Stacheldraht

Stacheldraht is a combination of Trinoo and TFN with encryption added to communications between the client and handler and the handler and the agents. Agents can generate TCP SYN floods, UDP floods, ICMP floods, and Smurf attacks against the victim. Default communications are as follows:

client	handler:	TCP port 16660		or 60001
handler	agent:	TCP port	65000	or ICMP	echo reply
agent	handler:	TCP port	65000	or ICMP	echo reply

Today, since the discovery of the leaves worm with the f.exe malicious code in June 2001, the main emphasis seems to be on controlling systems from IRC channels or using flooding IRC bots. If you see traffic entering or leaving your network on TCP 6667 (actually TCP 6660–6670) you probably should consider taking a close look at it, unless you are sure the owner of the system is actually using IRC to chat.

Summary

In denial-of-service attacks, the source address is probably spoofed. Please report them to your CIRT anyway. Many of the denial-of-service attacks are very old and well understood; this does not mean they aren't effective. Although there is nothing impressive about Echo-Chargen, I was just talking with a major Internet service provider that lost a T3 circuit for three hours to an oscillation.

As far as DDoS attacks, you can do little right now if you become a victim site. A document is available from www.incdents.org to guide you step by step if you think one of your UNIX hosts might be infected with one of these Trojans. A wise analyst will download and read this from www.incidents.org/react/trojan.php before she has to deal with an infected system. And, you certainly can take some measures for preventing your site from becoming a launching ground. First, make sure you have egress filtering that allows packets to leave your network only if they contain source IPs from your network. There is an excellent paper on egress filtering available from Incidents.org, www.incidents.org/protect/egress.php. This prevents source IP spoofing used by many of the attacks. Also, you can configure your intrusion-detection system to look for some of the signatures so that you have detection capabilities if you do become a launching site. And, as trite it sounds, you have less chance of a host compromise if you block unnecessary traffic into your sites and your hosts are well patched and maintained. This prevents the compromises necessary to install the DDoS software.

Appendix C. Detection of Intelligence Gathering