Mac OS9 Flood Attack 185
Yoel Inbar writes "John Copeland, a professor at Georgia Tech, has discovered the possibility of using Macs running OS 9 as a distributed DOS tool. Basically, by sending a Mac running OS 9 a custom UDP packet, you can get it to reply with a 1500 byte ICMP packet(these packets are normally sent as part of MTU discovery). Send these UDP packets to a bunch of Macs, spoof the source addresses....voila, instant DOS.
Apparently this is "in the wild"; he reports several scans designed to elicit these packets. "
Re:Wouldn't that be quite difficult (Score:1)
The fact that you have to send as many packets as the recipient of the DoS attack is true, but from how I interpret the announcement, no matter how small the UDP packet is a 1500 byte ICMP packet will always be returned.
This is a bit odd. Why 1500 bytes? It is the MTU for Ethernet, but I can't really see how that should affect the size of the ICMP error message. Maybe the fellows at Apple made an error in the internal coding of packet length, and the ICMP error-return code included the sent packet and then garbage up until the 1500 byte limit.
However, it can never be as destructive as a smurf attack (unless you have a whole subnet filled with Macs running OS9 _and_ they answer with this ICMP on broadcast packets to the specific port). Also, if it is only one specific UDP port, it is pretty easy to block in firewalls.
no -its acting like a byte amplifier (Score:2)
Here I have three slaves (199.77.146.20, 199.77.146.103, 199.77.158.61) being stimulated to send 30 1500-byte packets per second to address 24.88.48.47 (my cable modem). The combined bit rate is 3 x 30/s x 1500 bytes x 8 b/B = 1,080,000 bits/s. I could have increased the rate several times, but not much more would have interfered with the network.
-kris
Re:A new hacking tool? ;) (Score:1)
I, too, find it interesting that such attention is targeted specifically toward OS 9 when all the facts have yet to be laid out. And yes, it is correct that all OSes have the ability to react in the manner as in the original post.
I will differ from you in that I believe OpenBSD is the most secure out-of-box solution. As for "easiest" to maintain, well...
Oh, and these are my views, not the university's. =)
Thanks,
dtc
(who is very pleased with his extremely secure stand-alone TI-30)
Bugs and Slashdot (Score:1)
Anyway, I fail to understand why such an obscure bug has propted such heated responses. Bugs happen to everyone - Apple, Microsoft, and even Linux. Unfortunately, they are a fact of life. Programmers are only human after all. What puzzles me is that this story went up within hours of it first being written, while a story that I sent in several weeks ago that was Apple related (the HeaderDoc, Netsprockets announcement) was rejected within minutes only to be posted a while later.
Not that I'm suggesting anyone has a double standard of course, I know it's hard to sift through hundreds of story submissions. Still...
Re:Here's the gist of the scheme (Score:1)
I'm just glad people still think these are ingenious means of attack. There are much more devilish ways to DoS.
don't forget about us! (Score:1)
see for yourself [zdnet.com]
Here is the fix: (Score:2)
http://asu.info.apple.com/swupdates.nsf/artnum/
Re:Can we get more information (Score:3)
But with this attack, I can trigger a response of 1024 bytes by sending only 24 bytes. The idea being that I can fill the victims pipeline without filling my own.
But for the most part that's just bogus. The difference in size just isn't that great. A script kiddie will fill his own ppp bandwidth with the triggers long before whitehouse.gov gets overloaded with the payload. Also, much of the bottleneck is due to # of packets rather than # of bytes, and the # of packets is identical for attacker and victim.
Apple should fix the hole, but in the grand scheme of things this isn't huge security news, especially given the paucity of Mac servers on the Net (where this could really do some damage).
Re:Here's the gist of the scheme (Score:2)
You mean a lot of MacOS 9.0 slaves. How old is 9.0 anyhow? Three months? There is already a low enough population of Macs on the live-connected Internet for this to be difficult to exploit, but they also have to be upgraded to a three-month old OS, too! "I don't think so, Tim."
