Subject: [Raven] German programmer "Mixter" addresses cyberattacks

From: "chefren" <[email-masked]>
Date: Tue, 15 Feb 2000 00:15:37 +0100

Comment at the end...

= =

This NEWS.COM (http://www.news.com/) story has been sent to you from [email-masked]

German programmer "Mixter" addresses cyberattacks
By Stephen Shankland
February 14, 2000, 12:35 p.m. PT
http://home.cnet.com/category/0-1005-200-1549399.html

      The federal investigation into last week's attacks on major Web sites has reportedly turned to at least one anonymous programmer believed to have written software that may have been used in the assaults.  

  A programmer known only as "Mixter," who says he resides in Germany, has not been publicly accused in any of the cases and denies any responsibility for the "distributed denial of service" (DDoS) attacks. Mixter is part of a small group of underground programmers who say they create assault 
technologies that can be used in testing to improve Internet security.   

  The recent attacks have renewed controversy over this practice, raising questions about whether these programs increase the potential for misuse when they are posted publicly online. In an interview Wednesday with CNET News.com at the height of last week's shutdowns, Mixter explained his 
actions and philosophy on technological security.  

  CNET News.com: Were you in fact the author of the attack tools? (Several  versions of the attack tools exist, including Tribe Flood Network, its  sequel TFN2K, Trinoo and Stacheldraht.)
    Mixter: I am in fact the author of the programs called TFN and TFN2K, but not of Trinoo. The original Trinoo was made some months earlier than the first TFN, but unlike TFN, (it's) not distributed publicly...Stacheldraht isn't written by me. There have been many false rumors about this. There 
is another German hacker who goes by the name "Randomizer" who wrote that one.  

  Why did you write the software?
    I first heard about Trinoo in July '99, and I considered it as interesting from a technical perspective, but also as potentially powerful in a negative way. I knew some facts of how Trinoo worked, and since I didn't manage to get Trinoo sources or binaries at that time, I wrote my own server-
client network that was capable of performing denial of service; later that month I published a working version of TFN on a handful of security sites to make the information public and generate awareness of the issue. The original Trinoo and other distributed tools existed since 1998.  

  Were you involved directly or indirectly in any of the recent high-profile attacks on Yahoo, eBay, CNN, Buy.com or Amazon?
    No. The fact that I authored these tools does in no way mean that I condone their active use. I must admit I was quite shocked to hear about the latest attacks. It seems that the attackers are pretty clueless people who misuse powerful resources and tools for generally harmful and senseless 
activities just "because they can."  

  What is your real name?
    I really prefer not to give you my real name. On the one hand it is a sad fact that many, many people have a bad opinion of anyone involved with "this strange hacking stuff" and that they make no difference between pointing out security weaknesses and exploiting them, and on the other hand, 
I'm using my handle, Mixter, because I do believe in privacy, and I simply want to keep my privacy on the Net, like many other nonmalicious people who care about security do.  

  What is your occupation?
    I finished school approximately half a year ago, and I have been getting some offers from security companies since then. However, due to personal issues I haven't yet been able to start an employment, but I will probably be going to work in the area of source code security auditing, where I 
will have a great potential of improving both my knowledge and network software.  

  How difficult is it to write the distributed denial of service attack tools?
    Not very difficult. The main concept is simply the client-server concept present in almost all Internet applications. Packet flooding and similar attacks are publicly known and available and can easily be implemented. When it comes to implementing stealth features, it might get a bit 
trickier. But factually, DDoS tools just make an old concept easier. Before DDoS, an attacker would just have to log on to every compromised machine, (then start) a flooding tool from each machine against the target.  

  How difficult is it to take over a sufficient number of computers to mount a distributed denial of service attack large enough to take down Yahoo?
    Unfortunately, it is quite easy. It is safe to assume that all of the flood servers are installed on hosts compromised through vulnerabilities that are publicly known, rather old, and can easily be patched. Most attackers use automated...scripts to do long-range scans for known 
vulnerabilities. This procedure can take some time, but the concept is really easy. They also do this from compromised and specially modified machines to be sure that their origin cannot be traced back.  

  How many computers would you estimate were used in the Yahoo attack?
    The amount they need depends. It isn't only the number, it is the bandwidth of each of these. From what I've heard from security mailing lists, attackers have already compromised Internet2 and other high-speed machines.  

