Child pages
  • CERT Advisory CA-2000-01 Denial-of-Service Developments

Pages in the Historical section of this site are provided for historical purposes, they are no longer maintained. Links may not work.

Skip to end of metadata
Go to start of metadata

This advisory is being published jointly by the CERT Coordination Center and the Federal Computer Incident Response Capability (FedCIRC).

Original release date: January 3, 2000
Source: CERT/CC and FedCIRC

A complete revision history is at the end of this file.

Systems Affected

  • All systems connected to the Internet can be affected by denial-of-service attacks.

I. Description

Continued Reports of Denial-of-Service Problems

We continue to receive reports of new developments in denial-of-service tools. This advisory provides pointers to documents discussing some of the more recent attacks and methods to detect some of the tools currently in use. Many of the denial-of-service tools currently in use depend on the ability of an intruder to compromise systems first. That is, intruders exploit known vulnerabilities to gain access to systems, which they then use to launch further attacks. For information on how to protect your systems, see the solution section below.

Security is a community effort that requires diligence and cooperation from all sites on the Internet.

Recent Denial-of-Service Tools and Developments

One recent report can be found in CERT Advisory CA-99-17.

A distributed denial-of-service tool called "Stacheldraht" has been discovered on multiple compromised hosts at several organizations. In addition, one organization reported what appears to be more than 100 different connections to various Stacheldraht agents. At the present time, we have not been able to confirm that these are connections to Stacheldraht agents, though they are consistent with an analysis provided by Dave Dittrich of the University of Washington, available at

http://staff.washington.edu/dittrich/misc/stacheldraht.analysis

Also, Randy Marchany of Virginia Tech released an analysis of a TFN-like toolkit, available at

http://www.sans.org/y2k/TFN_toolkit.htm

The ISS X-Force Security Research Team published information about trin00 and TFN in their December 7 Advisory, available at

http://xforce.iss.net/alerts/advise40.php3

A general discussion of denial-of-service attacks can be found in a CERT/CC Tech Tip available at

http://www.cert.org/tech_tips/denial_of_service.html

II. Impact

Denial-of-service attacks can severely limit the ability of an organization to conduct normal business on the Internet.

III. Solution

Solutions to this problem fall into a variety of categories.

Awareness

We urge all sites on the Internet to be aware of the problems presented by denial-of-service attacks. In particular, keep the following points in mind:

Detection

A variety of tools are available to detect, eliminate, and analyze distributed denial-of-service tools that may be installed on your network.

The National Infrastructure Protection Center has recently announced a tool to detect trin00 and TFN on some systems. For more information, see

http://www.nipc.gov/warnings/alerts/1999/trinoo.htm

Part of the analysis done by Dave Dittrich includes a Perl script named gag which can be used to detect stacheldraht agents running on your local network. See Appendix A of that analysis for more information.

Internet Security Systems released updates to some of their tools to aid sites in detecting trin00 and TFN. For more information, see

http://www.iss.net/cgi-bin/dbt-display.exe/db_data/press_rel/release/122899199.plt

Prevention

We urge all sites to follow sound security practices on all Internet-connected systems. For helpful information, please see

http://www.cert.org/tech_tips
http://www.sans.org

Response

For information on responding to intrusions when they do occur, please see

http://www.cert.org/nav/recovering.html
http://www.sans.org/newlook/publications/incident_handling.htm

The United States Federal Bureau of Investigation is conducting criminal investigations involving TFN where systems appears to have been compromised. U.S. recipients are encouraged to contact their local FBI Office.


We thank Dave Dittrich of the University of Washington, Randy Marchany of Virginia Tech, Internet Security systems, UUNet, the Y2K-ICC, the National Infrastructure Protection Center, Alan Paller and Steve Northcutt of The SANS Institute, The MITRE Corporation, Jeff Schiller of The Massachusetts Institute of Technology, Jim Ellis of Sun Microsystems, Vern Paxson of Lawrence Berkeley National Lab, and Richard Forno of Network Solutions.

Copyright 2000 Carnegie Mellon University.


Revision History


                
        
    
        
  • No labels