Admin Notice: Server hosting and denial of service attack

[Aoyagi]

EDIT: Any truth about Prague?

What about Prague? Everything is normal here. It has been said before. I have no idea who came with that that the whole Prague is being DoSed...

[Corsair]

that is just wrong.. There are better ways, One would be to make him watch reruns of the help channel on how to use your remote control, That would be very nice of us and after about a year that person wont be able to DDoS anything.. however he would know very much about his remote control...

Is anyone else getting an erection?

EDIT: Right-oh. Prague is okay.

---

[Zack]

This is similar to what I used to describe the situation to people on Skype yesterday.

Imagine someone's at your front door (if you don't -have- a front door, imagine someone's trying to buzz into your apartment building/jail cell/etc) and they ring the doorbell holding a package. You see the package is indeed sent to your address, but the name is... ridiculous. You don't know of anyone in your house with that name, so you look at the return address and write a letter to it, saying, "Hey, got your package, ain't nobody here named Yourmum Enjoysyogurt though." Then you go back to your business, little do you know that the return address you sent that letter to was just random numbers and words, but it's an address nonetheless so you can't tell from just looking at it.

But you're a server in this example, so you have a very strange business, it's your job to receive packages (packets) all day long, figure out what's in 'em (examine the data), have people in your house (your processes) tell you what to do with them, and then reply to that package's return address (source IP) with a suiting letter (response packet). You don't reply every time, sometimes it's just someone sayin' "Hey, this is what I'm doing," and sending you a box of stuff related to what they're doing (UDP datagram). But if you get one of those, and you see that it's sent to your address (your IP address in this case) but the name is wrong (it was sent to a port that you don't host anything on) then you DO need to reply to it.

So this is the problem, from what Boss told me, this scriddie (don't call them a hacker, most people don't know the proper definition of hacker, it's actually a good word) had collected a list of a bunch of servers who had a vulnerability to being able to send out UDP datagrams, or in this example packages, to anywhere that -anyone- wants them to. So they told those servers to send millions of these datagrams (datagrams are similar to packets, for our intents and purposes) to our server, but on random/insignificant ports. That caused the disco server to reply to the vast majority of those with a "Destination Unreachable" packet, telling the sender that they were doin' it wrong. This happening once every now and then isn't a problem for a server. This happening millions of times in a matter of minutes is a HUGE problem. The server quickly becomes overwhelmed, and can't process all these datagrams it's receiving and sends out millions of packets to what should be the spoofed IPs that these random datagrams are coming from, this is called backscatter. So since the server's too busy trying to sort out wtf is going on it can't pay attention to the people who need their packet saying "I just shot this rock, did I get Platinum?" replied to, or any datagram in particular for that matter. Not to mention, the shipping company (ISP) that delivers all these packages is like "WTF IS GOING ON HERE!?" Server crashes, and we're left where we are now.

Hopefully that will explain what happened to those who are curious.

---

99 bugs in my Java Code, 99 bugs in my Code,
Fix one bug and compile again,
283 bugs in my Java Code.

[Corsair]

-Snip-

Very good explanation. Sounds really frickin' scary. The guy knows what he's doing.

---

[Agmen of Eladesor]

Sorry - I saw this picture browsing and couldn't (although I probably should have) resisted.

---

Oh god... The end of days... Agmen agreed with me.

[Barricade]

actually, i dont think that he knows, whats he is doing and since there are programs available for such things....


hehe:D

---

[Kaze Dagon]

This is similar to what I used to describe the situation to people on Skype yesterday.

Imagine someone's at your front door (if you don't -have- a front door, imagine someone's trying to buzz into your apartment building/jail cell/etc) and they ring the doorbell holding a package. You see the package is indeed sent to your address, but the name is... ridiculous. You don't know of anyone in your house with that name, so you look at the return address and write a letter to it, saying, "Hey, got your package, ain't nobody here named Yourmum Enjoysyogurt though." Then you go back to your business, little do you know that the return address you sent that letter to was just random numbers and words, but it's an address nonetheless so you can't tell from just looking at it.

