Spamhaus attacks expose huge open DNS server dangers

Massive distributed denial-of-service attacks on Spamhaus this week focused widespread attention on the huge security threats posed by millions of poorly configured Internet Domain Name System (DNS) servers.
The attacks on Spamhaus that began March 19 were apparently launched by a group opposed to the Geneva, Switzerland-based volunteer organization's antispam work.
Several security firms described the attacks on the organization as the largest -- by far -- ever publicly known DDoS attacks to date.
In DDoS attacks, hackers typically try to take down a network by directing huge volumes of useless traffic to it. The traffic is usually generated using large botnets of compromised computers.

Large DDoS attacks have typically tended to involve between 4 gigabits per second to 10Gbps of traffic.
The Spamhaus attacks involved traffic volumes that reached a staggering 300Gbps -- said to be three times larger than the largest DDoS traffic seen to date and magnitudes greater than the traffic involved in a majority of past denial-of-service attacks.
The perpetrators behind the attack employed the well-known but infrequently used method DNS reflection to generate the huge stream of DDoS traffic directed against Spamhaus.
DNS servers are used primarily to look up and resolve domain names such as www.computerworld.com and www.idg.com to their corresponding IP addresses. If a DNS server does not have the domain information in its database or cache, it queries other nearby DNS servers for the information.
Ideally, DNS servers should be configured only to handle look-up requests coming from within a specific domain or IP address range. So a DNS server belonging to an ISP should handle only requests coming from within its IP address range.
In reality, however, millions of DNS servers are configured by default to be open DNS resolvers that accept and respond to queries from outside their own domain, making them vulnerable to exploitation by attackers because virtually anyone on the Internet can use an open DNS server to handle genuine or malicious queries.
For instance, to generate DDoS traffic, the attackers behind the Spamhaus attack sent queries with a spoofed source address to tens of thousands of open DNS resolvers, said Matthew Prince, CEO of CloudFlare, which has been helping Spamhaus deal with the recent attacks.
The lookup requests were made to appear as if they came from Spamhaus. So the responses to the requests from the tens of thousands of open DNS resolvers were sent to Spamhaus, generating a huge volume of traffic.
To magnify the volume of traffic, the attackers crafted the look-up queries in such a manner as to get each open DNS server to respond with much larger volumes of data than normal, Prince said.








Denial-of-service attacks that take advantage of open DNS resolvers are not new.
As far back as in 2006, more than 1,500 organizations around the world were hit by a series of similar attacks, prompting wide concern from security experts.
Then, as now, many security experts warned that ISPs and others operating DNS servers must ensure that their systems are properly configured to prevent attacks such as the one launched against Spamhaus. The problem remains as pervasive as ever despite the warnings, experts note today.
The Open DNS Resolver Project , an effort by a group of security experts to draw attention to the issue, estimates that there are currently about 27 million DNS servers that are open resolvers. About 25 million of those pose a significant threat, according to the project's website.

According to Prince, barely 100,000 of the open resolvers were used to direct 300Gbps of traffic against the organization. "What's spooky here is that only a tiny fraction of the open resolvers were used," he said. The attackers could easily have co-opted more DNS servers, Prince noted.
"This is a situation where some configuration changes on the DNS server side can help prevent the attacks," said Alex Cox, a principal security researcher with RSA Security's FirstWatch team.
But the required changes are difficult to get without a broad collaboration among ISPs. "The problem with a DNS attack is you can't really turn your DNS servers off" without causing widespread disruption, Cox said. "Once this thing blows over it will be interesting to see how some of the folks whose infrastructure was used will respond."
The perpetrators of this week's attacks knew that Spamhaus had a good infrastructure in place to deal with denial-of-service attacks and therefore had to do something really big, said Dan Holden, director of the security and engineering response team at Arbor Networks.
Such attacks are not fully defendable but can be mitigated by ensuring that DNS servers are configured properly, he said. "The good news is that these open DNS resolvers will get a lot more visibility" following the attacks he said. "So hopefully the issue will get fixed."
Several standards are readily available to help ISPs and others operating DNS servers to configure systems to ensure they respond only to requests from their own users, said Mike Smith director of the customer security incident response team at Akamai.
DNS server operators also need to have egress filtering controls in place to ensure that the DNS traffic leaving their networks originated from inside their network, he said.
The Open DNS Resolver Project also calls on DNS server operators to consider implementing rate-limiting software to prevent the sort of traffic amplification that was used in the Spamhaus attacks.
"There are things that need to get cleaned up. That is why we need some awareness of the problem," Smith said.

