Feeds

Anonymous DoS attacks thwarted with Aikido hip throw

War stories from 'Operation Avenge Assange'

Security for virtualized datacentres

In early December, researchers from security firm Radware were dispatched to repel attacks against a company being targeted by the Anonymous hacking collective and could only be described as fierce and potentially devastating.

With junk traffic hitting peaks of 14 Gbps and coming from botnets, Unix machines with massive amounts of bandwidth, and volunteers using a custom-designed denial-of-service weapon, Yuri Gushin and Alex Behar had their work cut out. Rather than responding with a defense in kind, they adopted a technique straight out of a text from Aikido, the martial art that blunts attacks by redirecting an opponent’s energy, rather than opposing it head on.

“We basically turned the tables here,” Behar, who spoke at this week's Black Hat security conference in Barcelona, told The Reg by Skype. “These kinds of techniques don't necessarily require a lot of bandwidth.” That allowed the target they were defending to repel the attackers without locking out legitimate visitors to the site.

Among the weapons in their arsenal was Roboo, a low-footprint tool the researchers released this week as an open-source tool for warding off DoS attacks and similar kinds of automated assaults. The challenge-and-response software sits in front of a webserver and requires remote machines that want to connect to first respond to simple queries sent in HTTP, HTML, JavaScript, and Adobe Flash.

Because it's technically inefficient for most attack tools to be fluent in those web languages, the DoS packets never reach their targets, even as legitimate users experience few if any perceptible delays. Roboo can also be used to weed out other types of bots, such as those that automatically register accounts or leave comment spam on websites, making it a possible substitute for Captchas, the puzzles designed to verify a real human is behind a web request that real humans often love to hate.

The Radware security specialists, who are regularly called on to defend e-commece companies and gambling sites against DoS attacks, also employed another technique that proved effective against the Anonymous attacks. It's called session disruption, and it works by dropping a single packet sent from a DoS agent shortly after an internet session has begun.

Internet protocols require both sides to reduce the amount of traffic being sent when packet loss is experienced. This “congestion time out mode” caused major problems for users of the Low Orbit Ion Cannon, the open-source tool Anonymous volunteers use to direct torrents of traffic at sites they disapprove of. LOIC responded to the slow-down by opening an increasing number of connections to the targeted site. Eventually, so many sockets were established that memory allocations were exhausted and the program crashed.

“It was very frustrating for them,” said Behar, who was monitoring internet relay chats where the attackers were congregating during the attacks. “They were really pissed off.”

To prevent session disruption from affecting legitimate connections, the researchers dropped a special form of packet that was unique to LOIC.

Gushin and Behar employed other defenses including one called tarpit that shrinks the amount of data a computer can send to a website to zero before an acknowledgement is required.

“The idea is to suffocate the attacker, to exhaust all its resources,” Gushin said.

The attacks, which Anonymous called "Operation Avenge Assange," came in retaliation to Visa, MasterCard, PayPal and other companies after they disrupted fundraising efforts by WikiLeaks by cutting off payment processing services to the whistle-blower website. The attacks involved floods of syn packets, Slowloris assaults, and at one point the use of hijacked Unix machines from a US state board of education, which delivered 8 million packets per second to the intended target. (The Reg agreed not to name the state or the target the researchers were defending.)

“The sophistication came from the fact that there was such a diversity of attacks,” Behar said. “It was very hard to figure out how to provide proper uptime.” ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.