Slashdot Mirror
D0z.me — the Evil URL Shortener
supernothing writes "DDoS attacks seem to be in vogue today, especially considering the skirmishes over WikiLeaks in the past few weeks. The size of a DDoS attacks, however, has historically been limited by how many computers one has managed to recruit into a botnet. These botnets almost universally require code to be executed on the participants' local systems, whether they are willing or unwilling. A new approach has been emerging recently, however, which uses some simple JavaScript to achieve similar ends. d0z.me is a new service that utilizes these techniques, but provides a unique twist on the idea. Posing as a legitimate URL shortening service, it serves users the requested pages in an iFrame, while simultaneously participating in a DDoS attack in the background. No interaction is required beyond clicking the link and staying on the page. This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants plausible deniability in the assault."
Dr Zoidberg: Hurray! I can do no less!!
Wouldn't it be possible for an admin to simply block all traffic which came from that website?
http://d0z.me/weFZ
...we talk about our techniques for doing all of our fun stuff, and make it a single button click for users. I have not been to the website, but if it has a way so that you can view the source (unless it truly does it all through JS) then that might be interested just to see. Point it at a site you know can't be taken down from a simple DDoS Web app like Amazon and then view the code of what it is actually doing.
The world is how you make it
In fact, there is a legitimate DDoS effect that occurs when a site is linked from Slashdot. The DDoS is not intentional, but the result is the same :)
Cheers, Chris
Ducks and runs.
What one fool can do, another can. (Ancient Simian Proverb)
Just tell me that the DDoS site is slashdotted.
Because there are fewer slashdotters than ever, so slashdotting is getting harder to do. We need code to cheat.
Tequila: It's not just for breakfast anymore!
Because it's an interesting proof-of-concept that DDoS is no longer bound to botnets, as well as proof-of-concept of DDoSing in Javascript.
...and (furthermore) how social networking sites could be used to spread this URL, in effect creating an ad-hoc botnet.
What one fool can do, another can. (Ancient Simian Proverb)
In other words, useful idiots ARE useful.
Not really ad hoc, they are just using a different vector to spread the malware. This time it's purely the users' actions instead of relying on exploiting the mistakes of a few programmers.
And as long as you attach teh cute kitteh or some other such nonsense, it's way easier to convince someone to "join" the botnot willingly than it is to exploit their computer from behind.
Ask any psychologist, there are way more "exploits" in human brains than even Microsoft can come up with for Windows =)
I normally don't go to URL shortener links at all, having long ago seen how easy they are to hid the real URL of suspicious sites. Also, I've been using Safari for years, and although Firefox is installed it's my preferred browser. Normally I have the download window and the activity window active on the right side of my desktop. The Activity window in particular is very handy for monitoring any and all surfing activity.
Similarly, I have been a long-time user of Little Snitch to monitor and authorize/deauthorize outgoing connections, with the network activity window always showing upon outgoing network activity. I suspected one, or both, of these tools would be useful.
Little Snitch, as expected, shows the network activity as a fairly constant level of network activity, but since it's an authorized outgoing connection (your web browser, naturally, has to be allowed to make connections to the usual internet ports like 80, etc, or no browsing for you) there isn't much that would really seem unusual. Many requests and deliveries of data are of course visible, but this is relatively normal and probably would not really alert anyone; for example it is similar to what you would see with a streaming server delivering content on a page. It's there, but it's not obvious something nefarious is going on unless you were really paying attention, and there's really no reason to be, since it's a standard browser operation, more or less.
Safari's Activity window, however, reveals the activity quite obviously. In a few moments using the sample page outlined in the original article, you see a huge amount of requests to the target url. A normal webpage might have up to 100 or even 200 different components, but not a constant stream that gets to 100 in a few seconds, and keeps going. The urls are fairly obvious as well, taking the form of: ...{continuous stream of ... example/com/?v= [some incremental number]} ...
http://www.example.com/?v=1292889926999
http://www.example.com/?v=1292889877790
The webpage does not fully load, but the stream continues until you close the page { [Command-W] or mouse click on the close button }
With the Activity Window open you should be able to monitor and react to being an unwitting party to the DDoS.
