DDoS Counterstrikes Prompt Debate

March 2004

How far can companies go to defend their web sites against distributed denial of service (DDoS) attacks? The question was hotly debated in security circles this week after Symbiot Inc. announced an upcoming product that can launch "counterstrikes" against DDoS perpetrators.

The notion of retaliatory attacks was panned by security analysts and network operators, who say such actions would congest networks, damage innocent parties and violate acceptable use policies - if not the law. Such tactics are unlikely avenues for corporate DDoS victims such as Microsoft or The SCO Group.

But they may be of interest to subjects of "DDoS blackmail" schemes, which in recent months have targeted online gambling sites. Several online casinos have admitted making payments to cyber-extortionists. Some who have refused to pay, including the Irish bookmaker Paddy Power, say their operations were subsequently disrupted by DDoS attacks.

Symbiot says it will release its product March 31. The Austin, Texas company has published "rules of engagement" that argue that in rare cases, the target has the right to respond with "asymmetric force," including counter-DDoS attacks and "special operations applying invasive techniques."

Symbiot's iSIMS product is in the final phase of beta testing at "several customer sites and in use on live networks," according to vice president William Hurley II, and is also being tested by partners for integration with other security solutions. Hurley said iSIMS will be sold under a subscription agreement, and deployed on a customer's network as a set of server appliances.

"Symbiot has no intention of doing anything illegal, and we strongly discourage our clients from using our software in any way that is illegal, unethical, or violates any law," said Hurley. "We contend that in incredibly rare circumstances, asymmetrical responses may be justified. We are enabling our customers to plan and execute appropriate countermeasures when malicious attackers have been accurately identified."