Cert Advisory CA-99-17 (Score:2)
Don't know if this is related, but here is a link to the Cert Advisory [cert.org] discussing how Mac OS9 can be used as a 37.5 times DoS amplifier.
Hope this helps.
Re:Wouldn't that be quite difficult (Score:2)
True, you get a bit of a multiplier in the response, but this still isn't an attack with a multiplier. Its not like the mac sends the same packet back out to the broadcast address which then starts all the other macs doing this. It would be more effective just to ping flood them from the rooted box on the big pipe. Think about it, if you have rooted a unix box on a fat pipe to coordinate the attack, why not just attack from there?
--
Mike Mangino Consultant, Analysts International
Re:Since source is closed, we must wait for Apple. (Score:1)
- Jeff A. Campbell
- VelociNews (http://www.velocinews.com [velocinews.com])
A Smurf by any other name? (Score:2)
Sounds simple in principle:
Pretend to be your target (IP spoof)
Ping a bunch of Macs
Watch real target fall over as all the Macs respond to the ping
How and why is this different? The 1500b packet? Is MacOS 9 unique in this?
Pardon my ignorance, just really curious.
I dont understand (Score:2)
If I sent ping packets with spoofed IPs to three hundred machines running any OS, wouldn't they respond with packets to the target machine?
-konstant
Yes! We are all individuals! I'm not!
apple's patch is up... (Score:2)
well, this might be some 'hoax', but *someone* at apple posted a patch even though they seem to be off...
this is really standard stuff, there are at least as many misconfigured routers out there (on biggger pipes) than static IP OS9 machines... i doubt the existence of ANY Y2K plot using these machines...
anyway, the patch is at:
ftp://ftphqx.info.apple.com/Apple_Support_Area/
I knew it. (Score:2)
j/k
DOS (Score:2)
I can see this kind of distributed DOS being called the 'iWhack Attack'.
Probably not unique to MacOS (Score:1)
the microsoft investment... (Score:5)
this is no big deal. here's why: (Score:1)
2. There aren't many mac users with cable modems because we are all poor from buying overpriced hardware.
3. See #1 and #2
no big deal.
A new hacking tool? ;) (Score:2)
Really, this is a serious security issue. As an admin, I rue the day that OS9 is deployed if such a possibility remains "in the wild." Being stuck in the middle of AOL's subnet doesn't help, either, but at least eliminating this one source will save myself and countless others the hassle of hoping and praying that no script kiddie gets his hands on a tool to exploit this vulnerability.
Re:DOS (Score:1)
(website excerpt)
This page presents evidence of a conspiracy to shut down Internet Connections. Zero-hour is probably New Years Eve, EST.
OT Advanced Tuner (Score:3)
Engineers on vacation. (Score:2)
Re:Huh? (Score:1)
A patch is now available (Score:1)
Open Transport Tuner 1.0 [apple.com]. You may also find more information on the Mac Attack FAQ [mediaone.net].
iMac on Crack (Score:2)
Which no one will install (Score:2)
Re:A new hacking tool? ;) (Score:3)
What strikes me as a bit weird is that whenever the MacOS operating system has such a vulnerability everybody is going ballistic, like if it proves a point they have been making all along. Might be my peculiar way of looking at things tho :)
I've been working with all three operating systems for quite a few years now, and MacOS - at least up to 8.6 - remains the most secure out-of-the-box operating system out. A well tuned and maintained Mac server remains one of the most secure internet platforms out there. Is up and running in less than a minute, a snap to set up and maintain.
Of course, it has purposes it's best suited for and situations you'd rather not use one. Same goes for Linux, or any other operating system out there. Which is why I use MacOS, Linux and IRIX, and as little NT as possible :)
Cya
bBob
(who is very happily running a mixed MacOS/Linux setup)
Re:Can we get more information (Score:2)
Its not as bas as smurf was, but don't write this off.
