This page is a very long, comprehensive, often breathtaking account of a Denial of Service attack. It's written by a very smart admin who would not accept that a 13-year-old could take down his entire network at will. Call it a must-read:

http://grc.com/dos/grcdos.htm

Off slashdot?
yes tis a good one. As on of the comments on the slashdot article said, if only there was some kinda of financial incentive for ISPs to lok its possible comprimised systems, particualr with cable internet, its easy for someone ot put together a sizeable amout of directable bandwidth.

I didn't remember them covering this one! But it's a natural for Slashdot.

http://slashdot.org/article.pl?sid=0...02&mode=thread

Posted by michael on Thursday May 31, @11:31PM

So yea =)
I assumed u got it from there =)

Huh. Actually, I did just skim past it there, but picked it up on another weblog which probably got it from there.

Ah k , cool
this is like a real-time conversation lol...

Just out of curiosity, considering the bandwidth at your disposal (god I wish i had T1, not 56k) what kind of security stuff do you use? Do you run Windoze, Linux, XBSD?

I have a few Linux boxes and a few Windows boxes. The Linux boxes are all patched with the latest stuff and only run the services that are needed. The Windows boxes are all running ZoneAlarm except one.

I was broken into once. Somebody rooted a server on the ISP's network where I live and installed a packet sniffer that basically watched the entire network for passwords. At that point they were able to root just about everyone.

Since then the ISP has tightened considerably. One time last year an employee of mine ran a portsniffer on our boxes just to see what we could find. But he screwed up and the sniffer sniffed addresses in other people's subnets. The next day I got a call from the ISP saying cut it out!

But we could be tracked, because we weren't spoofing our addresses. The scariest point in the article is that, if WinXP goes out in its current state, all these kiddies will be able to spoof to their hearts content, hiding their own addresses and becoming untraceable.

Oh and by the way
 

None of the systems I have is anywhere near state of the art. That's one great thing about Linux; the P3-500 is more than enough to satisfy all the hits the Cellar can generate, and in fact I even have a P-200 that still puts in service duty. Even 486s would more than handle the load of most websites!

OH yea i know.....scary stuff...
A guy i know hacked an e-commenrce company that will remain nameless while sitting on their front lawn lol. COuldn't find him coz he fuced up the packets so bad, this stuff scares me...u run tripwire under linux?
I use Zonealarm under windoze and tripwire/latest patches under Linux. I've gotta learn FreeBSD one of these days......In between, social, school, homeowrk, gaimg, cellar posting....

*laughz yes true, i was suprised to find slashdot runs off 8 machines, sure they are beefy but....

Actually I do run tripwire - and I started the day after I found that break-in (which happened about two years ago). It's a pain in the butt, but it makes me feel much better.

One other thing I do is to run top and other utilities that the simpler crackers can't reliably modify. The cracker that got me had a "root kit" that modified ps (which shows active processes), ls (file directories), and a few others. he left his root kit around for me to find and dissect. It was quite an education.

Hmm interesting...while i havne't had any personal experience of cracking under linux i spose thats the kind of places you'd put it, basic apps, particulary PS now i think of it.

Well, the reason they modify ps is so that the daemons they start won't be found through the usual methods. They also modify who and w for similar reasons. Most of the crackers I've found are looking to run irc bots of some sort. They want to start the daemon and leave and not be noticed for a while.

Insecure wireless?

Nope, he was just arrogant/bored.
BUt yea, i've heard of people doing that *many* times. They had one at my school for a short while but it took around 5 days for kids to start picking holes in the pissweak security so the scrapped the idea.

I just wanted to throw in my $0.02 security tale...

The local ISP in my area got its shell server's ssh client compromised, and didn't notice for some time. Hundreds of passwords were recorded including several of my own.

Another server that I had a shell account on got hacked a couple months ago, also an ssh hack I believe, and the cracker came in through my account. I was shocked, since I don't connect from anywhere but work, home, and the ISP's shell server, and I only use ssh. It wasn't until much later when the ISP realized that they had been compromised that I realized how my password got stolen. As it turns out, a friend of mine's J.C. shell account also got hacked. He ended up with his account terminated, and the teacher threatened to throw him out of the class for hacking... He later found out this was because there was some sort of root kit in his home directory. He, also, had been connecting via the ISP's shell server using the compromised ssh client.

All in all it was a real eye-opener for me and a lot of other people. Persumably a single person caused so much damage, not just online but in various people's lives as well. Stupid cracks like this seem like a minor annoyance until you get victimized by one.

With the shear lack of water-tight security around tales like yours scare me, while I’ve never suffered a major crack a recent story about the *almost* cracking of a Californian power company (what power is there to stop?) to the level of control computers scared the shit out of me, cyber terrorism becomes real-world terrorism, i can see combined cyber-real world terrorists attacks with essential services being knocked off...
Scary stuff, I think the world needs more OpenBSD and less stupid admins.

Re: Denial of service attack dissected
 

I believe the concensus was that personal ID verification is not a problem in America AND it will not get worse. It is the general trend. We have plenty of databases to trace what you supposidly did, but we have no fundamental method so that you and only you can confirm you are who you say you are AND we have no methods so that you can confirm that your ID is safe and uncompromised.

OK, maybe a system could not be created to avoid this particular shell ID and Password violation. But we have virtually no systems for you only to prove you are you AND to verify that others have not compromised your ID. Presently another can steal your ID, you would never know, AND you would suffer consequences from powers that would first look to blame you - all because we don't have a National ID Confirmation system.


[Edited by tw on 06-12-2001 at 02:22 PM]

Yes, i have to agree, i mean have a *BIG* problem with the govt watching me, but i don't mind being given a number, it doesn’t achieve anything in itself.
The only thing that strikes me is what exactly does it achieve, its how it’s checked that it’s the right person, i.e., verification that is the tricky bit, particularly on the net were *nothing* is secure.