Subject: RE: DDOS attacks

From: "Gordon Fecyk" <[email-masked]>
Date: Tue, 29 Jun 2004 19:33:15 -0500

> It seems to me the DDOS attacks we have reviewed so far
> pretty much boil down to:
> 
> SECURITY CONSIDERATIONS

Looking at this from a purely administrative point, I question this entire
e-mail.

>   We take it as a given that malicious entities control
>   large distributed networks of 0wned machines, in the six
>   to eight figure range.  These machines are compromised
>   workstation-grade machines that belong to ordinary
>   end-users on broadband connections.  They are generally
>   referred to as zombies.

First and foremost, what can a pack of zombie machines do to this system that
they can't already do to other systems?  Flood e-mail?  Perform repeated DNS
lookups?  Ping the hell out of mail servers or DNS servers?

>   The most elegant way to mount such an attack is to
>   contrive a scenario in which the technology itself plays a
>   part in the resulting denial of service.  If the attack
>   does not affect those who do not adopt the technology, and
>   only hurts those who do adopt the technology, it gives
>   adopters incentive to abandon the technology.  Such an
>   auto-targeting attack can be easily executed using zombie
>   networks.

Al Capone of Cyberspace.  "Don't even think of doing this or we'll hurt you."

That's like telling me not to use Internet Explorer just because you know how
to exploit flaws in it.  Or Outlook.  Or any other big name product or
technology.  Yet here I am sitting at my desk with the two most dangerous
pieces of software on my computer running at the same time, without
anti-virus software running even, and I'm not affected by the current
garbage.  Or the recent garbage.  Or the earlier garbage.  Or the garbage
that is yet to come.  So 180solutions knows how to install spyware behind
peoples' backs.  Big deal - doesn't work if the user can't install anything
to begin with (such as on a 2K or XP box with a limited user).

Steve Gibson preached to Microsoft pleading not to enable Raw Sockets support
in Windows XP.  His network was attacked as a result of his ranting - not
with r00ted XP boxes exploting raw sockets - but with a plain and simple
traffic flood.  Yet he maintains TO THIS DAY that Microsoft doomed the
Internet SOLELY because of this technology.

Bugs and flaws in MARID are going to be the least of your worries when Al
Spampone tells you not to use it or else, as you explained later on.

>   Both the elegant and the brute-force attacks are feasible
>   against any open protocol.  The only way to avoid these
>   attacks completely is to retreat to a "private club"
>   model, in which nodes do not communicate with other nodes
>   if they have not previously established a trust
>   relationship.
> 
>   A midway position between total openness and a "private
>   club" involves the use of reputation services.  If a
>   protocol endpoint tests new connections against a
>   reputation service before engaging more deeply in protocol
>   operation, attacks can be mitigated.

I disagree wholehartedly here.  Technologies can and do function - often
better - in an open environment.  PGP is my favorite example here, because
there's a lock where you know how the mechanism works, yet it is still
extremely difficult to break.  A strong lock, indeed.  Sure it _had_ bugs.
They got fixed.

Security by obscurity, or by reputation, is just going to hide problems until
they're discovered far too late.  Ironically, we don't have to look past our
own desktops to see examples.

Now do we have anything to hide here?

Here's another example: I'm supposedly a fool for leaving my Win2K AD
domain's primary DNS server exposed to the Internet.  Sure I'm firewalling
and port-forwarding everything I need, and if you poked around long enough
you'd discover my entire internal AD structure.  But what can you do with it?
You know my services' CSIDs (I think that's what they're called) but since
you can't talk to it through SMB or NetBIOS you're SOL.

And when MARID records begin to appear on my domain you're going to know
where my authorized SMTP clients will be.  So what?  None of those IPs or
hostnames are yours and unless you r00t my boxes they never will be.

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: Roy Badami <[email-masked]>
Date: Wed, 30 Jun 2004 01:56:18 +0100

>>>>> "Gordon" == Gordon Fecyk <[email-masked]> writes:

    Gordon> Al Capone of Cyberspace.  "Don't even think of doing this
    Gordon> or we'll hurt you."

I can't tell whether that's tongue-in-cheek or not.  But if you
haven't been following what's been happening to DNS blaklists over the
last year, that's pretty much exactly what's going on at the moment.

Spammers, hackers and organized crime gangs are very much working
together.  People running blacklists are getting targetted by large
scale DDoS attacks in an attempt to get them to give up, and several
prominent blacklists have shut down over the past year because they
couldn't cope.  All but the largest ISP's are now I suspect likely to
be unwilling to host a customer that runs a high profile blacklist,
because they know that they can't cope with the inevitable DDoS
attacks.

	-roy

---

From: Meng Weng Wong <[email-masked]>
Date: Wed, 30 Jun 2004 02:48:18 -0400

On Tue, Jun 29, 2004 at 07:33:15PM -0500, Gordon Fecyk wrote:
| 
| And when MARID records begin to appear on my domain you're going to know
| where my authorized SMTP clients will be.  So what?  None of those IPs or
| hostnames are yours and unless you r00t my boxes they never will be.
| 

Speaking of which, did anyone ever take you up on the offer
to forge enough of a TCP sequence to inject mail into your
servers?  I think that offer's been on the table for more
than a year now.

---

From: Meng Weng Wong <[email-masked]>
Date: Wed, 30 Jun 2004 02:53:57 -0400

On Wed, Jun 30, 2004 at 01:56:18AM +0100, Roy Badami wrote:
| 
| Spammers, hackers and organized crime gangs are very much working
| together.  People running blacklists are getting targetted by large
| scale DDoS attacks in an attempt to get them to give up, and several
| prominent blacklists have shut down over the past year because they
| couldn't cope.  All but the largest ISP's are now I suspect likely to
| be unwilling to host a customer that runs a high profile blacklist,
| because they know that they can't cope with the inevitable DDoS
| attacks.
| 

It seems to me that all the bad guys, put together,
collectively control more CPU power and more bandwidth than
all the good guys put together.

We are besieged.

It is no wonder we are transitioning to "assumed guilty
unless proven innocent".

Other appropriate models include an immune system design, in
which complex organisms constantly fend off disease.

In that model, it is imperative that the complex organisms
keep adapting and differentiating.  We, the good guys, need
faster and more diverse ways to respond to threats.  The
commercial antispam and antivirus guys have got it right.
The open community do too, with frequent releases of
SpamAssassin.  Our standards processes need to come up to
speed as well.