new offensive solution for DDoS

imported_Stephen · Post #1 (**permalink**) 03-18-2004, 08:46 AM

Quote:

AUSTIN, TEXAS - March 4, 2004 - Symbiot, Inc., an emerging leader in the field of Intelligent Security Infrastructure Management Systems (iSIMS), today announced the first IT security solution that can both repel hostile attacks on enterprise networks and accurately identify the malicious attackers in order to plan and execute appropriate countermeasures - effectively fighting fire with fire.

Do you think this will be successful?

I think it will cause problems because DDoS uses machines of innocient people, doing something in return to them attacking could cause problems for them, run up their bandwidth useage and maybe even go against their TOS

BlackStorm · Post #2 (**permalink**) 03-18-2004, 08:59 AM

Quote:

“Until today, security solutions have been totally passive in nature,” said Michael W. Erwin, president of Symbiot, Inc. “Merely erecting defensive walls around the perimeter of an enterprise network is not an adequate deterrent.” Symbiot’s iSIMS software provides graduated response levels based on the severity of the attacks, and the manager’s authority to respond. When it is necessary to act, Symbiot’s iSIMS does not limit the means available for network self-defense. Rather, the response is limited by the intensity, duration and realized effect of each attack. Symbiot’s iSIMS solution integrates seamlessly with existing enterprise architectures. In addition to monitoring and managing the security infrastructure that protects valuable digital assets, Symbiot’s iSIMS enables customers to take appropriate action to respond when attacked. “Symbiot has introduced the first and only tool that intelligently and accurately responds to hostile attacks against enterprise networks,” said Richard Forno, former chief security officer for Network Solutions, and a noted information warfare specialist. “While other companies offer only passive defense barriers, Symbiot provides the equivalent of an active missile defense system.”
- more - About Symbiot Symbiot® (www.symbiot.com) is an emerging leader in the Intelligent Security Infrastructure Management Systems (iSIMS) marketplace. With the aid of proprietary artificial intelligence (AI) software, Symbiot's iSIMS (intelligent SIMS) analyzes network patterns to provide real-time, predictive tools for managing and responding to security events. Symbiot's iSIMS software interoperates with existing firewalls, intrusion detection systems, and intrusion prevention systems.

This is from a pdf on their site

It has a bit more information on what they are doing

Lesli · Post #3 (**permalink**) 03-18-2004, 10:35 AM

Here's hoping that the rest of the Internet doesn't get caught in the crossfire. If their system can correctly identify the true culprits, then great, go for it. I do like the thought of spammers, DDoS black-hat hackers, and others being made to pay for their actions.

However, I do see that hosts may get caught in this crossfire. And how will ISPs respond? They'll also be caught as well. How will consumers react if this starts causing severe network lag? And what will happen the first time someone is "caught" incorrectly?

BlackStorm · Post #4 (**permalink**) 03-18-2004, 10:53 AM

Lesli, thats the main thing I was thinking about.
If its also attacking the remote machines, it will be using even more of the hosts bandwidth, this, plus the bandwidth used by the initial DDoS could cause HUGE fines for hosts.

It could cause really big network lag I think because of all the traffic going in both directions, just think of 200 machines attacking a server by DDoS, and then the server returning "fire".
What if you have 10 servers being attacked at the same time, on the same network

Not something I would want to experience

turnkey · Post #5 (**permalink**) 03-18-2004, 10:55 AM

What if the hacker had that "software" in place as well? Nothing like two machine guns going off at the same time.

Although, it does sound like a nice system. I have a passive anto DDoS system in place with my server at The Planet but don't know how well it works. I don't want to find out...

RobAPI · Post #6 (**permalink**) 03-18-2004, 02:05 PM

Quote:

What if the hacker had that "software" in place as well? Nothing like two machine guns going off at the same time.

Great point.
What would happen if two servers are doing this?
Ie. two online hosting servers, one of which has been taken by a hacker launching a DDoS and attacking another hosting server.
What would the software do then?
Would they both try "attack" each other?

imported_maxhest · Post #7 (**permalink**) 03-18-2004, 07:23 PM

Hmm, intresting point. I would like to see what this is. Probally expensive, although.

turnkey · Post #8 (**permalink**) 03-18-2004, 08:08 PM

Yea, the small guy (us) will probally never get our hands on this anyhow. Intelegent software sounds like 10k range or more.

imported_HadleyHost · Post #9 (**permalink**) 04-27-2004, 02:19 PM

It sounds good - a lot of places have been ddossed recently

Freckled · Post #10 (**permalink**) 04-27-2004, 04:48 PM

Quote:

Originally posted by turnkey
Yea, the small guy (us) will probally never get our hands on this anyhow. Intelegent software sounds like 10k range or more.

That's probably very true turnkey but most large datacenters would probalby apply it to all machines and just charge a couple more bucks on the servers prices, They are just as interested in keeping us covered as we are, I hope we hear more about this as it gets closer to the marketing stage

imported_Andrew · Post #11 (**permalink**) 04-28-2004, 02:05 PM

The true value here is in being able to accurately identify the attacking party (which - I am yet to be sold on) - However, if this system could accurately identify the source of these attacks - its worth every dollar.

I dont think the counter strike has much value and Im sure sure if they are playing on pent up frustration of IT professionals to make sales - but, a counter attack would be just as bad as the initial attack..

To me, being able to track the $^@#%$%$#$%#@'ers down and let appropriate legalities run their course would bring a smile to my face...