Jump to content
Team Avolition
Sign in to follow this  
m1enkrafft_man

A friend and I 'Did a Thing'

Recommended Posts

asmcint    279

If it's actually as bad as you're describing what a laughable bounty. Neat anyway

 

Thinking the same thing personally. You'd expect a decent cash bounty for that tbh.

  • Upvote 1

Share this post


Link to post
m1enkrafft_man    142

If it's actually as bad as you're describing what a laughable bounty. Neat anyway

 

Eh, I'm not too hurt by the whole thing, for a few reasons. One, we used University resources for the research, so any monetary gains would go to the school. Two, there's still a very strong chance I'll be presenting at DEFCON next year (I couldn't do so because of contractual stuff with Apple this year, and as such I've delayed my hire-on date to be after DEFCON next year to give me that chance).

 

So I'm happy with what I've got. Plus it's good exposure and a bit of good publicity, which never hurts.

 

EDIT: Also, nobody could figure out a way to 'patch' the attack; they recommend throwing more resources at it, but then you could just use more resources yourself. Not all companies have the resources necessary, so they're sorta SOL at that point. That was a large factor into the bounty as well - we couldn't figure out a solid fix.

Edited by m1enkrafft_man

Share this post


Link to post
Keit1h    8

Reminds me of a slowloris thing that me and a few friends made, it did the exact same thing. Any TCP based service you could hit off using only your PC. I wonder if yours is any similar to the way we did ours, which was written in C++. I don't think I have the source/program anymore, but if I can find it on my old laptop or something I'll definitely touch on that as well. After awhile we slowly figured out how pointless and stupid DDoSing shit for no good reason was, so it was put to rest.

 

Also you probably found something that other "hackers" have found before, or some method that has mostly remained private for some reason. Those slowloris variants are really not that difficult to come up with or create.

 

Now touching on your bounty, damn they ripped you off. Selling it to script kiddies even would give you a better buck. Some kids will pay ANYTHING for a "super powerful DDoSer takes anything down in under a minute1!!!1!"

Edited by Keit1h

Share this post


Link to post
m1enkrafft_man    142

Also you probably found something that other "hackers" have found before, or some method that has mostly remained private for some reason. Those slowloris variants are really not that difficult to come up with or create.

 

Even then, resource starvation existed well before the Slow Loris attack. That's all we've done, but figured out a way to get it to work on anything you hand it. Even things like game servers (that are TCP -based) and the like.

 

As for someone else having done it, I wouldn't doubt it. However, even Chris with all his connections couldn't dig anything up, so if someone has been using a similar attack then 'Oh well'.

Share this post


Link to post
Sirenfal    4034

Even then, resource starvation existed well before the Slow Loris attack. That's all we've done, but figured out a way to get it to work on anything you hand it. Even things like game servers (that are TCP -based) and the like.

 

As for someone else having done it, I wouldn't doubt it. However, even Chris with all his connections couldn't dig anything up, so if someone has been using a similar attack then 'Oh well'.

 

I can tell you someone I know has abused TCP attacks like this, though the scope isn't quite as wide as what you're describing. I think it's an unusual class of research because most criminals aren't smart enough to work on something like this (or have no reason to; the smart people tend to be the people after money, not goofing off), and security researchers rarely have the opportunity to test real world attack scenarios with DDoS. Owning a test box is one thing, fucking up a network and potentially other networks between you and the target is another.

 

As far as I can tell TCP is fundamentally flawed, and the only long term solution is to replace it with a new protocol eventually if these kinds of attacks become commonplace. There are also some worse exploits that abuse how networks interact with each other, but I'm going to be vague about that because those are even worse.

  • Upvote 2

Share this post


Link to post
m1enkrafft_man    142

As far as I can tell TCP is fundamentally flawed, and the only long term solution is to replace it with a new protocol eventually if these kinds of attacks become commonplace. There are also some worse exploits that abuse how networks interact with each other, but I'm going to be vague about that because those are even worse.

 

That was the ultimate conclusion we drew as well. However, Cisco and co are a little hesitant to have to say that, especially because of the Internet's technology adoption rate (eg: IPv6).

 

As for the worse exploits - I believe Arbor put out a pretty good paper recently about some stuff similar to what I think you may be referring to and how they were utilized against the Rio Olympics.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×