5 ms·

Possible flaw in LOIC - Tool used to DDoS Amazon

10 points by jjoe 16y ago

muyyatin 16y ago
Actually the Host header is for HTTP/1.1. They are sending HTTP/1.0 requests. Since most modern browsers send HTTP/1.1 requests, they may be able to filter by ignoring HTTP/1.0 traffic in general.
jimwise 16y ago
You mean other than that it's a tool used to launch DDoS attacks? Joke aside, Host: is optional in HTTP/1.0 (it's mandatory in HTTP/1.1). I would not be surprised if blocking on this cut out some set of proxies and spiders out there as well (whether these are customers you can't afford to block is another question).
ZeroMinx 16y ago
HTTP/1.0 doesn't specify Host as a request parameter, iirc, so you might as well block on "HTTP/1.0".
dredge 16y ago
The source for one version of LOIC can be found on GitHub: https://github.com/NewEraCracker/LOIC/ https://github.com/NewEraCracker/LOIC/ A quick skim-read of the code mentioned in the post shows that this version seems to be different, specifically: https://github.com/NewEraCracker/LOIC/blob/master/HTTPFlooder.cs#L70 https://github.com/NewEraCracker/LOIC/blob/master/HTTPFloode... if (random == true) buf = System.Text.Encoding.ASCII.GetBytes( String.Format("GET {0}{1} HTTP/1.1{2}Host: {3}{2}{2}{2}", Subsite, new Functions().RandomString(), Environment.NewLine, Host)); else buf = System.Text.Encoding.ASCII.GetBytes( String.Format("GET {0} HTTP/1.1{1}Host: {2}{1}{1}{1}", Subsite, Environment.NewLine, Host)); (botched indentation is my own) The Host header mentioned in the blog post is present, the protocol is now HTTP/1.1 and random string appears to be an attempt to defeat a simple packet matching algorithm. I doubt many legitimate requests these days come without a User-Agent header, though...
- tptacek 16y ago
  The queries this generates look nothing like real requests; equally importantly, it's not actually implementing HTTP. Also, the concurrency mechanism is naive; you could write an evented proxy that writes 1 byte back and hangs, gumming up a thread. These problems are really easy to fix, so I'm not sure whether it's worth discussing them; most people on HN aren't in a position to actually implement countermeasures to this tool, and there's nothing conceptually interesting about it to learn from.
- contextfree 16y ago
  Pretty surprised to see that it's WinForms based. .NET: not just for cubicle dwellers anymore!
wwortiz 16y ago
I am really interested in what repercussions will come of all this, because I'm willing to bet some portion (probably large) of the people performing these attacks didn't actually take caution to make sure they were indeed anonymous.
- blutonium 16y ago
  No, but for the most part they don't need to. 1) It's not just LOIC users DDoSing. There are usually small to medium sized botnets involved, especially on big attacks. 2) You said it yourself - there are tens of thousands of clients involved, and it's often difficult to tell because of #3 (unless there's a TCP/UDP message specified, which is a surefire way to ID attacks) 3) Most LOIC users use the /hivemind option, which turns control over to a master in an IRC channel. It can selectively throttle (most) clients, and spread the work around the net to make the attack more difficult to block. 4) They've got a standard line for getting caught[1] (sorry for the offensive URL) The other thing to note is the time and expense involved in trying to identify and prosecute a few thousand people for participating would be enormous. We'll have to see if they try this time. [1] http://encyclopediadramatica.com/LOIC#Newfags_FAQs http://encyclopediadramatica.com/LOIC#Newfags_FAQs
citricsquid 16y ago
I know disclosure is the in thing, but couldn't this have been forwarded to the affected companies without alerting the hordes of not-so-smart people using the program to help them stop the attack? unixy appears to be a server company, surely they understand how hard dealing with an attack like this is... I guess that's viral marketing or something.
Anon_09876567 16y ago
Thanks for the bug report :)

10 points by jjoe 16y ago

Actually the Host header is for HTTP/1.1. They are sending HTTP/1.0 requests. Since most modern browsers send HTTP/1.1 requests, they may be able to filter by ignoring HTTP/1.0 traffic in general.

jimwise 16y ago

You mean other than that it's a tool used to launch DDoS attacks? Joke aside, Host: is optional in HTTP/1.0 (it's mandatory in HTTP/1.1). I would not be surprised if blocking on this cut out some set of proxies and spiders out there as well (whether these are customers you can't afford to block is another question).

ZeroMinx 16y ago

HTTP/1.0 doesn't specify Host as a request parameter, iirc, so you might as well block on "HTTP/1.0".

dredge 16y ago

The source for one version of LOIC can be found on GitHub: https://github.com/NewEraCracker/LOIC/ https://github.com/NewEraCracker/LOIC/ A quick skim-read of the code mentioned in the post shows that this version seems to be different, specifically: https://github.com/NewEraCracker/LOIC/blob/master/HTTPFlooder.cs#L70 https://github.com/NewEraCracker/LOIC/blob/master/HTTPFloode... if (random == true) buf = System.Text.Encoding.ASCII.GetBytes( String.Format("GET {0}{1} HTTP/1.1{2}Host: {3}{2}{2}{2}", Subsite, new Functions().RandomString(), Environment.NewLine, Host)); else buf = System.Text.Encoding.ASCII.GetBytes( String.Format("GET {0} HTTP/1.1{1}Host: {2}{1}{1}{1}", Subsite, Environment.NewLine, Host)); (botched indentation is my own) The Host header mentioned in the blog post is present, the protocol is now HTTP/1.1 and random string appears to be an attempt to defeat a simple packet matching algorithm. I doubt many legitimate requests these days come without a User-Agent header, though...

tptacek 16y ago
The queries this generates look nothing like real requests; equally importantly, it's not actually implementing HTTP. Also, the concurrency mechanism is naive; you could write an evented proxy that writes 1 byte back and hangs, gumming up a thread. These problems are really easy to fix, so I'm not sure whether it's worth discussing them; most people on HN aren't in a position to actually implement countermeasures to this tool, and there's nothing conceptually interesting about it to learn from.
contextfree 16y ago
Pretty surprised to see that it's WinForms based. .NET: not just for cubicle dwellers anymore!

wwortiz 16y ago

I am really interested in what repercussions will come of all this, because I'm willing to bet some portion (probably large) of the people performing these attacks didn't actually take caution to make sure they were indeed anonymous.

blutonium 16y ago
No, but for the most part they don't need to. 1) It's not just LOIC users DDoSing. There are usually small to medium sized botnets involved, especially on big attacks. 2) You said it yourself - there are tens of thousands of clients involved, and it's often difficult to tell because of #3 (unless there's a TCP/UDP message specified, which is a surefire way to ID attacks) 3) Most LOIC users use the /hivemind option, which turns control over to a master in an IRC channel. It can selectively throttle (most) clients, and spread the work around the net to make the attack more difficult to block. 4) They've got a standard line for getting caught[1] (sorry for the offensive URL) The other thing to note is the time and expense involved in trying to identify and prosecute a few thousand people for participating would be enormous. We'll have to see if they try this time. [1] http://encyclopediadramatica.com/LOIC#Newfags_FAQs http://encyclopediadramatica.com/LOIC#Newfags_FAQs

citricsquid 16y ago

I know disclosure is the in thing, but couldn't this have been forwarded to the affected companies without alerting the hordes of not-so-smart people using the program to help them stop the attack? unixy appears to be a server company, surely they understand how hard dealing with an attack like this is... I guess that's viral marketing or something.

Anon_09876567 16y ago

Thanks for the bug report :)