6 ms·

> “None of these sites ever required the FBI to confirm that it owned, operated, or had any property right to the computer that the FBI attacked during its test

> “None of these sites ever required the FBI to confirm that it owned, operated, or had any property right to the computer that the FBI attacked during its testing (as would be appropriate if the attacks were for a legitimate or authorized purpose),” reads an affidavit (PDF) filed by Elliott Peterson, a special agent in the FBI’s Anchorage field office. So perhaps the next wave of booter sites can avoid scrutiny by adding a dialog asking the customer if they own the target or are authorized to attack it (in addition to not publishing ads advertising targets like websites and game servers) ?

scandinavian 4y ago
Sure, if they implement verification steps to ensure that the site is owned by the person attacking it. The verification steps could be similar to the ACME challenges: https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
- hannob 4y ago
  That would still be a terrible idea. If you do it domain-based it's obviously insecure (validate -> change a-record -> attack), if you do it IP based you basically allow attacks on cloud services that rent cheap virtual servers. Also keep in mind that a DDoS affects infrastructure on the way whose operators have not consented. I don't really think there's an ethical way to run a DDoS "stresser" service on the public Internet.
  - MajimasEyepatch 4y ago
    How is domain-based insecure? There are tons of services that use DNS records to validate ownership of a domain. If someone has managed to get control of a domain and modify its DNS records, they can do a lot more damage than a DDOS.
    - tedunangst 4y ago
      How do you stop me from pointing my DNS record at your server?
      - kkielhofner 4y ago
        That’s not how domain verification works. Typically a service using domain verification will ask you to create a specific, randomly generated TXT or similar record on your domain. After you’ve created the record you click a button or something and they do a query for it. Only someone with access to DNS for the domain can create such a record.
        Matheus28 4y ago
        You misunderstood him. Suppose: EXAMPLE.VICTIM.XYZ -> A 1.2.3.4 EXAMPLE.ATTACKER.XYZ -> A 1.2.3.4 EXAMPLE.ATTACKER.XYZ -> TXT whatever verification is needed DDoSes operate on IPs, not dns names. In the end, the target IP is getting DDoSed anyway.
        kkielhofner 4y ago
        No I didn’t. I was speaking to domain name validation generally - as in a way for you to prove your ownership and control over a domain name. Yes, of course DDoS or any kind of traffic can be pointed at an IP or any arbitrarily created DNS record. The only way for a “reputable” stress testing platform to validate IP space would be RIR validation via WHOIS or similar, PTR records, etc. Of course this isn’t practical because most people don’t control their IP space or even have the foggiest idea what any of that means (because why should they).
        Goz3rr 4y ago
        > Only someone with access to DNS for the domain can create such a record. That's why OP specified their DNS record. You buy/use a random domain name you own, point the A record at the IP you wish to attach, and then simply complete the TXT record verification since you have full control over the domain, while the booter resolves the A record to the true target.
      - 4y ago
    - kxrm 4y ago
      Domain verification doesn't do anything to prove that the target is a willing participant. A DNS record doesn't indicate that you own the underlying IP or CNAME target. At best DNS based verification are only good at verifying things that specifically relate to the domain (SSL for example).