Re:Apple's Statement (Score:1)
Re:A new hacking tool? ;) (Score:1)
Re:Pardon my ignorance, but... (Score:1)
Re:Can we get more information (Score:2)
Thanks for setting me straight.
--
Mike Mangino Consultant, Analysts International
Re:I could have told you that one. (Score:2)
when they have something to say.
apple is not going to comment until they know exactly what is going on and have a patch.
if you'll notice and read some of the posts put up after yours, you'll discover that once apple did know what was going on and had a patch.. they commented and released the patch.
as for the apachebench bit, i think they did comment very quickly. i seem to pretty clearly remember reading a technote at apple's website about it. in fact i think that was where i first saw it, linked from macnn. i searched the Tech Info Library just now (which may not be the same as teh technotes) and was not able to locate what i thought i rememebred reading, but i did locate http://til.info.apple.com/techinfo.nsf/artnum/n59
which is a general OS X Server patch that seems to adress the apachebench problem.
i remember when the ping of death became a problem, but it was long enough ago i can't remember how apple handled it.
apple does not like to do anything unless they can be sure of what they're doing. they do not like releasing software before they think it's perfect. they do not like talking about unreleased software until they're certain it's ready to be talked about. they do not like to comment on things they don't know enough about to comment on correctly. this seems pretty reasonable to me-- at least, it's slightly better than vaporwaring and amplifying rumors based on information they haven't personally verified yet.
Mac OS 9 and DoS (Score:1)
re: trin00 / TFN is much more of a problem (Score:1)
The OS9 thing is a networkcode issue, just like smurf attacks was. Whenever you design network code think about this: if the protocol being used does not use a handshake or in some other way verify the recipient, do NOT send large packets in response to small ones.
UDP & ICMP/IP can be used for this sort of attack very easily. if you use a clever DNS request I'm sure you can get a packet back that is a lot larger than your request. connectionless protocols all have that flaw.
On a last note though, this does not sound like a problem worth attention unless it responds to broadcast addrs.
From the CERT advisory: CA-99-17 Denial-of-Service (Score:2)
MacOS 9 can be abused by an intruder to generate a large volume of traffic directed at a victim in response to a small amount of traffic produced by an intruder. This allows an intruder to use MacOS 9 as a "traffic amplifier," and flood victims with traffic. According to [3], an intruder can use this asymmetry to "amplify" traffic by a factor of approximately 37.5, thus enabling an intruder with limited bandwidth to flood a much larger connection. This is similar in effect and structure to a "smurf" attack, described in
http://www.cert.org/advisories/C A-98.01.smurf.html [cert.org]
Unlike a smurf attack, however, it is not necessary to use a directed broadcast to achieve traffic amplification.
and
Appendix A. Vendor Information Apple Computer We've reproduced the problem in our lab and we are working now to create a fix that can be easily distributed to our customers. The problem only affects customers running our most recent release of networking software on machines that are continuously attached to the internet.
While most Macintosh customers are not affected by this problem, we are moving quickly to put a solution in place.
Re:the microsoft investment... (Score:1)
--
Re:Huh? (Score:1)
Check out my reference to Phrack 54.
Re:Can we get more information (Score:1)
--
Mike Mangino Consultant, Analysts International
Re:Sounds like a Smurf attack. (Score:1)
I'm afraid the only answer to that is ignorance. Nothing will break, after all - the protocol suite is intended to work with "real" addrs.
Re:trin00 / TFN is much more of a problem (Score:2)
Show me ten boxes you have rooted (not your own please
OS 9 Open Transport Issues (Score:1)
In fact we have not yet been able to get a single customer connected who is running it.
All of you mac people using modems to connect to the net may want to hold off until they get this one fixed.
