Slashdot Mirror
D0z.me — the Evil URL Shortener
supernothing writes "DDoS attacks seem to be in vogue today, especially considering the skirmishes over WikiLeaks in the past few weeks. The size of a DDoS attacks, however, has historically been limited by how many computers one has managed to recruit into a botnet. These botnets almost universally require code to be executed on the participants' local systems, whether they are willing or unwilling. A new approach has been emerging recently, however, which uses some simple JavaScript to achieve similar ends. d0z.me is a new service that utilizes these techniques, but provides a unique twist on the idea. Posing as a legitimate URL shortening service, it serves users the requested pages in an iFrame, while simultaneously participating in a DDoS attack in the background. No interaction is required beyond clicking the link and staying on the page. This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants plausible deniability in the assault."
Dr Zoidberg: Hurray! I can do no less!!
Wouldn't it be possible for an admin to simply block all traffic which came from that website?
http://d0z.me/weFZ
This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants plausible deniability in the assault.in the assault.
You'd still have to explain why you enabled Javascript.
...we talk about our techniques for doing all of our fun stuff, and make it a single button click for users. I have not been to the website, but if it has a way so that you can view the source (unless it truly does it all through JS) then that might be interested just to see. Point it at a site you know can't be taken down from a simple DDoS Web app like Amazon and then view the code of what it is actually doing.
The world is how you make it
DDOS is merely a tool, sending bytes over a data stream. It is not evil in itself, although some may try to use it in the service of good or evil.
In fact, there is a legitimate DDoS effect that occurs when a site is linked from Slashdot. The DDoS is not intentional, but the result is the same :)
Cheers, Chris
Ducks and runs.
What one fool can do, another can. (Ancient Simian Proverb)
And slashdot is advertising this... why, exactly?
Just tell me that the DDoS site is slashdotted.
I normally don't go to URL shortener links at all, having long ago seen how easy they are to hid the real URL of suspicious sites. Also, I've been using Safari for years, and although Firefox is installed it's my preferred browser. Normally I have the download window and the activity window active on the right side of my desktop. The Activity window in particular is very handy for monitoring any and all surfing activity.
Similarly, I have been a long-time user of Little Snitch to monitor and authorize/deauthorize outgoing connections, with the network activity window always showing upon outgoing network activity. I suspected one, or both, of these tools would be useful.
Little Snitch, as expected, shows the network activity as a fairly constant level of network activity, but since it's an authorized outgoing connection (your web browser, naturally, has to be allowed to make connections to the usual internet ports like 80, etc, or no browsing for you) there isn't much that would really seem unusual. Many requests and deliveries of data are of course visible, but this is relatively normal and probably would not really alert anyone; for example it is similar to what you would see with a streaming server delivering content on a page. It's there, but it's not obvious something nefarious is going on unless you were really paying attention, and there's really no reason to be, since it's a standard browser operation, more or less.
Safari's Activity window, however, reveals the activity quite obviously. In a few moments using the sample page outlined in the original article, you see a huge amount of requests to the target url. A normal webpage might have up to 100 or even 200 different components, but not a constant stream that gets to 100 in a few seconds, and keeps going. The urls are fairly obvious as well, taking the form of: ...{continuous stream of ... example/com/?v= [some incremental number]} ...
http://www.example.com/?v=1292889926999
http://www.example.com/?v=1292889877790
The webpage does not fully load, but the stream continues until you close the page { [Command-W] or mouse click on the close button }
With the Activity Window open you should be able to monitor and react to being an unwitting party to the DDoS.
... is a d0z.me link that points to & targets d0z.me!
http://d0z.me/7iWC
See
http://en.wikipedia.org/wiki/Lad_Vampire
affords willing participants plausible deniability in the assault.
Seriously? There are actually enough people that willingly want to do this kind of thing that it deserves a post on slashdot?
Please, if you care about the internet at all don't be coerced into doing this kind of thing - it is the digital equivalent of pissing in the pool...
- sigs are stupid
Interesting proof of concept. How long until someone hacks into a major site, cnn.com, nytimes, etc, and sneaks this code in there? With a little obfuscation it could be buried and hidden pretty easily in the mounds of Javascript most sites are running these days, and be set to activate only when and where the hacker chooses. How long would it take before someone finally figured out what's causing the target to get massively DDoS'ed? Especially if the attacks are staggered, not made to run constantly, and multiple sites are involved at different random times? Virus scan each of the computers involved, and you turn up nothing! No worms or trojans found. Very clever!
I remember seeing a similar trick in the past but the user's CPU time was used rather than their bandwidth (distributed computing through the browser).
Basically the javascript on the page would fetch work units off a central server and feedback the results in the background while the user was viewing the site.
Combining the URL forwarder + distributed computing element would be a good way to use this for good instead of eeeeevil (unless you use it to crack passwords!) especially with the amount of spare CPU cycles desktops have.
OpenDNS blocked it as malware because someone here decided to report it... Looks like I'm getting rid of OpenDNS
in fact i showed somehting almost exactly like that to a friend TEN YEARS AGO. WHOSE the twerp stealing my ideas ill show him my upgrade.... j/k
IFRAME and IMG SRC and similiar spam like this could and should be easily preventable. Browsers however don't normally pass information on the nature of the request. That is, it could tell the server it's coming from a click, a javascript, an iframe, and img src or whatever. Sites should be able to refuse incoming requests that are from an iframe. A simple HTTP header with the type of request would help greatly. It wasn't created as a method of attack, but it's used that way.
-- these are only opinions and they might not be mine.
...Finally we are now able to slashdot slashdot...
Non-Linux Penguins ?
http://www.partinchina.com
Distributed denial of service is a TOOL people
its NOT inherently "bad"
The FF plugin Web of Trust warns that this shortener site is dangerous.
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
Hopefully this will teach people to stop "shortening" URLs. Once you use one of these proxies you lose all control over where your links point to and who tracks the clicks. And it makes you look like a spammer or worse.
... why hasn't anyone figured this out before? Is it too easy and too obvious to be true?
So this bit in .htaccess should suffice to alleviate the DDoS attack?
.* - [F]
RewriteEngine on
RewriteCond %{HTTP_REFERER} d0z\.me [NC]
RewriteRule
It says "\. me"
look up iframes and DHTML seriously its real real old crap use mate refresh to reload the iframe and make it a pixel in size with a url wooooooooo