Akamai DDoS: Sophisticated?

I have to ask the obvious of how a DDoS is sophisticated. Anyone have more details of this? There has been limited discussion here on AO about this attack but given the size of it and it's impact it certainly brings into question the idea that attacks are going down (CSI/FBI 2004 Survey).

Most DDoSes that I've heard about -- MafiaBoy's being the most prominent -- have been fairly simple, straightforward tools. Perhaps DRDoS? Could this been GRC's situation on a large scale?

Comments?

Quote:

---

Source: SecurityFocus


Leighton provided few additional details, except that the attack was coordinated, large and sophisticated. The volume of traffic was unprecedented even for a company that "sees a lot of attacks," he said.

"It had components that we had not seen before," he said, declining to comment further.

Akamai, which distributes the content of the sites on more than 15,000 servers worldwide to speed delivery and improve reliability, said third-party monitoring services overstated the impact of Tuesday's problems. Keynote Systems Inc., a monitoring service whose statements were widely reported Tuesday, said the availability of the top 40 sites it monitors dropped from 100 percent to just over 80 percent during the outage.

---

Ok, do you mean if that DDoS was sophistacted or if most are?

Well, as I said, most of my experience with DDoS is that they are simple and straightforward. So what I'm trying to figure out how a DDoS could be "sophisticated" and what specifically about this one makes it "sophisticated".

Maybe it used multiple tools and techniques to create a multi-tiered DDOS attack. Since the article was quite vague, we can only guess. But since we're guessing anyhow, thats my guess.

P.S. I LOVE ALL OF YOU.
-QUAD

well i think it would have to be somewhat sophisticated to take down such a company as Akamai. Like the guy said, i think they would get alot of attacks pointed at them, so one that could take them offline for a period of time would have to be pretty preplanned and have alot of bandwidth to do such a thing. I know it wasnt a worm or anything and im not really into ddos so im not sure how they could of gotten that much bandwidth pointed into Akamai's direction. Im sure it could be sophisticated in someway. All im tryin to say is that to bring down such servers as big as Akamai's it would have to be someone sophisticated to an extent.

I agree with you, I do not believe that DDos attacks are sophisticated or even take skill (scriptkiddie tools).

But I will try lets take the Mafiaboy example. I would assume that they figure the sophisticated part can come from how many servers were compromised and used as platforms for the massive scale attacks. If I remember correctly he somehow was able to use a bunch of different college networks and from there he would coordinate them to send the attack all in unision. However the kid was so cheap he did nothing but DL the proggie from some German creator (I believe).

I don't think this is sophisticated because the security folk still can find it and were it came from maybe not pinpoint the exact source but at least the last hop or so. When I think sophisticated I think of hacks were people are in and out quick and have gotten all the info they needed and setup everything they needed to for the next step.

I am waiting for these attacks to start on Cell Phones.


- MilitantEidolon

Quote:

---

If I remember correctly he somehow was able to use a bunch of different college networks and from there he would coordinate them to send the attack all in unision. However the kid was so cheap he did nothing but DL the proggie from some German creator

---

Ya but the colleges at that time had little or no security. In addition, IIRC, he used @Home as another source for "zombies" and since it was "Internet Boom" time, no one conceived that they needed security. (It's a home machine! I have nothing to steal).

The German Tool you're referring to is Stacheldraht (means barbed wire in German IIRC).

MsMittens - My post was Vague I know but the basic point I was going after was that someone looking at a 120lb kid and thinking he took control of corps like Amazon - Yahoo that it had to be challenging so they are going to call it sophisticated to save face to the public who doesn't understand the simplicity behind a DDos Attack they just think it is a bad thing.

- MilitantEidolon

IIRC, akamai has various servers all over the world. Perhaps the person organzing it got zombies to attack ALL their servers at the same time, hence it would be somewhat sophisticated. Just another random thought...

Quote:

---

.. so they are going to call it sophisticated to save face to the public who doesn't understand the simplicity behind a DDos Attack they just think it is a bad thing.

---

Now this would be more plausible for Akamai, IMO --- except that the ones that are interested in this aren't the general public but rather the general IT community. And they'd probably see the difference between "sophisticated" and simple. Then again, when the GRIDs were attacked, the "sophisticated" password cracking tool was used: John the Ripper. :D

Anyways, if anyone gets any more details I know I'd be interested in this "sophisticated" attack.

