OcUK DDoS attack - £10,000 reward

Status
Not open for further replies.
Firstly I wish you all the best on tracking these people down.

Can I recommend you consider hosting the forums elsewhere, for one it'll enable you to cut down the list of unique IP's visiting the store, just to click through to the forums.

Secondly I don't think a public reward is a smart idea (it'll attract all sorts if spread around - and that's not a good thing fella).

I'd advise (and you may well have done already) to seek professional help, SOCA should provide you with companies they recommend (though as SOCA are pretty new they might not be a great PoC on this).
 
To do this cold is some serious work, its serious work with all the information provided. Comming from a bot net /zombie will be from 1,000's of ip's are we expected to investigate this blind or can we request logs?
 
I must admit this has made me remember my naughty days back on IRC where a load of us would flood or winnuke people off of IRC to hijack their channels with our eggdrops.... LOL.. those were the days! We thought we were cool but in reality were just script kiddies :D
 
The last thing you want is for the business to be affected like this, especially in the current climate. Well I hope that whoever is responsible for this gets caught quickly and punished.
 
The problem you're going to have is that to do a 'proper' DOS attack then you're going to need thousands/millions of nodes (or very fast connections) to attack the site with (basically request page after page of information). The firewall will then see all of these requests and start to ban the IP's however if the IP's are only requesting the homepage then the firewall can't really ban these as it's a legitimate request. Because there are literally millions of them in some cases it can't handle it and thus the servers get over loaded and starts to time out and fall over.

Funnily I was talking to a colleague earlier when this site was mentioned about how slow it was and we suspected DOS then.

Without the logs though it's going to be very hard to prove who has done it and because it will be a bot network getting something together for SOCA, etc. will be even harder. The attacks will, most likely, have come from several different countries.



M.
 
javan_gibbon_L.jpg
 
VaderDSL said:
Ok, say this DDOS was using infected machines, what sort of malware would it take the form of? I've got Kaspersky AV and run regular scans, is this sort of thing detectable usually by AV or is it something more sinister?
Click to expand...
They would probably be using crypted files, so I don't think you would be able to detect it very easily.
 
http://sparrow.ece.cmu.edu/group/who_are_we.html


One of the fundamental limitations of the Internet is the inability of a packet flow recipient to halt disruptive flows before they consume the recipient's network link resources. Critical infrastructures and businesses alike are vulnerable to DoS attacks or flash-crowds that can incapacitate their networks with traffic floods. Unfortunately, current mechanisms require per-flow state at routers, ISP collaboration, or the deployment of an overlay infrastructure to defend against these events. Our Stateless Internet Flow Filter (SIFF) system allows an end-host to selectively stop individual flows from reaching its network, without any of the common assumptions listed above. We divide all network traffic into two classes, privileged (prioritized packets subject to recipient control) and unprivileged (legacy traffic). Privileged channels are established through a capability exchange handshake. Capabilities are dynamic and verified statelessly by the routers in the network, and can be revoked by quenching update messages to an offending host. SIFF is transparent to legacy clients and servers, but only updated hosts will enjoy the benefits of it
Click to expand...
 
Status
Not open for further replies.
Back
Top Bottom