From: Victor Cruz [mailto:vcruz@mediaone.net]
Sent: Tuesday, July 31, 2001 10:03 AM
Subject: Code Red commentary...
Importance: High
Technically, Code Red is a denial-of-service (DoS) problem. Analysts like
John Pescatore at Gartner Group will tell you that there's no stopping the
black hats (bad boy hackers) from launching these assaults; the tools to
conduct these DoS attacks are readily available on the Web and even come
equipped with graphical user interfaces.
[If they are going to stretch it in this context,
then any type of computer attack could fit the bill. Code Red is
NOT a DoS attack like the ones quoted in the next
paragraph, nor the ones in February 2000. This is lame marketing
riding on the back of the Code Red fiasco.]
DoS attacks are occurring as frequently as 4,000 times per week, according
to U-C San Diego. And Exodus says they get 200-300 attacks weekly. The
average cost of a low-grade attack (lasting less than 3 hours) is $15,000.
The most you can do is mitigate.
Ever since that well-publicized February 2000 DoS attack that hit Web sites
like Yahoo, eBay, MSN, E*Trade, Amazon.com and others by a 16-year old
Canadian kid code named "MafiaBoy", a crew of startups announced their
intention to offer DoS fixes. These startups include Arbor, Asta, Lancope,
and Mazu Networks.
Of all the startups, Mazu seems to be ahead of the pack; they have a
$100,000 product on the market aimed at Internet data centers. Customers
are Exodus, Intel Online Services, Equinix, ElephantX and Interliant.
In a nutshell, DoS floods networks (computer servers, routers, pipes) with
bogus URL requests, blocking legitimate traffic from getting through.
Hackers do this by installing code on unsuspecting computers, turning
computers like Microsoft's Internet Information Servers, into "zombies."
DoS is a hot topic. The typical data center customer gets hit with frequent
medium-grade DoS attacks at an average cost of $15,000 per attack. A
prolonged DoS attack, similar to the May 2001 attack on government-appointed
security watchdog CC/CERT, can cost $100,000 or more.
I am not the expert. Dr. Philip London, CEO at Mazu Networks, is.
Victor Cruz
Principal
mediaPR.net
tel. 508 785-1590
