7 ms·

Except the good ones know how to properly obfuscate the C&C servers. These morons ran everything through their public IRC server, hosted on the same network as

by timdorr 12y ago

Except the good ones know how to properly obfuscate the C&C servers. These morons ran everything through their public IRC server, hosted on the same network as the website advertising the service.

sp332 12y ago
Yup, from http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsquad-rise-and.html http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsqua... "I had noticed that lizardpatrol.com (the official LizardSquad website) was hidden behind cloudflare, so on a hunch I send a HTTP request to the darkode server, with the hostname set to "lizardpatrol.com".... That's right, the darkode server is also hosting the official LizardSquad website, oh dear." Why is CloudFlare protecting these sites, anyway?
- dewey 12y ago
  Because it's a customer like everyone else, as a service provider you should maintain a neutral stance even if you don't like the service they provide. Just like ISPs shouldn't handle Netflix's traffic any different than traffic from other companies.
  - sp332 12y ago
    ISPs will cut off service entirely if a customer is behaving abusively.
    - deleted 12y ago
      [deleted]
    - Karunamon 12y ago
      No, they will cut off service entirely if the user's behavior threatens their network (usually legally). As an example, ISP's don't drop spammers because they morally hate spam, they drop spammers because their mail servers will get blacklisted and make their customers hate them. A fine distinction, but an important one.
  - drzaiusapelord 12y ago
    Knowingly providing internet infrastructure so others can attack other internet infrastructure is far from "being neutral." ISPs disconnect customers all the time for abuse, yet somehow Cloudflare gets a free pass? Funny how the solution to being DDOS'd by their own customers is, "Buy our product." In the sane world we call this racketeering or protection money.
    - newaccountfool 12y ago
      If I was Cloudflare I wouldn't go cutting my customers until I had a court order or an official reason to.
- rudolf0 12y ago
  It's an intentional business decision, and it makes some sense if you understand the process. First, here's their CEO's explanation of their stance: http://blog.cloudflare.com/58611873/ http://blog.cloudflare.com/58611873/ Cloudflare is closer to a router than a host. They just happen to be a router which masks that which they're routing to. If you file an abuse complaint to them about a specific domain, they won't take any actions themselves. However, they will tell the reporter the server's real hosting provider, and will forward the complaint to the hosting provider with information allowing the provider to determine what server the domain corresponds to. There are some pros and cons to this approach, but considering their role as a completely neutral "transit station" of traffic, I think it makes the most sense legally and practically. Ethically I have a few qualms with it (if a site is very, very blatantly advertising illegal material, ethically I think they should either disable Cloudflare cloaking for the domain, stop resolving the domain at all, or just cancel the customer's account entirely; legally they don't necessarily need to, though, and I can understand why they don't), but they still make it very easy for a hosting provider to take action when there is an abuse complaint.
  - drzaiusapelord 12y ago
    >Cloudflare is closer to a router than a host. They literally run Varnish, mod_security, mod_evasive, etc. They literally host content. They are a host, not a "router."
    - newaccountfool 12y ago
      They're not really a host, you don't give them any files to use or to host for you, you merely switch your DNS settings and they cache your content.
      - sillysaurus3 12y ago
        This argument wouldn't hold up if copyright infringement were involved. Why should it hold up in this case? I'm undecided.
- x0054 12y ago
  I can see 3 reasons why CloudFlare is protecting the site of LizardSquad, first 2 of which are really bad reasons: 1. Perhaps their logic is, if they protect LS's site, perhaps LS is less likely to attack services behind CloudFlare in fear of taking out their own site in the processes. I am not saying that CloudFlare does this out of fear of LS, perhaps they just think it's a sound business practice. 2. CloudFlare directly and significantly benefits from the illegal activity of LS and other DDoS organizations. DDoSers are the boogyman, and CloudFlare protects people from the boogyman, for money. The more boogyman attacks are there, the more people flee to the protecting arms of CloudFlare. 3. CloudFlare has the attitude that they are simple an ISP, or a router of traffic, and they are not responsible for any of the content on the sites they "distribute." This is a good position legally to take. As my friend, a prosecutor, jokingly points out, "everything is illegal." So, some country or another would be able to find something objectionable about almost every single site on the internet, and CloudFlare want's to be treated like an ISP, not responsible at all for any of that stuff. But let's say the content in question wasn't a DDoS site, but a child porn site, would CloudFlare be so adamant in their stance, I don't think so. Even ISPs quickly disconnect their customers from the internet when clear and easily verifiable allegation of child porn, piracy, fraud, or bonnet operations are presented to them. Basically, CloudFlare is not responsible for LS, but they should be a good Net citizen, and drop them voluntarily. That being said, they are not going to for reasons # 1 and 2.
rudolf0 12y ago
They appear to be awful at OPSEC but pretty good at offensive security. Which is a very common theme with groups like these. As long as their core botnet infrastructure stays afloat, it doesn't really matter to them what's discovered about the stresser or even their real identities in some cases. They're very brazen, to say the least. I imagine their botnet won't be up for too much longer though.
- ryanlol 12y ago
  If we were awful at opsec we probably would have already been identified by someone. We've been going at this since August.
ryanlol 12y ago
You're pretty quick to call people morons for someone who doesn't have a clue about what he is talking about. These routers Krebs is talking about (Which have largely been infected since August) were never connected to an IRC network. And as for the gcloud servers, yeah we connected a few of them to the public IRC... So what? It's not like as if they we're ever going to survive beyond few hours. Also, Krebs seemed to imply that we used the Google bots for DDoS attacks... That's pretty ridiculous considering Google will automatically suspend you if they detect traffic anomalies.

