The attack is on! Both 2600 and Phrack, 2 of the biggest well-known underground hacking magazines, have posted exploit code to do one of the nastiest denial of service attacks that the Internet has seen so far. Hundreds of people have access to these programs to bring down services on the Internet. Many of these people are targeting their attacks at various organizations such as ISP. Panix, an ISP, has been under attack for quite a few days now and they have not been able to receive email. Many other
The reporting on these events has sucked big-time. Panix couldn't receive mail for two multiple-hour periods. After that, telnet and web ports were attacked. We're not going to talk about implementations, but some solutions have been implemented. Alexis feels that it's very important to get wide press coverage, to help to force ISPs/NSPs to filter outbound crap from their network. I agree that everyone from the small to the large regional should do this.
Another way to fix this is to set the kernel maximum number of half open connections allowed (SO_MAXCONN) to a higher number than the default value.
Or eliminate it; a Sparc 1+ has been able to handle over 1000 syns/sec while still serving w/ no SO_MAXCONN (the test eliminated in the kernel) and with the SYN timeout set to 7 seconds (a bit aggressive, we may use 15 seconds when we put these patches in permanently tomorrow).
We have a tool that will look for SYN packets that do not get followed with ACK and clean the half open connections by sending a RST packet. This unclogs the port and allows legitimate connections to happen. This tool is called RealSecure (tm). To obtain a copy of the RealSecure tool, send email to majordomo@Iss.net and within the body of the message, type:
subscribe realsecure
RealSecure (tm) is a comprehensive attack recognition and real time response tool that ISS is alpha testing and will expire in 60 days.
This sounds very good... Maybe someone will even post a free, limited-function one as goodwill.
-- Christopher William Klaus Voice: (770)395-0150. Fax: (770)395-1972 Internet Security Systems, Inc. "Internet Scanner finds Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes Web: http://www.iss.net/ Email: cklaus@iss.net before the hackers do."
Avi