RE: Denial of service

[Ted Doty <ted () iss net>]

At 03:44 PM 8/17/98 -0700, Tupshin Harper wrote:
> There are generally three reasons for an attack:
> 1) Attacker wants to obtain information.
> 2) Attacker wants to obtain use of resources
> 3) Attacker wants to inflict damage on the attacked
> 4) Attacker wants to climb Mt. Everest(because it's there).
>
> Number three is frequently overlooked by those that should know better.
> Many otherwise secure networks/systems are susceptible to denial of service
> attacks, typically motivated by number three.  Examples of denial of service
> attacks range from crashing a server to using a thermo-nuclear device on
> your ISP.

I personally don't think that you can protect yourself from Denial Of
Service attacks in an Internet environment, since there are so many
autonomous domains of control.  While the ISPs are trying to address this,
progress is slow.  Trying to trace an attacker back through several
providers is a very people-intensive operation, meaning it's slow and
expensive.

Anyone who wants to can crash your Internet router.  If you've patched it
sufficiently that this is not possible, they can crash your ISP (who almost
certainly is *not* patched sufficiently).  If this doesn't work, they can
smurf you from some vulnerable third party. Using some poor slob who's
vulnerable to smurf and has a T3 Internet feed is always good for a laugh
with the d00dz.

This doesn't even begin to address issues like resource poisoning: classic
examples of this are email spam and folks tossing flame bait on newsgroups.
 These "attacks" are more social, but result in fewer people using the
poisoned resources.

If your network positively has to be up for mission critical applications,
don't connect it to the Internet.

- Ted

-----------------------------------------------------------------------
Ted Doty, Internet Security Systems          | Phone: +1 678 443-6000
6600 Peachtree Dunwoody Road, 300 Embassy Row | Fax:   +1 678 443-6479
Atlanta, GA 30328  USA                       | Web: http://www.iss.net
-----------------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE