Slashdot Mirror

← Back to Stories (view on slashdot.org)

Holiday E-Commerce DDoS Attack Hits EC2 Cloud

Posted by Soulskill on from the tis-the-season dept.

ARos writes "A holiday DDoS attack targeted a west-coast DNS provider, which is known for serving large-scale E-Commerce sites (including amazon.com and walmart.com). 'Neustar, which provides DNS services to high profile website addresses under the UltraDNS brand, said the flood of malicious traffic, just two days before Christmas, was directed at the company's facilities in San Jose and Palo Alto, and that the effects were mostly limited to California users.' CNet adds: 'In addition to the high-profile sites, dozens of smaller sites that rely upon Amazon for Web-hosting services were also taken down by the attack. Amazon's S3 and EC2 services were affected by the problems, according to Jeff Barr, Amazon's lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets.'"

54 of 75 comments (clear)

  1. Why? by Brad1138 · · Score: 3, Insightful

    Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

    --
    If you could reason with religious people, there would be no religious people
    1. Re:Why? by Shikaku · · Score: 1

      Who is so damn board that they have nothing better to do than "attack"

      ...Did Canada have a sudden rabies outbreak for beavers?

    2. Re:Why? by palegray.net · · Score: 4, Funny

      Who is so damn board

      Hey, if I were made of wood I'd be angry too.

      --
      512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
    3. Re:Why? by Anonymous Coward · · Score: 1, Funny

      Plank-ton?

    4. Re:Why? by Anonymous Coward · · Score: 1, Interesting

      Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

      Step 1. DOS existing DNS server
      Step 2. Make rogue DNS server active, which returns URL's for phishing organization's transparent proxy.
      Step 3. Phish out all login, pw, and CC information.
      Step 4. Launder info or use to run fraudulent transactions.
      Step 5. Profit!

      The technical details vary, of course, as well as the specific mechanism. But in essence this is most likely what was being attempted... how successful it was remains to be seen. Or it could be any number of people, organizations, or governments that would like to see a big hit to the largest online retailers during their busiest time of year.

    5. Re:Why? by AigariusDebian · · Score: 5, Interesting

      Ever heard of DNS cache poisoning? There really should be an investigation into this. One of the attack vectors is pretty simple - use a DDOS to slow down the response time of the real DNS servers of *.amazon.com, use a cache poisoning timing-based attack on some subset of DNS servers further down the chain (like for example at a medium-sized ISP) to replace the IP of Amazon servers with an IP of your specially prepared hijacking servers, a client goes to amazon.com, but get redirected to your server, you proxy their traffic (use a man-in-the-middle attack to defeat SSL or just use human-engineering for that) until they make a purchase and instead of proxing their credit-card info you just keep it for your self and transfer money to your accounts. Profit!

      Something like that could have taken place here, but you cann't know that until you analyse logs at Amazon and all the ISP DNS servers that could have beenaffected by this.

    6. Re:Why? by Jah-Wren+Ryel · · Score: 1

      What feeling of accomplishment do they really get and/or what point are they trying to make?

      The ability to believably threaten to do it again in order to extort money.
      Or, given the timing, they may have been trying to make good on such a threat.

      --
      When information is power, privacy is freedom.
    7. Re:Why? by Katchu · · Score: 1

      Who is so damn board

      Hey, if I were made of wood I'd be angry too.

      Some old broad, probably.

      --
      Keep Doing Good.
    8. Re:Why? by tlhIngan · · Score: 2, Interesting

      Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

      Money.

      Online gambling sites are constantly attacked by DDoS, because they have money, and their continued revenue relies on people being able to connect reliably to their servers. Thus, you can threaten to shut down a site or ask they pay $5000 or so to avoid a protection fee.

      I'm guessing in this economy, big sites like Amazon and the like are the next tempting targets. Imagine being able to shut them down during the critical shopping periods and how much money you could extort out of them.

      And with EC2, many sites are probably running on it or relying on it for backup. Kill it and you've proved to many sites that their service could go down, and hey, would you like to pay $5000 to ensure it stays up? And heck, the sites that go down, you don't even have to know what they are. If it's a big site, the news will report it. If it's a small site, you'll hear about it through various forums. Boom, instant target list for extortion.

    9. Re:Why? by sopssa · · Score: 1

      What? Do you understand how DNS works? How the fuck would you get root and other recursive DNS servers to connect to your server instead of the real one by merely bringing the real dns servers down? If the attackers would be able to intercept DNS traffic, it wouldn't matter if the real servers we're down or not. But that's a little bit harder to pull off than some kiddie dossing.

    10. Re:Why? by Cassius+Corodes · · Score: 1

      I wonder if it would be cost effective to pay someone to take out a major online retailer (esp at christmas) so as to get more traffic yourself (assuming you are a rival online retailer)?

      --
      Control is an illusion, order our comforting lie. From chaos, through chaos, into chaos we fly
    11. Re:Why? by ascari · · Score: 1

      Hmm. A competitor perchance?

  2. East Coast, no problem by Suki+I · · Score: 1

    A holiday DDoS attack targeted a west-coast DNS provider, which is known for serving large-scale E-Commerce sites (including amazon.com and walmart.com). 'Neustar, which provides DNS services to high profile website addresses under the UltraDNS brand, said the flood of malicious traffic, just two days before Christmas, was directed at the company's facilities in San Jose and Palo Alto, and that the effects were mostly limited to California users.'

    My book and blogger buddy in the Mid-Atlantic didn't notice any issue. I hope they track the source down soon.

    --
    Home of The Suki Series
    1. Re:East Coast, no problem by socsoc · · Score: 1

      and that the effects were mostly limited to California users.

      Perhaps because the Mid-Atlantic states are nowhere near California?

    2. Re:East Coast, no problem by shentino · · Score: 2, Interesting

      Ok, here's a solution.

      Trace as many of the IPs as possible and let their owners know their computers have been jacked.

      Any of them don't do squat about it after X amount of time, confiscate their computer for knowingly aiding and abetting a criminal offense. Or something.

      Enough people get in trouble for not doing jack about their computers being infected and you can see vigilance going up.

    3. Re:East Coast, no problem by zill · · Score: 1

      No law enforcement agency in the country has the authority to do this.

    4. Re:East Coast, no problem by sopssa · · Score: 2, Insightful

      Ok, here's a solution.

      Trace as many of the IPs as possible and let their owners know their computers have been using BitTorrent.

      Any of them don't do squat about it after X amount of time, confiscate their computer for knowingly aiding and abetting a copyright infringement. Or something.

      Enough people get in trouble for not doing jack about their computers being used for copyright infringement and you can see vigilance going up.

    5. Re:East Coast, no problem by shentino · · Score: 1

      That has never stopped them from violating our civil rights anyway.

      My point was, if they're going to trample the constitution they may at least as well do something useful while they're at it.

  3. Re:Slashdot, now slower than all the major commerc by palegray.net · · Score: 2, Informative

    Umm... you must be new around here. Slashdot is basically a news aggregation site (stories come from other, already published sources), with community commentary and badly edited story summaries ;).

    --
    512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
  4. Consider extortion by grolaw · · Score: 4, Interesting

    One reason for DDoS attacks is to prove that you can shutdown a site.

    The site will pay for protection from future attacks. The offshore gambling sites have been "victims" of these attacks according to Steve Gibson.

    1. Re:Consider extortion by bartwol · · Score: 1

      But the only protection you can buy from them is their "commitment" to not attack again. That doesn't protect you from another attacker launching an attack, and if you're one who pays, then I'd say you've improved your chance of that.

      It seems that a technical defense is your only real defense, and "paid protection" is the resort of tomorrow's road kill.

    2. Re:Consider extortion by grolaw · · Score: 1

      Just what do you think a "protection racket" is?

    3. Re:Consider extortion by bartwol · · Score: 2, Insightful

      Protection from the protector, *and* protection from his competitors (read: "territorial dominance").

    4. Re:Consider extortion by grolaw · · Score: 1

      That's not a sentence. I have no idea what you want to convey.

      A "protection racket" is a form of extortion that has existed for thousands of years, if you include feudal states as large-scale "protection rackets."

      It may seem self-defeating to acquiesce to the extortion, but the costs are minimal compared to serious disruption of the business that a DDoS attack from a botnet.

    5. Re:Consider extortion by bartwol · · Score: 1

      Thanks for explaining that.

      Do you think the traditional protection racket, as your chosen model, is sufficiently congruent to this case as to make a good argument for a website operator to pay a DoS attacker to not attack again?

      Let me re-phrase my question. Would YOU pay a [purported] DoS attacker to not attack again? (I need to differentiate here between that which you think a smart person such as yourself should do, as opposed to what you think is appropriate for the many stupid people such as myself.)

    6. Re:Consider extortion by grolaw · · Score: 1

      The past has shown that the off shore gambling sites have paid repeatedly - and they remain profitable. The protection racket is a parasite that loses when it kills its host.

    7. Re:Consider extortion by bartwol · · Score: 1

      Would YOU pay a [purported] DoS attacker to not attack again?

    8. Re:Consider extortion by grolaw · · Score: 1

      Assuming that I ran an Amazon - a lawful business - I'd report the extortion and work with INTERPOL and the FBI to make the payment and keep my business alive and catch the botnet operator(s).

      That would, undoubtedly, cost a lot of money.

    9. Re:Consider extortion by bartwol · · Score: 1

      Interesting choice of strategies.

      I/my company was recently a DDoS attack target. We were only willing to employ technical counter-measures; we had/have no willingness to appease the attacker. Our strategy was (and is) very expensive for us. But so far, we survive (and grow).

      As long as there are people around who think like you, there will be attackers who will exploit your strategy, and there will be collateral victims such as my company. Fortunately, we're unprofitable feed for the attackers so they don't dwell too long on us, and instead make their beds with more "logical" thinkers such as yourself. Attackers are smart and adaptable that way.

    10. Re:Consider extortion by grolaw · · Score: 1

      I'm an attorney. The response is what the law mandates.

      The anonymity of these attackers makes any countermeasure expensive.

      Your company has been the victim of criminal trespass (or, whatever the crime is called in your jurisdiction) and your company has to report the crime or be guilty of aiding the DDoS criminal. Effectively, your company's path facilitates future attacks because the failure to report this attack denies the police information about a crime and leads. The police cannot exercise their powers without assistance from the victims.

      Your corporate legal department is simply not equipped to deal with this type of situation.

      I litigated my first Title 18 civil computer tampering case back in '95. We put three adolescents (and, their parents) who had root on an ISP I represented, through the civil wringer - we sued the parents for placing a dangerous instrumentality into the hands of the kids - computers and Internet access - and then the US Attorney had a wack at them.

      That situation was different - we were able to identify the hackers - because the fools were applying to warez groups from their "invisible" accounts on one of the Sun servers. We had names, addresses and copies of the IRC chats.

      We asked for $200k/family and a LIFETIME BAN on the kids use of computers. The civil Court granted the judgments - but refused the equitable remedy of the ban.

      However, the US Attorney got the ban under the Criminal charges and I damned well did follow up when the little criminals graduated from HS and went to college - each college received copies of the lifetime computer ban - in the form of a certified Judgment. I sent copies off to the parents, too.

      Whatever happened to them afterward, I don't know. I do know that before all of the legal work - that we contacted the parents and advised them of what their kids were doing and asked them to stop or we would take legal action. The parents, to a family, reacted with hostility. We tagged their homeowners' policies in the civil judgments - but they had to pay for the kids criminal defense out of their own pockets. Nothing like a good walletectomy to shut down the arrogant.

      Your company's failure to take its duty to the law seriously only makes it easier for these criminals to ply their trade. Sloppy decision. If I knew enough to turn your company in, I would do so in a heartbeat.

    11. Re:Consider extortion by bartwol · · Score: 1

      Forgive me for my delay...I had to summon the will to reply.

      Your points are rife with invalid assumptions about my points and the applicability of your analogies/anecdotes. For example, your closing remark:

      Your company's failure to take its duty to the law seriously only makes it easier for these criminals to ply their trade. Sloppy decision. If I knew enough to turn your company in, I would do so in a heartbeat.

      Whatever unlawful act you imply my company to have done here is, quite simply, of your convenient imagination. Your defense is no more than a blustery, uninformed, egotistical offense. Do you really consider your guidance to be helpful to a SMALL merchant who falls victim to an ALLEGED DDoS?

