ISPs take on DDoS attacks

Network World - Although the number and intensity of distributed denial-of-service attacks are on the rise, users are hard-pressed to find tangible new services to help thwart or defend against such assaults.

However, the largest ISPs are doing more behind the scenes and are promising new tools by next year that will help predict and better defend against worms and viruses that act like distributed DoS attacks and true distributed DoS strikes.

"There have been more attacks in the last six months than there have been in the last 10 years," said Hossein Eslambolchi, president of AT&T Labs, at a recent press conference.

Carnegie Mellon University's CERT Coordination Center for reporting Internet security problems backs up such claims. Through the end of September, there were 114,855 security breaches reported by users and ISPs, which is 32,761 more than all of 2002. These reports include all types of security policy violations from distributed DoS to hacker attack.

Although there are more security violations, the types of distributed DoS attacks have not changed much in 12 to 18 months, says Paul Morville, director of product management at Arbor Networks Inc., which offers PeakFlow network behavior anomaly detection products to service providers. What has changed is the size and scope of these attacks.

"Attacks used to be largely assigned to an individual host. These days, the attacks are very large coming from multiple points on the Internet and are targeted at a network," he says. Arbor is seeing zombie armies, which are compromised host machines, with as many as 50,000 hosts attacking one network, Morville says.help thwart or defend against such assaults.

While VPNs and managed firewall services are available from many ISPs, the primary goal of these offerings is to secure traffic that travels over the Internet. The largest business ISPs don't commonly offer intrusion-detection services that include anomaly detection aimed at mitigating the effects of distributed DoS attacks.

But that likely will change in the next 12 months.

MCI, like AT&T Corp. and Sprint Corp., is testing tools that are designed to detect distributed DoS attacks, and worms and viruses that act like distributed DoS by trying to eat up a target's bandwidth.

"Around mid-next year we'll deploy a solution that will enhance our detection ability so we can be more proactive," says Bob Blakely, security services product manager at MCI. The tools that MCI is looking at deploying include anomaly and intrusion-detection elements. MCI says it's testing a number of vendor products, including Arbor gear.

While MCI says it's been doing in-house traffic