Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    Openhack III Bowed But Not Broken

    By
    Timothy Dyck
    -
    January 22, 2001
    Share
    Facebook
    Twitter
    Linkedin

      The battle has begun, and the first salvo was a fierce one, as a cascade of denial-of-service attacks swept over the Openhack III site in its first four days of operation.

      As of midday Thursday, no one had succeeded in any of the four hacking goals, although eWeek Labs saw creative DoS attacks directed against the Champaign, Ill., site, along with heavy usage.

      There are consistently 50 to 100 users logged in to the shell server, trying to break that systems security. (eWeek Labs Openhack I and II tests didnt allow users to log in locally.) Openhack IIIs widespread coverage by news media nationwide might have added to this glut of would-be hackers.

      Argus Systems Inc. staff discovered a bug in the companys code that caused two of the Open Hack systems (the shell and Web servers) to crash under a heavy network load. They analyzed core dumps from these crashes on Tuesday and developed a patch, which was installed on the affected servers on Wednesday.

      The systems that allow user log-ins—the shell and Web servers—are a swamp of general nastiness as users attack both the system theyre on and one another. One common attack weve found is where users modify each public accounts .profile script (which is run automatically when new users log in) to immediately log them out again either through an “exit” or “kill-9 $$” command.

      We also saw several resource utilization attacks where users run so many processes that the systems process table is filled up or the server runs out of swap space. At this point, no new log-ins can happen, and those who are already logged in cant run any commands. Argus is working on ways to stop these kinds of attacks, but resource utilization attacks (as a class) are hard to prevent.

      There have also been countless DoS attacks, both locally and remotely. On Wednesday morning, less than 48 hours into the test, our intrusion detection log had grown to 1.3GB in size and contained logs for 7.46 million events; we stopped logging the most common DoS attacks at that point simply to save disk space.

      One user discovered a way Tuesday to remotely shut down or crash IBMs WebSphere application server; were still trying to figure out how this was accomplished.

      WebSpheres log files contain a large number of Java null pointer and illegal argument exceptions in code that parses user input, showing that many people are submitting bad data to the store, hoping to manipulate server-side code into retrieving the secret database data.

      Timothy Dyck
      Timothy Dyck is a Senior Analyst with eWEEK Labs. He has been testing and reviewing application server, database and middleware products and technologies for eWEEK since 1996. Prior to joining eWEEK, he worked at the LAN and WAN network operations center for a large telecommunications firm, in operating systems and development tools technical marketing for a large software company and in the IT department at a government agency. He has an honors bachelors degree of mathematics in computer science from the University of Waterloo in Waterloo, Ontario, Canada, and a masters of arts degree in journalism from the University of Western Ontario in London, Ontario, Canada.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×