Denial-of-Service Attacks: Street Crime on the Web New Scientist (06/06/07) Vol. 194, No. 2607, P. 30; Giles, Jim
as it appeared in the June 18, 2007 edition of ACM TechNews.
Malefactors are increasingly using denial-of-service (DoS) attacks--the practice of crippling Web connections with a flood of traffic--to steal money from unaware Web site owners, and the method's persistence is aided by the fact that individual users and small companies generally cannot afford anti-DoS safeguards. "There are more players, better players, in the market than just a year ago," notes Arbor Networks computer security specialist Jose Nazario. One of the most common techniques to launch DoS attacks is to contaminate computers with bot software that lies dormant on the compromised PC until it is instructed to link with the target Web site, and the simultaneous accessing of the site by massive numbers of bot-infected PCs can often cause the server to crash. University of California, San Diego researchers determined that over half of the more than 68,000 DoS attacks perpetrated between 2001 and 2004 targeted home users or small businesses, and among the more serious kinds of attacks are those used to hold sites for ransom. University of Washington computer networks expert Tom Anderson thinks Web sites must be more selective in who they communicate with if DoS attacks are to be countered, and he and his colleagues have developed a protocol for online information exchange in which sites insert a token in the code they share with visiting computers, which would be interpreted by software installed at the site's ISP as proof of legitimate communication. The distribution of these tokens would be halted if the site is attacked, spurring the ISP to impede incoming connections upstream to prevent the site from seizing up. Web Link to Publication Homepage
