McAfee Develops Protection Against Denial-of-Service Attacks

McAfee, the anti-virus division of Network Associates, said it has come up with a solution to the denial-of-service attacks that have been hitting Web sites this week.

The firm has updated its VirusScan product to detect the "Zombie" code, which it says is responsible for launching distributed denial of service (DDoS) attacks.

McAfee said that these attacks, which have rendered Web portals such as Yahoo, eBay, E*trade, Microsoft and Amazon inoperable in recent days, can marshal the resources of hundreds or thousands of servers to join the attack.

The attacks work, the IRT security firm said, via the insertion of a commonly available piece of malicious code. This so-called Zombie code, though not technically a virus, represents a security threat that McAfee said is a major one.

McAfee says that users can download the update for their McAfee VirusScan for Linux and Solaris products immediately to scan for DDoS agents that might be used to attack other sites.

Further details of the updates, and the DDoS attacks can be found on the main Network Associates' Web site at http:www.nai.com . The company is also offering companies a free scan of their sites from its MyCio site at http://www.mycio.com.

Vincent Gulloto, McAfee's director of AVERT (anti-virus emergency response team), said that it is important to note that the security problems this week were not in the Web sites that went down, but in the multitude of servers which were unwitting participants.

"The solution to the problem lies in taking back each computer that can add to a hacker's arsenal, by removing the DDoS agent that makes it dangerous," he said.

McAfee said that the DDoS Zombie code, the most popular of which is known as Tribe Flood Network, have been widely available through hacker bulletin boards since as early as July of 1999.

The firm noted that, as often happens with widely available virus code, variants and copycats soon sprung up, bearing names such as Trinoo, Stacheldraht and TFN2K.

McAfee's main Web site is at http://www.mcafeeb2b.com.

Reported by Newsbytes.com, http://www.newsbytes.com.