Re: Attacking every host in the path?

[Bugtraq Mailing Lists <bugtraq () terra pissah com>]

Mike,
        It is very possible that the attacker has run traceroute to a host
on your network, attacking your routers in its path, and your upstream
router, including the border router. There isn't much of other way to
figure out your network without using a traceroute. You can block
traceroute comming in from the Internet on your border router. In such
case, the border router will stop traceroutes from going into your network
with !X or !A icmp messages (Icmp protocol-prohibited, etc). The only
information the attacker will have after that is basically the IP of your
border router and the destination host he originally attacked. Or if you
disable icmp type time-exceeded altogether on the border router, the only
IP that will show up is the destination host in traceroute.

That may be the one way attacker might have used. The other way is,
attacker may have looked up yoru IP address in ARIN whois, and attacked
the whole IP block that you might own.

Hope this helps

--haesu

On Tue, 8 Jan 2002, Mike Lewinski wrote:

> Are there any known tools for generating attacks against every host in a
> given path?
>
> We have a client who has been attacked directly by IP address several times.
> Working with our peers we have null routed the target when the attacks were
> too large or had too many forged source addresses to otherwise defend.
>
> Today the attackers began targeting our infrastructure, and it was noticed
> when the border router reported "remote RSHELL attempts" against it to
> syslog. I suspect that this was due to random destination ports in the
> attack. Most of the source hosts were obviously bogus, but we haven't ruled
> out the attack as cover for intrusion attempts. But there were clearly
> packet floods against upstream routers several hops from the destination,
> and our peer noticed activity that appeared to be aimed at them as well.
>
> I'm aware that this could be a slightly clever individual who understands
> traceroute, but wonder if we're not seeing some new script kiddie tool.
>
> Mike
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com