  Given that TFN2K uses master and slave computers and encrypted communications channels, how diffi
cult is it to find out who originally sent  the order to attack?
    Remote detection is practically impossible unless the attack goes on for a timed amount of days
. In that case, if all backbone providers would cooperate and monitor their routers, the origin of 
some of the "slave" servers could be tracked. That was a point I wanted to prove.  

  Since the other existing DDoS tools weren't totally anonymous and untraceable, I saw the possibil
ity that security people would waste their time trying to find ways to track the attacker, while th
e DDoS tools would sooner or later become sophisticated enough to make this impossible. There is st
ill the chance of finding attackers if they aren't extremely careful and leave traces on the compro
mised hosts or manipulate and damage things on the compromised hosts enough so that the administrat
or detects them locally.  

  Do you know if TFN or Trinoo were used in the Yahoo, eBay, Amazon, CNN  or Buy.com attacks, or wa
s it other software?
    I'm pretty sure a tool derived from TFN and/or Trinoo was used. Currently, many people seem to 
be modifying those tools, or developing new, similar ones, and keeping them private. This is becaus
e when a program is publicly known, people have a chance of identifying it locally when it is installed on their server by searching for binary patterns, as the FBI (National Infrastructure Protection Center) proved. This is basically the Trojan/virus problem, where antivirus vendors continuously 
bring out updated scanners, and virus authors continuously bring out new or modified viruses.  

  Anything else you'd like to say?
    I'd like to remind people that the real problem is the insecurity of the huge amount of servers, and not the people that are exploiting it. If security companies and governments are starting a "hunt" against the people they call "hackers," they might succeed in tracking and persecuting some 
of them, but the real problem remains: Everyone who can manage to learn a handful of Unix commands and to set up a tool can commence DDoS attacks, as long as the overall Internet security is as bad as it is now.  

  I found it really disturbing and scary when I read that President Clinton is intending to dedicate $240 million for the sole purpose of wiretapping and domestic surveillance. In my opinion, no amount of denial of service attacks or computer intrusions could ever cause a comparable amount of 
money to be lost in the future. Additionally, such methods and laws can easily be circumvented by malicious people using compromised systems to relay through a number of encrypted channels and are therefore affecting everyone except the people they are intended against.  

-------------------------------------------------------

(Pretty clueless ideas regarding a society as far as I see 
it. It's simply not acceptable for a lawful society that 
vandalists can produce damage worth of millons of dollars 
without much chance of getting cought.)

It might well be that just tapping personal or business 
communication won't be enough to stop digital vandalism in 
the near future and police needs a sight at the traffic 
like they can look at numberplates of cars in a city...  

Oops! The net really starts growing up with both pain and 
joy...

+++chefren

p.s. I still think Raven might mark the point in time IETF 
lost the  guidance of Internet standards. I don't expect 
IPv6 to take off as we know it (maybe via UTMS with 
absolute(!) addresses), I expect a 5-10 year "standards" 
vacuum without a lot of new things and after that some form 
of government by UN/ETSI or even a new UN guided agency.

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Richard Payne" <[email-masked]>
Date: Tue, 15 Feb 2000 09:50:44 -0500

> like they can look at numberplates of cars in a city...

Using distributed denial of service as yet another rationale for tapping
makes very little sense. The number of zombies involved makes it likely that
the originators of the attacks will eventually be caught. As pointed out by
mixter in the interview, the underlying problem is lax security on the
zombies. The end result will be better security as people become aware of
the potential problems.

> of government by UN/ETSI or even a new UN guided agency.

The UN running the Internet? Saints preserve us in creosote!

Richard Payne

---

From: "Ge' Weijers" <[email-masked]>
Date: Tue, 15 Feb 2000 08:02:42 -0700

> of government by UN/ETSI or even a new UN guided agency.

This was already tried, in the ITU (nee CCITT). Intergovernemental
agencies produce insane standards like X.25 and SS7. OSI is only
used in textbooks.

There's nothing significant coming out of the ITU anymore, SS7 was
their crowning achievement of bloat and multilayered complexity. It
still amazes me dialtone is as reliable as it is. Most of the new
stuff is not developed in the ITU anymore (ATM etc).  X.500 never got
off the ground because of its own weight, X.400 e-mail is almost dead
as well.

