The Discordant Opposition Journal Issue 04 File 07

Published in

· 5 years ago

  

::::::::::::::::::::::::::::::::::::::::::::::::::::::April/99 
::: The Discordant Opposition Journal ::: Issue 4 - File 7 ::: 
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 

 :Distributed Attacks: 
  cronus 

  Many high profile targets are getting attention from hacking groups. 
In past hackers would be individuals that targeted a specific machine 
or network. If hackers were involved in groups, the partnership would 
more likely involve information swapping and discussion of different 
techniques. But modern day 'Tiger Team' groups actually co-ordinate in 
probing the system and gather huge amounts of information about the 
systems integrity. 

  Dozens of hackers working together with a common goal, amassing huge 
amounts of data about the target system. Port scans, bandwidth usage 
and even network scans. All the information can be later combined to 
give a more detailed account of the system. This is the definition of 
a distributed attack. 

  Using any form of basic encryption, the group can communicate and 
co-ordinate. No form of encryption is perfectly secure. But e-mails 
that are encrypted with PGP will sufficiently protect anyone's plans 
OF network intrusion. These hacking groups can use any form of basic 
encryption or alternative communication to hide their intentions. And 
since hackers aren't working on any time schedule they can draw out  
the probing process and eradicate the fear of drawing attention to 
their work.  

  The timing of any attack can be, and in the past has been, handled 
with military precision. By co-ordinating with each other, the hackers 
can each probe with a single connection. When each hackers results  
are combined, a more general view of the system starts to become  
clear. And as said before, the whole attack can be drawn out. The  
longer the probing of the server takes, the less likely the admin 
will notice. Or the alternative approach could be taken. The whole 
process could take place in a matter of hours and be done before  
anyone would have a chance to notice. 

  The more spread out the attackers, the more diverse the entries in 
the system logs. The main way a system administrator would know that 
their system was being probed would be the system logs. The logging 
of connections and data transfers is done by default on most systems. 
If the probes come from multiple sources, the likely hood of detection 
is decreased. 

  Because no one hacker is probing the system, the logs would reflect 
multiple connections without any seamless thread of consciousness. The 
lack of coherent thought in the probing would make detection of the 
probe more difficult. Although the mentalities of the individuals 
involve in the attack would be based on the common goal. The range of 
tactics and ideas to probe the weaknesses of the system will improve 
the chances of finding a hole and also help hide the attack. 

  Anyone with a server that's online or a network of online machines 
needs to be aware of the threat of distributed attacks. I have given 
a general outline of the distributed attack. To protect against it 
is simply a matter of more directed attention at your system. 

   ... intoxicated with the madness ... 
         cronus (at) iol (dot) ie 
  ___________  ____   ____  __ __  ______ 
_/ ___\_  __ \/  _ \ /    \|  |  \/  ___/ 
\  \___|  | \(  <_> )   |  \  |  /\___ \  
 \___  >__|   \____/|___|  /____//____  > 
     \/                  \/           \/  
      http://homepages.iol.ie/~cronus