Re:Boycott John Copeland! (Score:1)
Re:I knew it. (Score:1)
And as for your conviction of the opinion (masquerading as "fact") that an intuitive, ergonomic, logically structured operating system is somehow flawed (as a client of course... Classic MacOS is a poor server), well... I sure wish you had some sort of coherent argument to back up your assertions, but hey, that's cool.
We really ought to take this to email, to spare the rest of /., but since you're posting anonymously, I can't do that.
Re:I could have told you that one. (Score:1)
But: they already have: (Score:1)
Now, that didn't take long, did it?
offtopic (Score:1)
What methods are avaiable to stopping to slowing down this type of attack towards a Unix server? Would a firewall help, or could it be blocked at the router?
This type of attack has been avaiable to crackers for awhile now, but I haven't seen a decent method of preventing, stopping, or even slowing down this type of attack? Any ideas?
Could this be addressed in a ask Slash? It also burns when I take a piss, could this be addressed also?
some of this is a joke, can you guess which?
What "OS 9 Open Transport Issues" ? (Score:1)
Personally my b&w g3 running OS 9 that I am on right now via modem was a breeze to set up, and I haven't had a problem with it.
Duck`
Pardon my ignorance, but... (Score:1)
Re:Can we get more information (Score:2)
The problem is that the script kiddies crack a few hosts sitting on T1s or better and then run the attack from there.
You might check out CERT's [cert.org] paper on distributed DoS attacks [cert.org]. They don't go into great detail, but it does explain how the kiddies operate.
Sounds like a Smurf attack. (Score:2)
Here's my question: Why aren't more ISPs filtering out IP packets that have a "From" address of a machine not covered by the ISP? If a router services an ip block of... say... 192.168.0.*, why doesn't it drop packets that don't come "from" that address? I suppose the big question is, why is address spoofing even an issue anymore? Is there some sort of roaming technology that might break? Can someone point out what would be back about this?
Re:I dont understand (Score:2)
DOS means Denial Of Service. (Score:1)
See above.
Re:Wouldn't that be quite difficult (Score:1)
I hadn't considered the size of the ethernet frame, but then again, I'm not the type of guy that has the knowledge to consider things like that.
The reasoning not to just ping flood them from the rooted box is apparently this (from that link):
If the attack computer sends 4000 40-byte trigger packets per second
(bit rate less than 1.3 Mbps), the slave will send 4000 1500-byte packets
to the target (bit rate 48 Mbps).
The target organization (or organizations) is cut off from the Internet
because it's connection, a 1.5 Mbps (million bit per second) T-1 or a
45 Mbps DS-3 digital line is swamped with ICMP packets from forty
different sources. Note that 30 different T-1 connections could be
swamped by varying the return addresses in the trigger packets).
Does this make sense? I'm no guru (or neophyte, for that matter), but it sounds like you're saying this guy's "byte amplification" is a load of hooey because the ethernet frame for the little trigger packet is still 1500 bytes, so you're using up your bandwidth whether or not you fill up the frame. (wonderful feeling to knowingly display a lack of knowledge on
I'd agree that this seems like an odd method to launch a DoS attack. Except that it's kind of cool (if it's true).
-beme
Re:Sounds like a Smurf attack. (Score:1)
Very likely to be a hoax... (Score:1)
"evidence of a conspiracy to shut down Internet Connections", yeah, right..
It does seem on the page as if he is pro-mac, so I have no idea why he would post this.. but who knows what mental state he is in
Re:the Red Hat open source investment... (Score:1)
I could have told you that one. (Score:1)
Seriously, when has Apple's reaction ever been anything but "We have no official comment at this time"? Remember how long Macs were susceptible to the Ping of Death a few years back? Silence from Apple. ApacheBench crashing any MacOS X Server that it touched, possibly pointing to an architectural flaw? No comment. No offense to you, John (I'm not sure if you work for Apple or not), but Apple seems to be near the bottom of the list -- at least they're above Oracle -- when it comes to releasing critical information in a timely manner.
