Outside Hacker Attacks Network
By Peggy Liao and Daniel Myers
News Associates

Between 2:30 and 5:30 am on Friday, February 11, network servers for the Claremont Colleges and Claremont Graduate University were effectively disabled after suffering a "distributed denial of service attack." The attack, which originated from somewhere outside of the campus network, was targeted at a computer in one of Pomonas dormitories.
In a "distributed denial of service attack," hackers take over poorly-secured computers on fast Internet connections, and then, when they are ready to execute the attack, command them to repeatedly contact the target computer. The volume of traffic overwhelms the target and any other computers on its network, leaving them unable to communicate with the outside world. Further complicating the matter, the attackers mask, or "spoof," their identities, making it extremely difficult to identify them.
During the three hours of the attack, inbound information sent by the hackers totaled 17.5 gigabytes and comprised 99% of the inbound information during that time period. The 17.5 gigabytes made up close to 44% of all inbound traffic for that date.
According to the Claremont Intercollegiate Networking Effort (CINE), the amount of information directed at the target computer could be compared to that contained in 18,000 e-mails.
During this, e-mail, outbound web requests and inbound requests made by off-campus computers trying to access Claremont would have been delayed. However, Wolff only received one student e-mail complaining about the delay because the attack did not occur during a high-traffic timeframe.
Had the attack occurred during the daytime, it is unlikely that OIT would have been able to defend against it. "Weve never had an attack of this magnitude before," OIT Director Terris Wolff said. "There would have had to been someone on staff to actively try and block the attack," Wolff said. "And, it would have been hard to block so many spoofed IP [addresses]."
Moreover, the success of similar, albeit larger (Wolff estimated that fewer than ten computers were involved in the attack on the Claremont Colleges network), attacks on large, well-defended sites such as Yahoo! and Amazon.com makes it extremely unlikely that Claremont would have been able to withstand the load.
The "denial of service attack" was different from the other problems that the Pomona network has been experiencing since last September. One, known as a syn attack, causes problems within the mail server. Pomona has also been the unwitting source of attacks after its computers were compromised.