiency out of the hardware (40% greater than theoretical possibility) by IBM's own benchmarks, and found a security hole in their code in the process .. as he put it "bit enough to drive an 18 wheeler through", which he reported to them. They told him it was his hacking, he broke something ... NOT OUR CODE!!! IBM CODE CAN'T BE BROKEN!!! So he went to their 'demo center' and fed in a deck of punch cards.
On the IBM Selectric console in the IBM demo center, it printed.
"May I please have a cookie?"
The operator ignored it.
8 hours later during shift turnover It printed
"I never got my cookie"
The two operators looked at it, shrugged, and ignored it. The dayshift operator went home.
4 hours later the console printed.
"You're not a very nice operator either, I never did get my cookie"
The operator thought the guys upstairs were fooling around and ignored it.
2 hours later.
"WHERE IS MY COOKIE!"
hummm...
1 hour later.
"Dammit give me a cookie!"
30 minutes.
"I WANT A COOKIE!"
15 minutes ... 7.5 minutes ... eventually we get to 32 cookies this second .. 64 cookies this second ... 128 cookies this second.
An IBM Selectric typewriter which is the main console for a 360/65 cannot print even the word cookie in a second, much less a whole sentence, and certainly not 128 of them! There was ONE way to crash a 360/65 .. Fill up the console buffer. The system considered console messages to be important, and if the system couldn't print all of them, it halted.
Reboot ... excuse me... Mainframe terminology here... "IPL" the system. First console message:
"You know, I never DIID get my cookie!" .. and the process starts over.
Finally IBM called my mentor...
um... did you submit a job to the demo center?
Yes, but don't worry, it was just a simple 'unprivileged' process, and as you said, your security is flawless, so I am sure there is no danger. :-)
Sir, I think we are prepared to acknowledge that there MAY BE a security hole in our system somewhere. It seems that your job never finished and yet it does not seem to exist in the system anywhere. Our experts tell us we have to re-install the operating system to fix it. Do you have any alternative suggestions?
Just one... Go get the best operator you have and put him on the console and call me back.
Yes sir... .. an hour later
Sir, this is king super operator, they just called me back in to work to assist you in solving our issue.
OK ... now listen carefully. I am only going to say this once. Type carefully, and don't screw this up .. are you ready?
Yes sir.
Good type this ... "c" "o" "o" "k" "i" "e" ... now press "Enter"
Console prints . "Thank you that was good", and the job ends.
After that IBM never ever questioned it if my mentor reported a problem with IBM software ever again.
Denial of Service is just about as old as marriage.
The story of the Cookie program, in the words of its author.
This type of denial of service was already quite common long before that.
No
I will back that up with my own story of a weaker DoS. The year was one of 1970-72, I do not know which. UC Berkeley had two CDC 6400s, A was normal, B was used for an experimental time sharing system and thus had an optional-at-extra-cost instruction, Exchange Jump, which swapped context. I had been toying with a Fortran program and gotten tired of it, so decided to finish it off in a burst of glory. It began execution in some obscure subroutine instead of MAIN, never called MAIN, and as it ground away at its nominal task, it gradually modified an innocent instruction into an Exchange Jump. But sadly, once it finally had modified it to the Exchange Jump opcode, there was no context, just a pointer to 0, and it farked the entire machine.
Now I wasn't truly anti-social. I had in fact written on the card deck that it was only to be run on machine A, not B. Unbeknownst to me, that Exchange Jump instruction was also used by diagnostic programs, and the tech was too lazy to disable it after each visit, just left it enabled at all times, so my Fortran program crashed the machine.
It wasn't much of a DoS, I will admit. The OS, CALIDOSCOPE (Cal Improved Design On SCOPE (Supervisory Control Of Program Execution)), could only handle 6 batch jobs at once at most, so that's the worst it could do. But I did get called in to the admin's office, who sighed and gave me that "What are we going to do with you?" look. He knew I wasn't malicious, but he had to warn me to not do it again.
Infuriate left and right