Wikileaks' Defense: The DDoS Attack

Are WikiLeaks vigilantes going too far?

From MasterCard and Visa to PayPal and Amazon, the cyberworld's WikiLeaks supporter known as Anonymous is lashing out against companies that have pulled support for WikiLeaks.

Anonymous' Operation Payback -- just follow #Payback or Twitter handles @Anon_Operation and @Op_Payback for background -- also took down the website of Swiss bank PostFinance, where WikiLeaks founder Julian Assange once banked. PostFinance closed Assange's account, claiming Assange provided a false address when he signed up with the bank.

I suspect Twitter and Facebook, now that both have closed Operation Payback's accounts, will be next on the attack list. We will just have to wait and see.

A WikiLeaks Primer

WikiLeaks is a whistleblower site. It's been around for a while, but the site flew relatively under the radar until it released leaked cables from American embassies and diplomats. Now that WikiLeaks is on the radar, it's getting quite a bit of heated attention from the government, media, business and general public. In response, WikiLeaks avengers have launched several distributed denial of service, DDoS, attacks on those who have refused to support WikiLeaks.

DDoS is Easy

"In essence, the person or group carrying out the attack creates or modifies a Trojan or malware to take control of thousands or tens of thousands of computers globally," says independent financial-services consultant Jerry Silva. "The affected computers, sometimes called 'zombies,' are instructed to load pages from the target site, all at once, and typically download Web pages that are graphically intensive, so that the target system is overwhelmed by the sheer number of requests. The target servers become so busy that legitimate visitors of the site cannot get through."

Those DDoS attacks violate the Internet Architecture Board's Internet proper-use policy, but as Alan Paller, executive director of the SANS Institute points out, violation-enforcement is tough, and DDoS attacks are more common, especially among financial institutions, than anyone in the industry wants to admit.

"Banks are already being subjected to extortion using similar denial of service attacks -- attacks that would prevent me (as a customer) from doing online banking," he says.

Here's the primary problem: Though DDoS attacks are pretty easy to launch, they're not so easy to combat. "The software for these attacks is available for rent or stealing, and it's a very profitable line of business for organized crime groups," Paller says. Most companies, like online gambling sites -- not legal in the United States -- just pay for the extortion.

But banks and businesses cannot do much to protect themselves either, since attacks hit at the Internet level, Paller says. That means protection has to come from the Internet service provider. "The main line of defense is not something you can do internally, and that's part of the issue," he says. The sheer volume and variety of DDoS attacks makes them hard to identify and, thus, block.

"These are open TCP attacks," Paller says. "Those attacks can be blocked by the ISP, but many companies don't buy the special blocks." Besides, blocking any transaction runs the risk of blocking something legitimate, and what bank or business wants to do that?

As Silva points out, "This kind of attack is akin to preparing the institution for a natural disaster. You never know if or when you'll be hit; but a DDoS should be an event included in the bank's disaster recovery or business contingency plans."

So, where does that leave us? Well, the ISPs can provide protection, within reason. But as attacks get more sophisticated, there's only so much transaction and request blocking an ISP can do.

A more likely scenario of vigilante defeat? Vigilantes attacking each other, like those who have waged counterattacks on Operation Payback. Maybe there is such a thing as codes of ethics among cybercriminals.