contributed by Brian Martin
So what exactly is going on out there? What are these denial of service attacks that are taking down high profile sites left and right? What makes these sorts of attacks succeed? Why hasn't anyone been caught yet? Will anyone get caught? How do I protect myself? Who's fault is it?

Everyone seems to have questions but no one seems to have answers.

Have Script, Will Destroy (Lessons in DoS)

contributed by Space Rogue
Web Sites around the net are bracing for more attacks today as such major companies as E-Trade, LA Times, Datek, and ZD-Net recover from massive denial of service attacks.

There are lots of rumors flying around the net right now. Some are pretty far fetched but others are more believable. One such rumor is it that the packets that have been used to flood at least one of sites may have contained content: A source close to HNN says the content includes "Various references to Mixter, greets to hacker groups, etc. Several references to the Internet becoming a "whorehouse of E-commerce". Of course at this time none of this is confirmed.

Law enforcement agencies are working over time attempting to track down the perpetrator(s). Some sources indicate that they may be close to an arrest while others still say they have little to go on.

What is surprising is that some companies are not admitting that they were hit by this attack. Microsoft has admitted that a partner was hit but they would not identify which one. A Lycos statement said that they already take 'extensive precautions' and declined further details. Companies need to realize that clamming up and closing the doors will not prevent this sort of thing from happening again. Only through communication and the sharing and pooling of information will a solution, and the attacker(s), be found.

The Industry Standard
ZD Net
Smart Money
Wired
ABC News
Bloomberg
Fox News
CNN

contributed by jericho
NIPC has developed a new release of the software application that will detect tfn2k client, tfn2k daemon, trinoo daemon, trinoo master, tfn daemon, tfn client, stacheldraht master, stacheldraht client, stachelddraht demon and tfn-rush client. This new version (find_ddosv31) is now available for Solaris on Sparc or Intel platforms and Linux on Intel platforms and will no longer improperly identify itself or any previous version as a DDOS program.

NIPC

Unfortunately they are only distributing executables and not source. With all the recent cases of the FBI and NSA trying to pass legislation that will allow them to backdoor various communications systems, computer networks and everything else.. how could anyone trust these?

contributed by Macki and Bronc
2600.com has an interesting viewpoint on this whole mess and the media representations of hackers.

2600.com

Bronc Buster has posted an article with more opinions from the underground about these recent attacks.

The Synthesis

contributed by Space Rogue
We linked to this yesterday but we feel it is worth mentioning again. The CERT Coordination center held a workshop concerning this type of attack back at the beginning of November.

Results of Distributed-Systems Intruder Tools Workshop

CERT has also released a couple of advisories warning system administrators about the dangers of this kind of attack.

CERT Advisory CA-99-17 Denial-of-Service Tools
CERT Advisory CA-2000-01 Denial-of-Service Developments

contributed by Arik
A worm known as Win32 Haiku.16384, or Haiku Worm for short, has been identified as a potential threat to Internet sites. Once infected the worm searches a victims hard drive for email addresses and then mails itself out to every address it finds.

PR Newswire - via Yahoo