Read More

The OSI Reference Model In brief

One of the greatest functions of the OSI specifications is to assist in data transfer between disparate
hosts—meaning, for example, that they enable us to transfer data between a Unix host
and a PC or a Mac.
The OSI isn’t a physical model, though. Rather, it’s a set of guidelines that application
developers can use to create and implement applications that run on a network. It also provides
a framework for creating and implementing networking standards, devices, and internetworking
schemes.
The OSI has seven different layers, divided into two groups. The top three layers define how
the applications within the end stations will communicate with each other and with users. The
bottom four layers define how data is transmitted end to end. Figure 1.6 shows the three upper
layers and their functions, and Figure 1.7 shows the four lower layers and their functions.
FIGURE 1 . 6 The upper layers
• Provides a user interface
• Presents data
• Handles processing such as encryption
• Keeps different applications’
• data separate
Application
Presentation
Session
Transport
Network
Data Link
Physical










When you study Figure 1.6, understand that the user interfaces with the computer at the
Application layer and also that the upper layers are responsible for applications communicating
between hosts. Remember that none of the upper layers knows anything about networking
or network addresses. That’s the responsibility of the four bottom layers.
In Figure 1.7, you can see that it’s the four bottom layers that define how data is transferred
through a physical wire or through switches and routers. These bottom layers also determine
how to rebuild a data stream from a transmitting host to a destination host’s application.
FIGURE 1 . 7 The lower layers
The following network devices operate at all seven layers of the OSI model:
Network management stations (NMSs)
Web and application servers
Gateways (not default gateways)
Network hosts
Basically, the ISO is pretty much the Emily Post of the network protocol world. Just as Ms.
Post wrote the book setting the standards—or protocols—for human social interaction, the
ISO developed the OSI reference model as the precedent and guide for an open network protocol
set. Defining the etiquette of communication models, it remains today the most popular
means of comparison for protocol suites.
The OSI reference model has seven layers:
Application layer (layer 7)
Presentation layer (layer 6)
Session layer (layer 5)
Transport layer (layer 4)
Network layer (layer 3)
Data Link layer (layer 2)
Physical layer (layer 1)










The Application Layer
The Application layer of the OSI model marks the spot where users actually communicate to
the computer. This layer only comes into play when it’s apparent that access to the network
is going to be needed soon. Take the case of Internet Explorer (IE). You could uninstall every
trace of networking components from a system, such as TCP/IP, NIC card, and so on, and you
could still use IE to view a local HTML document—no problem. But things would definitely
get messy if you tried to do something like view an HTML document that must be retrieved
using HTTP or nab a file with FTP or TFTP. That’s because IE will respond to requests such
as those by attempting to access the Application layer. And what’s happening is that the Application
layer is acting as an interface between the actual application program—which isn’t at
all a part of the layered structure—and the next layer down by providing ways for the application
to send information down through the protocol stack. In other words, IE doesn’t truly
reside within the Application layer—it interfaces with Application layer protocols when it
needs to deal with remote resources.
The Application layer is also responsible for identifying and establishing the availability of
the intended communication partner and determining whether sufficient resources for the
intended communication exist.
These tasks are important because computer applications sometimes require more than
only desktop resources. Often, they’ll unite communicating components from more than one
network application. Prime examples are file transfers and email, as well as enabling remote
access, network management activities, client/server processes, and information location.
Many network applications provide services for communication over enterprise networks, but
for present and future internetworking, the need is fast developing to reach beyond the limits
of current physical networking.












