Hackers cut off SCO Web site

[NullDevice]

This weekend, a denial-of-service attack took down the Web site of the SCO Group, which is caught in an increasingly acrimonious row with the open-source community over the company's legal campaign against Linux.
SCO's Web site was largely out of commission until Monday morning, a representative for the Lindon, Utah-based Unix and Linux seller said Monday. Performance measurement statistics from Netcraft indicated that the site had been down since Friday night.

In a distributed denial-of-service (DDoS) attack, numerous computers simultaneously send so much data across a network that the targeted system slows to a crawl trying to keep up with the traffic it's receiving. The SCO representative could not say where this weekend's strike originated.

However, unofficial open-source spokesman Eric Raymond suggested in a posting Sunday to open-source news Web site NewsForge that the attack was launched by someone angry at comments from SCO executives criticizing the open-source community's role in the legal battles over Linux.

[Syini666]

I will never understand why people do stupid s*** like that, becuase it never helps their "cause". If anything it will provide more ammunition for SCO to use against the Open Source community. Just like when the RIAA site was hit with DoS attacks and even defaced. It never proves anything, and just makes things worse.

[CXGJarrod]

I think that Nelson Muntz from the Simpsons said it best.... "Ha-ha"

For the record, I dont think that DOS'ing the site was the best idea for the Linux cause, but like RoadClosed said, the little voice in my head is saying "ha-ha."

[RoadClosed]

I am with CXGJarrod, while one side agrees with Syini666 - I can't help but hear that "ha ha" voice in my head.

[phishphreek]

Now who would want to do that to a nice bunch of folks like the people at SCO?!

Sheesh... what is this world coming to?

[KorpDeath]

It's easy to be immature about hot subjects like this but the simple fact of the matter is that SCO will end up laying on it's own sword for this. So why not just let it happen, they obviously don't need any help screwing themselves.

That's a much bigger "HA-HA!".

IMHO

[gore]

Before we point fingers, does anyone know for sure it was a bunch of Linux people? and yea your damn right I laughed.

[r8devil]

Although i laughed when i read it. I have to agree that it doesnt help anything in the case. It only serves to make the open source community seem to be immature. This makes all the bigwigs out there not really like the open suorce idea. They already dont like it cos it seems to be taking power and $ from their hands and putting it into the publics hands.

[breakology]

A user at slashdot posted this about the SCO attacks:

I posted this at Groklaw, and I'm reposting it here since it seems pretty relevant to the current thread:

I ran some traceroutes to see where the problem is, and the results are quite interesting.

First, let's start with www.canopy.com. I am listing the traceroute output from step 12, since that's just two steps before where things get revealing:

Tracing route to www.canopy.com [216.250.142.120] over a maximum of 30 hops: ....
12 77 ms 77 ms 76 ms 66.62.3.56
13 74 ms 77 ms 74 ms den1-core-01.tamerica.net [66.62.3.45]
14 77 ms 77 ms 76 ms den1-edge-01.tamerica.net [66.62.4.3]
15 77 ms 77 ms 77 ms vi-001.brdr01.den05.viawest.net [66.62.160.22]
16 75 ms 77 ms 76 ms gige-01-m00-00.crrt02.den05.viawest.net [64.78.230.210]
17 87 ms 87 ms 89 ms pos-03-01.crrt01.slc03.viawest.net [64.78.227.10]
18 89 ms 89 ms 89 ms c7pub-216-250-136-70.center7.com [216.250.136.70]
19 91 ms 88 ms 87 ms c7pub-216-250-142-126.center7.com [216.250.142.126]
20 88 ms 89 ms 90 ms c7pub-216-250-142-120.center7.com [216.250.142.120]

Trace complete.

Now, let's traceroute www.caldera.com

Tracing route to www.caldera.com [216.250.140.125] over a maximum of 30 hops: ....
12 74 ms 77 ms 77 ms dal1-core-01.tamerica.net [66.62.6.193]
13 76 ms 77 ms 74 ms den1-core-01.tamerica.net [66.62.3.45]
14 77 ms 74 ms 74 ms den1-edge-01.tamerica.net [66.62.4.3]
15 * * * Request timed out.

And finally, www.sco.com:

Tracing route to www.sco.com [216.250.140.112] over a maximum of 30 hops: ....
12 76 ms 77 ms 76 ms dal1-core-01.tamerica.net [66.62.6.193]
13 75 ms 77 ms 76 ms den1-core-01.tamerica.net [66.62.3.45]
14 77 ms 76 ms 75 ms den1-edge-01.tamerica.net [66.62.4.67]
15 * * * Request timed out.

Canopy, Caldera, and SCO, all have addresses that are within the same class C addressing range, respectively: 216.250.140.120, 216.250.140.125, 216.250.140.112. While this makes it very possible that all three sites are served by the same machine, we can't prove that from this information. It is however, likely that they are served from the same router.

The next thing to note is that the route to SCO and Caldera both fail at the 14th step in the tracert. The last router that responds for each of them, at the 13th step, is den1-edge-01.tamerica.net (albeit from different ports). Canopy also passes through den1-edge-01.tamerica.net at the 13th step, but continues on to a router at viawest.com. From there, it passes through 2 more routers at ViaWest, and 3 routers at Center7.

ViaWest and Center7 are both Canopy companies.

On initial analysis, for any other company, a network manager/sys admin/networking consultant (such as me) would simply assume that SCO/Caldera was having a problem with its ISP. The weird thing, though, is the presence of Canopy's IP address right *between* SCO's and Caldera's addresses.

Assume that all 3 segments are served by the same router (no, we can't prove it from this data, but it's extremely likely). Canopy, in that case, should be experiencing problems too if the site were under a DOS attack.

In fact, anyone planning a DDOS attack would find it easier to just take out the whole address range, thereby including all 3 sites, rather than focus on just the SCO/Caldera sites -- and for technical reasons alone. Never mind that they would *want* to target Canopy as well.

Given all this, it is a pretty safe bet that SCO/Caldera has taken its websites down itself.

Why? To protect themselves from a DDOS attack? No. Any decent firewall could take care of that for them. That's why I suspected that it was not DoS attack: they've simply been down too long.

[Highlander]

Do you think SCO is moving or got booted from their ISP ???
Maybe the ISP does not want any problems.
SCO did dig up a BIG can of worms....