Feeds

'Ragtag' Russian army shows the new face of DDoS attacks

Semi-organized people just as dangerous as botnets

Seven Steps to Software Security

In late April, a Russian-speaking blogger upset with recent events in Estonia posted a series of dispatches calling on like-minded people to attack government servers in that country.

"They're really fascists," the user, who went by the name of VolchenoK, wrote of Estonian government officials, according to this translation. "Let us help those who are there and really fought for the memory of our grandfather and grandmother. Yet they are fighting against fascism!"

VolchenoK's dispatch was echoed in posts on other Russian-speaking websites and helped set the groundwork for more than a week of distributed denial of service (DDoS) attacks, which sometimes brought official Estonian websites to their knees.

The assault on the Estonian sites was motivated by the government's removal of a Soviet-era memorial from the center of that country's capital. For decades, the monument stood as a tribute to Soviet soldiers who drove out the Nazis during World War II. Some Russians took the removal as a slap in the face and sought revenge.

The attacks should serve as a wake-up call for US government officials about the potency of several new DDoS tools adopted by cyber criminals, says Arbor Networks senior security engineer Jose Nazario. He will speak about about DDoS threats later this month at the US Department of Defense's Cyber Crime Conference.

Rage against the Machine

The Estonia attacks are a graphic example of the damage that disaffected groups can cause when they vent their rage on internet targets, he says. Combined with a separate round of attacks on sites belonging to both pro-Russian and anti-Russian groups over the last three months, they raise the possibility that attacks based on political, ethnic or cultural differences may be on the rise.

"That ragtag army ... can actually be effective," Nazario says. "We're very, very worried about computer botnets. We should be just as worried about semi-organized groups of upset people."

Posts like the one left by VolchenoK included a do-it-yourself script users could run to turn their computers into individual launch pads for the attacks. They also included instructions on when participants should start and stop them to ensure the incursions caused as much damage as possible. They were combined with more traditional DDoS attacks from networks of zombie machines.

By Western standards, the attacks weren't all that sophisticated. They topped out at about 100MB per second, compared with as much as 40GB per second unleashed against some targets. They also employed protocols such as ICMP and TCP SYN, which have been used for so long that they are no longer effective against many hardened targets.

But more recent events may show that politically motivated attackers are growing more savvy. Over the past several months, Nazario has documented attacks on sites belonging to groups on both sides of the Russian establishment. Targets include the Party of Regions, a pro-Russian party led by Ukrainian Prime Minister Viktor Yanukovych; the site of Gary Kasparov, the Russian chess grandmaster turned critic of Russian President Vladimir Putin; and namarsh.ru, another dissident site. All attacks have been carried out using botnets, Nazario says.

BlackEnergy

One weapon used in these most recent raids is a tool called BlackEnergy. It doesn't rely on the more primitive IRC protocol, doesn't scan for new hosts to infect and is cloaked in a rootkit, making it hard for users or security researchers to detect. A graphical interface makes it easy for hackers to configure and it is designed solely for carrying out DDoS attacks, Nazario says.

More than three dozen servers have been detected as command and control centers for BlackEnergy, and because the tool is available for $40 the number could grow, Nazario says. HTML-based bots like BlackEnergy are harder for security professionals to detect and stop because the data they generate looks similar to web traffic.

"The DDoS problem hasn't gone away," Nazario says. "People who commit those kind of attacks have more specialized tools avaiable to them and their attacks have gotten mor specialized."

So Nazario is working with the computer emergency response teams of various governments to snuff out the command and control servers that act as the hubs for these networks. Among the techniques for stopping them are the blacklisting of domain names and internet protocol addresses and the sharing of signature files that can be used by Snort and other intrusion detection systems to pinpoint the servers. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.