DDOS Attack Tools.pdf

DDOS Attack Tools

Ethical Hacking and

Countermeasures

DDOS - Introduction

Evolution of a smurf attack

End result – many systems flooding the victim

with IP packets

More sophisticated control of the “flooders”

Relies upon the inability of the “flooders”

sysadmins to detect their presence.

DDOS setup started > 1 year before attacks

DDOS Attack Tools

Trinoo

Tribe Flood Network (TFN)

Tribe Flood Network 2000 (TFN2K)

Stacheldracht/stacheldrachtV4

Stacheldracht v2.666

Shaft

mstream

DDOS – Attack Sequence

All of the DDOS tools follow this sequence.

Mass-intrusion Phase – automated tools

identify potential systems with weaknesses

then root compromise them and install the

DDOS software on them. These are the

primary victims.

DDOS Attack Phase – the compromised

systems are used to run massive DOS against

a victim site.

Trinoo

Trinoo (Trin00) was the first DDOS tool to be

discovered.

Found in the wild (binary form) on Solaris 2.x

systems compromised by buffer overrun bug in

RPC services: statd, cmsd, ttdbserverd.

Trinoo daemons were UDP based, password

protected remote command shells running on

compromised systems.