1. Ethics of Distributed DoS (Why TFN is Evil) March 2, 2000 Mintcho Petkov Dartmouth College

2. Introduction Timeline of Attacks Feb 7 - Yahoo Feb 8 - CNN, Buy.com, eBay, Amazon Feb 9 - E-Trade, ZDNet Source: www.CNN.com Investigation Uncovered Distributed Denial of Service Attack (DDoS) Tool used: Tribe Flood Network (TFN) TFN created by the German hacker Mixter

3. Denial of Service Attacks What is DoS? Consume all resources. No resources left for others Must be intentional. Examples Run a CPU-intensive program on tahoe without caring about the results Allocate as much memory as possible (on a multi-user machine) Flood a network address with meaningless traffic (commonly ICMP, UDP) Distributed DoS Denial of Service launched from several computers with automated coordination.

4. Tribe Flood Network Target automated manual

5. Situation Analysis Parties Involved Creator of TFN (Mixter) Attacker Administrators of compromised machines (zombies) Target Issues Responsibility of Zombie administrators Mixter’s Responsibility Overall Internet Insecurity

6. Responsibility of Zombie Owners If zombies were secure, no DDoS attack possible Without a large number of high-bandwidth, low-security computers to be compromised, there is no attack. Why were the zombies not secure? Cost to society outweighs cost to individual Conflict of interest (“I have nothing important on this machine, so why invest in security?”) Not everybody is a security expert!

7. Mixter’s Responsibility Source: iss.net Security Administrator Tool for Analyzing Networks (SATAN) Automatically exposes system vulnerabilities Legitimate and illegitimate uses TFN and Capacity Management Testing the maximum amount of traffic a server can handle Distributed packet flooding tools help Cracking random computers NOT part of Capacity Management Mixter Shares the Blame The tool can only be used for malicious purposes

8. Overall Internet Insecurity Sources: CNN.com, news.yahoo.com, iss.net Noteworthy Incidents NATO website successfully flooded during Yugoslav War FBI website made inaccessible by a DoS attack (Feb 18, 2000) 227 computers used in a DDoS attack against the University of Minnesota (August 17, 1999) General Concerns about TFN Automation Encryption (list of compromised hosts encrypted) Concealment Techniques (broadcast addressing) Large existing networks of compromised machines

9. Conclusions References: Computer Security - www.iss.net News - CNN.com, news.yahoo.com Mixter’s Website - www.mixter.org Analysis of TFN - staff.washington.edu/dittrich/misc/tfn.analysis Expert on TFN - cbrenton@sover.net (Chris Brenton) To Summarize: SATAN can be good TFN is evil People can be careless The Internet is insecure