The Presentation Layer
The Presentation layer gets its name from its purpose: It presents data to the Application layer
and is responsible for data translation and code formatting.
This layer is essentially a translator and provides coding and conversion functions. A successful
data-transfer technique is to adapt the data into a standard format before transmission.
Computers are configured to receive this generically formatted data and then convert the data
back into its native format for actual reading (for example, EBCDIC to ASCII). By providing
translation services, the Presentation layer ensures that data transferred from the Application
layer of one system can be read by the Application layer of another one.
The OSI has protocol standards that define how standard data should be formatted. Tasks
like data compression, decompression, encryption, and decryption are associated with this
layer. Some Presentation layer standards are involved in multimedia operations too.
The Session Layer
The Session layer is responsible for setting up, managing, and then tearing down sessions
between Presentation layer entities. This layer also provides dialog control between
devices, or nodes. It coordinates communication between systems and serves to organize
their communication by offering three different modes: simplex, half duplex, and full
duplex. To sum up, the Session layer basically keeps different applications’ data separate
from other applications’ data.
The Transport Layer
The Transport layer segments and reassembles data into a data stream. Services located in the
Transport layer segment and reassemble data from upper-layer applications and unite it into
the same data stream. They provide end-to-end data transport services and can establish a
logical connection between the sending host and destination host on an internetwork.
Some of you are probably familiar with TCP and UDP already. (But if you’re not, no worries—
I’ll tell you all about them in Chapter 2.) If so, you know that both work at the Transport
layer and that TCP is a reliable service and UDP is not. This means that application developers
have more options because they have a choice between the two protocols when working with
TCP/IP protocols.




The Network Layer
The Network layer (also called layer 3) manages device addressing, tracks the location of devices
on the network, and determines the best way to move data, which means that the Network layer
must transport traffic between devices that aren’t locally attached. Routers (layer 3 devices) are
specified at the Network layer and provide the routing services within an internetwork.
It happens like this: First, when a packet is received on a router interface, the destination IP
address is checked. If the packet isn’t destined for that particular router, it will look up the destination
network address in the routing table. Once the router chooses an exit interface, the packet
will be sent to that interface to be framed and sent out on the local network. If the router can’t find
an entry for the packet’s destination network in the routing table, the router drops the packet.
Two types of packets are used at the Network layer: data and route updates.
Data packets Used to transport user data through the internetwork. Protocols used to support
data traffic are called routed protocols; examples of routed protocols are IP and IPv6.
You’ll learn about IP addressing in Chapters 2 and 3 and IPv6 in Chapter 13 .
Route update packets Used to update neighboring routers about the networks connected to
all routers within the internetwork. Protocols that send route update packets are called routing
protocols; examples of some common ones are RIP, RIPv2, EIGRP, and OSPF. Route update
packets are used to help build and maintain routing tables on each router.
In Figure 1.13, I’ve given you an example of a routing table. The routing table used in a
router includes the following information:
Network addresses Protocol-specific network addresses. A router must maintain a routing table
for individual routing protocols because each routing protocol keeps track of a network with a different
addressing scheme (IP, IPv6, and IPX, for example). Think of it as a street sign in each of the
different languages spoken by the residents that live on a particular street. So, if there were American,
Spanish, and French folks on a street named Cat, the sign would read Cat/Gato/Chat.





The Data Link Layer
The Data Link layer provides the physical transmission of the data and handles error
notification, network topology, and flow control. This means that the Data Link layer
will ensure that messages are delivered to the proper device on a LAN using hardware
addresses and will translate messages from the Network layer into bits for the Physical
layer to transmit.
The Data Link layer formats the message into pieces, each called a data frame, and adds a customized
header containing the hardware destination and source address. This added information
forms a sort of capsule that surrounds the original message in much the same way that engines,
navigational devices, and other tools were attached to the lunar modules of the Apollo project.
These various pieces of equipment were useful only during certain stages of space flight and were
stripped off the module and discarded when their designated stage was complete. Data traveling
through networks is similar.
Figure 1.15 shows the Data Link layer with the Ethernet and IEEE specifications. When you
check it out, notice that the IEEE 802.2 standard is used in conjunction with and adds functionality
to the other IEEE standards.
FIGURE 1 . 1 5 Data Link layer
It’s important for you to understand that routers, which work at the Network layer, don’t
care at all about where a particular host is located. They’re only concerned about where networks
are located and the best way to reach them—including remote ones. Routers are totally
obsessive when it comes to networks. And for once, this is a good thing! It’s the Data Link
layer that’s responsible for the actual unique identification of each device that resides on a
local network.
For a host to send packets to individual hosts on a local network as well as transmit packets
between routers, the Data Link layer uses hardware addressing. Each time a packet is sent between
routers, it’s framed with control information at the Data Link layer, but that information is
stripped off at the receiving router and only the original packet is left completely intact. This framing
of the packet continues for each hop until the packet is finally delivered to the correct receiving
host. It’s really important to understand that the packet itself is never altered along the route; it’s
only encapsulated with the type of control information required for it to be properly passed on to
the different media types.