A sophisticated DDoS IMO would consist of an attacker more......sophisticated. HA!
J/K. It is probably a safe bet that Akamai had NIDS, and probably CIDS hardware. As you probably well know one way an IDS detects an attack is by signatures. If The attacker could get 1000's of computers to attack Akamai's network and he/she could manage to sneak these crafted packets in with out the IDS flippin out...I'd say thats sophisticated. Shutting down a band as large as Akamai's would not be easy. Even for two hours. It is probably also safe to assume that Akamai has a very, very tight security policy. After how many times yahoo, MS's sites have been taken down before, defaced, whatever, you'd think that they would have learned and have 90% of there bases covered. In short no script kiddie did this, as with most DoS. Most DoS are performed by kids who barely grasp what a packet is let alone try and perform a large attack such as this. I am not saying whoever did this was a genius. But it is probably safe to say they did there homework, and they did it well.

I personally think it's was a plain and simple DOS attack with a very large number of zombie bots. They are using the sophisticated word because

1) They are trying to protect their image
2) The traffic the zombie network created all looked like real and legitimate traffic.

You can read more info here
http://zdnet.com.com/2100-1105_2-5236403.html

There is a firm difference between sophisticated and coordinated (or in this case, coordinated VERY properly). I think that the attack was just so well coordinated and possibly size wise was massive to the point where it could shutdown the Akamai server's. I gotta agree with SDK as well, chance's are they are making it bigger than what it is because they are trying to protect their image.

My guess was the best. Period. :P

I came across this paper on my travels. I think some of you here may well find it of interest. Its in pdf format, anyway heres the link::http://www.cs.ucsd.edu/~savage/papers/UsenixSec01.pdf

It's got to be these guys, MsMittens ;)

Maybe it's sofisticated because each zombie sends a request... Or what if you Bounced off itself? Can you even do that?

-Cheers-

A security professional who participated in investigating the attack confirmed that the DDoS attack apparently came from an extremely large bot net.

"If it was (a) bot, it was very well written and it was very large," the security expert said on condition of anonymity. "As far as we could tell...it all looked like real and legitimate traffic."

While Tuesday's attack was aimed at bringing down the four major Web sites, Akamai's Leighton said his company was the true target.

"At the high level, it was clear that this attack was focused on a subset of our customers," he said. "We assumed they were attacked as a way to get at Akamai."

What remains unclear is how the DDoS attack could be so selective as to focus on the main Yahoo, Google, Microsoft and Apple sites. Distributed attacks are typically blunt instruments rather than scalpels, as evidenced by the mass outages caused by this method in 2000.

http://asia.cnet.com/sg/0,39002190,39183708,00.htm

hmm

my guess is, unlike most bot's used for packeting nets, this bot used a (simple) http engine of some sort to grab the pages in a valid way. Most bots simply generate a SYN packet with garbage attatched, or simply just garbage. Having a properly crafted hand-shake procedure incurrs the overhead of having to acctualy send the page and process the page (dynamic pages for example).

Say a handshake takes 1k of data, and the page is 100k with images and the works, you easily see how it can drain the servers. DRDoS could not be used as it dosn't permit return data.

I think the most sofe-ist-hi-cated attack I've read about is version of the "man in the middle" attack. Attacker sends a steady stream of syn packets to a computer, effectively causing it to ignore incoming connections. After being syn-flooded, it will only attempt to respond to the syn/ack the half-open connectoins in queue, but it won't be able to open any more connections. The attacker waits for the syn/ack packets that return, and examin the TCP sequence number inside each packet.

During the Ack -> Syn/Ack -> Syn process the originating host sends the TCP sequence number it wishes to use, and the target responds by sending the sequence number back during the syn/ack process. Once both have established communication and agreed on the sequence number of the segments they are exchanging, the originating host can send the final segment contiaining its own Ack of the targets sequence number and data transfer can start. Once the cracker has made a guess at the sequence number made available for the next incoming connection, it is possible to "spoof" the connection by using a bogus TCP sequence number. Once the guess has been made, the cracker can send a syn packet to the real target, which is "supposedly" from the server you just syn-flooded (a trusted server). The target will attempt to syn/ack the server, which can't respond cause its connection queue is full. Instead the cracker sends an Ack packet which uses the guessed TCP sequence number in the Syn/Ack, and the attacker now has a oneway connection into the targetmachine which appears to be coming from a trusted server. The cracker can now pipe any command necessary to compromise the target machine.... Once he's done, all he has to do is send the packet containing the RST bit to the server. This clears the connection queue and no-one is the wiser.

---Paraphrased from "A Complete H@ckers Handbook"

Meh. Works, neh?

~m