Re: NANOG meeting subject of attack? Hmmmm....

[Bino Gopal <bino () watsun cc columbia edu>]

As Charles says, from what I've read of the CERT advisories, there is
nothing proactive one can really do for these DDos attacks, besides
securing machines from being hacked, correct?

Also note that the link that Paul gave to the cnet story doesn't mention
anything about NANOG (for those who were looking).  That only came later
tonight, by 8:30pm with this story:

        http://news.cnet/com/news/0-1005-200-1545456.html

Also see CNN (as they got hit) at:

        http://cnnfn.com/2000/02/08/technology/yahoo/

Looks like the news organizations have picked up on the timing
'coincidence' (if it was one).  Apologies if this is old news; I just
didn't see any mention of it yet, and it seemed rather operational, given
the nature of what happened. :)

                                                        BINO


On Tue, 8 Feb 2000, Charles Sprickman wrote:

> On Tue, 8 Feb 2000, Christian Nielsen wrote:
> > On Tue, 8 Feb 2000, Paul Ferguson wrote:
> >
> > >   http://news.cnet.com/news/0-1007-200-1544910.html?dtn.head
> >
> > I guess the only way to 'protect' against something this big would be to
> > follow Pauls RFC and/or have big, fat pipes sitting idle.
>
> It's my understanding that these recent attacks are DDoS attacks, which
> really don't need to involve any address spoofing.  The MO would look
> similar to a smurf (many different source addresses bombarding you), but
> here the negligent (call the lawyers?) party with the hacked Solaris boxes
> running out-of-the-box configs would not be helped by said RFC, right?
>
> > This is a sad day for the internet. :(
>
> Just a reminder that we are working in a anarchic, non-cooperative
> business, that's all :)
>
> Charles
>
> > Christian