Installing DDoS Software
There is a relatively standard procedure that is followed when
installing the DDoS software in preparation for an attack.
1. Previously compromised hosts have “zombie” agents installed on
them.
2. Another compromised host has the master controlling software
installed on it. This piece of software is configured to be aware of the
location of all the agents.
3. The last step is to install client software on the attacker's machine,
used to initiate the attack.
Initiating the Attack
The attack is typically initiated in the following manner:
1. The client communicates the IP addresses of the desired targets to
the master system.
2. This master system then instructs each of the agents to launch an
attack against the target using standard DoS techniques.
Early detection of these systems was possible by scanning machines for
the presence of agents and by sniffing network traffic to detect the
communication between the master and the agents.
Evolution of DDoS
As the DDoS tools have evolved they now incorporate encryption as
part of the master to agent communication and allow agents to listen
UDP ports, which only respond when sent a shared secret key. These
two enhancements make detecting these systems remotely, a very
difficult task.
No comments:
Post a Comment