Under Attack? Call (844) END.DDoS

Round 2: DDoS Versus Wikileaks

In the second round of what may possibly be a protracted Internet skirmish, a denial of service attack briefly blocked access to the cablegate.wikileaks.org web site this morning around 8:00 am EST. On twitter, Wikileaks pegged the DDoS as exceeding 10 Gbps (significantly larger than my 2-4 Gbps estimate for the first round of attacks on Sunday).


As compared with this Sunday’s initial attack (blog analysis available here), ATLAS data from 110 providers around the world suggest today’s DDoS was both larger and more sophisticated. Specifically, today’s attack involved several different components, including a low bandwidth application level DDoS and a 2-3 Gbps Syn attack against the primary “cablegate” IP addresses (the hosted web site is load balanced across data center locations in Europe and the US West Coast).

An example of one of the anonymous alerts ATLAS collected yesterday is shown below. This alert is for a modest TCP Syn attack against cablegate.wikileaks.org targeting high number ports. The source address blocks are anonymized with XX replacing the high number bits.


<attack start="2010-11-30 18:10:01 GMT" stop="2010-11-30 18:56:27 GMT">
<rate bps="70312432" pps="220847"/>
<protocols>TCP</protocols>
<tcpflags>Syn</tcpflags>
<source>
<ips>xx.xx.25.0/27</ips>
<ports>1024-2047</ports>
</source>
<dst>
<ips>204.236.131.131/32</ips>
<ports>16384-32767,32768-65535</ports>
</dst>
</attack>

In the below chart, I graph traffic from 110 ATLAS carriers around the world to address blocks (BGP prefixes) used by Wikileaks. Note these address blocks may also include traffic to other customer using the same hosting provider. The attack began around 7am EST though a smaller traffic spike occurs around 2am. All times are EST. At the time of this blog posting, the DDoS is still ongoing though not significantly impacting Wikileaks access.


Based on Netcraft and other reports, the outage was brief though cablegate web site performance was moderately impacted throughout the day.

Interestingly, the attack appears to originate from a relatively small number of source IPs, including machines in Russia, eastern Europe and Thailand.

– Craig

 

Tags: ,

Comments (23)

  • Avatar

    Nicky

    |

    Interesting. Is there anyway the countries are off and they are all really coming from the US? Is there a way they can hide where they are actually coming from?

  • Avatar

    manny

    |

    Nicky: you be they do.

    The military calls it Cyberwarfare for a reason.

  • Avatar

    KristoferA

    |

    Russia, Eastern Europe, Thailand… what do these countries have in common? Lots of people using pirated versions of Windows etc that are readily available to purchase on DVDs/CDs. The pirate discs are often contaminated with all kinds of junk/spyware/crapware so those countries are self-made botnets. The real origin of the traffic is most likely elsewhere…

  • Avatar

    Vico

    |

    Actually, Wikileaks is just becoming a target that many different botnet masters are targeting for fun. Because WikiLeaks is in the news it’s “cool” to attack them and see how strong your army is.

  • ประเทศไทยเป็นหนึ่งในต้นตอการโจมตี Wikileaks | ข่าวไอที ข่าวเทคโนโลยี ข่าวคอมพิวเตอร์ บทความคอมพà¸

    |

    […] ที่มา – Arbor Networks […]

  • Wikileaks on the Run « Machimon

    |

    […] has been massive and orchestrated attack on the hosting of Wikileaks files, from a distributed denial of service, to Amazon dumping […]

  • Avatar

    TheJesterFesters

    |

    Craig – if you watch the video’s of thejester’s xerxes DOS – one known source of the DOS attacks – you might notice that the news gadget on the sidebar of his Ubuntu desktop is showing news in Cyrillic script – Russian I believe. Rookie mistake on his part.

  • The Weakest Link: What Wikileaks Has Taught Us About the Open Internet | TECHNOLOGY NEWS

    |

    […] of documents to major global newspapers, the site has been besieged by DDOS attacks (upwards of 10 Gbps at one point), forcing the site offline and hampering its ability to deliver […]

  • Wikileaks derailed by just a hundred computers | Pitts Report

    |

    […] eastern Europe and Thailand, says Craig Labovitz of Arbor Networks in Ann Arbor, Michigan, who has been tracking the attacks. It is likely that the machines sending the traffic are being secretly controlled by a hacker […]

  • ThousandEyes | Network Visibility | Service Assurance | Web Performance

    |

    […] began monitoring the wikileaks.org domain after we learned about two rounds of DDoS attacks that managed to take the site offline on November 28 and November […]

  • Avatar

    DoS Atacks

    |

    Craig: Do you have any figures on the DDoS attacks traffic figures for those done by Anonymous Group against postbank, paypal, visa/mastercard?

  • Julian Assange: The Man Who Kicked The Hornets' Nest | Webscopia

    |

    […] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

  • Julian Assange: The Man Who Kicked The Hornets’ Nest | DoS Attacks

    |

    […] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

  • DDoS Attacks Make Headlines, But How Common Are They? : Febryadi.com

    |

    […] Now to put this in some perspective with recent events, Arbor Networks estimates that the DDoS attacks that took WikiLeaks down on the day the cables were released were around 2-4 Gbps, just slightly above the average DDoS attack. But two days later, another attack on the site clocked in around 10 Gbps. […]

  • Cara Mencegah DDOS attack dengan mod_evassive Centos/WHM | Code Zero

    |

    […] Round 2: DDoS Versus Wikileaks | Security to the Core | Arbor … […]

  • DDoS Attacks 101

    |

    […] has been focused specifically on the cables between the US and Iraq. Shortly before and then again after WikiLeaks went live with Cablegate, it experienced a DDoS attack and went down for some […]

  • DDoS Attacks: Size doesn’t matter

    |

    […] were made with less than 1 Gigabit per second (Gbps). Sure, some attacks, like the one that got WikiLeaks in 2010 used 10Gbps level attacks, but, really, you don’t need to that much traffic to knock the stuffings out of a Web […]

Comments are closed