Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


DDoS Tools Flourish, Give Attackers Many Options

More than 55 DDoS tools and services on the market offer hacktivists, increasingly driven by ideological or political goals, a wide range of choices, Arbor security researcher reports.

Securing The Super Bowls Of Sports
Securing The Super Bowls Of Sports
(click image for larger view and for slideshow)
How hard is it to launch a distributed denial-of-service (DDoS) attack?

Arguably, the hacktivist collective Anonymous has made launching DDoS attacks look easy, due to its high-profile DDoS campaigns against everyone from PayPal and MasterCard to the FBI and Department of Justice. In addition, Anonymous offered the promise of one-click attacks via its low orbit ion cannon (LOIC) DDoS attack tool.

While LOIC was great at building buzz for Anonymous, it also provided valuable intelligence for law enforcement agencies, since many users apparently didn't realize that the tool alone wouldn't obscure their IP address from the sites they attacked.

[ They may be impossible to prevent, but 10 Strategies To Fight Anonymous DDoS Attacks can help you mitigate an attack in progress. ]

But LOIC, it turns out, is just one of many DDoS tools now available for online use, downloading, or renting. Indeed, there's now a thriving DDoS tool and botnet ecosystem that includes "single user flooding tools, small host booters, shell booters, remote access Trojans (RATs) with flooding capabilities, simple DDoS bots, complex DDoS bots, and some commercial DDoS services," said Curt Wilson, a research analyst at Arbor Networks, in a blog post. "Many types of threats can be blended into any given tool in order to make the tool more attractive and financially lucrative"--as in, profitable for whoever's renting out the DDoS capabilities.

All told, Wilson recently counted 55 different DDoS tools, which are still just a fraction of what's publicly and commercially available. Of course, some of these tools are more dangerous than others. For example, Fg Power DDOSER is designed to flood a gaming competitor with packets, thus slowing their connection speed or knocking them offline, although the DDoS toolkit also includes a Firefox password stealer, said Wilson. Another relatively simple tool, Silent-DDoSer, can launch UDP, SYN, and HTTP attacks, and also offers "triple-DES and RC4 encryption, IPv6 capabilities, and password stealing functions," he said.

At the other end of the spectrum, meanwhile, there are a number of complex DDoS toolkits and related bots, and typically also Web-based command-and-control interfaces. These toolkits sport names such as Darkness/Optima, DeDal, Dirt Jumper, G-Bot, and Russian Armageddon. Finally, services such as Death DDoS Service and Totoro offer commercial DDoS options, meaning that rather than running the tools themselves, attackers can just outsource the job.

Why launch a DDoS attack? Many times, as with botnets, the goal is to steal valuable information, such as financial details. But such attacks can also be used for business purposes. "While there are numerous motives for DDoS, such as revenge, extortion, competitive advantage, and protest, many of the commercial DDoS services emphasize competitive advantage with wording devoted to taking down a competitor," said Wilson. "More troubling is the recently reported distracting use of DDoS to flood networks after financial theft has been performed via a banking Trojan in order to allow the thieves extended access to the loot."

But some of those drivers may be changing. In fact, half of DDoS attacks are now ideologically driven, according to a new study of 2011 attacks conducted by Arbor. "Ideologically and politically motivated DDoS attacks have dramatically risen as the perceived root cause of large-scale DDoS attacks on the Internet," said Roland Dobbins, Asia-Pacific solutions architect for Arbor Networks, via phone.

Previously, he said, service providers and network operators saw the leading causes of DDoS attacks as "nihilism, vandalism, criminal activity, and gaming activity--people unhappy with their gaming comrades, who DDoS them," he said. "Then there's criminal extortion, where people will demand 'protection money' to allow a DDoS'd site to come back up."

Another interesting finding--with DDoS implications--from Arbor's new research is that wireless network operators' security capabilities appear to lag their wireline counterparts by about 10 years, principally in terms of the visibility they do or don't have into what's happening on their TCP/IP networks, which now serve an enormous number of smartphone users and their increasing data consumption requirements. "Wireless operators around the world had become what I like to call 'accidental ISPs' over the last four years, since the introduction of the iPhone," Dobbins said.

"Some of the larger providers have really done a tremendous job of making a transition, understanding that TCP/IP is really the future," he said. "But there are a number of wireless providers around the world at which the senior management doesn't agree with the proposition that their primary business is now Internet access, and that voice...will become [only] packetized TCP/IP."

At those organizations, knowledge of TCP/IP security can lag, which leaves the telecommunications carriers at greater risk of not being able to cope with DDoS attacks launched at their wireless networks. "There's still this focus on minutes versus packets. It's going to take a lot of time for the industry to make that conceptual shift," said Dobbins.

There are no silver bullets when it comes to protecting company and customer data from loss or theft, but there are technological and procedural systems that will go a long way toward preventing a WikiLeaks-like data dump. Download our How To Prevent An Online Data Dump report. (Free registration required.)


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...