On Feb 13, 2012 4:37 AM, "Lucas Fernando Amorim"
<lf.amorim@xxxxxxxxxxxx <mailto:lf.amorim@xxxxxxxxxxxx>> wrote:
With the recent wave of DDoS, a concern that was not taken is the
model
where the zombies were not compromised by a Trojan. In the standard
modeling of DDoS attack, the machines are purchased, usually in a
VPS,
or are obtained through Trojans, thus forming a botnet. But the
arbitrary shape doesn't need acquire a collection of computers.
Programs, servers and protocols are used to arbitrarily make
requests on
the target. P2P programs are especially vulnerable, DNS, internet
proxies, and many sites that make requests of user like Facebook
or W3C,
also are.
Precisely I made a proof-of-concept script of 60 lines hitting
most of
HTTP servers on the Internet, even if they have protections likely
mod_security, mod_evasive. This can be found on this link [1] at
GitHub.
The solution of the problem depends only on the reformulation of
protocols and limitations on the number of concurrent requests and
totals by proxies and programs for a given site, when exceeded
returning
a cached copy of the last request.
[1] https://github.com/lfamorim/barrelroll
Cheers,
Lucas Fernando Amorim
http://twitter.com/lfamorim
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/