02:26 PM

DDoS Tools Flourish, Give Attackers Many Options

More than 55 DDoS tools and services on the market offer hacktivists, increasingly driven by ideological or political goals, a wide range of choices, Arbor security researcher reports.

Securing The Super Bowls Of Sports
Securing The Super Bowls Of Sports
(click image for larger view and for slideshow)
How hard is it to launch a distributed denial-of-service (DDoS) attack?

Arguably, the hacktivist collective Anonymous has made launching DDoS attacks look easy, due to its high-profile DDoS campaigns against everyone from PayPal and MasterCard to the FBI and Department of Justice. In addition, Anonymous offered the promise of one-click attacks via its low orbit ion cannon (LOIC) DDoS attack tool.

While LOIC was great at building buzz for Anonymous, it also provided valuable intelligence for law enforcement agencies, since many users apparently didn't realize that the tool alone wouldn't obscure their IP address from the sites they attacked.

[ They may be impossible to prevent, but 10 Strategies To Fight Anonymous DDoS Attacks can help you mitigate an attack in progress. ]

But LOIC, it turns out, is just one of many DDoS tools now available for online use, downloading, or renting. Indeed, there's now a thriving DDoS tool and botnet ecosystem that includes "single user flooding tools, small host booters, shell booters, remote access Trojans (RATs) with flooding capabilities, simple DDoS bots, complex DDoS bots, and some commercial DDoS services," said Curt Wilson, a research analyst at Arbor Networks, in a blog post. "Many types of threats can be blended into any given tool in order to make the tool more attractive and financially lucrative"--as in, profitable for whoever's renting out the DDoS capabilities.

All told, Wilson recently counted 55 different DDoS tools, which are still just a fraction of what's publicly and commercially available. Of course, some of these tools are more dangerous than others. For example, Fg Power DDOSER is designed to flood a gaming competitor with packets, thus slowing their connection speed or knocking them offline, although the DDoS toolkit also includes a Firefox password stealer, said Wilson. Another relatively simple tool, Silent-DDoSer, can launch UDP, SYN, and HTTP attacks, and also offers "triple-DES and RC4 encryption, IPv6 capabilities, and password stealing functions," he said.

At the other end of the spectrum, meanwhile, there are a number of complex DDoS toolkits and related bots, and typically also Web-based command-and-control interfaces. These toolkits sport names such as Darkness/Optima, DeDal, Dirt Jumper, G-Bot, and Russian Armageddon. Finally, services such as Death DDoS Service and Totoro offer commercial DDoS options, meaning that rather than running the tools themselves, attackers can just outsource the job.

Why launch a DDoS attack? Many times, as with botnets, the goal is to steal valuable information, such as financial details. But such attacks can also be used for business purposes. "While there are numerous motives for DDoS, such as revenge, extortion, competitive advantage, and protest, many of the commercial DDoS services emphasize competitive advantage with wording devoted to taking down a competitor," said Wilson. "More troubling is the recently reported distracting use of DDoS to flood networks after financial theft has been performed via a banking Trojan in order to allow the thieves extended access to the loot."

But some of those drivers may be changing. In fact, half of DDoS attacks are now ideologically driven, according to a new study of 2011 attacks conducted by Arbor. "Ideologically and politically motivated DDoS attacks have dramatically risen as the perceived root cause of large-scale DDoS attacks on the Internet," said Roland Dobbins, Asia-Pacific solutions architect for Arbor Networks, via phone.

Previously, he said, service providers and network operators saw the leading causes of DDoS attacks as "nihilism, vandalism, criminal activity, and gaming activity--people unhappy with their gaming comrades, who DDoS them," he said. "Then there's criminal extortion, where people will demand 'protection money' to allow a DDoS'd site to come back up."

Another interesting finding--with DDoS implications--from Arbor's new research is that wireless network operators' security capabilities appear to lag their wireline counterparts by about 10 years, principally in terms of the visibility they do or don't have into what's happening on their TCP/IP networks, which now serve an enormous number of smartphone users and their increasing data consumption requirements. "Wireless operators around the world had become what I like to call 'accidental ISPs' over the last four years, since the introduction of the iPhone," Dobbins said.

"Some of the larger providers have really done a tremendous job of making a transition, understanding that TCP/IP is really the future," he said. "But there are a number of wireless providers around the world at which the senior management doesn't agree with the proposition that their primary business is now Internet access, and that voice...will become [only] packetized TCP/IP."

At those organizations, knowledge of TCP/IP security can lag, which leaves the telecommunications carriers at greater risk of not being able to cope with DDoS attacks launched at their wireless networks. "There's still this focus on minutes versus packets. It's going to take a lot of time for the industry to make that conceptual shift," said Dobbins.

There are no silver bullets when it comes to protecting company and customer data from loss or theft, but there are technological and procedural systems that will go a long way toward preventing a WikiLeaks-like data dump. Download our How To Prevent An Online Data Dump report. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio