Feeds

Anonymous DoS attacks thwarted with Aikido hip throw

War stories from 'Operation Avenge Assange'

3 Big data security analytics techniques

In early December, researchers from security firm Radware were dispatched to repel attacks against a company being targeted by the Anonymous hacking collective and could only be described as fierce and potentially devastating.

With junk traffic hitting peaks of 14 Gbps and coming from botnets, Unix machines with massive amounts of bandwidth, and volunteers using a custom-designed denial-of-service weapon, Yuri Gushin and Alex Behar had their work cut out. Rather than responding with a defense in kind, they adopted a technique straight out of a text from Aikido, the martial art that blunts attacks by redirecting an opponent’s energy, rather than opposing it head on.

“We basically turned the tables here,” Behar, who spoke at this week's Black Hat security conference in Barcelona, told The Reg by Skype. “These kinds of techniques don't necessarily require a lot of bandwidth.” That allowed the target they were defending to repel the attackers without locking out legitimate visitors to the site.

Among the weapons in their arsenal was Roboo, a low-footprint tool the researchers released this week as an open-source tool for warding off DoS attacks and similar kinds of automated assaults. The challenge-and-response software sits in front of a webserver and requires remote machines that want to connect to first respond to simple queries sent in HTTP, HTML, JavaScript, and Adobe Flash.

Because it's technically inefficient for most attack tools to be fluent in those web languages, the DoS packets never reach their targets, even as legitimate users experience few if any perceptible delays. Roboo can also be used to weed out other types of bots, such as those that automatically register accounts or leave comment spam on websites, making it a possible substitute for Captchas, the puzzles designed to verify a real human is behind a web request that real humans often love to hate.

The Radware security specialists, who are regularly called on to defend e-commece companies and gambling sites against DoS attacks, also employed another technique that proved effective against the Anonymous attacks. It's called session disruption, and it works by dropping a single packet sent from a DoS agent shortly after an internet session has begun.

Internet protocols require both sides to reduce the amount of traffic being sent when packet loss is experienced. This “congestion time out mode” caused major problems for users of the Low Orbit Ion Cannon, the open-source tool Anonymous volunteers use to direct torrents of traffic at sites they disapprove of. LOIC responded to the slow-down by opening an increasing number of connections to the targeted site. Eventually, so many sockets were established that memory allocations were exhausted and the program crashed.

“It was very frustrating for them,” said Behar, who was monitoring internet relay chats where the attackers were congregating during the attacks. “They were really pissed off.”

To prevent session disruption from affecting legitimate connections, the researchers dropped a special form of packet that was unique to LOIC.

Gushin and Behar employed other defenses including one called tarpit that shrinks the amount of data a computer can send to a website to zero before an acknowledgement is required.

“The idea is to suffocate the attacker, to exhaust all its resources,” Gushin said.

The attacks, which Anonymous called "Operation Avenge Assange," came in retaliation to Visa, MasterCard, PayPal and other companies after they disrupted fundraising efforts by WikiLeaks by cutting off payment processing services to the whistle-blower website. The attacks involved floods of syn packets, Slowloris assaults, and at one point the use of hijacked Unix machines from a US state board of education, which delivered 8 million packets per second to the intended target. (The Reg agreed not to name the state or the target the researchers were defending.)

“The sophistication came from the fact that there was such a diversity of attacks,” Behar said. “It was very hard to figure out how to provide proper uptime.” ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.