Security Basics mailing list archives
RE: Attacking a machine on network.
From: "Murda Mcloud" <murdamcloud () bigpond com>
Date: Thu, 31 May 2007 10:07:00 +1000
It's one of those problems that some of the smartest(smarter than me anyway!) haven't managed to come up with a surefire way of preventing. Why? Because you want people to go to your site-but you want to differentiate between good traffic and bad traffic. How do you do that? What kind of 'filters' do you setup? How far out from your perimeter can you tell it is bad traffic? How much redundancy can you build into your sites? Like you said-it starts to get costly. Look at what happened to Blue Frog when they tried to 'attack' the attackers/spammers. Google it-it is a very fascinating case. And with it being 'distributed' it's even worse now-why, because they can 'move' the zombies around so well-so much control and they can change where the attack is originating from. It's like playing Command and Conquer-you know, when you've got three or four mini armies built up and you can send them in waves from different directions. (My analogies get worse as I get older). -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of John Pluffum Sent: Wednesday, May 30, 2007 7:44 PM To: security-basics () securityfocus com Subject: Re: Attacking a machine on network. Paul Sebastian Ziegler wrote:
If someone doesn't run a service, this obviously leads me to the assumption that that particular machine could never be cracked ? Is this a right assumption ?Not really. Some attacks actually target the drivers of the network-interfaces. For example the WLAN drivers on MacOS X and some versions of Madwifi had issues. Since those drivers listen to the traffic anyway, it might be possible to trigger some sort of overflow without a single listening port. Also information leakage may occur no matter if the box is running any ports itself. Furthermore there are other techniques to communicate with boxes than just ports. Look up "portknocking" for that.
But one question that remains is that I have read lot of news these days (for e.g., Russia vs. Estonia) where they say they say that Russians have DDOS'ed Estonia so badly that it has left the government, corporate and academic systems totally crippled. If DDOS is so powerful form of attack, why hasn't there been some kind of filtering done that can essentially prevent all these kinds of nastiness ? Or is this something that is insanely costly/impossible ? Or of course, plain bureaucracy ? Thanks again for your insights.
Current thread:
- Attacking a machine on network. John Pluffum (May 29)
- Re: Attacking a machine on network. Jason Ross (May 29)
- Re: Attacking a machine on network. Paul Sebastian Ziegler (May 30)
- Re: Attacking a machine on network. John Pluffum (May 30)
- RE: Attacking a machine on network. Mark Brunner (May 30)
- Re: Attacking a machine on network. Ryan Chow (May 30)
- RE: Attacking a machine on network. Murda Mcloud (May 30)
- Re: Attacking a machine on network. John Pluffum (May 30)
- Re: Attacking a machine on network. Alexander Klimov (May 30)
- <Possible follow-ups>
- Re: Re: Attacking a machine on network. sandeep . sandhu . in (May 30)
- Re: Re: Attacking a machine on network. savagemp5 (May 31)