The Physical Layer
Finally arriving at the bottom, we find that the Physical layer does two things: It sends bits and
receives bits. Bits come only in values of 1 or 0—a Morse code with numerical values. The
Physical layer communicates directly with the various types of actual communication media.
Different kinds of media represent these bit values in different ways. Some use audio tones,
while others employ state transitions—changes in voltage from high to low and low to high.
Specific protocols are needed for each type of media to describe the proper bit patterns to be
used, how data is encoded into media signals, and the various qualities of the physical media’s
attachment interface.
The Physical layer specifies the electrical, mechanical, procedural, and functional requirements
for activating, maintaining, and deactivating a physical link between end systems. This
layer is also where you identify the interface between the data terminal equipment (DTE) and
the data communication equipment (DCE). (Some old phone-company employees still call
DCE data circuit-terminating equipment.) The DCE is usually located at the service provider,
while the DTE is the attached device. The services available to the DTE are most often accessed
via a modem or channel service unit/data service unit (CSU/DSU).
The Physical layer’s connectors and different physical topologies are defined by the OSI as
standards, allowing disparate systems to communicate. The CCNA objectives are only interested
in the IEEE Ethernet standards.
Hubs at the Physical Layer
A hub is really a multiple-port repeater. A repeater receives a digital signal and reamplifies or
regenerates that signal and then forwards the digital signal out all active ports without looking
at any data. An active hub does the same thing. Any digital signal received from a segment on
a hub port is regenerated or reamplified and transmitted out all ports on the hub. This means
all devices plugged into a hub are in the same collision domain as well as in the same broadcast
domain.












Ethernet Networking
Ethernet is a contention media access method that allows all hosts on a network to share the
same bandwidth of a link. Ethernet is popular because it’s readily scalable, meaning that it’s
comparatively easy to integrate new technologies, such as Fast Ethernet and Gigabit Ethernet,
into an existing network infrastructure. It’s also relatively simple to implement in the first
place, and with it, troubleshooting is reasonably straightforward. Ethernet uses both Data
Link and Physical layer specifications, and this section of the chapter will give you both the
Data Link layer and Physical layer information you need to effectively implement, troubleshoot,
and maintain an Ethernet network.
Ethernet networking uses Carrier Sense Multiple Access with Collision Detection (CSMA/CD),
a protocol that helps devices share the bandwidth evenly without having two devices transmit at
the same time on the network medium. CSMA/CD was created to overcome the problem of those
collisions that occur when packets are transmitted simultaneously from different nodes. And trust
me—good collision management is crucial, because when a node transmits in a CSMA/CD network,
all the other nodes on the network receive and examine that transmission. Only bridges and
routers can effectively prevent a transmission from propagating throughout the entire network!







