[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISN] 'Ragtag' Russian army shows the new face of DDoS attacks


By Dan Goodin in San Francisco 
The Register
4th January 2008

In late April, a Russian-speaking blogger upset with recent events in 
Estonia posted a series of dispatches calling on like-minded people to 
attack government servers in that country.

"They're really fascists," the user, who went by the name of VolchenoK, 
wrote of Estonian government officials, according to this translation. 
"Let us help those who are there and really fought for the memory of our 
grandfather and grandmother. Yet they are fighting against fascism!"

VolchenoK's dispatch was echoed in posts on other Russian-speaking 
websites and helped set the groundwork for more than a week of 
distributed denial of service (DDoS) attacks, which sometimes brought 
official Estonian websites to their knees.

The assault on the Estonian sites was motivated by the government's 
removal of a Soviet-era memorial from the center of that country's 
capital. For decades, the monument stood as a tribute to Soviet soldiers 
who drove out the Nazis during World War II. Some Russians took the 
removal as a slap in the face and sought revenge.

The attacks should serve as a wake-up call for US government officials 
about the potency of several new DDoS tools adopted by cyber criminals, 
says Arbor Networks senior security engineer Jose Nazario. He will speak 
about about DDoS threats later this month at the US Department of 
Defense's Cyber Crime Conference.

Rage against the Machine

The Estonia attacks are a graphic example of the damage that disaffected 
groups can cause when they vent their rage on internet targets, he says. 
Combined with a separate round of attacks on sites belonging to both 
pro-Russian and anti-Russian groups over the last three months, they 
raise the possibility that attacks based on political, ethnic or 
cultural differences may be on the rise.

"That ragtag army ... can actually be effective," Nazario says. "We're 
very, very worried about computer botnets. We should be just as worried 
about semi-organized groups of upset people."

Posts like the one left by VolchenoK included a do-it-yourself script 
users could run to turn their computers into individual launch pads for 
the attacks. They also included instructions on when participants should 
start and stop them to ensure the incursions caused as much damage as 
possible. They were combined with more traditional DDoS attacks from 
networks of zombie machines.

By Western standards, the attacks weren't all that sophisticated. They 
topped out at about 100MB per second, compared with as much as 40GB per 
second unleashed against some targets. They also employed protocols such 
as ICMP and TCP SYN, which have been used for so long that they are no 
longer effective against many hardened targets.

But more recent events may show that politically motivated attackers are 
growing more savvy. Over the past several months, Nazario has documented 
attacks on sites belonging to groups on both sides of the Russian 
establishment. Targets include the Party of Regions, a pro-Russian party 
led by Ukrainian Prime Minister Viktor Yanukovych; the site of Gary 
Kasparov, the Russian chess grandmaster turned critic of Russian 
President Vladimir Putin; and namarsh.ru, another dissident site. All 
attacks have been carried out using botnets, Nazario says.


One weapon used in these most recent raids is a tool called BlackEnergy. 
It doesn't rely on the more primitive IRC protocol, doesn't scan for new 
hosts to infect and is cloaked in a rootkit, making it hard for users or 
security researchers to detect. A graphical interface makes it easy for 
hackers to configure and it is designed solely for carrying out DDoS 
attacks, Nazario says.

More than three dozen servers have been detected as command and control 
centers for BlackEnergy, and because the tool is available for $40 the 
number could grow, Nazario says. HTML-based bots like BlackEnergy are 
harder for security professionals to detect and stop because the data 
they generate looks similar to web traffic.

"The DDoS problem hasn't gone away," Nazario says. "People who commit 
those kind of attacks have more specialized tools avaiable to them and 
their attacks have gotten mor specialized."

So Nazario is working with the computer emergency response teams of 
various governments to snuff out the command and control servers that 
act as the hubs for these networks. Among the techniques for stopping 
them are the blacklisting of domain names and internet protocol 
addresses and the sharing of signature files that can be used by Snort 
and other intrusion detection systems to pinpoint the servers.

Visit InfoSec News