      You are an attorney. I am a technician. Riddle me this: how many lawyers should it have taken me to address a DDoS attack?

      I find your perspective to be way out at the periphery of the problem. You sound like a D.C. lawyer, or of some similar culture where one might develop the false belief that government is playing a large role in mitigation of internet technical risks. Keep chewing on that idea while I continue to adjust and harden my perimeter defenses, widen my trustful connections, heed good practices, and employ other techniques needed to keep DDoS risks at acceptable levels. I have many additional opportunities yet available to mitigate my risks such that I don't foresee any time in the next few years that your strategies will provide a competitive bang for my company's buck. Your strategies do, however, offer a reasonable return on lawyer's (or a bureaucrat's) investment.

    12. Re:Consider extortion by grolaw · · Score: 1

      You and your company are criminals. END OF DISCUSSION.

      My degrees include biology, chemistry, endocrine physiology and law and I have been a major midwest city assistant DA (20 years ago).

      I have only CONTEMPT for people who don't report criminal acts - and thusly facilitate further criminal acts.

      If you see a drunk getting into a car, then watch them run over a kid in a crosswalk - but don't call the police because you don't want to get involved - I can easily put you both in the same set as those people in Queens who ignored Kitty Genovese's cries for assistance while being murdered.

      You are a criminal by dint of your failure to report criminal activity.

      QQQQ U and your company, too.

  5. Re:Slashdot, now slower than all the major commerc by juuri · · Score: 4, Insightful

    Says the person with the ID over one million.

    Slashdot used to be quite fast with the aggregation, it is quite terrible now. When CNN or the BBC are reporting tech news faster than a site that is supposed to be for tech nerds that's a good indication of the quality and speed. What's worse is this write up actually has misinformation in it that was disproven ALREADY... but this is so slow coming here, well...

    --
    --- I do not moderate.
  6. Attack vectors shifting? by horatio · · Score: 4, Interesting

    Maybe I'm wrong, but it seems like the attack vectors are shifting away from going after your target directly, but instead attacking the critical infrastructure support services like DNS.

    --
    There is very little future in being right when your boss is wrong.
    1. Re:Attack vectors shifting? by Katchu · · Score: 2, Insightful

      Perhaps this is because the sources are not idle time-wasters simply marking territory. The source may be political/military tests to determine how to effectively damage commerce. Check out the usual suspects. [OT] I sometimes (used to) read Usenet newsgroups with Google Groups, but some political/military spam attacks have rendered many groups there virtually useless. No commercial spammers would so effectively drive potential clients away. This spam does not appear when I use a newsreader.

      --
      Keep Doing Good.
  7. Re:Slashdot, now slower than all the major commerc by glitch23 · · Score: 1

    One could think it is the holidays,

    Think about what that sentence states and answer me 2 things: 1) Does it even make any sense? and 2) What does it mean? I ask because "it is the holidays" does not make sense to me and I don't know what it means, not to mention it sounds stupid. What holidays? How can "it" be more than one holiday at the same time? Why is the non-sense term only used in December? A holiday is a specific day; not like a season that lasts for weeks. When is the proper time to start using the term "holidays" and when should I stop using the term "holidays"? Should I only do it to avoid using the term Christmas? What is the "holidays" etiquette?

    --
    this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
  8. Re:Slashdot, now slower than all the major commerc by Low+Ranked+Craig · · Score: 1

    All the nerds are playing with their new toys today...

    --
    I still cannot find the droids I am looking for...
  9. Re:Slashdot, now slower than all the major commerc by palegray.net · · Score: 1

    Says the person with the ID over one million.

    Actually, says the guy whose original UID wasn't much higher than yours, and created a new account a couple of years ago. And I really can't say that the average speed of news aggregation has significantly diminished since then.

    --
    512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
  10. Re:Slashdot, now slower than all the major commerc by Afforess · · Score: 1

    If you come to /. to see the latest Tech News Report, you're doing it wrong. I come because /. features articles that don't appear anywhere else.

    --
    If our elected representatives no longer represent us, do we still live in a Democracy?
  11. Re:Slashdot, now slower than all the major commerc by DAldredge · · Score: 3, Funny

    Be quite new guy! But you are right.

