DD4BC group is quite famous for their DDoS attacks on Bitcoin exchanges, gambling business, other gaming websites. Usually it all starts with an email regarding a ransom of 1-25BTC and a small DDoS attack as a demo. If the ransom is not paid, the bigger attack will come. At least email says so. There is quite interesting analysis from Akamai Networks.
On the 6th of May 2015 a "company from forex industry" received a letter with ransom for 25 BTC from DD4BC group. As far as I know other FOREX companies were also ddosed that day, but I'm not sure if it were the same guys.
Anyhow, we have collected some stats and interesting info about "demo" attack on "this company".
Attack type: DDoS (SSDP and NTP amplification)
Bandwidth consumed: nearly 10 Gbit/s
Total source IPs: 369243
Total autonomous systems: 5866
Total countries: 188
As you can see the attack was really distributed.
It would be interesting to know, that 99% of the traffic was SSDP. Why intersting? Amplification factor of SSDP is way more less then NTPs. It is more handy to use NTP or DNS amplifiers in attack.
The main reason of such popularity is that SSDP is enabled on lots of the routers, webcams, etc. by default. I have researched some IPs that were used in attack - mostly it is SOHO routers and network cameras. Can you imagine, that there are 365936 devices with SSDP waving to the whole wild Internet? And these are the ones we know of.
On the 6th of May 2015 a "company from forex industry" received a letter with ransom for 25 BTC from DD4BC group. As far as I know other FOREX companies were also ddosed that day, but I'm not sure if it were the same guys.
Anyhow, we have collected some stats and interesting info about "demo" attack on "this company".
Attack type: DDoS (SSDP and NTP amplification)
Bandwidth consumed: nearly 10 Gbit/s
Total source IPs: 369243
Total autonomous systems: 5866
Total countries: 188
As you can see the attack was really distributed.
It would be interesting to know, that 99% of the traffic was SSDP. Why intersting? Amplification factor of SSDP is way more less then NTPs. It is more handy to use NTP or DNS amplifiers in attack.
The main reason of such popularity is that SSDP is enabled on lots of the routers, webcams, etc. by default. I have researched some IPs that were used in attack - mostly it is SOHO routers and network cameras. Can you imagine, that there are 365936 devices with SSDP waving to the whole wild Internet? And these are the ones we know of.
Lets have a look at the Autonomous Systems now.
The leader is from China - Chinanet AS4134 and 13.3%. Anyhow, there is nothing remarkable in that chart. China and US are on the top. As it was already said, there were 5866 detected in this attack.
Here is how IP distribution by countries look like:
No surprises. US beats CN a bit.
I will try to inform ISPs about NTP amplifiers and SSDP devices in their network, but I don't expect much.
If you'd like to make your own research on this attack - let me know. I will give you all info I have.
No comments:
Post a Comment