Cheers,
ZicoKnows@hotmail.com
exactly (Score:1)
Re:Huh? (Score:1)
From my own perspective: Quake 3 Arena runs at a lower ping under Linux than it does under Win 98. My pings (to my close local server) average around 60-100 ms under windows. They average 30-60 under Linux. Same hardware (I dual boot).
There is also probably a good deal of junk in the windows stack. This is why there are net-accelerators for windows. Again, I get faster download speeds under Linux (Cable modem) than I do under Windows. True, it could be tied to something else, but what? Given the number of times that I have installed (and Re-installed) Windows, and the times that I have upgraded my Linux Kernel and distro over the past few years, the pings and downloads are always better under Linux. You are correct, I can't prove its the stack. I just have very strong suspicion that it is. Is that enough to base an argument on? Probably not. Still I would be interested as to your thoughts on what could cause the difference.
Regarding the first response, I still don't see how Red Hat is an equivalent, they don't control the TCP/IP stack under Linux, Microsoft obviously does under Windows. Microsoft has had its stack attacked many times, and is slow to fix it. The same attacks have been levied at Linux (just as this Mac DOS attack is being discussed) and the fixes have been extremely fast.
My question is what is your point? The original post was funny, especially to myself as I have dealt with both OS's for some time. Microsoft DID make a "donation" to Apple. AFAIK, Red Hat did not. (And why post as AC anyhow?)
Re:Since source is closed, we must wait for Apple. (Score:1)
--
Boycott John Copeland! (Score:3)
Re:OS 9 Open Transport Issues (Score:1)
Re:I could have told you that one. (Score:1)
Re:I knew it. (Score:1)
Conscience is the inner voice which warns us that someone may be looking. [lemuria.org]
Re:the microsoft investment... (Score:1)
Re:OS 9 Open Transport Issues (Score:1)
Bug MUCH more than UDP (Score:1)
Re:Huh? (Score:2)
They already did sue, in fact. (Score:2)
See http://ww w.macobserver.com/news/99/september/990903/microw
DOS Client? (Score:2)
Sure, it's worth style points, but does CERT really need to know about it?
Re:Can we get more information (Score:1)
Remeber, the bandwidth is used at the ethernet layer. A 29 byte udp packet still uses 1500 bytes of bandwidth.
I've read this comment a few times now. It is nonsense, ofcourse. Ethernet packet are variably sized.
yup (Score:1)
Those tech support guys are bastards, especially Todd. And no one else at Apple will comment on anything either.
If you want more info about this, I'd just stay tuned to sites like:
www.macnn.com
www.xlr8yourmac.com
www.maccentral.com/forum/
www.macfixit.com
www.macintouch.com
Apple may keep its mouth shut until it has a fix. Apple might even wait for MacOS 9.0.1 to release a fix(see www.appleinsider.com)
"OS-9"? (Score:1)
I'm now taking bets on how long before Microware wakes up it's lawyers.
Patch... to be applied before Jan 1 ?! (Score:2)
Apple has developed a patch, but it must be applied by OS-9 Macintosh owners before New Years Eve to be effective.
I guess someone has somehow acquired access to this guy's webpage and put all the BS there (like Mahir
Re:Can we get more information (Score:1)
Remeber, the bandwidth is used at the ethernet layer. A 29 byte udp packet still uses 1500 bytes of bandwidth.
I've read this comment a few times now. It is nonsense, ofcourse. Ethernet packet are variably sized. And you can most certainly send a 29 byte UDP packet.
Re:Engineers on vacation. (Score:1)
No. As far as Macs are concerned, this bug is specific to the version of OpenTransport in OS9.0
Re:Wouldn't that be quite difficult (Score:2)
Every layer the packet passes through with add and remove any necessary padding for transmission. For example, if that 69 byte IP frame were to pass through an ATM (AAL5) network, it would need two 53byte ATM cells.
