Feeds

Everything you wanted to know about DDoS attacks

But Steve Gibson hadn't got around to finding out

  • alert
  • submit to reddit

Combat fraud and increase customer satisfaction

Independent security expert Steve Gibson has posted his much-awaited analysis of the DDoS attacks launched against his grc.com site and it makes fascinating reading.

Steve was hit with two heavy denial-of-service attacks at the start of the month which made his site inaccessible to everyone. This is the start point in an extensive hunt and investigation for who had attacked him, why, how and was it possible to prevent it happening again.

Reading somewhat like a thriller or Raymond Chandler novel, Steve found that a 13-year-old boy calling himself Wicked and two others had been incensed with reports that Mr Gibson has called them script-kiddies on his site. As it happened, he didn't, but this was enough provocation for the DoS attack.

Despite Wicked's claims, Steve discovered that he had simply made small changes to an IRC bot - aka Zombie - which was present on a large number of innocent people's PCs. The program effectively gives a hacker complete control over someone's PC and works through IRC. Once the program is there, a hacker can update the program as and when they wish. Then, if the person is online, the PC can be used to fire hundreds of packets at chosen IP addresses - a denial-of-service attack.

Steve managed to get hold of a copy of the Zombie, which he used to infiltrate an IRC chat area where a number of hackers were discussing use of the Zombies and were writing different versions for one another. While there he has a fascinating conversation with a senior hacker that calls himself Boss.

On the way, Steve lambastes ISPs for paying little attention to their security and also ignoring his attempts to offer to put it right. He is also saddened by the current state of legal powers regarding such Internet attacks - FBI officers explaining that nothing can be done unless $5,000 worth of damage is caused and even then priority is given to criminals. Plus, since Wicked is only 13, he is exempt from prosecution.

He also gives a dire warning about Windows XP which we will cover very shortly in another story. In short it is a fantastic piece of investigative journalism and we strongly recommend a read. The piece ends with Steve promising to knock out a new piece of software that will ascertain how much effort ISPs are putting into protecting their customers PCs, in the hope of forcing them to pull up their socks.

The full text in on grc.com here. The article has already sparked a big discussion, going on as we speak. ®

Related Story

Leading security expert on the end of DDoS attacks

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.