Distributed Denial-of-Service Attacks

Before the millennium rollover, I ran into a former coworker who, within the past five years, had retired from her computer-related job. After exhausting more pertinent topics, I asked her whether she planned to fly home to Nebraska for the Christmas holiday. Indeed, she was staying into the New Year. I was curious whether she had any fears about the possibility of Y2K computer problems and flying. She admitted no anxiety and asked me whether there was anything that she should be concerned about. I calmly mentioned a minor inconvenience of a massive denial-of-service against all infrastructure systems such as power grids, airlines, and banks continuing for days, weeks, or even years to assuage her nonexistent anxiety. Innocently enough, she replied, "What's a denial of service?" Believe me, this is a sharp woman, and I thought nothing less of her because of her question; I just realized that my fears were based on my exposures, and her peace of mind was based on her exposures.

I believe, however, that exposure for most of the rest of the media-connected world changed with the denial-of-service attacks against some of the major Internet players, such as Yahoo! and eBay, in February 2000.You could not help but hear on the nightly news or read on the front pages of the newspapers about these attacks that felled these giants of e-commerce. Months later, the media still buzzes about the lack of consumer confidence associated with these attacks much as years ago you couldn't read or hear about the Russian space station Mir without hearing the word "beleaguered."

The software responsible for these and many more attacks is known as distributed denial of service (DDoS) because it is a denial of service originating from many different source hosts. Thankfully for us as authors and perhaps unfortunately for you as readers, we haven't captured any traffic associated with these attacks. But, no discussion of denial of service today is respectable unless the distributed denial-of-service attacks are covered.

Intro to DDoS

Remember the powerful Smurf attack that used an intermediate site and all its responding hosts to amplify a denial-of-service attack? That is a drop in the ocean compared to the magnitude of some of the distributed denial-of-service attacks. If you look at the architecture of the Smurf attack, you will discover that there is really one hostile origin of the attack: A malicious user at one host crafts one or many ICMP echo requests to a broadcast address of the amplification site with a spoofed source IP of the target host. Many amplification hosts can magnify the intensity of the attack.

In a DDOS attack, many different "hostile" hosts enlisted are directed to attack a target site. These so-called hostile hosts are compromised hosts that have had distributed denial-of-service software installed on them. Maybe this new public awareness about these attacks will eliminate some of the naive attitudes of "why would someone want to break into my computer…it's got nothing worth stealing."

DDoS software comes in many different incarnations, each with different terminology and techniques. Among all, however, there is a notion of a controlling computer that directs the