Everything you wanted to know about DDoS attacks

By Kieren McCarthy Posted: 31/05/2001 at 10:25 GMT

Independent security expert Steve Gibson has posted his much-awaited analysis of the DDoS attacks launched against his grc.com site and it makes fascinating reading.

Steve was hit with two heavy denial-of-service attacks at the start of the month which made his site inaccessible to everyone. This is the start point in an extensive hunt and investigation for who had attacked him, why, how and was it possible to prevent it happening again.

Reading somewhat like a thriller or Raymond Chandler novel, Steve found that a 13-year-old boy calling himself Wicked and two others had been incensed with reports that Mr Gibson has called them script-kiddies on his site. As it happened, he didn't, but this was enough provocation for the DoS attack.

Despite Wicked's claims, Steve discovered that he had simply made small changes to an IRC bot - aka Zombie - which was present on a large number of innocent people's PCs. The program effectively gives a hacker complete control over someone's PC and works through IRC. Once the program is there, a hacker can update the program as and when they wish. Then, if the person is online, the PC can be used to fire hundreds of packets at chosen IP addresses - a denial-of-service attack.

Steve managed to get hold of a copy of the Zombie, which he used to infiltrate an IRC chat area where a number of hackers were discussing use of the Zombies and were writing different versions for one another. While there he has a fascinating conversation with a senior hacker that calls himself Boss.

On the way, Steve lambastes ISPs for paying little attention to their security and also ignoring his attempts to offer to put it right. He is also saddened by the current state of legal powers regarding such Internet attacks - FBI officers explaining that nothing can be done unless $5,000 worth of damage is caused and even then priority is given to criminals. Plus, since Wicked is only 13, he is exempt from prosecution.

He also gives a dire warning about Windows XP which we will cover very shortly in another story. In short it is a fantastic piece of investigative journalism and we strongly recommend a read. The piece ends with Steve promising to knock out a new piece of software that will ascertain how much effort ISPs are putting into protecting their customers PCs, in the hope of forcing them to pull up their socks.

The full text in on grc.com here. The article has already sparked a big discussion, going on as we speak. ®

The story

-- Martin Thompson (mthom1927@aol.com), May 31, 2001

Answers

This should be required reading by everyone who takes their computer useage (and what's stored there...) seriously.

xj

-- xj (jw_ala@yahoo.com), June 01, 2001.

Thanks Martin!
this is a must read!!!!

-- (perry@ofuzzy1.com), June 01, 2001.