by timdorr 12y ago

Except the good ones know how to properly obfuscate the C&C servers. These morons ran everything through their public IRC server, hosted on the same network as the website advertising the service.

sp332 12y ago

Yup, from http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsquad-rise-and.html http://www.malwaretech.com/2014/12/darkode-ode-to-lizardsqua... "I had noticed that lizardpatrol.com (the official LizardSquad website) was hidden behind cloudflare, so on a hunch I send a HTTP request to the darkode server, with the hostname set to "lizardpatrol.com".... That's right, the darkode server is also hosting the official LizardSquad website, oh dear." Why is CloudFlare protecting these sites, anyway?

dewey 12y ago
Because it's a customer like everyone else, as a service provider you should maintain a neutral stance even if you don't like the service they provide. Just like ISPs shouldn't handle Netflix's traffic any different than traffic from other companies.
- sp332 12y ago
  ISPs will cut off service entirely if a customer is behaving abusively.
  - deleted 12y ago
    [deleted]
  - Karunamon 12y ago
    No, they will cut off service entirely if the user's behavior threatens their network (usually legally). As an example, ISP's don't drop spammers because they morally hate spam, they drop spammers because their mail servers will get blacklisted and make their customers hate them. A fine distinction, but an important one.
- drzaiusapelord 12y ago
  Knowingly providing internet infrastructure so others can attack other internet infrastructure is far from "being neutral." ISPs disconnect customers all the time for abuse, yet somehow Cloudflare gets a free pass? Funny how the solution to being DDOS'd by their own customers is, "Buy our product." In the sane world we call this racketeering or protection money.
  - newaccountfool 12y ago
    If I was Cloudflare I wouldn't go cutting my customers until I had a court order or an official reason to.
rudolf0 12y ago
It's an intentional business decision, and it makes some sense if you understand the process. First, here's their CEO's explanation of their stance: http://blog.cloudflare.com/58611873/ http://blog.cloudflare.com/58611873/ Cloudflare is closer to a router than a host. They just happen to be a router which masks that which they're routing to. If you file an abuse complaint to them about a specific domain, they won't take any actions themselves. However, they will tell the reporter the server's real hosting provider, and will forward the complaint to the hosting provider with information allowing the provider to determine what server the domain corresponds to. There are some pros and cons to this approach, but considering their role as a completely neutral "transit station" of traffic, I think it makes the most sense legally and practically. Ethically I have a few qualms with it (if a site is very, very blatantly advertising illegal material, ethically I think they should either disable Cloudflare cloaking for the domain, stop resolving the domain at all, or just cancel the customer's account entirely; legally they don't necessarily need to, though, and I can understand why they don't), but they still make it very easy for a hosting provider to take action when there is an abuse complaint.
- drzaiusapelord 12y ago
  >Cloudflare is closer to a router than a host. They literally run Varnish, mod_security, mod_evasive, etc. They literally host content. They are a host, not a "router."
  - newaccountfool 12y ago
    They're not really a host, you don't give them any files to use or to host for you, you merely switch your DNS settings and they cache your content.
    - sillysaurus3 12y ago
      This argument wouldn't hold up if copyright infringement were involved. Why should it hold up in this case? I'm undecided.
x0054 12y ago
I can see 3 reasons why CloudFlare is protecting the site of LizardSquad, first 2 of which are really bad reasons: 1. Perhaps their logic is, if they protect LS's site, perhaps LS is less likely to attack services behind CloudFlare in fear of taking out their own site in the processes. I am not saying that CloudFlare does this out of fear of LS, perhaps they just think it's a sound business practice. 2. CloudFlare directly and significantly benefits from the illegal activity of LS and other DDoS organizations. DDoSers are the boogyman, and CloudFlare protects people from the boogyman, for money. The more boogyman attacks are there, the more people flee to the protecting arms of CloudFlare. 3. CloudFlare has the attitude that they are simple an ISP, or a router of traffic, and they are not responsible for any of the content on the sites they "distribute." This is a good position legally to take. As my friend, a prosecutor, jokingly points out, "everything is illegal." So, some country or another would be able to find something objectionable about almost every single site on the internet, and CloudFlare want's to be treated like an ISP, not responsible at all for any of that stuff. But let's say the content in question wasn't a DDoS site, but a child porn site, would CloudFlare be so adamant in their stance, I don't think so. Even ISPs quickly disconnect their customers from the internet when clear and easily verifiable allegation of child porn, piracy, fraud, or bonnet operations are presented to them. Basically, CloudFlare is not responsible for LS, but they should be a good Net citizen, and drop them voluntarily. That being said, they are not going to for reasons # 1 and 2.

rudolf0 12y ago

They appear to be awful at OPSEC but pretty good at offensive security. Which is a very common theme with groups like these. As long as their core botnet infrastructure stays afloat, it doesn't really matter to them what's discovered about the stresser or even their real identities in some cases. They're very brazen, to say the least. I imagine their botnet won't be up for too much longer though.

ryanlol 12y ago
If we were awful at opsec we probably would have already been identified by someone. We've been going at this since August.

ryanlol 12y ago

You're pretty quick to call people morons for someone who doesn't have a clue about what he is talking about. These routers Krebs is talking about (Which have largely been infected since August) were never connected to an IRC network. And as for the gcloud servers, yeah we connected a few of them to the public IRC... So what? It's not like as if they we're ever going to survive beyond few hours. Also, Krebs seemed to imply that we used the Google bots for DDoS attacks... That's pretty ridiculous considering Google will automatically suspend you if they detect traffic anomalies.