Internet security experts currently have no answer to a rash of denial of service attacks - where attackers can bring down systems by bombarding them with so much data that legitimate transactions grind to a halt - according to a speaker at a major security conference.
"We do not know how to defend against this," said Winn Schwartau, at the International Banking & Information Security Conference in New York. Schwartau is president of Interpact Inc., a consulting firm in, Florida, and author of Information Warfare: Chaos on the Electronic Superhighway. "Surviving denial of service on the Internet is becoming increasingly crucial," he said.
"This is a worrisome concern," said Dan Schutzer, vice president and director of advanced technology at Citibank in New York.
Schwartau outlined a potential defence that combines detection modules, dynamic reaction tools and an "alternative control channel" to go around a clogged TCP/IP connection that is under attack. A rudimentary prototype based on this theory may possibly be ready for testing in six to nine months, he said.
Meanwhile, hacker sites on the World Wide Web offer anonymous mail bombing services - just enter the site you want attacked and how many messages you want sent there as well as the "Ping O' Death Page," which details the vulnerabilities of various operating systems, Schwartau said.
The Internet is susceptible to various data-flood attacks because information and control are on the same channel, Schwartau said. He suggested using "smart" detection modules that recognize if too many email messages or pings are coming in, reaction modules that set filtering based on activity being detected and an alternative channel between customers and their service providers (perhaps dial-up cellular modems) to deal with an attack.