Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Yahoo offline because of attack (was: Yahoo network outage)

  • From: Wayne Bouchard
  • Date: Thu Feb 10 01:41:04 2000

> I smell denial here. The compromised systems (only 52?) had to have access
> to pipes at least 1 Gbps in size, in order to carry out this attack (do the
> math yourself). Either there were many more systems participating (in itself
> a scarey thought) or many of these large and professionally run systems are
> owned and their operators don't know it. The only other alternative is the
> conspiracy theory from hell.

I've seen instances where workstations of experienced people had been
compromised for considerable periods of time without their
knowledge. This, to me, is not suprising. My view of security is that
its all about trust. Major public servers are watched quite closely
simply as a result of the attention that has to be given to the
applications they support. However, those same administrators
generally don't watch smaller, auxillary systems (ie, a 3rd nameserver
several thousand miles away that serves no other function.)

Consider the responsibility of a corporate security dude and IT guys
who is trying to watch over the network used by 3 or 4 thousand
employees, most of whom have desktop computers and few of which know
how to do more than email 3 meg excel files to 30 or 40 people all
over the corporate network several times a day. If the network is not
kept absolutely tight, everything is a risk.

I always work from the maxim (and those I work with have heard this at
least a hundred times before) that "the easiest way to break into one
computer is to break into another computer that it trusts."
(eg. personal workstations... how many times have you looked at your
process table this week?)

Wayne Bouchard                                    [Immagine Your    ]                                      [Company Name Here]
Network Engineer


Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.