      - adolph 4y ago
        Oh like: Evil haxxxor: creates domain name pointed at target it doesn’t own Innocent stress test site: prove you own this domain by adding cname in the DNS record EH: sure, heh heh heh ISTS: performs ddos against target
    - wlesieutre 4y ago
      But the DDOS attack isn't against the domain, it's against whatever server the domain points at. Requiring the owner to post a file at a specific URL would prove actual control of the server in a way that domain records don't. I can point a domain at whatever server I want, no need for it to be my own.
  - kuschku 4y ago
    Use the reverse DNS of the IP. Then do an ACME DNS01 challenge against that domain. That should work.
  - lolinder 4y ago
    What about a file-based validation? Require that a file be located at the root of the server with a validation code, and check that file regularly during the stress test. The only way I can think around that would be to have a reverse proxy that forwards most traffic but not requests for that one file, but then your DDoS isn't actually distributed.
    - TheDong 4y ago
      I find out my victim uses "SharedPHPHosting-R-US" for their website which uses virtual hosting to have one php server serve many different customers. I create my own SharedPHPHosting site, host the file, and point the stress testing site at it. Both my site and my victim's site are down. Success. I believe "neocities" uses the same IP and servers for all neocities websites, so there's another example where this would work.
      - prox 4y ago
        I wonder why people even do ddos attacks. What possible gain could there be from denying a service for a short while? Maybe competing webshops? It’s still seems overly childish to me. That said I never really looked into this.
        charcircuit 4y ago
        1. Money. Most online business can't make money if they are offline. If being offline or unstable is costing you $x / hour and you can stop it by just paying a fee. It's an easy way to end it. 2. Hurt your competition. In some online businesses DDoS attacks are used to compete with other businesses since if your competitor is offline more people will come to you. 3. Power. Some people want to flex the power they have over others. 4. Fame. You can get notoriety for taking something offline.
        namelessoracle 4y ago
        DDOS can be the definition of a heckler's veto. It's like blasting super loud music so nobody can hear what a person is saying. Dont like what a site is saying? DDOS so it cant load and people cant read it. For bonus points you are preventing site from getting clicks and thus ad revenue. There are communities on discord that setup donation links to make sure sites they dont like keep getting hit by DDOS via crowdfunding.
- singlow 4y ago
  Typically you just verify it by requesting a known name path like /allow-ddos-attacks.txt and it must contain a unique key generated for the account. Some have you add it as a special rule in /robots.txt
- tsimionescu 4y ago
  It's important to note that this would not be enough, since a DDoS also impacts carrier infrastructure. The company I work for actually contemplated creating such a service (strictly for testing purposes, which is our business), and one of the major problems was that we would actually need to have contracts with all ISPs and transit providers that the traffic would pass through, even if we could make sure that the destination was owned by whoever was paying for the test.
stefan_ 4y ago
No, you may still not punch your neighbor just because someone else told you he asked you to. This is a strict liability kind of felony.
- phyzome 4y ago
  I don't think punching someone falls under strict liability, and I don't think DoS attacks do either.

