After having some “triumphant smashes” (most notably against Sony) last year, the notorious group of hackers “Anonymous” has decided that its time to hit the jackpot and do something extraordinary. So they have decided to initiate their 2012 proceedings with a bang. On 31st of March, Anonymous will temporarily shut down the whole internet.
That’s silly, how are they gonna do this?
Well it seems like they do have a plan but whether their plan will be successful or not is a totally different issue. Take a look at what they have in mind.
Click here for original source.
In order to shut the Internet down, one thing is to be done. Down the 13 root DNS servers of the Internet. Those servers are as follow:
By cutting these off the Internet, nobody will be able to perform a domain name lookup, thus, disabling the HTTP Internet, which is, after all, the most widely used function of the Web. Anybody entering “http://www.google.com” or ANY other url, will get an error page, thus, they will think the Internet is down, which is, close enough. Remember, this is a protest, we are not trying to ‘kill’ the Internet, we are only temporarily shutting it down where it hurts the most.
While some ISPs uses DNS caching, most are configured to use a low expire time for the cache, thus not being a valid failover solution in the case the root servers are down. It is mostly used for speed, not redundancy.
I have compiled a Reflective DNS Amplification DDoS tool to be used for this attack. It is based on AntiSec’s DHN, contains a few bugfix, a different dns list/target support and is a bit stripped down for speed.
The principle is simple; a flaw that uses forged UDP packets is to be used to trigger a rush of DNS queries all redirected and reflected to those 13 IPs. The flaw is as follow; since the UDP protocol allows it, we can change the source IP of the sender to our target, thus spoofing the source of the DNS query.
The DNS server will then respond to that query by sending the answer to the spoofed IP. Since the answer is always bigger than the query, the DNS answers will then flood the target ip. It is called an amplified because we can use small packets to generate large traffic. It is called reflective because we will not send the queries to the root name servers, instead, we will use a list of known vulnerable DNS servers which will attack the root servers for us.
DDoS request —> [Vulnerable DNS Server ] <—>Normalanswer <—> Normal Client request
| ( Spoofed UDP requests
| will redirect the answers
| to the root name server )
|[ 13 root servers ] * BAM
Since the attack will be using static IP addresses, it will not rely on name server resolution, thus enabling us to keep the attack up even while the Internet is down. The very fact that nobody will be able to make new requests to use the Internet will slow down those who will try to stop the attack.
Will 31st of March 2012 will be remembered as Internet Blackout Day or the act just turns out to be a publicity stunt, only time will tell. So let’s wait and see.
Anonymous has distanced itself from the plot. Click here to read.
Article publié pour la première fois le 23/02/2012