3 ms·
I was more interested in the claims made in #Ref#Ref. It looks like the exploit needs server-side Javascript execution in order to work. (edit: Nevermind, no it
by thaumaturgy 15y ago
I was more interested in the claims made in #Ref#Ref. It looks like the exploit needs server-side Javascript execution in order to work. (edit: Nevermind, no it doesn't, that was confusion on the part of people that had written articles after reading other peoples' articles.) I don't see a lot of the stodgy old Wall Street web-facing systems (or even internal systems) supporting something like that.
It also looks like it requires a working SQLi on the target site, which means that before it can even be used, someone's going to need to find a nice exploit on the target, and if they find that, then using RefRef to take down the target is kinda pointless.
Shucks. I was almost hoping to see a cool new exploit here.
edit: Bah, it's even more simple than that. It uses an SQLi to run the MySQL "benchmark" function an absurd (99999999999) number of times, according to the code I found. Not only that, but it's just benchmarking a simple text string; they could have given MySQL something much more gnarly to chew on if they'd wanted.
"Patching" against this attack should be as easy as adding an htaccess rule for any requests containing "select+benchmark" and then restarting MySQL.
Son, I am disappoint.
- emiraga 15y agoI am not sure if this is the whole thing http://www.refref.org/p/refref.html http://www.refref.org/p/refref.html but it does not seem very sophisticated edit: #refref seems to refer to multiple tools, but looking at this screenshot http://2.bp.blogspot.com/-v_gCKJilPLw/TjPob43lXiI/AAAAAAAACoU/dpq93BW25zY/s1600/anon_ddos_tool+%25281%2529.jpg http://2.bp.blogspot.com/-v_gCKJilPLw/TjPob43lXiI/AAAAAAAACo... is also trivial.
- thaumaturgy 15y agoYeah, that's what I found too. I think you beat my edit by a few seconds. :-) It looks like several versions have been written, but they're probably all based on the same basic concept. The "Javascript" version that people were referring to is probably the screenshot you posted, which would be trivial to launch with a few Ajax requests. I will point my finger and laaaaaugh if this manages to take down any Wall Street websites.
- emiraga 15y agoSince they have a lot of members, bringing down a website is still possible (even if they simply click refresh continuously). Now, about the tool, assuming they are really smart (they aren't) they would make a bookmarklet which would have to be clicked while Wall Street website is open. This would allow all kinds of things to be done, including Ajax requests. If #refref tool is hosted on another domain, same-origin policy would prevent Ajax from happening. Most likely, in that case they are simply creating a bunch of IFRAMEs and refreshing them with javascript.
- thaumaturgy 15y ago> ...same-origin policy would prevent Ajax from happening. Actually, it doesn't! I decided to try this out for myself a while back. You can get or post a request to any resource at another domain, you just don't get to see the contents of the results. But the request itself works just fine, and you'll even still get to know when the request is complete.