Hi,
The bruteforce approach to surviving a DDoS is a fatter pipe than what
the attack can throw at you.
So in most cases you'll be able to survive but in the "perfect storm
scenario" you'll eventually be swamped.
Other measures can assist but the end solution is having a bigger pipe
than what your attacker can throw at you.
Regards,
Ryan.
On 5/30/07, John Pluffum <john.pluffum@gmail.com> wrote:
Paul Sebastian Ziegler wrote:
>> If someone doesn't run a service, this obviously leads me to the
>> assumption that that particular machine could never be cracked ? Is this
>> a right assumption ?
>>
>
> Not really. Some attacks actually target the drivers of the
> network-interfaces. For example the WLAN drivers on MacOS X and some
> versions of Madwifi had issues. Since those drivers listen to the
> traffic anyway, it might be possible to trigger some sort of overflow
> without a single listening port.
> Also information leakage may occur no matter if the box is running any
> ports itself.
> Furthermore there are other techniques to communicate with boxes than
> just ports. Look up "portknocking" for that.
>
But one question that remains is that I have read lot of news these days
(for e.g., Russia vs. Estonia)
where they say they say that Russians have DDOS'ed Estonia so badly that
it has left the government, corporate and academic systems totally crippled.
If DDOS is so powerful form of attack, why hasn't there been some kind
of filtering done that can essentially prevent all these kinds of
nastiness ?
Or is this something that is insanely costly/impossible ? Or of course,
plain bureaucracy ?
Thanks again for your insights.
