up vote 0 down vote favorite
2
share [g+] share [fb]

A hacker under the alias Th3j35t3r claims he created an application named XerXes which enables to perform DDoS attacks without using botnets, zombie pc's and with no collateral damage to intermediary nodes and no long term damage to target.

See for live DDoS attack recorded on video: >> here <<

This video just worries me (because the internet might be not save), on the other hand I think it's fake because how can anyone launch an DDoS attack (Th3j35ter claimed he was responsible for the attack on wikileaks' website) with 10 gigabit / second from a single pc? And that while Wikileaks is using load-balancers on 3 different ip's?

Does anyone know if this is for real? If it's real, how does it work? And how can websites protect itself from this?

(I am not a hacker/cracker/scriptkiddie and I don't want to be!!)

link|improve this question
feedback

1 Answer

up vote 3 down vote accepted

It looks like this attack is not a traditional DDOS that uses thousands of servers, it looks like it is a DOS that utilises an exploit in Apache, perhaps by sending malformed packets that Apache takes several seconds to process, but only take a fraction of a second to send. Send a few hundred of these per second and Apache keels over.

The giveaway is that the hacker claims that the software only works on Apache, and there will be an IIS version soon used to work on Apache only, and is now "not just limited to Apache". A traditional DDOS works on ANY web server, regardless of platform, as it works by clogging the internet pipes to the server as well as overwhelming the web server.

Looks like this one just works by overwhelming the web server, rather than clogging the pipes to the server.

As a result, the amount of bandwidth a server has is totally irrelevant, as is the number of servers they have. As they add more servers, just increase your amount of traffic by n+1 and the new web server will go down as well.

However, this generally means that Apache will patch the vulnerability pretty damn soon, once they get their hands on the attack vectors.

link|improve this answer
Xerxes is not limited to Apache. th3j35t3r.wordpress.com/2010/12/09/time-to-speak-up-part-two All thou it might use different exploits for different servers. – Carl Bergquist Dec 14 '10 at 8:54
@Carl - Your info is far more up to date than what I was reading. I suspect you're correct that it uses different exploits for different web servers (Apache, IIS, etc) – Mark Henderson♦ Dec 14 '10 at 22:07
If you actually watch the demo of this tool, the interesting thing is that as soon as the attack stops the target is available again almost immediately. So it does look like it overwhelms the server without actually bringing it down and could be exploiting some sort of a bug in Apache. – Sergei Jun 27 '11 at 2:12
So, basically.. XerXes = Slowloris with a GUI and some extra exploits for different servers. – Mr. Pallazzo Feb 12 at 18:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.