MP-DDoser: A rapidly improving DDoS threat - Revision history

Eric.freyssinet at 21:42, 31 July 2015

2015-07-31T21:42:29Z

← Older revision		Revision as of 21:42, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Image=mp-ddoser-a-rapidly-improving-ddos-threat.png		\|Image=mp-ddoser-a-rapidly-improving-ddos-threat.png
	\|~~Legend~~=		\|Botnet=MP-DDoser,
	\|~~Document~~=		\|Malware=,
	\|~~Licence~~=		\|CCProtocol=,
	\|~~Video~~=		\|Operation=,
	\|~~Link~~=~~http://ddos.arbornetworks.com/~~2012~~/06/mp-ddoser-a-rapidly-improving-ddos-threat/~~		\|Year=2012
	~~\|Author=Jeff Edwards,~~		\|Date=2012-06-07
	~~\|NomRevue=The Arbor Networks Security Blog~~
	\|Date=~~June 7th,~~ 2012
	\|Editor=Arbor Sert		\|Editor=Arbor Sert
	\|~~Year~~=~~2012~~		\|Link=https://asert.arbornetworks.com/mp-ddoser-a-rapidly-improving-ddos-threat/
	\|~~ISBN=~~		\|Author=Jeff Edwards,
	~~\|Page~~=
	\|Abstract=This blog post is the fifth installment in our ongoing series of articles surveying the crypto systems used by different DDoS-capable malware families. Today’s topic is MP-DDoser, also known as “IP-Killer”		\|Abstract=This blog post is the fifth installment in our ongoing series of articles surveying the crypto systems used by different DDoS-capable malware families. Today’s topic is MP-DDoser, also known as “IP-Killer”

Line 23:		Line 20:
	In addition to a Slowloris-style attack and various generic flooding capabilities, the newest versions of MP-DDoser support an ApacheKiller-style attack, which is a relatively new (and sophisticated) low-bandwidth technique for inflicting denial-of-service attacks against Apache web servers. It first appeared in the form of a proof-of-concept Perl script in August 2011. Then toward the end of 2011 we saw a version of it incorporated into the Armageddon DDoS bot; however that implementation turned out to be severely flawed. Now, we are seeing it show up in MP-DDoser – and a review of the bot’s assembly code indicates that it does indeed appear to be a fully functional, working implementation of the Apache Killer attack.		In addition to a Slowloris-style attack and various generic flooding capabilities, the newest versions of MP-DDoser support an ApacheKiller-style attack, which is a relatively new (and sophisticated) low-bandwidth technique for inflicting denial-of-service attacks against Apache web servers. It first appeared in the form of a proof-of-concept Perl script in August 2011. Then toward the end of 2011 we saw a version of it incorporated into the Armageddon DDoS bot; however that implementation turned out to be severely flawed. Now, we are seeing it show up in MP-DDoser – and a review of the bot’s assembly code indicates that it does indeed appear to be a fully functional, working implementation of the Apache Killer attack.
	The core of the attack involves the sending of a very long Range HTTP header that is intended to bring web servers (especially Apache) to their knees by forcing them to do a great deal of server-side work in response to a comparatively small request. It is therefore one of the more effective low-bandwidth, “asymmetrical” HTTP attacks at the moment.		The core of the attack involves the sending of a very long Range HTTP header that is intended to bring web servers (especially Apache) to their knees by forcing them to do a great deal of server-side work in response to a comparatively small request. It is therefore one of the more effective low-bandwidth, “asymmetrical” HTTP attacks at the moment.
	\|~~Botnet~~=~~MP-DDoser,~~		\|Document=
	\|~~Malware~~=,		\|Licence=
	\|~~CCProtocol~~=,		\|Video=
	\|~~Operation~~=,		\|NomRevue=The Arbor Networks Security Blog
	\|Keyword=Ddos,		\|ISBN=
			\|Page=
			\|Keyword=Ddos,
	}}		}}

Eric.freyssinet: Text replacement - " ddos.arbornetworks.com" to ""

2015-02-08T16:49:35Z

Text replacement - " ddos.arbornetworks.com" to ""

← Older revision		Revision as of 16:49, 8 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://ddos.arbornetworks.com/2012/06/mp-ddoser-a-rapidly-improving-ddos-threat/ ~~ddos.arbornetworks.com~~		\|Link=http://ddos.arbornetworks.com/2012/06/mp-ddoser-a-rapidly-improving-ddos-threat/
	\|Author=Jeff Edwards,		\|Author=Jeff Edwards,
	\|NomRevue=The Arbor Networks Security Blog		\|NomRevue=The Arbor Networks Security Blog

Eric.freyssinet: 1 revision imported

2015-02-07T14:26:44Z

1 revision imported

New page

{{Publication
|Image=mp-ddoser-a-rapidly-improving-ddos-threat.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://ddos.arbornetworks.com/2012/06/mp-ddoser-a-rapidly-improving-ddos-threat/ ddos.arbornetworks.com
|Author=Jeff Edwards,
|NomRevue=The Arbor Networks Security Blog
|Date=June 7th, 2012
|Editor=Arbor Sert
|Year=2012
|ISBN=
|Page=
|Abstract=This blog post is the fifth installment in our ongoing series of articles surveying the crypto systems used by different DDoS-capable malware families. Today’s topic is MP-DDoser, also known as “IP-Killer”

As far as we are aware, MP-DDoser was first documented in February 2012 by Arbor analyst Curt Wilson in his pioneering survey of modern DDoS threats. Like many of the malware families we see these days, MP-DDoser is exclusively a DDoS bot; it has no ability to do key-logging, info-stealing, spamming, or other such mayhem. We started seeing the first MP-DDoser samples back in December 2011, which billed themselves as “Version 1.0″. These early versions had a number of serious flaws, such as a completely broken Slowloris attack implementation, and really awful crypto key management. But the latest samples (now up to “Version 1.6″) are much improved; the key management is quite good, and the buggy DDoS attacks are not only fixed, but now include at least one technique (“Apache Killer”) that may be considered reasonably cutting edge.

The full details of our analysis are included in the attached report, but here are the highlights:

In addition to a Slowloris-style attack and various generic flooding capabilities, the newest versions of MP-DDoser support an ApacheKiller-style attack, which is a relatively new (and sophisticated) low-bandwidth technique for inflicting denial-of-service attacks against Apache web servers. It first appeared in the form of a proof-of-concept Perl script in August 2011. Then toward the end of 2011 we saw a version of it incorporated into the Armageddon DDoS bot; however that implementation turned out to be severely flawed. Now, we are seeing it show up in MP-DDoser – and a review of the bot’s assembly code indicates that it does indeed appear to be a fully functional, working implementation of the Apache Killer attack.
The core of the attack involves the sending of a very long Range HTTP header that is intended to bring web servers (especially Apache) to their knees by forcing them to do a great deal of server-side work in response to a comparatively small request. It is therefore one of the more effective low-bandwidth, “asymmetrical” HTTP attacks at the moment.
|Botnet=MP-DDoser,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=Ddos,
}}