The Strange Tale of the
Attacks Against GRC.COM
by Steve Gibson, Gibson Research Corporation
Page last modified: Sep 17, 2005 at 11:40
Nothing more than the whim of a 13-year
old hacker is required to knock any user,
site, or server right off the Internet.
I believe you will be as fascinated and concerned as I am by the findings of my post-attack forensic analysis, and the results of my subsequent infiltration into the networks and technologies being used by some of the Internet's most active hackers.
nearly 2.4 BILLION malicious packets.
If the attacking machines had been running Windows
2000 or the home-targeted version of Windows XP, as
they certainly will be next year, we would have been
utterly defenseless and simply forced off the Internet.
This is what anyone on the Internet can soon expect.
Stemming the Flood with Our ISP
Within a minute of the start of the first attack it was clear that we were experiencing a "packet flooding" attack of some sort. A quick query of our Cisco router showed that both of our two T1 trunk interfaces to the Internet were receiving some sort of traffic at their maximum 1.54 megabit rate, while our outbound traffic had fallen to nearly zero, presumably because valid inbound traffic was no longer able to reach our server. We found ourselves in the situation that coined the term: Our site's users were being denied our services.