Round 2: DDoS Versus Wikileaks

By: Craig Labovitz -

In the second round of what may possibly be a protracted Internet skirmish, a denial of service attack briefly blocked access to the cablegate.wikileaks.org web site this morning around 8:00 am EST. On twitter, Wikileaks pegged the DDoS as exceeding 10 Gbps (significantly larger than my 2-4 Gbps estimate for the first round of attacks on Sunday).


As compared with this Sunday’s initial attack (blog analysis available here), ATLAS data from 110 providers around the world suggest today’s DDoS was both larger and more sophisticated. Specifically, today’s attack involved several different components, including a low bandwidth application level DDoS and a 2-3 Gbps Syn attack against the primary “cablegate” IP addresses (the hosted web site is load balanced across data center locations in Europe and the US West Coast).

An example of one of the anonymous alerts ATLAS collected yesterday is shown below. This alert is for a modest TCP Syn attack against cablegate.wikileaks.org targeting high number ports. The source address blocks are anonymized with XX replacing the high number bits.


<attack start="2010-11-30 18:10:01 GMT" stop="2010-11-30 18:56:27 GMT">
<rate bps="70312432" pps="220847"/>
<protocols>TCP</protocols>
<tcpflags>Syn</tcpflags>
<source>
<ips>xx.xx.25.0/27</ips>
<ports>1024-2047</ports>
</source>
<dst>
<ips>204.236.131.131/32</ips>
<ports>16384-32767,32768-65535</ports>
</dst>
</attack>

In the below chart, I graph traffic from 110 ATLAS carriers around the world to address blocks (BGP prefixes) used by Wikileaks. Note these address blocks may also include traffic to other customer using the same hosting provider. The attack began around 7am EST though a smaller traffic spike occurs around 2am. All times are EST. At the time of this blog posting, the DDoS is still ongoing though not significantly impacting Wikileaks access.


Based on Netcraft and other reports, the outage was brief though cablegate web site performance was moderately impacted throughout the day.

Interestingly, the attack appears to originate from a relatively small number of source IPs, including machines in Russia, eastern Europe and Thailand.

- Craig

 

Comments

  1. Interesting. Is there anyway the countries are off and they are all really coming from the US? Is there a way they can hide where they are actually coming from?

  2. Nicky: you be they do.

    The military calls it Cyberwarfare for a reason.

  3. KristoferA 12/01/2010, 3:53 am

    Russia, Eastern Europe, Thailand… what do these countries have in common? Lots of people using pirated versions of Windows etc that are readily available to purchase on DVDs/CDs. The pirate discs are often contaminated with all kinds of junk/spyware/crapware so those countries are self-made botnets. The real origin of the traffic is most likely elsewhere…

  4. Actually, Wikileaks is just becoming a target that many different botnet masters are targeting for fun. Because WikiLeaks is in the news it’s “cool” to attack them and see how strong your army is.

  5. Did WikiLeaks Hacker The Jester Pull Police Raid Hoax?

    “The Jester was angry enough with militants recruiting for jihad and about the WikiLeaks disclosures to launch a DoS attacks on their sites, so why was he not very peeved about an impostor using his name to scam money? The logical conclusion might be that The Jester himself is the hoaxer…”

    https://www.infosecisland.com/blogview/9970-Did-WikiLeaks-Hacker-The-Jester-Pull-Police-Raid-Hoax.html

  6. TheJesterFesters 12/04/2010, 1:45 pm

    Craig – if you watch the video’s of thejester’s xerxes DOS – one known source of the DOS attacks – you might notice that the news gadget on the sidebar of his Ubuntu desktop is showing news in Cyrillic script – Russian I believe. Rookie mistake on his part.

  7. Here’s a report of a DDOS attack on Mastercard

    http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2010/12/05/international/i083539S60.DTL

    said to be in response to their actions to cut off Wikileaks payment processing.

  8. DoS Atacks 12/12/2010, 4:20 am

    Craig: Do you have any figures on the DDoS attacks traffic figures for those done by Anonymous Group against postbank, paypal, visa/mastercard?