... is a d0z.me link that points to & targets d0z.me!
http://d0z.me/7iWC
It sounds like an interesting implementation, but I don't know about "proof of concept" - this concept has been in use for years. I remember in the late nineties activists putting together websites using javascript to repeatedly load web pages of political targets in order to DOS them; I think there was one directed at the WTO site, intended to be used as a kind of virtual support for the protests in Seattle in 1999. Of course, I'm not sure how much damage we could actually do with our 56k modems.
affords willing participants plausible deniability in the assault.
Seriously? There are actually enough people that willingly want to do this kind of thing that it deserves a post on slashdot?
Please, if you care about the internet at all don't be coerced into doing this kind of thing - it is the digital equivalent of pissing in the pool...
- sigs are stupid
Interesting proof of concept. How long until someone hacks into a major site, cnn.com, nytimes, etc, and sneaks this code in there? With a little obfuscation it could be buried and hidden pretty easily in the mounds of Javascript most sites are running these days, and be set to activate only when and where the hacker chooses. How long would it take before someone finally figured out what's causing the target to get massively DDoS'ed? Especially if the attacks are staggered, not made to run constantly, and multiple sites are involved at different random times? Virus scan each of the computers involved, and you turn up nothing! No worms or trojans found. Very clever!
OpenDNS blocked it as malware because someone here decided to report it... Looks like I'm getting rid of OpenDNS
IFRAME and IMG SRC and similiar spam like this could and should be easily preventable. Browsers however don't normally pass information on the nature of the request. That is, it could tell the server it's coming from a click, a javascript, an iframe, and img src or whatever. Sites should be able to refuse incoming requests that are from an iframe. A simple HTTP header with the type of request would help greatly. It wasn't created as a method of attack, but it's used that way.
-- these are only opinions and they might not be mine.
...Finally we are now able to slashdot slashdot...
Non-Linux Penguins ?
Distributed denial of service is a TOOL people
its NOT inherently "bad"
The FF plugin Web of Trust warns that this shortener site is dangerous.
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!
... why hasn't anyone figured this out before? Is it too easy and too obvious to be true?
So this bit in .htaccess should suffice to alleviate the DDoS attack?
.* - [F]
RewriteEngine on
RewriteCond %{HTTP_REFERER} d0z\.me [NC]
RewriteRule
It says "\. me"
The concept of web-based DDoS is not new. Attacks based on refreshing images and scripts have been around for a good while. The use of HTML5 cross-origin requests to perform these attacks at much higher rates, combined with URL shortening obfuscation, is, afaik, a new concept. That is not to say that others hadn't thought of it, but I certainly haven't seen it implemented anywhere.
But yeah, if you did indeed have this idea 10 years ago, before HTML5 was even conceived, I commend you. That kind of foresight is rare.
"All we have is logic and love on our side."
it's an interesting proof-of-concept that DDoS is no longer bound to botnets
No... it’s a proof-of-concept DDoS that is bound to a new type of botnet. This is performed without the user’s knowledge, which is the definition of a botnet: conscripting someone’s PC without their knowledge or consent.
And we already had DDoS attacks that were not bound to botnets: users voluntarily downloaded and ran the LOIC or various in-browser HTML5 pages exactly like this one, except that they were explicit in their intentions.
In other words, we already had botnets, and we already had HTML5 DDoS tools: this is only new because we never had something that combined both aspects.
Distributed Denial of APK: It takes 15 seconds to reply to him anonymously, but wastes tons of his time if we all do it.
The difference is that this poses as a legitimate URL-shortener so that the people whose computers are attacking the target don’t even realise they’re participating in it.
Distributed Denial of APK: It takes 15 seconds to reply to him anonymously, but wastes tons of his time if we all do it.