Holiday E-Commerce DDoS Attack Hits EC2 Cloud

ARos writes "A holiday DDoS attack targeted a west-coast DNS provider, which is known for serving large-scale E-Commerce sites (including amazon.com and walmart.com). 'Neustar, which provides DNS services to high profile website addresses under the UltraDNS brand, said the flood of malicious traffic, just two days before Christmas, was directed at the company's facilities in San Jose and Palo Alto, and that the effects were mostly limited to California users.' CNet adds: 'In addition to the high-profile sites, dozens of smaller sites that rely upon Amazon for Web-hosting services were also taken down by the attack. Amazon's S3 and EC2 services were affected by the problems, according to Jeff Barr, Amazon's lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets.'"

Comments

Why?

[Brad1138]

Who is so damn board that they have nothing better to do than "attack" a web site? What feeling of accomplishment do they really get and/or what point are they trying to make? They need to get out of their mothers basement and do something with there lives.

Re:Why?

[palegray.net]

Who is so damn board

Hey, if I were made of wood I'd be angry too.

Re:Why?

[AigariusDebian]

Ever heard of DNS cache poisoning? There really should be an investigation into this. One of the attack vectors is pretty simple - use a DDOS to slow down the response time of the real DNS servers of *.amazon.com, use a cache poisoning timing-based attack on some subset of DNS servers further down the chain (like for example at a medium-sized ISP) to replace the IP of Amazon servers with an IP of your specially prepared hijacking servers, a client goes to amazon.com, but get redirected to your server, you proxy their traffic (use a man-in-the-middle attack to defeat SSL or just use human-engineering for that) until they make a purchase and instead of proxing their credit-card info you just keep it for your self and transfer money to your accounts. Profit!

Something like that could have taken place here, but you cann't know that until you analyse logs at Amazon and all the ISP DNS servers that could have beenaffected by this.

Consider extortion

[grolaw]

One reason for DDoS attacks is to prove that you can shutdown a site.

The site will pay for protection from future attacks. The offshore gambling sites have been "victims" of these attacks according to Steve Gibson.

Re:Slashdot, now slower than all the major commerc

[juuri]

Says the person with the ID over one million.

Slashdot used to be quite fast with the aggregation, it is quite terrible now. When CNN or the BBC are reporting tech news faster than a site that is supposed to be for tech nerds that's a good indication of the quality and speed. What's worse is this write up actually has misinformation in it that was disproven ALREADY... but this is so slow coming here, well...

Attack vectors shifting?

[horatio]

Maybe I'm wrong, but it seems like the attack vectors are shifting away from going after your target directly, but instead attacking the critical infrastructure support services like DNS.

Re:Slashdot, now slower than all the major commerc

[DAldredge]

Be quite new guy! But you are right.