Holiday E-Commerce DDoS Attack Hits EC2 Cloud

ARos writes "A holiday DDoS attack targeted a west-coast DNS provider, which is known for serving large-scale E-Commerce sites (including amazon.com and walmart.com). 'Neustar, which provides DNS services to high profile website addresses under the UltraDNS brand, said the flood of malicious traffic, just two days before Christmas, was directed at the company's facilities in San Jose and Palo Alto, and that the effects were mostly limited to California users.' CNet adds: 'In addition to the high-profile sites, dozens of smaller sites that rely upon Amazon for Web-hosting services were also taken down by the attack. Amazon's S3 and EC2 services were affected by the problems, according to Jeff Barr, Amazon's lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets.'"

Comments

Why?

[Brad1138]

Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

Re:Why?

[palegray.net]

Who is so damn board

Hey, if I were made of wood I'd be angry too.

Re:Why?

[AigariusDebian]

Ever heard of DNS cache poisoning? There really should be an investigation into this. One of the attack vectors is pretty simple - use a DDOS to slow down the response time of the real DNS servers of *.amazon.com, use a cache poisoning timing-based attack on some subset of DNS servers further down the chain (like for example at a medium-sized ISP) to replace the IP of Amazon servers with an IP of your specially prepared hijacking servers, a client goes to amazon.com, but get redirected to your server, you proxy their traffic (use a man-in-the-middle attack to defeat SSL or just use human-engineering for that) until they make a purchase and instead of proxing their credit-card info you just keep it for your self and transfer money to your accounts. Profit!

Something like that could have taken place here, but you cann't know that until you analyse logs at Amazon and all the ISP DNS servers that could have beenaffected by this.

Re:Why?

[tlhIngan]

Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

Money.

Online gambling sites are constantly attacked by DDoS, because they have money, and their continued revenue relies on people being able to connect reliably to their servers. Thus, you can threaten to shut down a site or ask they pay $5000 or so to avoid a protection fee.

I'm guessing in this economy, big sites like Amazon and the like are the next tempting targets. Imagine being able to shut them down during the critical shopping periods and how much money you could extort out of them.

And with EC2, many sites are probably running on it or relying on it for backup. Kill it and you've proved to many sites that their service could go down, and hey, would you like to pay $5000 to ensure it stays up? And heck, the sites that go down, you don't even have to know what they are. If it's a big site, the news will report it. If it's a small site, you'll hear about it through various forums. Boom, instant target list for extortion.

Re:Slashdot, now slower than all the major commerc

[palegray.net]

Umm... you must be new around here. Slashdot is basically a news aggregation site (stories come from other, already published sources), with community commentary and badly edited story summaries ;).

Consider extortion

[grolaw]

One reason for DDoS attacks is to prove that you can shutdown a site.

The site will pay for protection from future attacks. The offshore gambling sites have been "victims" of these attacks according to Steve Gibson.

Re:Consider extortion

[bartwol]

Protection from the protector, *and* protection from his competitors (read: "territorial dominance").

Re:Slashdot, now slower than all the major commerc

[juuri]

Says the person with the ID over one million.

Slashdot used to be quite fast with the aggregation, it is quite terrible now. When CNN or the BBC are reporting tech news faster than a site that is supposed to be for tech nerds that's a good indication of the quality and speed. What's worse is this write up actually has misinformation in it that was disproven ALREADY... but this is so slow coming here, well...

Attack vectors shifting?

[horatio]

Maybe I'm wrong, but it seems like the attack vectors are shifting away from going after your target directly, but instead attacking the critical infrastructure support services like DNS.

Re:Attack vectors shifting?

[Katchu]

Perhaps this is because the sources are not idle time-wasters simply marking territory. The source may be political/military tests to determine how to effectively damage commerce. Check out the usual suspects. [OT] I sometimes (used to) read Usenet newsgroups with Google Groups, but some political/military spam attacks have rendered many groups there virtually useless. No commercial spammers would so effectively drive potential clients away. This spam does not appear when I use a newsreader.

Re:Slashdot, now slower than all the major commerc

[DAldredge]

Be quite new guy! But you are right.

Evangelizing

[Anonymous Coward]

Sure, I know what you're all thinking: "Lead Web Evangelist" is a really lame job title and/or job description.

All what I'm saying is that you should REALLY feel sorry for the subordinate web evangelists that by extension, Amazon also has on staff.

Re:East Coast, no problem

[shentino]

Ok, here's a solution.

Trace as many of the IPs as possible and let their owners know their computers have been jacked.

Any of them don't do squat about it after X amount of time, confiscate their computer for knowingly aiding and abetting a criminal offense. Or something.

Enough people get in trouble for not doing jack about their computers being infected and you can see vigilance going up.

Re:East Coast, no problem

[sopssa]

Ok, here's a solution.

Trace as many of the IPs as possible and let their owners know their computers have been using BitTorrent.

Any of them don't do squat about it after X amount of time, confiscate their computer for knowingly aiding and abetting a copyright infringement. Or something.

Enough people get in trouble for not doing jack about their computers being used for copyright infringement and you can see vigilance going up.