4 ms·
Interestingly, DDoS attacks against Wikileaks can only delay dissemination of information a little bit. DDoS attacks against PayPal, on the other hand, can be e
by ntoshev 16y ago
Interestingly, DDoS attacks against Wikileaks can only delay dissemination of information a little bit. DDoS attacks against PayPal, on the other hand, can be effective in costing them real money, for every hour they are down.
If I were attacking them, I would target the APIs that merchants use instead of the main site. The main site has probably been DDoSed before, APIs are a subtler target. I imagine a successful attack there would have a broader and deeper impact.
Also, have browsers been used for DDoS before? I imagine with the popularity Wikileaks has, you can ask people to keep a page open if they want to participate, and share that page on Twitter/Reddit/Facebook. The page would repeatedly create requests loading the target urls in an iframe or as a script tag.
In this approach one would have to get rid of the referrer header, I guess. So open the urls using SSL. The SSL handshake would cause additional load.
Not sure how effective would that be compared to a traditional botnet that can delay TCP and SSL handshakes; things browsers can't do.
- cosmicray 16y ago> DDoS attacks against PayPal, on the other hand, can be effective in costing them real money, for every hour they are down. Ever heard the term 'collateral damage' ? If PayPal gets trashed (or at least significantly service impaired) that is going to hurt people way beyond PayPal. People who are trying (as I am) to keep up with the Christmas/Holiday rush, and wondering why so many orders, paid via PayPal, are not completing. An attack on PayPal is an attack on the wider business side of the web. Basically PayPal is the guy caught in the middle of a dispute (between Wikileaks/hacker community and the US Gov/Dept of State).
- jbooth 16y agoBasically PayPal is the guy caught in the middle of a dispute (between Wikileaks/hacker community and the US Gov/Dept of State). Well, then they should've stayed out of it. They haven't gotten so much as an official letter (which BTW would be extremely shady since the executive branch doesn't decide what's legal and not). Even if they did, they're under no obligation to do this unless there's a court order. They got involved because of the politics, they can deal with the blowback.
- ntoshev 16y ago> that is going to hurt people way beyond PayPal That's what I meant by broader and deeper impact. If service is impaired for merchants, a fraction of them will switch their payment provider. I am not arguing this is the right thing to do from moral standpoint btw. This just got me thinking about DDoSes for the first time. Would be interesting to hear what the security experts think.
- michaelchisari 16y agoPeople who are trying (as I am) to keep up with the Christmas/Holiday rush The same argument could be made against a work strike, or a mass protest, or an act of civil disobedience. There's very few examples in history of important issues being pushed forward in a way that was convenient for everyone.
- steveklabnik 16y agoOne might even make the claim that many important issues were only pushed forward specifically _because_ it was inconvenient for everyone.
- svemir 16y agothe best chrismas gift you can buy this year to the world is a freedom of speak!
- blhack 16y agoI believe that this is the point of what they're doing. They're hoping that this damages paypal to the point that merchants like you move to other payment processors. What is happening to you is horrible. I'm sorry.
- shadowpwner 16y agoInteresting idea. I would imagine the page load for the person who opens the webpage would be pretty high, unless there's a way to stop a webpage from loading. (Disabling images/js/flash client side, perhaps?). Also, the website owners would get banned pretty quick, unless they have some offshore hosting. Also, a double meta refresh is another way to get rid of the referrer beside using SSL.