@tormedhammaren
The ping flood protection sends all packets to NIL: ?
Yes. Well, not literally NIL:, the packets are just discarded. But those packets still need to pass thru SANA2 driver and IP level before they can be detected and dropped. This code pathway is quite long so it can cause problems, at least with slower systems.
The problem is that the Amiga features much less processing power compared to more modern system. So you can easily DOS it from just one host if bought sides have high bandwidth.
Right. With modern hardware simple pingflood is not going to take the system down, instead all the bandwidth need to be consumed (usually with DDoS).
Can scriptkiddies get that strong? Hope there aren't to many of those..
They are that strong already. Some years ago there was problem with kiddies crashing irc servers and/or causing netsplits and then riding the split to perform channel takeovers. Some very large websites have been taken down, even
most DNS root servers simultanously.
In fact, some of the modern viruses turn the Windoze boxes into these zombies, part of the botnet. Another common way is to send out trojan via email that patch the system and add it as node to such network.
There is some speculation that these viruses would in fact be
spread by spammers to generate large networks to send out spam email and to DDoS antispam services. At least three large AS services
have already
been shut down due to enduring DDoS attacks.
Another wild theory is that these viruses are in fact made by NSA to test large scale electronic warfare. It would be of interest to USA since they're most vulnerable for such attack, if ever performed as an act of war or terrorism. The date triggered self destruct of the viruses backs up this theory somewhat, since this way the effect of the virus is limited.
This means that you can make a system belive that you are a trusted host. This is what Mitnick did to break into Sutomu Shimomura's machine.
Right. Mitnick used this method to spoof trusted LAN host and used rsh service to execute a command to inject "+ +" to root's .rhosts file. This way, all hosts could rlogin as root or execute remote commands as root. There is a
description of the hack on usenet by Tsutomu Shimomura.
In which products is this ftpd used?
To my knowlegle all AmiTCP/IP versions available (that include the ftpd).
Is there a fix?
No fix is available. However, you can disable anonymous access to limit the threat to trusted users only.
I would still recommended you use some other ftpd instead.
