Feeds

Anonymous DoS attacks thwarted with Aikido hip throw

War stories from 'Operation Avenge Assange'

The Power of One eBook: Top reasons to choose HP BladeSystem

In early December, researchers from security firm Radware were dispatched to repel attacks against a company being targeted by the Anonymous hacking collective and could only be described as fierce and potentially devastating.

With junk traffic hitting peaks of 14 Gbps and coming from botnets, Unix machines with massive amounts of bandwidth, and volunteers using a custom-designed denial-of-service weapon, Yuri Gushin and Alex Behar had their work cut out. Rather than responding with a defense in kind, they adopted a technique straight out of a text from Aikido, the martial art that blunts attacks by redirecting an opponent’s energy, rather than opposing it head on.

“We basically turned the tables here,” Behar, who spoke at this week's Black Hat security conference in Barcelona, told The Reg by Skype. “These kinds of techniques don't necessarily require a lot of bandwidth.” That allowed the target they were defending to repel the attackers without locking out legitimate visitors to the site.

Among the weapons in their arsenal was Roboo, a low-footprint tool the researchers released this week as an open-source tool for warding off DoS attacks and similar kinds of automated assaults. The challenge-and-response software sits in front of a webserver and requires remote machines that want to connect to first respond to simple queries sent in HTTP, HTML, JavaScript, and Adobe Flash.

Because it's technically inefficient for most attack tools to be fluent in those web languages, the DoS packets never reach their targets, even as legitimate users experience few if any perceptible delays. Roboo can also be used to weed out other types of bots, such as those that automatically register accounts or leave comment spam on websites, making it a possible substitute for Captchas, the puzzles designed to verify a real human is behind a web request that real humans often love to hate.

The Radware security specialists, who are regularly called on to defend e-commece companies and gambling sites against DoS attacks, also employed another technique that proved effective against the Anonymous attacks. It's called session disruption, and it works by dropping a single packet sent from a DoS agent shortly after an internet session has begun.

Internet protocols require both sides to reduce the amount of traffic being sent when packet loss is experienced. This “congestion time out mode” caused major problems for users of the Low Orbit Ion Cannon, the open-source tool Anonymous volunteers use to direct torrents of traffic at sites they disapprove of. LOIC responded to the slow-down by opening an increasing number of connections to the targeted site. Eventually, so many sockets were established that memory allocations were exhausted and the program crashed.

“It was very frustrating for them,” said Behar, who was monitoring internet relay chats where the attackers were congregating during the attacks. “They were really pissed off.”

To prevent session disruption from affecting legitimate connections, the researchers dropped a special form of packet that was unique to LOIC.

Gushin and Behar employed other defenses including one called tarpit that shrinks the amount of data a computer can send to a website to zero before an acknowledgement is required.

“The idea is to suffocate the attacker, to exhaust all its resources,” Gushin said.

The attacks, which Anonymous called "Operation Avenge Assange," came in retaliation to Visa, MasterCard, PayPal and other companies after they disrupted fundraising efforts by WikiLeaks by cutting off payment processing services to the whistle-blower website. The attacks involved floods of syn packets, Slowloris assaults, and at one point the use of hijacked Unix machines from a US state board of education, which delivered 8 million packets per second to the intended target. (The Reg agreed not to name the state or the target the researchers were defending.)

“The sophistication came from the fact that there was such a diversity of attacks,” Behar said. “It was very hard to figure out how to provide proper uptime.” ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.