Round 2: DDoS Versus Wikileaks

In the second round of what may possibly be a protracted Internet skirmish, a denial of service attack briefly blocked access to the cablegate.wikileaks.org web site this morning around 8:00 am EST. On twitter, Wikileaks pegged the DDoS as exceeding 10 Gbps (significantly larger than my 2-4 Gbps estimate for the first round of attacks on Sunday).


As compared with this Sunday’s initial attack (blog analysis available here), ATLAS data from 110 providers around the world suggest today’s DDoS was both larger and more sophisticated. Specifically, today’s attack involved several different components, including a low bandwidth application level DDoS and a 2-3 Gbps Syn attack against the primary “cablegate” IP addresses (the hosted web site is load balanced across data center locations in Europe and the US West Coast).

An example of one of the anonymous alerts ATLAS collected yesterday is shown below. This alert is for a modest TCP Syn attack against cablegate.wikileaks.org targeting high number ports. The source address blocks are anonymized with XX replacing the high number bits.


<attack start="2010-11-30 18:10:01 GMT" stop="2010-11-30 18:56:27 GMT">
<rate bps="70312432" pps="220847"/>
<protocols>TCP</protocols>
<tcpflags>Syn</tcpflags>
<source>
<ips>xx.xx.25.0/27</ips>
<ports>1024-2047</ports>
</source>
<dst>
<ips>204.236.131.131/32</ips>
<ports>16384-32767,32768-65535</ports>
</dst>
</attack>

In the below chart, I graph traffic from 110 ATLAS carriers around the world to address blocks (BGP prefixes) used by Wikileaks. Note these address blocks may also include traffic to other customer using the same hosting provider. The attack began around 7am EST though a smaller traffic spike occurs around 2am. All times are EST. At the time of this blog posting, the DDoS is still ongoing though not significantly impacting Wikileaks access.


Based on Netcraft and other reports, the outage was brief though cablegate web site performance was moderately impacted throughout the day.

Interestingly, the attack appears to originate from a relatively small number of source IPs, including machines in Russia, eastern Europe and Thailand.

– Craig

 

23 Responses to “Round 2: DDoS Versus Wikileaks”

November 30, 2010 at 10:58 pm, Nicky said:

Interesting. Is there anyway the countries are off and they are all really coming from the US? Is there a way they can hide where they are actually coming from?

November 30, 2010 at 11:24 pm, manny said:

Nicky: you be they do.

The military calls it Cyberwarfare for a reason.

December 01, 2010 at 3:53 am, KristoferA said:

Russia, Eastern Europe, Thailand… what do these countries have in common? Lots of people using pirated versions of Windows etc that are readily available to purchase on DVDs/CDs. The pirate discs are often contaminated with all kinds of junk/spyware/crapware so those countries are self-made botnets. The real origin of the traffic is most likely elsewhere…

December 01, 2010 at 10:58 am, Vico said:

Actually, Wikileaks is just becoming a target that many different botnet masters are targeting for fun. Because WikiLeaks is in the news it’s “cool” to attack them and see how strong your army is.

December 02, 2010 at 6:55 pm, Anthony M. Freed said:

Did WikiLeaks Hacker The Jester Pull Police Raid Hoax?

“The Jester was angry enough with militants recruiting for jihad and about the WikiLeaks disclosures to launch a DoS attacks on their sites, so why was he not very peeved about an impostor using his name to scam money? The logical conclusion might be that The Jester himself is the hoaxer…”

https://www.infosecisland.com/blogview/9970-Did-WikiLeaks-Hacker-The-Jester-Pull-Police-Raid-Hoax.html

December 03, 2010 at 11:00 am, ประเทศไทยเป็นหนึ่งในต้นตอการโจมตี Wikileaks | ข่าว said:

[…] ที่มา – Arbor Networks […]

December 03, 2010 at 8:37 pm, From the Listening Post… 12/04/2010 (a.m.) « Sean Lawson, Ph.D. said:

[…] Round 2: DDoS Versus Wikileaks […]

December 03, 2010 at 8:39 pm, How to Find Wikileaks and Follow Cablegate « ZERO ANTHROPOLOGY said:

