9 ms·
Anonymous has never had the firepower to take down those three sites simultaneously using LOIC, so I'd be interested to see what the mechanism is. I suspect it
by redthrowaway 15y ago
Anonymous has never had the firepower to take down those three sites simultaneously using LOIC, so I'd be interested to see what the mechanism is. I suspect it's one or more of the Sabu-types firing their botnets. If this is the case, to what extant can this action be attributed to Anonymous? I'm sure there's likely broad support for it, but if it is just the actions of one or two botherders it makes attribution a bit of a grey area.
Edit: Add mpaa.org to the mix, as well as an attempt on fbi.gov. They'd have to have several gigs worth of bandwidth available to be able to hold all 4 sites down simultaneously. With average upload speeds in the hundreds of kilobits, that's a reasonably large botnet (50k-100k, as an pulled-from-ass guestimate).
- gee_totes 15y agoGiven the nature of both organizations are not too tech-savvy, I wouldn't be surprised if the sites in question were running an unpatched version of Apache and were susceptible to this: http://www.infoq.com/news/2011/08/apache-killer http://www.infoq.com/news/2011/08/apache-killer But that is pure speculation. What I'm trying to say is there are far more tools than LOIC to pull of a DDOS attack.
- redthrowaway 15y agoriaa.org, mpaa.org, and universalmusic.com I could see being unpatched, but I would have thought justice.gov would have to be patched for compliance reasons.
- gee_totes 15y agoThat's a logical point. But compliance with what? All I can find after a quick google search is National Institue of Technology GUIDELINES, and the only laws mentioned seem to deal with user privacy. In fact, the only compliance regulations I know of with government sites have to do with accessibility. [EDIT] Wait, I might be wrong. The DoD guide seems to cite quite a few regs, some of which may apply to the Justice department. Too bad I can't check their site :P http://www.defense.gov/webmasters/policy/dod_web_policy_12071998_with_amendments_and_corrections.aspx http://www.defense.gov/webmasters/policy/dod_web_policy_1207...
- officemonkey 15y agoSee also: FISMA. http://csrc.nist.gov/groups/SMA/fisma/index.html http://csrc.nist.gov/groups/SMA/fisma/index.html
- awj 15y ago> but I would have thought justice.gov would have to be patched for compliance reasons. I don't think that's true. I'd imagine the server behind justice.gov has no connectivity to anything important for compliance reasons, so patching it isn't really a big deal. Relevant xkcd: http://xkcd.com/932/ http://xkcd.com/932/
- jiggy2011 15y agoI'd be surprised, if I had the funds these organizations do and I knew I would be a likely be a target for this kind of thing I'd at least hire a security consultant to check these things over for me.
- deleted 15y ago[deleted]
- kristofferR 15y agoAccording to a tweet it's around 5600 guys with LOIC. "The Largest Attack Ever by Anonymous - 5,635 People Confirmed Using #LOIC to Bring Down Sites! #Anonymous" https://twitter.com/#!/YourAnonNews/status/160135858895335424 https://twitter.com/#!/YourAnonNews/status/16013585889533542...
- redthrowaway 15y agoI'm highly doubtful that that's all that's happening. I simply can't see a 5600-strong botnet (voluntary or not) holding down 4 independent domains simultaneously. On a separate note, I would have thought they had learned their lesson re: LOIC after OP:Payback. I guess we'll be seeing another string of arrests in the coming months.
- codezero 15y agoThey might manage to fill the connection limit for apache on each system (I think this is default to 256?).
- getsat 15y agoYou don't necessarily need a lot of bandwidth to take a site down. Slowloris, hash collisions (http://isc.sans.edu/diary.html?storyid=12286 http://isc.sans.edu/diary.html?storyid=12286), or simply a lot of HTTP requests to pages that consume a lot of CPU time are generally sufficient to take a site offline temporarily.
- jiggy2011 15y agoWhich hash functions built into the web server would they attack? I can't think of a specific time in a normal HTTP request that would use a user-supplied hash. I would assume only a minority of pages on the average site would eat CPU so surely the sensible defense to this would be to impose a maximum CPU usage on these parts so the rest of the website continues to work.
- pilate 15y agoAny PHP page will propagate the $_POST and $_GET arrays from user supplied data.
- jiggy2011 15y agogood point, so the idea would be to supply something like: page.php?x=1&y=1... where the x and y keys are going to have the same hash value, so that when it uses those vars in a page it will hit the same hash bucket and become O(n) not O(1)? Of course you would want to send a lot of different vars in.
- getsat 15y agoYup, though I'd probably pass those in using a POST request. A 5,000,000 character long log entry sticks out a bit, and most people aren't logging POST params by default.
- siegecraft 15y agoI was under the impression that Anonymous was just kind of a brand that anyone who wanted to could assign credit to for their activities (since they have the publicity infrastructure in place)
- arctangent 15y agoYou're correct. But I believe there's a certain amount of coordination going on behind the scenes in order to arrange significant activities. Anonymous is an interesting cultural phenomenon, but hiding behind a common shared identity is not new. For example, see here: http://en.wikipedia.org/wiki/Multiple-use_name http://en.wikipedia.org/wiki/Multiple-use_name http://en.wikipedia.org/wiki/Category:Collective_pseudonyms http://en.wikipedia.org/wiki/Category:Collective_pseudonyms
- espeed 15y agoDon't rule out a cyber-false-flag designed to raise the profile of "hackers" and build public demand for SOPA and friends.
- ryanac 15y agoIt is interesting that this article appeared today: http://news.ycombinator.com/item?id=3484419 http://news.ycombinator.com/item?id=3484419 On HN's frontpage, hours before the take down, then this.
- zotz 15y agoThis makes more sense than "Anonymous" taking down .gov websites in a coordinated attack. "Anonymous" is so handy, if they didn't exist the government would just have to invent them.
- jhales 15y agoPossible, but if this were true, one would expect denials from anonymous mouthpieces as well.
- sebphfx 15y agoalso, poster child spokesperson Barrett Brown confirmed it.
- jiggy2011 15y agoSOPA doesn't really have anything to do with DDOS afaik. But I take your point , it contributes to a general "the internet is scary" atmosphere.
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- joshuahedlund 15y agoThis is how they're doing it: http://gawker.com/5877707/ http://gawker.com/5877707/ Reeling in unwitting volunteers from Twitter
- redthrowaway 15y agoInteresting. I wonder if the js version behaves identically to the .net one. If so, it could offer plausible deniability to any LOICers out there. I'm not condoning the practice, but it is a creative solution to having your primary tool be rendered toxic by the op payback arrests.
- aliem 15y agothe js version does something like setInterval(function(){ var i = new Image(); i.src = target + randId + msg; ... // event handling }, 0) so you end up requesting an url every 0 ms the randId is just a simple `Date.now`, the message is an actual message taken from an input in the html. Source code: http://hastebin.com/gasitinafo.js http://hastebin.com/gasitinafo.js
- jiggy2011 15y agoThat's pretty nasty. Surely defense against this kind of thing should be built into browsers although you would need to detect an unending loop causing HTTP requests so run into the halting problem I guess. If they are tricking people into performing what is potentially a criminal act then they lose the limited amount of respect I did have for them.
- maxerickson 15y agoMy recent version of Firefox defaults to a limit of 15 connections per server. So there is some defense built in.
- jiggy2011 15y agoYea but as soon as one connection is finished it can just spawn another one so 15 concurrent connections is more than enough to do damage. Once you start doing thousands of concurrent connections you more likely to kill your router anyway.