Feeds

Anonymous DoS attacks thwarted with Aikido hip throw

War stories from 'Operation Avenge Assange'

Next gen security for virtualised datacentres

In early December, researchers from security firm Radware were dispatched to repel attacks against a company being targeted by the Anonymous hacking collective and could only be described as fierce and potentially devastating.

With junk traffic hitting peaks of 14 Gbps and coming from botnets, Unix machines with massive amounts of bandwidth, and volunteers using a custom-designed denial-of-service weapon, Yuri Gushin and Alex Behar had their work cut out. Rather than responding with a defense in kind, they adopted a technique straight out of a text from Aikido, the martial art that blunts attacks by redirecting an opponent’s energy, rather than opposing it head on.

“We basically turned the tables here,” Behar, who spoke at this week's Black Hat security conference in Barcelona, told The Reg by Skype. “These kinds of techniques don't necessarily require a lot of bandwidth.” That allowed the target they were defending to repel the attackers without locking out legitimate visitors to the site.

Among the weapons in their arsenal was Roboo, a low-footprint tool the researchers released this week as an open-source tool for warding off DoS attacks and similar kinds of automated assaults. The challenge-and-response software sits in front of a webserver and requires remote machines that want to connect to first respond to simple queries sent in HTTP, HTML, JavaScript, and Adobe Flash.

Because it's technically inefficient for most attack tools to be fluent in those web languages, the DoS packets never reach their targets, even as legitimate users experience few if any perceptible delays. Roboo can also be used to weed out other types of bots, such as those that automatically register accounts or leave comment spam on websites, making it a possible substitute for Captchas, the puzzles designed to verify a real human is behind a web request that real humans often love to hate.

The Radware security specialists, who are regularly called on to defend e-commece companies and gambling sites against DoS attacks, also employed another technique that proved effective against the Anonymous attacks. It's called session disruption, and it works by dropping a single packet sent from a DoS agent shortly after an internet session has begun.

Internet protocols require both sides to reduce the amount of traffic being sent when packet loss is experienced. This “congestion time out mode” caused major problems for users of the Low Orbit Ion Cannon, the open-source tool Anonymous volunteers use to direct torrents of traffic at sites they disapprove of. LOIC responded to the slow-down by opening an increasing number of connections to the targeted site. Eventually, so many sockets were established that memory allocations were exhausted and the program crashed.

“It was very frustrating for them,” said Behar, who was monitoring internet relay chats where the attackers were congregating during the attacks. “They were really pissed off.”

To prevent session disruption from affecting legitimate connections, the researchers dropped a special form of packet that was unique to LOIC.

Gushin and Behar employed other defenses including one called tarpit that shrinks the amount of data a computer can send to a website to zero before an acknowledgement is required.

“The idea is to suffocate the attacker, to exhaust all its resources,” Gushin said.

The attacks, which Anonymous called "Operation Avenge Assange," came in retaliation to Visa, MasterCard, PayPal and other companies after they disrupted fundraising efforts by WikiLeaks by cutting off payment processing services to the whistle-blower website. The attacks involved floods of syn packets, Slowloris assaults, and at one point the use of hijacked Unix machines from a US state board of education, which delivered 8 million packets per second to the intended target. (The Reg agreed not to name the state or the target the researchers were defending.)

“The sophistication came from the fact that there was such a diversity of attacks,” Behar said. “It was very hard to figure out how to provide proper uptime.” ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.