Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
In February 2016, the hacktivist group Anonymous published a hacktivist message in a video posted on YouTube. The
video contains detailed examples of uses for various DDoS tools, and the video description contains a link to a zip le
containing these tools.
Most of the tools offer similar DDoS attack typesmostly HTTP, TCP, and UDP oodsbut there is some interesting
differentiation. For example, some tools offer more Layer 7 attack granularity, while providing the attacker control of the
attacked URL path and parameters and also supporting POST oods. Other tools are focused on a single attack type,
such as "Anonymous Ping Attack" and "Pringle DDOS", which only have ICMP ood capability.
such as "Anonymous Ping Attack" and "Pringle DDOS", which only have ICMP ood capability.
If an attacker wants to launch a powerful Low and Slow DDoS attack, surprisingly he or she will nd only a single tool in
this bundle, the well-known Slowloris.pl perl tool, which is not authored by Anonymous at all. R.U.D.Y and other slow
POST tools are noticeably missing from this bundle.
Another group of tools provide some evasions, such as support for sending requests with different user agent and
referer headers. For example, the UnKnown DoSer, a Layer 7 ooder, even supports randomization of URL, User-Agent,
and the Content-Length values in order to bypass hard-coded attack signatures.
Some Anonymous sub-groups localize and re-brand the LOIC tool. LOIC-SD was rst published by a Brazilian hacker
group called Script Defenders and is mainly designed to overcome a language barrier by translating LOIC's user interface
into Portuguese.
The "Indonesia Fighter Cyber" hacking group created LOIC-IFC, which differs only in the default TCP/UDP ood
message saying, "Merdeka atau Mati", which means "Freedom or Death" in Malay. From a technical perspective, it
provides additional ability to append random characters to the attacked URL in case of HTTP ood, and to the packet
payload in case of TCP/UDP.
payload in case of TCP/UDP.
Another LOIC-modied tool included in this bundle is NewLOIC, which, despite its name, offers no new functionality,
only a new GUI design.
Anonymous still consider LOIC and its various versions to be meaningful tools in its DDoS arsenal. In fact, a quarter of
the tools included in this bundle are LOIC-based tools, despite the risk of exposing the attackers IP address by using
these tools.
Some of the DDoS tools known to be used by Anonymous arent included in the published bundle. R.U.D.Y, keep-
dead.php, TORsHammer, THC-SSL-DOS, #Refref, and AnonStress are just some of the known tools that don't appear
here. Attack tools that use proxies in order to protect the identity of their users also seem to be missing in this bundle,
which makes potential Anonymous new recruits vulnerable to detection and prosecution.
Even so, Anonymous continues to strengthen its presence. By regularly publishing a variety of simple-to-use tools, the
group makes DDoS attacks more accessible and easy to perpetrate, with the obvious goal of recruiting more users to
support its hacktivist operations. Although not a single tool in the bundle is new, the group continues to terrorize the
world with every successful DDoS operation.
2017 F5 Networks, Inc. All rights reserved. F5, F5 Networks, and the F5 logo are trademarks of F5 Networks, Inc. in the U.S. and in certain other countries. Other F5
trademarks are identified at f5.com. Any other products, services, or company names referenced herein may be trademarks of their respective owners with no
endorsement or affiliation, express or implied, claimed by F5. CS04-00015 0113