LadyboyDolls.com – DDOS attack

There have been several DDOS (Distributed Denial Of Service) launched on the newer ladyboy sites as of late. They started last year and are still going strong with pretty massive attacks on every new ladyboy pay site that opens. Of course since I’ve opened two new sites in the past few months, both of them are getting hit on and off.

In normal people talk, someone who runs another site who has serious geeks on the payroll can hack into 100s or 1000s of computers and use those computers to all visit one site at the exact same time, tying up resources on the site, chewing up bandwidth, slowing it down and sometimes costing the site owner a pretty penny to defend the site along with a spike in bandwidth costs. In a nutshell, it’s a pretty shitty thing to do.

I’m not going to go into my personal thoughts on this because to put blank, you don’t have the time to read everything I have to say about it. So I’m just going to give you some info I copied from a news site that is watching what is going on. Warning: geek talk!

From:  http://www.theregister.co.uk/2009/02/10/new_dns_amplification_attacks/

New-age cyber-attack inflicts major damage with modest means

Ladyboydolls.com and the new DDoS

By Dan Goodin in San Francisco

Posted in Security, 10th February 2009 05:07 GMT

A sustained cyber-attack against a handful of niche pornography sites has demonstrated a novel way to inflict major damage on hardened targets using a modest amount of data, a security researcher has warned.

The technique – which tricks the net’s authoritative name servers into bombarding innocent victims with more data than they can handle – is growing increasingly common, and it’s likely only a matter of time before commercial attack kits add it to their arsenal, said Don Jackson, a researcher with Atlanta-based security provider SecureWorks. He also warned there is no easy fix because any remedy will potentially require settings for millions of DNS, or domain-name system, servers to be individually changed.

The ongoing attacks on several sites related to transvestite porn work by sending hundreds of thousands of domain name servers a steady stream of packets that contain little more than the character “.” The queries, which are forged so they appear to have been sent from sites such as ladyboydolls.com and triplexbonanza.com, prompt the DNS servers to respond to the targets with a list of the internet’s root servers, responses that contain about eight times more data than the initial request.

“The amplifiers in this attack are name servers configured to what is considered best practices,” Jackson told The Register. Preventing the attack will require administrators to make changes to the software running each vulnerable DNS server on the internet, he added.

The attacks began in mid January and have used some 750,000 DNS servers to spew about 5Gbps worth of junk response packets at one victim alone, said Phil Rosenthal, CTO of ISPrime, an internet provider for one of the sites being attacked. Not bad work for a botnet that Jackson estimates is made up of fewer than 2,000 infected machines. The company has since been able to mitigate the attack using a variety of methods.

Representatives from NationalNet, which provides internet service to ladyboydolls.com, declined to comment. Attempts to reach representatives from the targeted porn sites were not successful.

The amplification technique exploits an artifact in the net’s DNS from the days when it was considered harmless for a name server to respond to misdirected name queries with the name of a more appropriate server to make the request. Read together, RFCs 1034, 1035 and 1912 call for name servers that are queried for the location of the root servers to honor the request, Jackson and others say.

“There’s really no reason to tell the requester that information,” said Randal Vaughn, a professor of information systems at Baylor University and an expert in DNS amplification. “The problem is more related to the fact that at one time DNS servers would need to ask each other for help. When name servers started out, there were assumptions made that requests are legitimate, so we’ll answer them.”

A Matter of Time

The attacks being tracked by Jackson have been accompanied by more traditional distributed denial of service (DDoS) attacks generated by botnets. They bear the hallmarks of a commercial DDoS application known as BlackEnergy (PDF), leading Jackson to believe it’s only a matter of time before the technique gets folded into the package.

What’s more, an increasing number of sites over the past couple weeks have been subjected to the attack. For now, they tend to be underground operations such as those cranking out pharmaceutical spam, but Jackson expects that to change.

“When the bot writers integrate this and use it as a value add, then we’ll see it in the mainstream,” he said.

The only way to prevent the attack is for DNS administrators to ensure their servers are configured to answer upward referrals only to authorized zones within their domain. While some DNS software, such as DJBDNS, does this by default, plenty of other other programs don’t. Various versions of BIND, by far the most widely used DNS program, by default return queries for the root servers. (Instructions for changing this behavior in BIND are available here).

DNS software from Microsoft and others can also be used by attackers as DNS amplifiers out of the box, Jackson says. (Readers who know how to change this default behavior for other packages are invited to leave a comment or contact me using this link).

Another possible fix, ISPrime’s Rosenthal said, is using firewalls built into FreeBSD, Linux, and Windows. But Jackson says this solution is far from ideal. That’s because it would require the blacklisting of hundreds of thousands of legitimate DNS servers. Instead, Jackson is leaning toward the use of special signatures based on the open-source intrusion prevention system known as Snort.

But even some of the more feasible remedies may create problems, warns Baylor University’s Vaughn, who says the sudden squelching of DNS responses to the queries could create collateral damage as the requests are repeated over and over.

“Everything we do has a cost, and unfortunately, this is one of those things where there might be some debate about what to do,” he said. “There’s going to have to be by protocol some sort of response.”