Home

Previous Entry | Next Entry

Under Attack

  • May. 27th, 2009 at 3:32 PM
James Unshaven
Yesterday my network was attacked. Hundreds of sites did portscans and attempted to establish Trojans in my network. The attack was so heavy it amounted to a Denial of Service. My Mac Mini started having problems before Cathy's laptop did.

I cut the power to the Yoggie Gateway, then restored power after a few seconds. The reset and reload took about ten minutes. I still had trouble reaching the Internet but I could look at my Yoggie status. The system logs showed several kinds of attacks from a great variety of sites. The attacks were obviously coordinated.

Response time gradually improved to the point that we hardly noticed the attacks but the logs showed that the attacks continued all night long. None of the malware got through, though, as far as I can tell; that is, the Yoggie system reports say there are no infections.




Comments

( 4 comments — Leave a comment )
[info]grioghair wrote:
May. 29th, 2009 12:27 am (UTC)
Any idea who was behind this, and what actually caused it?
[info]am0 wrote:
May. 29th, 2009 06:12 am (UTC)
Attacker
It sounds like a typical attack: somebody infects a whole bunch of machines anonymously and instructs all of them to do a port scan or try to infect a chosen victim with a Trojan or virus. The owners of the infected machines are probably unaware that their machines are attacking mine. If I didn't have the Yoggie Gatekeeper, I would probably be unaware that an attack took place, even though such attacks happen all of the time. One clue is that I detected the attack shortly after installing the Yoggie Gatekeeper on my wireless net.

Previously, I have noted mysterious slowdowns fairly often. I just didn't know what caused them. I know many people, especially Linux people, who have installed their own cheap computer with Linux to do what the Yoggie does for me now. They say that unprotected systems usually are attacked within seconds of going on to the Internet. I'm pretty sure that happened to me when I was last infested. When I first installed the Yoggie there were many attacks in the first ten minutes of operation. I had been considering setting up an old machine to do the job -- software packages and advice are available on the Web -- but I really don't have space for a big machine.
[info]grioghair wrote:
May. 30th, 2009 03:16 am (UTC)
I thought, maybe, it might have been one of the many strains of conficker that is floating around. I went back to Norton. I just heard that Kaspersky has let through a hacker who stole visa card info. I never store that info on a computer.
[info]am0 wrote:
May. 30th, 2009 04:34 am (UTC)
Virus
There are so many infestations of so many kinds of viruses, Trojans, worms and so on that traffic from the malware makes up a significant part of all Internet traffic. They are so numerous that eventually one will make it through almost any defense. Adding another layer of defense didn't buy absolute security but a combination of defenses, including using a Mac or Linux system makes it harder for the bandits to own me. That doesn't mean I can safely play or share the presentations my friends send me, as my wife does. Being aware of what behavior is risky helps, too. Not storing dangerous information on your system is nice if you don't ever make purchases on the Internet but giving your information to real stores is dangerous, too. I imagine we'll begin to encrypt everything on our machines, too, in the not too distant future.
( 4 comments — Leave a comment )