How to stop a service denial attack before it stops you

| SPECIAL TO GCNIt's not easy to defend a federal Web server against distributed service denial attacks, but it's not impossible either.For years now, the government has been under the gun in an undeclared cyberwar with hackers around the globe. The simplest and so far the most common attack is denial of service, which keeps a server so busy with fake data traffic that it can't do its real job.A distributed denial-of-service attack pits multiple computers across the Internet against a single target server. Most serious attacks today orchestrate the use of hundreds of machines and take the target server out of commission for the duration of the attack.Site managers are busy searching for ways to defend themselves. It will take a more centralized effort to make a real difference, plus a commitment from Internet service providers to truly put a lid on the monster.The first defensive step is understanding how the game is played.It used to be possible to tell who was sending too much data traffic by examining the data packets. But hackers have taken up IP spoofing, which conceals the address of the originating machine. The Internet, designed to share data openly, is very trusting. Dump a data packet anywhere on the Net, and it will be delivered without prejudice.When a server comes under attack, it's important to recognize the style of attack. Sometimes it's a combination of styles.Captus Networks Corp. of Woodland, Calif., has identified four types of attacks as most common:These four types of attacks involve incoming traffic. At a higher and more serious level, a target server is compromised and used to attack machines elsewhere. It becomes necessary to monitor the server's outgoing traffic, too.Many agencies have installed two basic defenses:Firewalls and intrusion detection systems are reactive measures. They won't stop an attack, and they can shut only part of it down.Bad traffic can be shut down at two points:A traffic-limiting IDS can also reframe data communications between two points by asking the sender to slow down the rate of data acknowledgment. Legitimate servers will do so. Those that don't are deemed untrustworthy, so their packets are then filtered out.This method is mainly effective against what security expert Steve Gibson has dubbed 'script kiddies,' who work within Microsoft Windows and download hacking scripts from the Internet. Such hackers don't know sophisticated methods of concealing their IP addresses.In theory, a traffic-limiting device installed outside the firewall should strip out and redirect bad traffic without becoming a choke point for good traffic. It could also deny inbound data from specified IP addresses, either for a set time or until an attack stops. The denial automatically ends when traffic flow returns to normal.Managers with such systems in place can set thresholds and policies for various triggers, as well as alerts and filters for bad traffic.But this approach won't rid the network of unwanted packets. Only the Internet provider can keep them out. Also, it's nearly impossible for the straight traffic-limiting approach to succeed with heavily spoofed packets because each can arrive with a different fake IP address. The best overall bet is a multilevel approach:XXXSPLITXXX-If you suspect a distributed denial-of-service attack is under way, reconfigure your network for real-time capture of packet traffic, then log the traffic. An intrusion detection system can do this.In a limited data sample, you likely will see either large fragments of improperly formed packets aimed at any server port or large User Datagram Protocol packets aimed at some nonexistent port. You also might see Internet Control Message Protocol debris from large-packet ping commands.It's likely your local router and firewall can discard this garbage, keeping it out of your main Web servers. But the data flood will still block legitimate traffic by using up bandwidth. Your true bandwidth is the limit of what your routers can handle.The best place to filter out bad packets is before they leave the router of your main Internet connection. You should have a 24-hour engineering contact there, and keep the phone numbers handy.A secondary and quicker solution is to install a traffic-limiting intrusion detection system, but it can't be done after an attack has begun.Show the provider your analysis of the attack pattern, then ask for filters to be applied for specific UDP and ICMP traffic shown in your analysis. This should reopen your connection while you work with the provider to try to trace the bad traffic further upstream.The only real way to trace spoofed traffic upstream is to hop from router to router, involving other network administrators. This is a lengthy effort.Generally speaking, distributed service denial attacks die out over time as other sites shut down their compromised servers. The flow gets shut off before traffic can be traced all the way back to the source. XXXSPLITXXX-There's only one sure way of stopping the spread of distributed denial-of-service attacks: Take away hackers' ability to spoof IP addresses.It then becomes possible to trace and shut down the offenders'and to prosecute them.'The processing power of the Internet is distributed, and so is the responsibility,' said security expert Steve Gibson of Gibson Research Corp. of Laguna Hills, Calif. 'Everyone needs to take some.'He supports widespread configuration of routers for so-called egress filtering. If a packet leaving a network doesn't have a proper originating IP address within that network, then the router drops it before it can reach the Internet.Often egress filtering requires adding only one line of code to a router configuration.'If the major Internet service providers took responsibility for traffic egress from their networks, then no one could spoof an IP address from within those networks,' Gibson said. 'Even if a zombie [program] got into one of their customers' machines, it would be limited to the range of addresses in a specific section of a network.'Of course, it's tough to get the entire Internet to cooperate. But Gibson has set up the Spooferino project to push things in that direction.Spooferino is a downloadable software tool that sends a spoofed packet from the user back to Gibson's site, at . From the data returned by Spooferino, Gibson is building a directory of providers that are not blocking spoofed traffic.'It will start a discussion about who does and who doesn't filter,' Gibson said. 'ISPs that do not allow spoofed traffic out on the Internet are taking responsibility. Now look at my list of the ones that are not being good neighbors. Why not? It's certainly easy enough to do the filtering.'He said he hopes for an eventual confrontation. Some parts of the Internet will threaten to close themselves off from the parts that are not trustworthy. That could mean big trouble for heedless providers.Gibson believes they will fall into line to avoid being boycotted by the rest of the Net.Big backbone providers could amend their contracts to say they won't renew bandwidth agreements unless the providers take responsibility for the dirt they're now allowing on the Net.Government agencies can participate in this cleansing effort by requiring egress filtering on their routers.