Re: Recent DDoS (was Ping flood? Whats the point?)

[k.baker () ITS CANTERBURY AC NZ (Kerry Baker)]

I think this sort of thing lends some weight to my arguement for network
administrators to use ACLs to prevent spoofed packets leaving their
networks.  I hope the media attention will prompt some action.  Due to the
use of CIDR it shouldn't be too hard to do!

Another thought:  If the Feds trace these attacks back to their true source
and the source addresses were spoofed can the ISP be sued by the victim for
allowing spoofed packets originate from their network?  Whats the legal term
for this?  Lack of due diligence?

Regards,
Kerry.

-------------------------------------------------------------------
Kerry Baker                      Phone: +64 3 364 2336
NETWORK CONSULTANT                 Fax: +64 3 364 2332
Information Technology Services   http://www.canterbury.ac.nz
University of Canterbury        mailto:k.baker () its canterbury ac nz
Christchurch, New Zealand

> -----Original Message-----
> From: Incidents Mailing List [mailto:INCIDENTS () SECURITYFOCUS COM]On
> Behalf Of Bino Gopal
> Sent: Wednesday, 9 February 2000 19:31
> To: INCIDENTS () SECURITYFOCUS COM
> Subject: Recent DDoS
>
>
> Just wondering why there hasn't been much mention of the recent DDoS'
> against a lot of the major sites on the web...  Given the nature of the
> list, I would have expected _some_ mention, but I don't think I've seen a
> peep, which is very surprising!
>
> If you don't know what I'm talking about, then read:
>
>         http://news.cnet/com/news/0-1005-200-1545456.html
>
> and
>
>         http://cnnfn.com/2000/02/08/technology/yahoo/
>
>
> Seems that this could get very serious before it gets much better...
>
>                                                       BINO