Re:the Red Hat open source investment... (Score:1)
Redhat's done squat... so far as this discussion goes.
Re:Apple's Statement (Score:2)
"Since CERT has posted their advisory this afternoon, it does appear to be something real. I still haven't been able to find any further internal information, but when I do, I will pass it along.
John"
Apple's Statement (Score:5)
"We have no official comment at this time.
Remember, we have a policy of not discussing unannounced updates. Once I find out any further
information, I will tell you what I can.
For one thing, it smells like a hoax to me. First, there is already a product called "OT Tuner"
from a third-party company (Sustainable Softworks), so we would be extremely unlikely to use
this name. Second, we would never supply any kind of "patch" software to an outside party
without making them sign a non-disclosure agreement. Third, most of the engineers were on
holiday at the end of last week, and it is very unlikely a patch could have been developed and
tested in such a short time without information going out internally within Apple (which hasn't
happened).
I'm not saying it is indeed a hoax, I'm just saying don't put a lot of validity to it until we know
more.
John Phelps
Forum Leader - Apple Support Discussions"
Wouldn't that be quite difficult (Score:3)
a) Have a very long list of Mac's running OS9
b) Send out a lot of UPD packets
In fact, you would have to send out as many packets as the attacked server will recieve. So basically, you have to have enough bandwidth to withstand your own DOS attack. Of course it does have the advantage of hiding your IP, but it sounds no more effective than "ping -f".
Can we get more information (Score:3)
So normally, you send an ICMP response request packet (a ping packet) to a machine and it responds to you. This is a pretty simple concept. The problem is that you flood the connection with your ping requests. I believe ping floods are normally caused when you get the machine to respond on a broadcast or multicast address. If the mac just responds with a ping response, this isn't a very important discovery.
However, there are other kinds of ICMP (Internet Control Message Protocol) packets. Maybe this isn't a straight ping request or ping response flood. Unfortunately, there isn't more information provided about it. Can someone post more information?
--
Mike Mangino Consultant, Analysts International
Why just OS9 (Score:2)
Jazilla.org - the Java Mozilla [sourceforge.net]
Does this seem like a dumbass to anyone else? (Score:3)
Yup. Sounds easy as pie to me.
Then there's some of his "proof", like the CERT email. From which he removes a paragraph with no indication what it used to say, and removes the PGP signature. It also merely talks about a completely different attack, and says "if we get time to look at this alleged OS 9 thing, we'll try."
Just smells fishy to me.
ryan
trin00 / TFN is much more of a problem (Score:2)
And how exactly is this more dangerous than trin00 / Tribe Flood Network? For those who haven't heard of trin00/TFN, it is networks of hundreds of r0043d machines on the Internet, each running daemons with the sole purpose of flooding any IP from widely scattered machines, all under the control of 5kr1p4 k1dd3z.
I suppose if the trin00/TFN code were updated to support this new kind of DoS as an option, it could be bad, but a bug like this can not be easily exploited to disrupt the internet itself, since Macs make up such a small population of the "live" Internet.
This is not to say that the DoS can't be launched against the MacOS 9.0 machines themselves, but the potential for widespread 1/1/2000 mischief is limited.
Re:Huh? (Score:2)
Nope. There was an "issue" with Win98 and one of the Win2K betas or RCs and IGMP floods. They'd cause a bluescreen in the affected versions of Win98 and Win2K, but didn't in Win95 or NT4.
Re:Wouldn't that be quite difficult (Score:2)
So, couldn't you send the packetr to the Macs using a very small frame size and have them in return clog the pipe for you? It sounds that way to me.... maybe i'm wrong
Re:Can we get more information (Score:2)
Re:Why just OS9 (Score:2)
Because OT is totally modular, any bug fix/patch would be a nice small download, well under a Meg, unless Apple decides to roll the patch into OS 9.0.1, coming soon.
