During the first days of this week several high-profile web sites fell victim of what seems to be Denial of Service (DoS) attacks. Much visited sites like Yahoo!, the famous Internet bookshop Amazon.com and CNN were victims, some of those were unavailable for hours.

DOS attacks have a long history as one of the dangers of being connected to the Internet. In its simplest form such an attack occurs when a computer issues a lot of (special) commands to another computer, thus disabling the latter to carry out its normal business. Traditionally the way to protect against such attacks is analyzing the traffic and preventing unusual amount of data from one source from reaching the targeted computer.

During the latest months, however, a new kind of attacks have been seen. This kind of attack, known as "Distributed Denial of Service attacks" (DDoS) is different from the older type, in the fundamental way that it comes from a lot of different sources, sometimes thousands of different computers. This makes it difficult to identify and protect against. It should be noticed that even though a lot of different computers are involved, these are innocent, unaware victims of one or a few attackers.

Two of the most common tools to use in such attacks are known as trin00 and Tribal Flood Network (tfn). Both are available for downloading from the Internet, thus being of considerable danger for Internet sites which are crucial for an organization's Internet presence.

A comprehensive advisory about these kind of attacks was published jointly by CERT Coordination Center and the US' Federal Computer Incident Response Capability (FedCIRC). It is available from CERT Advisory CA-2000-01 and is recommended reading for those more interested in information about this kind of attack. This document also has a link to an even more comprehensive analysis which sums up the result of a workshop (in PDF format) with security experts discussing this particular problem.

The advisory from Internet Security Systems' X-Force does also provide good information about this kind of attack. This advisory covers in detail the various parts of the tools used.

Both these advisories are recommended reading.

Per Olav Førland