Denial-of-service attacks
Do I need to worry about the recent Internet distributed denial-of-service (DDOS) attacks being used in my organization's intranet?
The recent denial-of-service attacks are thought to be based on three software packages - TFN, Trin00 and Stacheldraht, which use "zombie modules" installed on servers to launch attacks against a single site.
For your intranet, you should be worried about two things - protecting your net from DDOS attacks, and protecting your servers from being used against other sites. Protecting your net requires intrusion-detection capabilities and active traffic control. Protecting your servers requires sound system security and active monitoring. While the majority of these attack tools run on Solaris and Linux systems, some run under other Unix operating systems and Windows platforms.
Review the CERT advisory at www.cert.org/advisories/CA-2000-01.html to understand how to deal with the threat. Information is also available at www.fbi.gov/nipc/welcome.htm, http://staff.washington.edu/dittrich/misc/stacheldraht.analysis, and http://xforce.iss.net/alerts/advise40.php3. You can find software for scanning servers for TFN, Trin00 and Stacheldraht at www.fbi.gov/nipc/trinoo.htm. A Perl script called "gag" that detects Stacheldraht attacks is available at the washington.edu link mentioned above. Also, Sun has patches for holes exploited by hackers installing zombies at www.sunsolve.com.
RELATED LINKS
As a network architect at Change at Work in Houston, Blass understands the strain of developing and managing networks. Send your problems to dr.internet@changeatwork.com
Ask Dr. Internet archive
Past columns.