Half- and Full-Duplex Ethernet
Half-duplex Ethernet is defined in the original 802.3 Ethernet; Cisco says it uses only one wire
pair with a digital signal running in both directions on the wire. Certainly, the IEEE specifications
discuss the process of half duplex somewhat differently, but what Cisco is talking
about is a general sense of what is happening here with Ethernet.
It also uses the CSMA/CD protocol to help prevent collisions and to permit retransmitting
if a collision does occur. If a hub is attached to a switch, it must operate in half-duplex mode
because the end stations must be able to detect collisions. Half-duplex Ethernet—typically
10BaseT—is only about 30 to 40 percent efficient as Cisco sees it because a large 10BaseT network
will usually only give you 3 to 4Mbps, at most.
But full-duplex Ethernet uses two pairs of wires instead of one wire pair like half duplex.
And full duplex uses a point-to-point connection between the transmitter of the transmitting
device and the receiver of the receiving device. This means that with full-duplex data transfer,
you get a faster data transfer compared to half duplex. And because the transmitted data is
sent on a different set of wires than the received data, no collisions will occur.
The reason you don’t need to worry about collisions is because now it’s like a freeway with
multiple lanes instead of the single-lane road provided by half duplex. Full-duplex Ethernet is
supposed to offer 100 percent efficiency in both directions—for example, you can get 20Mbps
with a 10Mbps Ethernet running full duplex or 200Mbps for Fast Ethernet. But this rate is
something known as an aggregate rate, which translates as “you’re supposed to get” 100 percent
efficiency. No guarantees, in networking as in life.
Full-duplex Ethernet can be used in three situations:
With a connection from a switch to a host
With a connection from a switch to a switch
With a connection from a host to a host using a crossover cable

Read More

Police Fighters

Game Description:

Sun City is the city of the future, but the rising crime rate makes this place dangerous for living. Extremists block roads, criminals crash cars and hackers override the city’s automatic traffic control. The Special Supercar Police Unit was organized to blow the whistle on these practices.Download this free full version game today and help police to battle against crime.
Free Game Features:
- Real action game, vehicular combat;
- Modern 3D graphics;
- Extraordinarily addictive game play;
- Unique power-ups;
- Gorgeous effects, huge explosions!
- Original soundtrack and powerful sound effects;
- Free full version game without any limitations.

System Requirements:

• - Windows 95/98/XP/ME/Vista/7;
• - Processor 800 Mhz or better;
• - RAM: minimum 1024Mb;
• - DirectX 9.0 or higher;
• - DirectX compatible sound board;
• - Easy game removal through the Windows Control Panel.

No download? In his case CLICK HERE
File Size: 64 Mb

Read More

Sudden Strike

Game Description:

During World War II, Crimea was a scene of some of the bloodiest battles. Finding yourself in a battle-scarred world, you will assume the role of a military commander in charge of an occupied town seeking to survive and fight.Download free full version game today and experience the intensity and adrenaline rush of real combat.
Free Game Features:
- Award-winning strategy game;
- More than 50 missions;
- Increased degree of realism: completely overhauled unit values;
- More than 50 new units;
- Fight battles in three difficulty levels;
- Controllable boats allow you to cross rivers;
- Supplies and additional fire power provided by controllable railways;
- Each motorized unit possesses a separately controllable crew and can be captured;
- Weather system: March troops through rain and snow;
- Campaigns set in summer & winter landscapes;
- Free full version game without any limitations.

System Requirements:

• - Windows 95/98/XP/ME/Vista/7;
• - Processor 800 Mhz or better;
• - RAM: minimum 1024Mb;
• - DirectX 9.0 or higher;
• - DirectX compatible sound board;
• - Easy game removal through the Windows Control Panel.

No download? In his case CLICK HERE
File Size: 182 Mb

Read More

Deadly Race

Game Description:

In the beginning of 21th century global energy crisis wakened World War III. A lot of cities were destroyed and people abandoned them searching for better life. Now these abandoned cities are used as race tracks for a new kind of popular entertainment - Apocalypse Motor Racing. Daredevils from different corners of the world drive to victory through wrecked cars of their competitors in this deadly racing.Download free full version game today and try to win Apocalypse Motor Racing or try to survive!

System Requirements:

• - Windows 95/98/XP/ME/Vista/7;
• - Processor 800 Mhz or better;
• - RAM: minimum 1024Mb;
• - DirectX 9.0 or higher;
• - DirectX compatible sound board;
• - Easy game removal through the Windows Control Panel.

