The Rise of DDOS Attacks Between DDOS and the rise of highly effective phishing, we are now entering a new age of awareness This is a short NetFrameworks newsletter in which I'd like to highlight the increased risk of Distributed Denial of Service (DDOS) attacks and related extortion. In my role as CTO in my security consulting practice I have observed extortion attempts on several high dollar sites especially those companies for whom a network outage would cause a substantial loss of revenue. Armed with an army of "zombie bots" which are unwilling and unknowing desktop computers and servers infected with the hacker's remote control DDOS software, hackers threaten to unleash malicious traffic from their army of bots onto company websites or other mission-critical infrastructure if extortion money is not paid. When not paid, these hackers have been successful at taking sites off the Internet. The hackers typically propose payment terms on a service-basis and if it were't so serious, it would be humorous to read their terms and extortion letters-- often if you pay them their extortion fee up-front you get a "yearly discount" otherwise you pay a higher fee monthly to keep them from destroying your business. As you would expect, once paying they often come back for more despite these "agreed upon" terms. When under a DDOS attack, the typical response of your ISP or hosting organization is to simply null-route your traffic which is equivalent to disconnecting you from the Internet. They do this because the cost and risk to their infrastructure in keeping you online is excessive. They null route you until and if they can filter these attacks at the source which is often difficult or impossible to do without advance planning or use of a DDOS mitigation service. NetFrameworks, my security consulting practice, works with various DDOS mitigation companies, ISP's, and hosting organizations on behalf of its clients to protect them from DDOS attacks with advanced planning and services and to work towards recovery when under attack. We also assist in prosecution of hackers involved in criminal DDOS extortion. Between DDOS and the rise of highly effective phishing, we are now entering a new age of awareness in the risk to mission critical business online. The honeymoon may indeed be coming to a close where companies doing significant business on the Internet can simply view protection of their infrastructure as overhead. In fact it is value in the most basic sense, but in this case the value of staying online and in business. The articulation of this value to your management isn't necessarily best done in the form of doom-and-gloom (the extremist as discussed in my second book) but we can, in the end, take a lesson from our extortionist friends-- whether it's part of the service fee for operating online, an enhanced security feature enabling additional business online, or simply a maintenance cost, it is becoming increasingly difficult to ignore the reality of our networked world and the inherent risks finally exploited. Eric Greenberg CTO, NetFrameworks Inc. http://www.NetFrameworks.com Author of Mission Critical Security Planner: When hackers won't take no for an answer (Wiley, 2003) http://www.CriticalSecurity.com

Previous newsletters

- Liability and Identity Theft: Managing the risk to your company of expensive litigation and court judgments  

- Intrusion Detection versus Prevention: This past week there was an exceptionally long thread about intrusion detection and prevention on a popular mailing list. It seems a well known analyst house published a controversial paper on the subject, fueling the debate  

- September 2002 Newsletter: Planning and Organizing