Feeds

Peer-to-peer networks co-opted for DOS attacks

DC++ flaw sees massive data storms

Beginner's guide to SSL certificates

A flaw in the design of a popular peer-to-peer network software has given attackers the ability to create massive denial-of-service attacks that can easily overwhelm corporate websites, a security firm warned last week.

Over the past three months, more than 40 companies have endured attacks emanating from hundreds of thousands of Internet Protocol addresses (IPs), with many of the attacks producing more than a gigabit of junk data every second, according to security solutions provider Prolexic Technologies.

The sheer number of internet addresses has caused problems for routers and firewalls, burying solutions that rely on some form of blacklisting, said Paul Sop, chief technology officer for the firm.

"It's like asking how fast can you bail your boat?" Sop said. "If you stop for a minute you get overwhelmed."

Unlike past attacks, which use tens of thousands of compromised computers to deluge a web server or network with data, the latest attacks came from a collection of computers running peer-to-peer software known as DC++. The software is based on Direct Connect, a protocol which allows the exchange of files between instant messaging clients.

While the file-sharing network is distributed, the directories of where to find certain files resides in a few servers, known as hubs. Older versions of the hub server software have a flaw that allows an attacker to direct clients to get information from another server, said Fredrik Ullner, a developer for the DC++ project and an computer-science undergraduate at Sweden's Lund Institute of Technology. Maliciously redirecting those client results in a large number of computers continuously demanding data from the victim's web server, overwhelming it with requests.

The attacks were used against DC++ own developers and hub directories as early as 2005. The first attacks targeted the project's directory of hubs, known as Hublist.org. Rogue DC++ users had created tools to flood a hub, and when Hublist.org removed the rogue users' servers, the group responded by attacking Hublist.org, Ullner said. The site is no longer accessible. The rogue group also hit DCPP.net, the project's main site, forcing the developers to move to SourceForge.

"These attacks are, unfortunately, getting more common," Ullner stated in an email interview with SecurityFocus.

The technique proved so effective that attackers have turned it on other companies.

In March, companies started seeking out Prolexic to help them stave off some devastating denial-of-service attacks. In many of the attacks, more than 150,000 computers would open a handful of connections each, burying the Web server in a avalanche of network data. The largest attacks seen by the company involved more than 300,000 computers, said Prolexic's Sop.

"We had millions and millions of connections in. We could identify the attacks with zero difficulty but new IPs were hitting us faster than we could block them."

While many of the attacks were part of an extortion attempt - a common way in the past to turn denial-of-service capabilities into cash - about three quarters of the attacks were motivated by industrial espionage, Sop said.

"The amount of money involved is pretty large," Sop said. "If you have a good internet business in Europe, and you can knock out your competitor, why spend money on marketing?"

The firm announced on Wednesday that it had developed a way to defend against the attacks.

A general solution is unlikely to appear from the DC++ project. While the problem has already been fixed in the DC++ hub software, it's hard to force everyone to adopt the fix, said developer Ullner.

"The attackers take advantage of people's reluctance to upgrade."

Moreover, even if all the hub administrators upgraded their systems, the attackers could run their own hubs until they commanded enough DC++ clients to attack a target.

"It's difficult to impossible to restrict this," said Ullner.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.