|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Yahoo offline because of attack (was: Yahoo network outage)
On Wed, Feb 09, 2000 at 09:25:43AM -0800, Roeland M.J. Meyer wrote: > A simple case of denial here, T1's are not cheap. It isn't the CPU > horsepower that is significant here. It is the access to the required > bandwidth that makes this so worrisome. > > In order to operate stealth-mode in a system, one must be on a box that has > sufficient power such that the operation of your code consumes less than 3% > of the box's available capacity. In addition, your network should consume > less than 5% of the site's pipe, even during an attack. Remember, it appears > that these hosts have been compromised for some time. Further, Sean > indicates that the entire attack system was tested at least once and no one > noticed. These guys have to be frugal with the assets if they want to > contnue using them undetected. This indicates planning and discipline. These > are NOT ignorant cracker-kiddies. > > This indicates one or two compromised hosts per site with 50-ish sites > penetrated, at minimum (probably, 100's). I would wager that even the 50-ish > sites actually used in the attacks had no idea that they were participating. > This indicates low resource usage on part of the attacking code, since the > first indicator SA's usually look for is abnormally high usage of resources. > > Let's quit assuming that all other operators are incompetent and start > assuming the worst, that crackers got this one by "competent" SAs, shall we? > If this is the case, then any of us are vulnerable. I find it difficult to > believe that there are 50 sites, with T3 connectivity or better, that are > all staffed exclusively by incompetent operators, let alone 100's or 1000's. You are quite confused. T1's are cheap, OC12s are not cheap. CPU is the limiting factor in many of these attacks, but not because of the ability to saturate a T1 with HTTP GETs or any other such nonsense. These attacks often taken down the attacking-victim as much as the attacked-victim, infact often times they run their attacks so strongly that they are unable to access the systems to stop them, which is why all the distributed attack programs have a built in length of time for the attack to run, any signal to "stop" would often never be received. The belief that previously seen problem were some kind of "test" is totally ubsubstantiated guesswork, of little quality. Your numbers are totally random with no basis in reality. You are correct that most sites do not realize they are participating even after a huge attack that cripples BOTH networks. It has not so much to do with "competency" as attention to detail and careful network monitoring, though you could easily make the arguement that operators who do not do such are incompetent. If you find this difficult to imagine you need a better imagination. -- Richard A. Steenbergen <[email protected]> http://users.quadrunner.com/humble PGP Key ID: 0x60AB0AD1 (E5 35 10 1D DE 7D 8C A7 09 1C 80 8B AF B9 77 BB) MFN / AboveNet Communications Inc - ISX Network Engineer, Vienna VA
|