|
Nona Parsons
and Ken Ebert
ZyQuest
We've
all heard about the denial of service attacks that shut
down Yahoo!, eBay, Amazon.com, and others that occurred
last month. These incidents have received a lot of press,
but there is still confusion surrounding these attacks.
What people really want to know is what is denial of service,
how does it happen, is my web site vulnerable, and how do
I prevent this type of attack?
Many
industry authorities use the acronym DoS to refer to denial
of service. DoS is a planned disruption of a website that
is conducted by overloading a server with network traffic.
There are different types of DoS, but basically they all
overload the server by either tying up the computer's processing
power or by filling up all the bandwidth available to the
victim. Many of these DoS attacks incorporate a mechanism
called "spoofing" in which the attacking computer impersonates
another "trusted" computer or one that doesn't exist at
all. In most cases, the victim's server attempts to respond
to false requests and ties up precious system resources.
No legitimate calls can get in when the system is busy acknowledging
false requests. DoS can become a significant problem for
individuals and businesses with a limited amount of bandwidth.
However, larger corporations and Internet-based businesses
may have a large amount of bandwidth (sometimes referred
to as a bigger pipe) and more computing power. These systems
are harder to overload, so that is when the attackers use
distributed denial of service (or DDoS).
Well
before a DDoS attack begins, the bad guys break into hundreds
of computers and distribute "zombie" software. Zombies are
essentially programs that can be set off by a timer or controlled
by a master program. The computers that are targeted for
zombie placement are systems that are always live on the
Internet.
The
zombies are timed to simultaneously send bogus data packets
to the victim's server. All of this data, coming from hundreds
of computers at once, blocks entry to legitimate users.
It's like all Three Stooges trying to get through the door
at once. There may be lots of jostling and squealing, but
no one gets through until the pressure lets up. Very few
legitimate calls get through and the web site gets flooded
like the engine of a car.
Many
companies can overcome such an attack. For some, it is no
worse than having the phone lines down for a day. For others
that are heavily dependent on web business or are in a business
that requires a reputation for reliability and security,
(like securities trading) it can be disastrous.
There
is no way of knowing if your web site will be targeted for
a DoS attack. If your business can't survive the downtime,
the best defense is to invest in software that alerts you
when an attack begins. The software is fairly sophisticated
and works with your firewall or router. Checkpoint Software
(http://www.checkpoint.com)
and Electric Lightwave, Inc.
(http://www.eli.net)
are two companies who produce software which provides this
type of protection. If an attack is detected, the software
sets up screens and filters to prevent the attack. It's
not cheap, though, and most small companies can't afford
the added expense. The other side of the coin is preventing
your computer or server from being hacked so you don't contribute
to being part of the problem. Products like TripWire from
TripWire Security (http://www.tripwiresecurity.com
) can be installed on your server to notify you that your
system has been compromised.
Also,
be sure that you have the latest patches applied to your
system from your operating system and all application vendors.
There
is one easy way to prevent your computer from being used
in a DDoS, or just to reduce the likelihood of it being
hacked: Turn it off when it's not in use, especially if
you are on an automatic (always on) Internet connection
such as DSL. This reduces the amount of time you are actually
connected, and it makes it harder for the hacker to get
in. The easiest thing you can do to thwart hackers is to
use a creative password. Construct a password that contains
8 characters or more, and is comprised of letters and numbers.
Don't use words that are in the dictionary. One popular
hackers' tool can crack any password that appears in the
dictionary.
Unfortunately
when dealing with security issues, the old saying is true,
"If a human brain invented it, given enough time and energy,
a human brain can break it."
|
