War between supporters and protesters of Wikileaks

報告者：劉旭哲

• As we knew, WikiLeaks dumped nearly 250,000 documents covering private United States diplomatic communications on 11/28

• 之前報告過，WikiLeaks移動到 Bahnhof AB• Now, there have a new terrible.

• Bank of America says it will no longer process transactions for the website WikiLeaks.

• It joins financial institutions including MasterCard and PayPal that have stopped handling payments for the site.

• 因此支持WikiLeaks的組織 Anonymous近來不斷招兵買馬以執行報復行動– keep the Internet free and open for everyone– The Internet has gone to war.

• 雙方互相 DoS：– 反對WikiLeaks → 對WikiLeaks網站發起 DDoS– 支持WikiLeaks → 對反對WikiLeaks的網站發起 DDoS

• Anonymous has targeted mainly companies which have decided for whatever reason not to deal with WikiLeaks.

• Some of the main targets involve Amazon, MasterCard, Visa and PayPal.

• Anonymous要求那些自願參與 DoS的使用者下載合法的 LOIC開放源碼工具

• LOIC（ Low Orbit Ion Cannon），–主要功能進行網路應用程式的強度測試，以讓開發人員檢視程式的負載能力

–同時也能被用來進行惡意的 DoS。• 使用者透過 LOIC可連結發號施令的 IRC伺服器，並由該伺服器決定共同「測試」（或攻擊）的目標

• The group used Twitter and IRC to seek supporters, referring them to its website, where they could download the software that turns a Windows or Mac PC into a weapon against the MasterCard site.

• Twitter 不斷地對於釋放訊息的帳號作停權處分

• 雙方有成功嗎？–流量太小 (未達 10Gbps)–未採用精細的應用程式層級攻擊

• 前兩級的 ISP業者或大型的內容 /代管供應商都能夠從容應付

• For Anonymous–鎖定網頁，非重要後端架構– Amazon的失敗，使自願者逐漸放棄

攻擊Wikileaks

攻擊Wikileaks

400 mbs

OLIC下載分析

2.5G/day攻擊 Amazon

失敗，因為資源太少

• Finish？– Not,yet

• 7成是來自於 LOIC程式及網路版的 JS-LOIC，每個志願者每秒會傳送數十個要求到指定的攻擊網站上，其中，網路版大概只有 100行的 Javascript程式，功能極少，桌面版複雜一些，能夠受 IRC指令控制或隨機轉換攻擊網站。

• Anonymous支持者近來有釋出另外兩項更複雜的流量癱瘓工具─ HOIC及 GOIC

Reference

• http://latino.foxnews.com/latino/news/2010/12/18/bank-america-deja-manejar-pagos-wikileaks/

• http://sourceforge.net/project/stats/detail.php?group_id=266937&ugn=loic&type=prdownload&mode=60day&file_id=0

• http://www.foxnews.com/scitech/2010/12/09/wikileaks-data-war-growing-hacktivists-say/

• http://asert.arbornetworks.com/2010/12/the-internet-goes-to-war/

• http://www.ithome.com.tw/itadm/article.php?c=65006• http://www.ithome.com.tw/itadm/article.php?c=65074