ALTHOUGH the “distributed denial-of-service” (DDoS) attacks that recently paralysed several major websites came as a surprise to many people, they were long expected by most experts in computer security. The software tools used to carry them out first came to light last summer, and security specialists held a meeting in Pittsburgh in November to discuss how to deal with them. The following month David Dittrich, a computer-security expert at the University of Washington, summarised an analysis of the threat by concluding: “I can't wait to see what the new year will bring.”
In January another meeting was held to discuss the problem, and the FBI's National Infrastructure Protection Centre warned of “malicious activity” that might be due to “preparation for widespread denial-of-service attacks.” Lo and behold, such attacks duly materialised this month, incapacitating Yahoo!, Amazon, CNN and other sites for several hours at a time. This provoked international concern and prompted President Clinton to hold a meeting at the White House on February 15th to discuss the problem. Yet a look at the history of denial-of-service attacks shows that the development of DDoS tools was only to be expected—and it also explains why the problem seems suddenly to have appeared from nowhere.
Perhaps the simplest denial-of-service attack is a “flood” such as a SYN flood. A SYN message is a connection request that is normally sent to a computer (such as a web server) to establish a channel for subsequent communication (such as the delivery of a web page). The computer responds with an acknowledgment and waits for a confirmation message. Forge the originating address of the SYN message (a trick called spoofing), however, and the target computer can be made to send its acknowledgment to a non-existent computer, which will never respond. The target computer, of course, is unaware of this. Flood it with SYN messages and it will soon be paralysed by its wait for non-existent confirmations. A related attack called a UDP flood works in a similar way.
Smurf and fraggle attacks are slightly more sophisticated. The former works by sending a single message, called an ICMP echo, to a special “broadcast” address that triggers responses from several computers on the same network. As with a SYN flood, the originating address is spoofed—but this time to a real machine, so that the resulting deluge of responses lands on the unfortunate target. Fraggle works in the same way, but uses UDP echo messages instead.
The names smurf and fraggle come from the programs written to launch such attacks. These can be downloaded from the Internet. Launching an attack using either program (or a SYN flood program such as synk) from your own computer is, however, a bad idea—unless you want to get caught. The answer is to break into an insecure computer elsewhere on the Internet. Using a set of software tools called a root kit it is then possible to do naughty things (such as launch attacks) using the compromised computer, without leaving behind any obvious traces.
Inevitably, malicious hackers soon began to combine these various attack tools into a single program. Papasmurf, for example, combines smurf and fraggle. Targa, written by a German hacker known as Mixter, combines several tools specifically devised to attack machines that run Microsoft Windows. The potency of these tools can be increased further by using them to attack a target machine from several compromised computers at once. But this requires the attacker to log on to each computer in turn to initiate the attack.
It was thus to be expected that the next step would be the development of “distributed” attack tools. Before the attack itself, several computers are broken into and tiny daemon programs are installed on them. These daemons are then remotely controlled by the attacker using master programs (hidden on other machines under cover of a root kit) that tell the daemons to attack particular machines. Trinoo, one of the first examples of this kind of attack tool, can be used to make UDP flood attacks. Tribe Flood Network (TFN), written by Mixter, is more sophisticated, and is capable of mounting SYN flood, UDP flood and smurf attacks. Using these tools, a single individual can launch attacks from dozens of machines at once.
These first-generation distributed attack tools have already been superseded. Stacheldraht, the tool thought to be behind some of this month's attacks, combines features of both trinoo and TFN, and has the ability to update daemon programs automatically. Similarly, TFN2K is an enhanced version of TFN. And, no doubt, even more ingenious tools are now being written. Mr Dittrich says he expects the next generation of distributed attack tools to be harder to detect and to eradicate than today's. They might also, he warns, be booby-trapped so that they start erasing data if discovered.
The tools that brought down Yahoo!, Amazon and other sites were, in other words, built up from simpler programs that have been used to mount less effective attacks on Internet sites for several years. Since single attacks are much less disruptive than distributed ones, the problem went largely unnoticed by those outside the security community, and the various fixes that have long been available to mitigate or prevent them were widely ignored.
This month's far more potent assaults were thus made possible because of a chronic failure to take security seriously, even as increasingly sophisticated attack tools were developed. Perhaps now website owners and businesses will sit up, take notice—and take precautions.
This article appeared in the Science & technology section of the print edition under the headline "Anatomy of an attack"