But Unix-based Tribal Flood Network and Trin00 overcome that barrier by allowing a single user, by means of the appropriate client software, to launch a coordinated attack on a target from thousands of compromised machines in which the necessary server software has been installed. Attackers can remotely install Tribal Flood Network and Trin00 on unsuspecting hosts by exploiting buffer-overflow vulnerabilities or one of a handful of other vulnerabilities. Claus says thousands of these ping-launching zombie machines have already been identified, many in university and government networks that are unprotected by firewalls. This new type of ping flooding capability means that a single attacker at his desktop could masquerade as a huge group sending out disabling pings. According to a recent CERT Coordination Center advisory, the target of an attack may not be able to rely on Internet connectivity for communications.
CERT suggests that firms have alternatives to the Internet for data communications.
CERT also recommends that if you discover one of these distributed attack tools installed on your servers, realize that it might provide information useful in locating or disabling other parts of the distributed attack network. Pages will open in a new browser window External sites are not endorsed by CNN Interactive. All Rights Reserved. Terms under which this service is provided to you. Read our privacy guidelines .