[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Arbitrary DDoS PoC

I could argue that an attack targeted at a service, especially HTTP, is not measured by the band, but the requests, especially the heavier, could argue that a technique is the most inherent characteristic of multiple sources of traffic and still relying on trust. I could still say that is an implementation that relates only to say - Look, it exists!, I could still prolong explaining about overheads, and using about the same time many sites that make the requests, thus reducing the wake of a failure, even if you say easily diagnosable.
But I'd rather say that it is actually very pedantic of you label something as inefficient, especially when not done a single test, only the pedantic observation of someone whose interests it is reprehensible. I will not say you're one of those, but this is really an attitude typical of this kind, which is certainly not a hacker. Thanks to people like that, do not know if you like, there are many flaws yet to be explored.
If anyone wants more information, obviously I will ask to send an email or call me to give a presentation, I will not think about anything. My goal in was invited researchers to study DDoS on this model, because anytime someone can direct thousands to generate a network congestion. 

On 13-02-2012 11:17, Gage Bystrom wrote:
Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent server with that using a single box. Sending your request through multiple proxies does not magically increase the resource usage of the target, its still your output power vs their input pipe. Sure it gives a slight boost in anonymity and obfuscation but does not actually increase effectiveness. It would even decrease effectiveness because you bear the burden of having to send to a proxy, giving them ample time to recover from a given request.
Even if you look at it as a tactic to bypass blacklisting, you still aren't going to overwhelm the server. That means you need more pawns to do your bidding. This creates a bit of a problem however as then all your slaves are running through a limited selection of proxies, reducing the amount of threats the server needs to blacklist. The circumvention is quite obvious, which is to not utilize proxies for the pawns....and rely on shear numbers and/or superior resource exhaustion methods....
On Feb 13, 2012 4:37 AM, "Lucas Fernando Amorim" <lf.amorim@xxxxxxxxxxxx <mailto:lf.amorim@xxxxxxxxxxxx>> wrote: 

    With the recent wave of DDoS, a concern that was not taken is the
    model
    where the zombies were not compromised by a Trojan. In the standard
    modeling of DDoS attack, the machines are purchased, usually in a VPS,
    or are obtained through Trojans, thus forming a botnet. But the
    arbitrary shape doesn't need acquire a collection of computers.
    Programs, servers and protocols are used to arbitrarily make
    requests on
    the target. P2P programs are especially vulnerable, DNS, internet
    proxies, and many sites that make requests of user like Facebook
    or W3C,
    also are.

    Precisely I made a proof-of-concept script of 60 lines hitting most of
    HTTP servers on the Internet, even if they have protections likely
    mod_security, mod_evasive. This can be found on this link [1] at
    GitHub.
    The solution of the problem depends only on the reformulation of
    protocols and limitations on the number of concurrent requests and
    totals by proxies and programs for a given site, when exceeded
    returning
    a cached copy of the last request.

    [1] https://github.com/lfamorim/barrelroll

    Cheers,
    Lucas Fernando Amorim
    http://twitter.com/lfamorim

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/