No download? In his case CLICK HERE
File Size: 44 Mb 

Read More

Star Defender 4

Game Description:

Star Defender 4 is a breathtaking space shooter that still has all the best features of Star Defender series. You’ll be dazzled by splendidly craft graphics and music. Face tons of new enemies with a unique style of behavior and new ways of attacking in Star Defender 4. Use new Star Defender 4 weapons: machine-gun, saw, flame thrower, acid bomb and cutter! And also the best weapons from the previous game: parasitron, lasers, infector, ball lightning, missiles, homing laser and barriers! Blast through more than 100 levels, 8 original missions and of course huge impressive Bosses in the end of every mission! You'll get the real pleasure playing Star Defender 4!
If you need a breathtaking game that won't let you let a mouse out of your hands to have a cup of coffee, which got already cold… If you want to feel as you were the Intergalactic Disinfector Number one who craves for taking vengeance on that disgusting annoying insects... If you long for the real war - then Star Defender 4 is for you! Download free full version game today and hold your breath...

System Requirements:

• - Windows 95/98/XP/ME/Vista/7;
• - Processor 800 Mhz or better;
• - RAM: minimum 1024Mb;
• - DirectX 9.0 or higher;
• - DirectX compatible sound board;
• - Easy game removal through the Windows Control Panel.

No download? In his case CLICK HERE
File Size: 13 Mb

Read More

Offroad Racers

Game Description:

The Off-road Racers contest is an event where monster trucks, rally cars, pickups and buggies compete with each other. Opponents can try to stop racers on their way to finish in three different racing modes. Download free full version pc game today, complete 18 stages and win the contest!
Free Game Features:
- Real offroad racing game;
- 3 different racing modes;
- 18 offroad stages;
- Modern 3D graphics;
- Extraordinarily addictive game play;
- Original soundtrack and powerful sound effects;
- Free full version game without any limitations.

System Requirements:

• - Windows 95/98/XP/ME/Vista/7;
• - Processor 800 Mhz or better;
• - RAM: minimum 1024Mb;
• - DirectX 9.0 or higher;
• - DirectX compatible sound board;
• - Easy game removal through the Windows Control Panel.

No download? In his case CLICK HERE
File Size: 70 Mb

Read More

Resident Evil 6 PC benchmark released

Capcom has released a free Resident Evil 6 Benchmark tool for PC players.

The tool will let users put their rig to the test ahead of the game's xxx release on March 22.
Capcom announced last month that the PC version will come with a new mode, 'The Mercenaries: No Mercy'. It's said to be a more challenging version of the existing 'Mercenaries' mode with "more enemies on screen than ever before", but also "the opportunity to rack up even higher combo scores".
Also announced (through that link) were plans to release a 'Siege mode' for the console versions of the game, an online multiplayer mode for two to six players. More details in that report.



Download the game

Read More

Nikon licenses Microsoft patent to use in Android-enabled cameras

Amidst all the recent patent cases revolving Android and smartphone operating systems in general, Microsoft has been able to get in on the action thanks to a patent it owns dealing with all portable devices running Android.

Nikon has recently come to terms with Microsoft in regards to current and future Android-based cameras which will likely require the renowned photography giant to pay an undisclosed royalty fee for every device sold.
This likely means that Nikon will have to fork over some cash for the current Nikon Coolpix S800C released last October with Android 2.3 Gingerbread on board.
Microsoft already has similar deals with Samsung, LG, HTC, Acer and Barnes & Noble. It’s odd that Microsoft has been able to strong-arm these major manufacturers into paying for using Android, but that’s the way intellectual property patent work.

Read More

Successor of Xbox 360

The much awaited next generation gaming console from Microsoft is rumored to be showcased in the month of April. According to a report from Computer and Video Games, Redmond is currently planning to hold a press event in the month of April and the successor of the Xbox 360, which is reportedly named Xbox 720, might be unveiled in the event.

Furthermore, users at NeoGAF have noticed a domain named XboxEvent.com, which has been registered by Eventcore. The agency has handled many of the previous product launch preparations for the Windows giants and it looks like the agency has already started its preparation for a launch event, which is very likely to feature the latest console from Microsoft.
Meanwhile, Sony has unveiled its next generation PlayStation and it’s high time Microsoft answer back to the move of its arch rival.

Read More