New attacks multiply the threats to systems
A new type of denial-of-service attack showing up on the Internet dramatically increases the threat to even well-secured computer systems, security experts said recently.
A new type of denial-of-service attack showing up on the Internet dramatically increases the threat to even well-secured computer systems, security experts said recently.The distributed attacks are described as force multipliers, and can leverage the power of thousands of computers against a single site.Two versions have been identified, called trinoo and Tribe Flood Network. Alan Paller, director of research for the SANS Institute in Bethesda, Md., said the new attacks are stealthy, automated and powerful.'It's a bigger problem by several orders of magnitude' compared with other typical hacker methods, Paller said.Hackers until recently were working out bugs in the force multiplier programs.But in August, a trinoo network of more than 200 computers was used to flood a system at the University of Minnesota with User Datagram Protocol (UDP) packets, knocking it out for two days, according to a report by David Dittrich of the University of Washington. About half of the computers used to launch the attack were on Internet2, the high-speed backbone operated by the University Corp. for Advanced Internet Development.'Trinoo networks are probably being set up on hundreds, perhaps thousands of systems on the Internet,' said Dittrich, a software engineer and consultant at the school's computing and communications client services group. 'An attack like this has the advantage of allowing an attacker to give a single IP address and have multiple attacks be launched, increasing the probability of successful attack.'A Tribe Flood Network, or TFN, attack is similar to trinoo but more versatile, Dittrich said.'While trinoo only implements UDP flood attacks, TFN supports Internet Control Message Protocol flood, UDP flood, SYN flood and Smurf-style attacks,' he said.TFN agents also can be harder to detect because they communicate using ICMP packets. Extra bits are inserted in the headers of these packets, which are disguised as echo replies to ICMP Packet Internet Groper requests. These packets pass through most firewalls without being inspected.With both trinoo and TFN, an attacker installs the application on a computer, often a server, that has been exploited using common vulnerabilities. These computers, called masters, then scan other systems to find vulnerable machines, and can automatically install attack software. These machines, called daemons, can number in the thousands in a single trinoo or TFN network. The master maintains a list of IP addresses for daemons under its command.When the attacker orders an attack against a target IP address, the master sends orders to the daemons under its control to launch a coordinated assault.'In many cases, masters have been set up on Internet service providers' primary name server hosts,' where high traffic hides covert communications, Dittrich said.Because of the volume of attack packets that can be focused on a single address, even a well-protected site can be overwhelmed and put out of service, Paller said. This can put sites with good security at the mercy of poorly secured sites that serve as masters and daemons.Since the attack programs were discovered, the SANS Institute and the Computer Emergency Response Team at Carnegie Mellon University have received a growing number of reports of suspicious ICMP echo replies on networks.Both trinoo and TFN have mostly been found installed on machines running SunSoft Solaris 2.x or Linux'probably because of the availability of hacker tools for these systems, Dittrich said.CERT's suggestions for defending against automated denial-of-service attacks focus on stopping them before they can get started. The first step is to secure networks against known exploits so they will not become hosts for trinoo and TFN. Next is preventing the origination of IP packets with spoofed source addresses.If an attack tool is found on a system, 'it is important to determine the role of the tool,' CERT advises. 'The piece you find may provide information that is useful in locating and disabling other parts of a distributed attack network.'Finally, if your agency's systems are the victim of a denial-of-service attack, remember that you might not be able to rely on the Internet for communications.Get more information on trinoo and TFN attacks on the SANS Web site, at , and the Carnegie Mellon CERT's Web site, at .
Flood support
On the attack
www.sans.orgwww.cert.org
By William Jackson
GCN Staff
 | A force multiplier attack can leverage the power of many computers to wear down the defenses of a single system. |
Flood support
On the attack
www.sans.orgwww.cert.org
NEXT STORY: OS UPDATE