SCO sites suffer DDOS attack

By Matt Whipp

Posted on 11 Dec 2003 at 10:33

SCO's web presence has been out of action since the middle of Wednesday.

SCO's PR Director Blake Stowell confirmed: 'We are experiencing another Distributed Denial of Service attack (DDOS). We hope to have our Web site up and running soon.'

The attack started 4:20am Mountain Time and has affected the company's websites, email, intranet and customer support services.

SCO seems to think that the attacks, which issued from 'several thousand' compromised servers, are the work of a single hand. The company is working with law enforcement to gather information that might lead to the perpetrator.

Stowell said the company does not yet know who is behind the attack. 'If we did we would have the local police encircle the building and carry the perpetrator off in hand cuffs. Nothing to report yet though,' he said.

The attack is known as a SYN attack, where SYN packets are sent from an IP address not in use on the Internet to the target system. The target system allocates resources for the request and sends back a packet to acknowledge the request. The target system then waits for a reply, but as the IP address is invalid, there is none, so it resends the acknowledgement four further times.

The attack, as such, is a relatively venerable one, and Groklaw quotes a security expert that believes such an attack is easy to defend against and that from his analysis, the problem would more likely be a case of hardware failure or a loose connection.

The company suffered a spate of DDOS attacks over a period of a week or so in early September.