But you're a server in this example, so you have a very strange business, it's your job to receive packages (packets) all day long, figure out what's in 'em (examine the data), have people in your house (your processes) tell you what to do with them, and then reply to that package's return address (source IP) with a suiting letter (response packet). You don't reply every time, sometimes it's just someone sayin' "Hey, this is what I'm doing," and sending you a box of stuff related to what they're doing (UDP datagram). But if you get one of those, and you see that it's sent to your address (your IP address in this case) but the name is wrong (it was sent to a port that you don't host anything on) then you DO need to reply to it.

So this is the problem, from what Boss told me, this scriddie (don't call them a hacker, most people don't know the proper definition of hacker, it's actually a good word) had collected a list of a bunch of servers who had a vulnerability to being able to send out UDP datagrams, or in this example packages, to anywhere that -anyone- wants them to. So they told those servers to send millions of these datagrams (datagrams are similar to packets, for our intents and purposes) to our server, but on random/insignificant ports. That caused the disco server to reply to the vast majority of those with a "Destination Unreachable" packet, telling the sender that they were doin' it wrong. This happening once every now and then isn't a problem for a server. This happening millions of times in a matter of minutes is a HUGE problem. The server quickly becomes overwhelmed, and can't process all these datagrams it's receiving and sends out millions of packets to what should be the spoofed IPs that these random datagrams are coming from, this is called backscatter. So since the server's too busy trying to sort out wtf is going on it can't pay attention to the people who need their packet saying "I just shot this rock, did I get Platinum?" replied to, or any datagram in particular for that matter. Not to mention, the shipping company (ISP) that delivers all these packages is like "WTF IS GOING ON HERE!?" Server crashes, and we're left where we are now.

Hopefully that will explain what happened to those who are curious.

Excelent explanation, Zack. Now all we can do is help the admins to get this server up and running in a way that this "scriddie" or "black hat hacker" (that's the definition i tend to use on reports for college about this) don't any more damage to this community. Plus i'm getting bored as hell without having much to do on my spare time, ehehe.

Btw, great sig Zack!

---

Kaze Dagon Files[/url]|Unto Hell|[url=http://discoverygc.com/forums/index.php?showtopic=88171]Absence of Light

[FreelancerFanatic]

-snip-

Great explanation, thanks.

---

LPI-Denton.Lebowski[O] -Patriots destroyed: 7
LY-Akihabara -Golden Chrysanthemums captured: 118
Church.of.Betelgeuse -Cultists gained: 0
[RHA]Eric.Collins -"Donations" recieved: 2
DHC-Miner.Hitzacker -Anti-radiation drugs taken: countless

[Tenshu]

that is just wrong.. There are better ways, One would be to make him watch reruns of the help channel on how to use your remote control, That would be very nice of us and after about a year that person wont be able to DDoS anything.. however he would know very much about his remote control...

Family Guy are the masters in coming up with non-violent ways of torture. Study hard comrades. *Turns on Family Guy with a maniacal grin*

---

[Zack]

Very good explanation. Sounds really frickin' scary. The guy knows what he's doing.

Thanks! The attack is a bit more complicated than I initially thought it was, I figured it was an ICMP flood, turned out to be a UDP flood, not too different in their end result, but the execution of this definitely was... unique. This is why people shouldn't code a public web-site that has strong integration with the server it's hosted on without consulting someone who's got their head on straight when it comes to running a secure server :>

actually, i dont think that he knows, whats he is doing and since there are programs available for such things....
hehe:D

This is probably true, I'm not sure on the required level of programming skill to use a public web-server to attack another server... but I'd imagine it's not easy, unless the person who coded that site did something retarded... like put a bash prompt ON the site ~_~

"black hat hacker" (that's the definition i tend to use on reports for college about this)

Perfect!

---

99 bugs in my Java Code, 99 bugs in my Code,
Fix one bug and compile again,
283 bugs in my Java Code.