[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: PANIX.COM down: denial of service attack
> Here are the gory details from the first MOTD last Saturday:
> The attacker is forging random source addresses on his
> packets, so there is no way to find his/her location. There
> is also no way to screen out those packets with a simple
> router filter.
> This is probably the most deadly type of denial-of-service
> attack possible. There is no easy or quick way of dealing
> with it. If it continues into Saturday we will start working
> on kernel modifications to try to absorb the damage
> (since there's absolutely no way to avoid it). This
> however will not be an easy job and it could take days to
> get done (and get done right).
> For those who are IP hackers, the problem is that we're
> being flooded with SYNs from random IP addresses on
> our smtp ports. We are getting on average 150 packets
^^^^
Can't access to this port be guarded against by a filtering
router which is configured to accept *only* a number of
trusted MX hosts ? That is the target itself *never* permits
any incoming traffic to smtp port *not* in the list of trusted
MX hosts, which does buffering for the target ?
Info on such MX hosts be hidden from secured way of DNS
setup so attacker will not learn about the MX hosts easily.
In case on MX host get flooded, there will be at least one
backup host to take over to prevent a total D.O.S.
> Since then the packet streams have hit almost all the ports for news, www,
> telnet, etc.
> DCF
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
M.C Wong Email: [email protected]
Australian Telecom Operation Voice: +61 3 9210 5568
Hewlett-Packard Australia Ltd Fax: +61 3 9210 5550
P.O. Box 221, Blackburn 3130, Australia