Experts warn of DDoS attacks

Security experts have warned of the danger of Distributed Denial of Service (DDoS attacks), and say that attacks are on the rise because the perpetrators know that more often than not they won't get caught.

At the NetEvents spotlight on internet security in Rome last week, security experts revealed their "favourite" DDoS attacks, which should act as a warning to any user.

David Love, head of the Security Technology Advocacy Group at Computer Associates and ex-chief of security for NATO Europe, said the Pentagon once denial-of-serviced itself trying to defend against the potential threat of mobile code.

Mobile code, such as Java, can be transmitted across a network and executed at the other end. "They banned all mobile code coming through the perimeter, causing a huge self-induced DoS attack."

Bill McGee, channels manager for Cisco's VPN and security business unit, said that the Nimda worm was quite an inspired piece of code.

"Nimda essentially shut down the internet in about 13 hours. It was successful because it used a variety of attack methods to eat up bandwidth. No single security product could stop it, you needed a combination of products to stand a chance."

Paolo Ardemagni, vice-president of Symantec southern Europe, said that virus writers are using more sophisticated techniques. "DoS is becoming just another extra attack method used by the virus authors. A company like Yahoo is picking up two viruses per second."

"Now you need to think about security from a holistic point of view," he added. "It's about business, not technology, and it all comes down to a matter of policy."

Edilberto Bottini, senior systems engineer, ISS, said that TCP-based attacks were particularly effective.

"You have the opportunity to try and filter the attacking packets, but TCP attacks can just change routes. An attacker can use many different routers in one attack, leaving you to monitor anything from one fat pipe to many small ones."

He said that you could reconfigure the network to defend against the attack, but by then it may be too late.