[…] has been massive and orchestrated attack on the hosting of Wikileaks files, from a distributed denial of service, to Amazon dumping […]

December 03, 2010 at 11:52 pm, How to Find Wikileaks and Follow Cablegate | The News blog said:

[…] has been massive and orchestrated attack on the hosting of Wikileaks files, from a distributed denial of service, to Amazon dumping […]

December 04, 2010 at 2:11 am, Wikileaks on the Run « Machimon said:

[…] has been massive and orchestrated attack on the hosting of Wikileaks files, from a distributed denial of service, to Amazon dumping […]

December 04, 2010 at 1:45 pm, TheJesterFesters said:

Craig – if you watch the video’s of thejester’s xerxes DOS – one known source of the DOS attacks – you might notice that the news gadget on the sidebar of his Ubuntu desktop is showing news in Cyrillic script – Russian I believe. Rookie mistake on his part.

December 05, 2010 at 1:02 pm, The Weakest Link: What Wikileaks Has Taught Us About the Open Internet | an/archivista said:

[…] of documents to major global newspapers, the site has been besieged by DDOS attacks (upwards of 10 Gbps at one point), forcing the site offline and hampering its ability to deliver data. After moving to […]

December 07, 2010 at 4:00 am, The Weakest Link: What Wikileaks Has Taught Us About the Open Internet | TECHNOLOGY NEWS said:

[…] of documents to major global newspapers, the site has been besieged by DDOS attacks (upwards of 10 Gbps at one point), forcing the site offline and hampering its ability to deliver […]

December 07, 2010 at 12:07 am, Wikileaks derailed by just a hundred computers | Pitts Report said:

[…] eastern Europe and Thailand, says Craig Labovitz of Arbor Networks in Ann Arbor, Michigan, who has been tracking the attacks. It is likely that the machines sending the traffic are being secretly controlled by a hacker […]

December 08, 2010 at 2:31 pm, Edward Vielmetti said:

Here’s a report of a DDOS attack on Mastercard

http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2010/12/05/international/i083539S60.DTL

said to be in response to their actions to cut off Wikileaks payment processing.

December 10, 2010 at 11:54 am, ThousandEyes | Network Visibility | Service Assurance | Web Performance said:

[…] began monitoring the wikileaks.org domain after we learned about two rounds of DDoS attacks that managed to take the site offline on November 28 and November […]

December 12, 2010 at 4:20 am, DoS Atacks said:

Craig: Do you have any figures on the DDoS attacks traffic figures for those done by Anonymous Group against postbank, paypal, visa/mastercard?

December 12, 2010 at 5:33 am, Julian Assange: The Man Who Kicked The Hornets' Nest | Webscopia said:

[…] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

December 12, 2010 at 5:38 am, Julian Assange: The Man Who Kicked The Hornets’ Nest | DoS Attacks said:

[…] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

December 14, 2010 at 4:15 am, DDoS Attacks Make Headlines, But How Common Are They? : Febryadi.com said:

[…] Now to put this in some perspective with recent events, Arbor Networks estimates that the DDoS attacks that took WikiLeaks down on the day the cables were released were around 2-4 Gbps, just slightly above the average DDoS attack. But two days later, another attack on the site clocked in around 10 Gbps. […]

January 21, 2011 at 5:24 pm, Cara Mencegah DDOS attack dengan mod_evassive Centos/WHM | Code Zero said:

[…] Round 2: DDoS Versus Wikileaks | Security to the Core | Arbor … […]

March 09, 2011 at 5:57 am, DDoS Attacks 101 said:

[…] has been focused specifically on the cables between the US and Iraq. Shortly before and then again after WikiLeaks went live with Cablegate, it experienced a DDoS attack and went down for some […]

February 06, 2012 at 11:16 pm, DDoS Attacks: Size doesn’t matter said:

[…] were made with less than 1 Gigabit per second (Gbps). Sure, some attacks, like the one that got WikiLeaks in 2010 used 10Gbps level attacks, but, really, you don’t need to that much traffic to knock the stuffings out of a Web […]

Comments are closed.