HTTP DDoS attack on our servers

From: Markus Peter (warp_at_spin.de)
Date: 07/08/03

  • Next message: James C. Slora, Jr.: "RE: Administrivia..." 
    Date: Tue, 08 Jul 2003 15:06:32 +0200
To: incidents@securityfocus.com

    Hello

    Since yesterday, about 8pm CET, we observe a strange phenomenon on one of
    our servers, which appears like a DDoS attack. The characteristics do not
    match those of the typical known UDP DDoS tools but is TCP based.

    Basically, > 8.000 IP numbers are sending HTTP requests to our server on a
    non-HTTP port (8000), which ran an entirely different, not HTTP related
    service on this machine. The IP numbers are mostly assigned to Europe and
    North America.

    The requests always look the same way:

    GET /index.htm HTTP/1.1
    Accept: */*
    User-Agent: UserAgent
    Connection: close
    Host: <our ip number>

    Please note that they literally supplied "UserAgent" as User-Agent - I only
    removed our ip number from the requests. Each attacking host opens multiple
    connections per second. Even though the server which ran at 8000 could not
    handle HTTP requests at all and immediately closed the connection after the
    first sent line, the sheer number of connection attempts was enough to
    basically force us to put the service offline, as we had over 60.000
    concurrent TCP connections due to this.

    Due to the above described characteristics, I'm pretty sure that it's not
    just a misguided link on some large website, but some sort of non-browser
    program doing the requests.

    We nmapped some of the requesting machines. All of the scanned hosts appear
    to be running windows, with all of them having TCP port 45836 open. If we
    try connecting to that port, the connection is either immediately closed
    again by the remote end, or occasionally kept open indefinitely, but in
    neither case any data is sent back to us.

    I'm now completely puzzled on what is happening and what kind of tool we
    confront. Anyone else experiences incidents like those? 

    -- 
Markus Peter - SPiN AG
warp@spin.de
----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
world's premier technical IT security event! 10 tracks, 15 training sessions, 
1,800 delegates from 30 nations including all of the top experts, from CSO's to 
"underground" security specialists.  See for yourself what the buzz is about!  
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
----------------------------------------------------------------------------
  • Next message: James C. Slora, Jr.: "RE: Administrivia..."

    Relevant Pages

    • Re: Slow DNS requests?
      ... I think that the delay is in resolving the DNS requests. ... Guest machines connected via CAT5 to the BEFSR41 run fine. ... As soon as the host name is resolved, performance seems to improve dramatically for that connection. ... your DHCP server will tell your machine what name servers to use. ...
      (comp.os.linux.networking)
    • Re: downloading a single file using multiple threads
      ... The multi part requests in HTTP1.1 are meant to request a single part or multiple parts in a single request, but you can't requests multiple parts in parallel from multiple client threads. ... I know that down-load managers claim to work over HTTP, but that doesn't mean they support multi-part parallel request handling over the same or multiple connections, I don't even know if the protocol allows you to issue new range request when you have a range requests pending. ... If on one connection the client asks for the first megabyte and on a second connection the same client asks for the second megabyte, then if the server is capable of servicing both requests at the same time, there's no reason the client can't wind up receiving both the first and second megabytes in parallel. ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: What is this code waiting for?
      ... and the web server is sat waiting for another request. ... the server times out the connection - and your read method returns ... open by default for further requests. ... If you send that header then the server ...
      (comp.lang.java.help)
    • Re: Problem with a Socket server program opening/accepting many connections and the GC is running.
      ... I'm not quite sure what you mean by "slowed down my server by adding a 10ms ... to handle the connection as quickly as possible? ... other clients requests are being serviced. ... >> available sockets. ...
      (microsoft.public.dotnet.framework.performance)
    • Re: IPC looking for simple/best way to communicate
      ... > want to go to a server/client connection. ... > Server accepts connections on given port. ... > could deal well with 150 or more requests per second. ... If a client attempts to connect to the server while the ...
      (comp.lang.perl.misc)