Distributed System Intruder Tools, Trinoo and Tribe Flood Network

Technical Report · Tue Dec 21 04:00:00 EST 1999

DOI:https://doi.org/10.2172/792254· OSTI ID:792254

Criscuolo, P J ^[1]; Rathbun, T

---

1. LLNL

Trinoo and Tribe Flood Network (TFN) are new forms of denial of Service (DOS) attacks. attacks are designed to bring down a computer or network by overloading it with a large amount of network traffic using TCP, UDP, or ICMP. In the past, these attacks came from a single location and were easy to detect. Trinoo and TFN are distributed system intruder tools. These tools launch DoS attacks from multiple computer systems at a target system simultaneously. This makes the assault hard to detect and almost impossible to track to the original attacker. Because these attacks can be launched from hundreds of computers under the command of a single attacker, they are far more dangerous than any DoS attack launched from a single location. These distributed tools have only been seen on Solaris and Linux machines, but there is no reason why they could not be modified for UNIX machines. The target system can also be of any type because the attack is based on the TCP/IP architecture, not a flaw in any particular operating system (OS). CIAC considers the risks presented by these DoS tools to be high.

• Research Organization: Lawrence Livermore National Lab., CA (US)
• Sponsoring Organization: USDOE Office of Defense Programs (DP) (US)
• DOE Contract Number: W-7405-ENG-48
• OSTI ID: 792254
• Report Number(s): UCRL-ID-136939
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS
ARCHITECTURE
COMPUTERS
DEFECTS
FLOODS
TARGETS