A Primer: How the Hackers Attack

The Dawn of Orchestrated Attacks

Hackers have toyed with the concept of synchronized flood attacks, but the first serious attempt at this came late last year. A hacker who calls himself Mixter created a program called Tribal Flood Network that permits even a hacker with marginal skills to cause mayhem in this manner.

TFN (and its counterparts Trib00 and Stacheldraht) use an ingeniously simple method to achieve their goal. The program comes in two parts. One is a small, remotely controllable program that can flood a site at any time; the second is the remote controller that synchronizes all the attacks.

Hackers need only to break into systems all over the Internet and plant the flood program on various servers. Then, when enough machines are running the flood program, the conductor (hacker) raises his baton and the symphony (distributed DoS attack) begins.

Don't Try This at Home

Typically, home or office users running Windows 95 or 98 aren't the target, either as unwitting hosts of the flood programs or as flood victims. Hackers want systems running UNIX operating systems (or the variant Linux), which are permanently connected to the Internet over high-speed lines. The FBI's National Infrastructure Protection Center (NIPC) provides free software to anyone who wants to check whether their systems are compromised with TFN, Trib00, or Stacheldraht (which means "barbed wire" in German).

The hackers can't use the DoS attack to steal passwords or information from the systems they attack. In fact, some hackers deny such attacks are true "hacks." They call the DoS attacks a case of vandalism, not of terrorism.

"They're not hackers, they're vandals," said Chris Tucker of the hacker group Cult of the Dead Cow. "DoS attacks are nothing new, really. In this case, they were coordinated against big-name sites and got some press attention."