  12. Re:Slashdot, now slower than all the major commerc by Silvrmane · · Score: 1

    I can name several: Christmas, Boxing Day, Winter Break for university students, and New Years. Hence, "it's the holidays."

    --
    planet texture maps and more
  13. What is gained-Bill Starkov by billstarkov · · Score: 1

    Perhaps to show that they can do it, but then whaRegards, Bill Starkov

  14. Re:Slashdot, now slower than all the major commerc by alen · · Score: 1

    with all the educated people here, you should know that celebrating the time around the winter solstice goes back a long way

  15. Re:Slashdot, now slower than all the major commerc by palegray.net · · Score: 1

    The point of this story isn't to announce the original incident, it's to talk about the impact on EC2. Get your own head out of your ass, and get some critical thinking skills while you're at it.

    --
    512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
  16. Evangelizing by Anonymous Coward · · Score: 2, Funny

    Sure, I know what you're all thinking: "Lead Web Evangelist" is a really lame job title and/or job description.

    All what I'm saying is that you should REALLY feel sorry for the subordinate web evangelists that by extension, Amazon also has on staff.

  17. Re:Slashdot, now slower than all the major commerc by dave562 · · Score: 1

    How much of that has to do with the fact that the "real" news sites are stepping up their coverage? Slashdot has been up for what, about a decade already? A lot has changed on the web in ten years. If nothing else Google has levelled the playing field in terms of information freshness. Where as in the past when search engines would miss huge swaths of content, it was presumably easier to get fresh information onto Slashdot before it showed up in other places.

    Think about it for a second. Consider the various factors involved with "News for nerds" these days. The tech world is NDA central. That limits one main source of information right there. Beyond the NDAs, tech companies have their own communications departments and they want to control the release of information that nerds find interesting. Tech news is far more mainstream these days. When I was in school, the idea of telling people that I talked to people "online" was a huge social stigma and it never came up... I kept it hidden (outside of 2600 meetings, Defcon, etc.) The mainstream nature of it means that there are more people paying attention to it, more people talking about it, more coverage of it.

  18. Re:start putting faces to these crimes by michaelhood · · Score: 1

    They need to have very public court cases against these criminals to start putting faces to these crimes. There were probably being blackmailed pay up or suffer a DNS attack.

    Most attackers involved in these type of operations are usually found to be located abroad in countries where this is not a priority, or the laws are simply not up to date on making this sort of stuff criminal.

  19. Re:Slashdot, now slower than all the major commerc by cheekyboy · · Score: 1

    Then why does slash report on stuff that I DO see in news paper prints 5 days before hand?

    If your 5 days late, dont report on it.

    Oh btw, im sick of this white background, its too corporate not NERDY, nerds like GREEN on BLACK.

    Give us a nerd theme.

    --
    Liberty freedom are no1, not dicks in suits.
  20. Bad Choice of Words by eulernet · · Score: 1

    In the Register article:

    Although more limited, Wednesday's malicious torrent of web traffic will insure that someone gets coal in their stocking.

    Of course, it's again the fault of those torrents of bits.

  21. Buzzword cringe by adnonsense · · Score: 1

    ... according to Jeff Barr, Amazon's lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets.'

    "Web Evangelist" ... "retweeted" ... "tweets" ... :rolleyes:

    1. Re:Buzzword cringe by jo42 · · Score: 1

      My brain automatically reads that as:

      ... according to Jeff Barr, Amazon's lead Twat, who retwated a report to that effect without clarification and confirmed it in later twats.'

  22. Re:Slashdot, now slower than all the major commerc by sopssa · · Score: 1

    If you actually was a geek, you'd know about user css. Or god's sake, you'd manage to Google for such.

  23. Re:Slashdot, now slower than all the major commerc by Cyberax · · Score: 1

    Yep. I routinely see tech news before they reach the Slashdot.

    However, the strength of Slashdot is not the fast news reporting. It's the community, I enjoy reading discussions far more than reading TFAs.

  24. Re:Slashdot, now slower than all the major commerc by Sage+Gaspar · · Score: 1

    Why not? If it's a story you already have seen you can take a pass, if not then you get to see it and can comment on it which is the main reason behind Slashdot!