scandinavian 4y ago

Sure, if they implement verification steps to ensure that the site is owned by the person attacking it. The verification steps could be similar to the ACME challenges: https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/

hannob 4y ago
That would still be a terrible idea. If you do it domain-based it's obviously insecure (validate -> change a-record -> attack), if you do it IP based you basically allow attacks on cloud services that rent cheap virtual servers. Also keep in mind that a DDoS affects infrastructure on the way whose operators have not consented. I don't really think there's an ethical way to run a DDoS "stresser" service on the public Internet.
- MajimasEyepatch 4y ago
  How is domain-based insecure? There are tons of services that use DNS records to validate ownership of a domain. If someone has managed to get control of a domain and modify its DNS records, they can do a lot more damage than a DDOS.
  - tedunangst 4y ago
    How do you stop me from pointing my DNS record at your server?
    - kkielhofner 4y ago
      That’s not how domain verification works. Typically a service using domain verification will ask you to create a specific, randomly generated TXT or similar record on your domain. After you’ve created the record you click a button or something and they do a query for it. Only someone with access to DNS for the domain can create such a record.
      - Matheus28 4y ago
        You misunderstood him. Suppose: EXAMPLE.VICTIM.XYZ -> A 1.2.3.4 EXAMPLE.ATTACKER.XYZ -> A 1.2.3.4 EXAMPLE.ATTACKER.XYZ -> TXT whatever verification is needed DDoSes operate on IPs, not dns names. In the end, the target IP is getting DDoSed anyway.
        kkielhofner 4y ago
        No I didn’t. I was speaking to domain name validation generally - as in a way for you to prove your ownership and control over a domain name. Yes, of course DDoS or any kind of traffic can be pointed at an IP or any arbitrarily created DNS record. The only way for a “reputable” stress testing platform to validate IP space would be RIR validation via WHOIS or similar, PTR records, etc. Of course this isn’t practical because most people don’t control their IP space or even have the foggiest idea what any of that means (because why should they).
      - Goz3rr 4y ago
        > Only someone with access to DNS for the domain can create such a record. That's why OP specified their DNS record. You buy/use a random domain name you own, point the A record at the IP you wish to attach, and then simply complete the TXT record verification since you have full control over the domain, while the booter resolves the A record to the true target.
    - 4y ago
  - kxrm 4y ago
    Domain verification doesn't do anything to prove that the target is a willing participant. A DNS record doesn't indicate that you own the underlying IP or CNAME target. At best DNS based verification are only good at verifying things that specifically relate to the domain (SSL for example).
    - adolph 4y ago
      Oh like: Evil haxxxor: creates domain name pointed at target it doesn’t own Innocent stress test site: prove you own this domain by adding cname in the DNS record EH: sure, heh heh heh ISTS: performs ddos against target
  - wlesieutre 4y ago
    But the DDOS attack isn't against the domain, it's against whatever server the domain points at. Requiring the owner to post a file at a specific URL would prove actual control of the server in a way that domain records don't. I can point a domain at whatever server I want, no need for it to be my own.
- kuschku 4y ago
  Use the reverse DNS of the IP. Then do an ACME DNS01 challenge against that domain. That should work.
- lolinder 4y ago
  What about a file-based validation? Require that a file be located at the root of the server with a validation code, and check that file regularly during the stress test. The only way I can think around that would be to have a reverse proxy that forwards most traffic but not requests for that one file, but then your DDoS isn't actually distributed.
  - TheDong 4y ago
    I find out my victim uses "SharedPHPHosting-R-US" for their website which uses virtual hosting to have one php server serve many different customers. I create my own SharedPHPHosting site, host the file, and point the stress testing site at it. Both my site and my victim's site are down. Success. I believe "neocities" uses the same IP and servers for all neocities websites, so there's another example where this would work.
    - prox 4y ago
      I wonder why people even do ddos attacks. What possible gain could there be from denying a service for a short while? Maybe competing webshops? It’s still seems overly childish to me. That said I never really looked into this.
      - charcircuit 4y ago
        1. Money. Most online business can't make money if they are offline. If being offline or unstable is costing you $x / hour and you can stop it by just paying a fee. It's an easy way to end it. 2. Hurt your competition. In some online businesses DDoS attacks are used to compete with other businesses since if your competitor is offline more people will come to you. 3. Power. Some people want to flex the power they have over others. 4. Fame. You can get notoriety for taking something offline.
      - namelessoracle 4y ago
        DDOS can be the definition of a heckler's veto. It's like blasting super loud music so nobody can hear what a person is saying. Dont like what a site is saying? DDOS so it cant load and people cant read it. For bonus points you are preventing site from getting clicks and thus ad revenue. There are communities on discord that setup donation links to make sure sites they dont like keep getting hit by DDOS via crowdfunding.
singlow 4y ago
Typically you just verify it by requesting a known name path like /allow-ddos-attacks.txt and it must contain a unique key generated for the account. Some have you add it as a special rule in /robots.txt
tsimionescu 4y ago
It's important to note that this would not be enough, since a DDoS also impacts carrier infrastructure. The company I work for actually contemplated creating such a service (strictly for testing purposes, which is our business), and one of the major problems was that we would actually need to have contracts with all ISPs and transit providers that the traffic would pass through, even if we could make sure that the destination was owned by whoever was paying for the test.

stefan_ 4y ago

No, you may still not punch your neighbor just because someone else told you he asked you to. This is a strict liability kind of felony.

phyzome 4y ago
I don't think punching someone falls under strict liability, and I don't think DoS attacks do either.