It's one of those problems that some of the smartest(smarter than me
anyway!) haven't managed to come up with a surefire way of preventing. Why?
Because you want people to go to your site-but you want to differentiate
between good traffic and bad traffic. How do you do that? What kind of
'filters' do you setup? How far out from your perimeter can you tell it is
bad traffic? How much redundancy can you build into your sites? Like you
said-it starts to get costly.
Look at what happened to Blue Frog when they tried to 'attack' the
attackers/spammers. Google it-it is a very fascinating case.
And with it being 'distributed' it's even worse now-why, because they can
'move' the zombies around so well-so much control and they can change where
the attack is originating from. It's like playing Command and Conquer-you
know, when you've got three or four mini armies built up and you can send
them in waves from different directions. (My analogies get worse as I get
older).
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of John Pluffum
Sent: Wednesday, May 30, 2007 7:44 PM
To: security-basics@securityfocus.com
Subject: Re: Attacking a machine on network.
Paul Sebastian Ziegler wrote:
If someone doesn't run a service, this obviously leads me to the
assumption that that particular machine could never be cracked ? Is this
a right assumption ?
Not really. Some attacks actually target the drivers of the
network-interfaces. For example the WLAN drivers on MacOS X and some
versions of Madwifi had issues. Since those drivers listen to the
traffic anyway, it might be possible to trigger some sort of overflow
without a single listening port.
Also information leakage may occur no matter if the box is running any
ports itself.
Furthermore there are other techniques to communicate with boxes than
just ports. Look up "portknocking" for that.
But one question that remains is that I have read lot of news these days
(for e.g., Russia vs. Estonia)
where they say they say that Russians have DDOS'ed Estonia so badly that
it has left the government, corporate and academic systems totally crippled.
If DDOS is so powerful form of attack, why hasn't there been some kind
of filtering done that can essentially prevent all these kinds of
nastiness ?
Or is this something that is insanely costly/impossible ? Or of course,
plain bureaucracy ?
Thanks again for your insights.