The IETF has serves us well, its processes are far more effective than
those of ITU or ETSI, all because of its informal, loose-knit
structure. And because of its informal nature it is not the right
forum to handle the politically hot potato of wiretaps.

Back to our scheduled program of rants and rave[n]s.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: "Ge' Weijers" <[email-masked]>
Date: Tue, 15 Feb 2000 08:12:33 -0700

> The UN running the Internet? Saints preserve us in creosote!

Of course it should be the UN. It's the highest authority, and
authorities are always right.

Ge'

---

From: "chefren" <[email-masked]>
Date: Wed, 16 Feb 2000 01:44:43 +0100

> On Tue, Feb 15, 2000 at 12:15:37AM +0100, chefren wrote:

..

> off the ground because of its own weight, X.400 e-mail is almost dead

I agree.
 
> structure.

"Serves" or "served", that's the question. The demands of 
the world are not heard or understood here. Techie problem?

> And because of its informal nature it is not the right

To get further the IETF has it's weaknesses. Social 
responsibility is clearly one of them.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Wed, 16 Feb 2000 01:53:54 +0100

On 15 Feb 00, at 9:50, Richard Payne wrote:

> makes very little sense.

Rationale for more control. Tapping is just one aspect, 
this goes somewhat beyond.

> The number of zombies involved makes it likely that

Security against lot's of request to a server?

..

> The UN running the Internet? Saints preserve us in creosote!

Might be... UN isn't ideal...

Who/what do you expect to "police/rule the world" in 
10/25/50/100 years?

Some form of world wide government and policing will 
definitely appear af far as I see it and why wouldn't it be 
able to push new standards?

+++chefren

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 21 Feb 2000 01:18:10 +0100

>the world are not heard or understood here. Techie problem?

The demands of Chefren and the FBI are heard, but not accepted here, I 
would say, while the demands of the ACLU, the EFF, and that US senator are 
both heard and accepted.

The world is not of one voice.

                    Harald

--
Harald Tveit Alvestrand, EDB Maxware, Norway
[email-masked]

---

From: "Matthew G. Saroff" <[email-masked]>
Date: Sun, 20 Feb 2000 20:21:45 -0600 (CST)

> would say, while the demands of the ACLU, the EFF, and that US senator are 
	I believe that you are referring to Representative Bob Barr.  He
is a member of the House of Representatives, not a senator.

--
  Matthew Saroff  | Standard Disclaimer:  Not only do I speak for
       _____      | No one else, I don't even Speak for me.  All my 
      / o o \     | personalities and the spirits that I channel
______|_____|_____| disavow all knowledge of my activities. ;-)
  uuu    U   uuu  | 
                  | In fact, all my personalities and channeled spirits
Saroff wuz here   | hate my guts. (Well, maybe with garlic & butter...)
For law enforcement officials monitoring the net: abortion, marijuana,
cocaine, CIA, plutonium, ammonium nitrate, militia, DEA, NSA, PGP, hacker,
assassinate. Hackers Ascend Upper 'Echelon' FBI CIA NSA IRS ATF BATF DOD
Send suggestions for new and interesting words to: 
[email-masked] (remove the numbers to reply)
Check http://www.pobox.com/~msaroff, including The Bad Hair Web Page

---

From: "chefren" <[email-masked]>
Date: Mon, 21 Feb 2000 21:56:00 +0100

> The world is not of one voice.

However, we do have to live =together= and it doesn't seem 
the IETF understands what's necessary for that.

Unfortunately IETF seems so "weldfremd" that it has only 
hardened old messages instead of looking for alternatives 
and keep more or less in touch with the rest of the world.

IETF could =at least= advise something like "make a law 
that forbids the use of wrong return addresses in IP 
packets. Or do an open proposal to the router industry to 
filter all packets with wrong return addresses out.

The proposed no-saying is useless. With or without nice 
wording.

+++chefren

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 22 Feb 2000 13:23:14 +0100

>filter all packets with wrong return addresses out.

RFC 2267, you mean?
This was recently raised to Best Current Practice status - announced Feb 15.

>The proposed no-saying is useless. With or without nice

Useless for progressing wiretapping standards, yes.

                    Harald