Pope
Re:Wouldn't that be quite difficult (Score:2)
1) In his experiments, only macs running OS9 responded to the scans he ran. Easy way to gather a pretty big list.
2) a 40 byte trigger packet results in a 1500 byte response, so you get a nifty little bandwidth multiplier there.
The page to read is http://people.atl.mediaone
-beme
CERT Advisory (Score:2)
37.5x traffic amplication. Wheeeeeeee.
Although that is incredibly dangerous, this guy is actually making a claim of an expected international y2k attack on the basis of two foreign port scans. hmmmm. Someone had a bit too much coffee.
Anyhow, I can't seem to find any reference of this on Bugtraq. He appears to have only informed CERT and his local network admin.
matt
Re:Sounds like a Smurf attack. (Score:2)
Yes, and I would certainly call that a "good thing," but that's a little different from what I was asking. You're refering to preventing a spoofed 1.1.1.1 packet from entering the 1.1.1.1 network. What I'm asking is why don't more places prevent 1.1.1.1 from sending out a spoofed 2.2.2.2 packet? 2.2.2.2 isn't on that network, so why shouldn't packets heading out "from" those addresses be blocked? I'm trying to think of a legitimate reason for allowing these false from addresses in IP packets, but I can't at the moment.
Apple just released OT Tuner 1.0 (Score:3)
http://asu.info.apple.com/swupdates.nsf/artnum/
Description
OT Tuner 1.0 switches off an option in Open Transport that would cause a Macintosh to respond to certain small network packets with a large Internet Control Message Protocol (ICMP) packet. This update prevents Macintosh computers from being the cause of certain types of Denial of Service (DOS)
issues.
To install, drag the OT Tuner 1.0 file to the System Folder (the tuner will be put in the extensions folder for you). Then restart your Macintosh.
Here's the info... (Score:3)
Copeland (Score:4)
He's just jealous that they ended up not naming their OS after him.
---
not just a Mac OS 9 problem (Score:5)
*****
Date: Tue, 28 Dec 1999 13:06:31 -0800
From: Geoff Duncan
Subject: Re: Mac DoS Attack
While the attack outlined by Copeland is feasible, it's worth noting the 1500-byte ICMP responses he describes are not isolated to Mac OS 9, and are more-or-less standard practice in a number of networking implementations, regardless of whether those are based on Mentat's STREAMS. Macs running Mac OS 9 are by no means the only systems which demonstrate this behavior; in fact, I can easily make a number of dedicated routers behave the same way. If I were a cracker intent on causing damage with this sort of attack, why would I bother to locate Macintoshes on DSL or cable modem networks when I can utilize the same behaviors in thousands of routers all over the Internet, each of which is presumably easy to locate and has reasonable (or excessive) amounts of bandwidth at its disposal?
The amplification attack Copeland describes involved gaining root access to a box with a big pipe - probably something running a flavor of Linux, Unix, or NT - and creating home-make forged packets. There are a number of potentially devastating attacks that can be launched under those circumstances that have nothing to do with Macs. TidBITS has been treated to a small selection of these sorts of attacks for the last several weeks. Calling for Mac OS 9 computers to be patched or taken off the net is not going to solve the problem or eliminate the feasibility of the attack Copeland describes.
Also, Copeland's speculation that the datagrams he detected are probes pursuant to Macintosh-specific News Year's Eve attacks are best described as unsubstantiated speculation. At worst, they might be described as irresponsible. I would hope any further coverage this report gains in the Macintosh press will be more objective than what's currently playing on the standard "rumor" sites.
*****
Here's the gist of the scheme (Score:2)
Had to search the web site a little to find this, so I thought I'd post it to make people's lives easier. The problem I see with the theory above is that: what ADSL/Cable connection could support 48 Mbps of data from the Macs? I think there would have to be an AWFUL LOT of Mac slaves to actually swamp a DS-3 connection. In fact, I bet it isn't even possible.