Counter DoS

Thu Mar 11 10:06:29 UTC 2004

>I wonder, are they planning to launch these DDoS attacks from
>compromised hosts belonging to unwitting accomplices like the
>bad guys do?

Could they be the people behind NetSky? We know now that Bagle
and MyDoom come from spammer gangs but I haven't heard if anyone
has identified a motive behind Netsky yet.

I suppose that Symbiot is the logical next step. Now that there
is a market for compromised hosts to build distributed networks
for DoS, DNS, or anonymous hosting the logical next step is for 
a legitimate company (or semi-legitimate) to step into that market
and try to dominate it.

If the ISP and the vendor community won't work together to build
the tools and systems needed to identify and block DDoS emitters
then this is the inevitable result. If it goes much further then
ISPs risk being sued for blocking DDoS because they will also be
blocking somebody's revenue stream as well.

--Michael Dillon