In early February 2008 distributed denial of service attacks (DDoS) wreaked havoc at a whole slew of online gaming sites with Full Tilt Poker, Titan Poker, Virgin Games and Party Poker being among the sites attacked by a web-based botnet, according to the Shadowserver Foundation, a watchdog group of security professionals that gathers, tracks, and reports on malware, botnet activity, and electronic fraud. Some e-commerce sites were also attacked.
The full impact of these attacks was not immediately clear but Full Tilt Poker's Web site was inaccessible for most of two days forcing Full Tilt to "pause" the final table of the FTOPS VII Main Event for a brief period, with just three players remaining when its client lost connectivity with the Full Tilt servers.
“Botnet DDoS attacks are the likely culprit for Full Tilt's client problem during the tournament” said Andre M. DiMino, director of the Shadowserver Foundation. "A botnet is a network of compromised computers that act as drones under the common control of a central server traditionally the way they're formed is through viruses that infect machines that are then recruited to join the botnet. The operator of the botnet, through the command server, then issues instructions to compromised machines that form the botnet." DiMino said.
“In the case of Full Tilt Poker each of the compromised machines was instructed to send simultaneous requests to the online game’s site, which was too much for the servers to bear." DiMino explained. "The requests overloaded the bandwidth and took the servers offline."
The fact that the DDoS attacks were web based made it more difficult to repel, DiMino said. Traditionally, DDoS attacks are controlled by Internet Relay Chat (IRC), which is fairly easy to block, DiMino added. But Web botnets are "more resilient and difficult" to stop.
The Shadow Foundation traced the initial attacks to a server hosted by Layered Technologies. That server has been shut down, but the botnet has moved to a new host and IP address. "DDoS attacks are always going to be out there," DiMino says. "In the past, they were used to show the might of the botnet. But the real purpose for botnets now is fraud and identity theft."
Webscreen - answer to Botnet DDoS prevention
One technology that would have been able to help prevent the Botnet from disrupting Full Tilt’s global poker game is the Webscreen WS Series network security appliance. Webscreen monitors all Web traffic hitting the network looking for signs on non-human behaviour. Botnets are triggered automatically which Webscreen can distinguish from the normal Web activity expected from a legitimate punter. A Webscreen appliance positioned at the network gateway in front of the gaming site’s servers would have blocked the botnet traffic whilst allowing the game to continue.
Thursday, 3 July 2008
Should DDoS Victims Own Up or Cover Up?
When a popular Web site is taken down by a DDoS attack the typical response by many companies is often to go into “denial” themselves or at least play hard to get should anyone want to the question them as to why their online services suddenly aren’t (online). The general view from the Web publisher’s side seems to be that by coming clean, and acknowledging the root cause, they are somehow opening the flood gates to copycat attacks. When many attacks can be stopped by agreeing to paying a substantial ransom it is perhaps understandable that companies decide to take the least worst option.
Whilst there may be some logic in taking this approach, perhaps if more companies in this position were more open about the problem it could ultimately be much better for the wider ecommerce community. One of the consequences of sweeping this under the carpet is that the perception is that DDoS is a less prevalent threat than it actually is, which in turn means that many companies down grade the risk factor and do not put in place adequate defence mechanisms. The reality is that DDoS attacks are an increasing weapon of choice with up to 5,000 recorded attacks per day in the US alone in the past 12 months.
The recent rumours circulating about the non-availability of Amazon’s Web site is a classic case in point and a missed opportunity to really bring the problem of DDoS into the open and maybe start to get a real industry debate going on how to solve the problem. It may be a naïve view but perhaps if more Web sites were protected the bot-herders might find that their efforts were not as lucrative in the future and decide to get a proper job.
However it is no less naïve than thinking that keeping the details private cannot hurt the company. Allowing customers and stakeholders to speculate fuels rumours and signals weakness and continuing vulnerability. Simply and honestly saying this is what happened and this is what we are doing about it ends the speculation and signals competence and strength, but if you wait too long it will sound like spin.
With technologies like Webscreen’s WS series available and proven effective in protecting some of the world’s busiest Web sites it makes little sense to sit and suffer in silence. For an investment of less than the average ransom figure demanded by the attackers it is possible to have a permanent solution and preserve the corporate reputation – and help the rest of the online business sector at the same time.
Whilst there may be some logic in taking this approach, perhaps if more companies in this position were more open about the problem it could ultimately be much better for the wider ecommerce community. One of the consequences of sweeping this under the carpet is that the perception is that DDoS is a less prevalent threat than it actually is, which in turn means that many companies down grade the risk factor and do not put in place adequate defence mechanisms. The reality is that DDoS attacks are an increasing weapon of choice with up to 5,000 recorded attacks per day in the US alone in the past 12 months.
The recent rumours circulating about the non-availability of Amazon’s Web site is a classic case in point and a missed opportunity to really bring the problem of DDoS into the open and maybe start to get a real industry debate going on how to solve the problem. It may be a naïve view but perhaps if more Web sites were protected the bot-herders might find that their efforts were not as lucrative in the future and decide to get a proper job.
However it is no less naïve than thinking that keeping the details private cannot hurt the company. Allowing customers and stakeholders to speculate fuels rumours and signals weakness and continuing vulnerability. Simply and honestly saying this is what happened and this is what we are doing about it ends the speculation and signals competence and strength, but if you wait too long it will sound like spin.
With technologies like Webscreen’s WS series available and proven effective in protecting some of the world’s busiest Web sites it makes little sense to sit and suffer in silence. For an investment of less than the average ransom figure demanded by the attackers it is possible to have a permanent solution and preserve the corporate reputation – and help the rest of the online business sector at the same time.
Subscribe to:
Posts (Atom)
Posts
