We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Popular Dirt Jumper DDoS toolkit riddled with security flaws, research finds

Command & control servers open to attack, says Prolexic

The criminal creators of the hugely popular Dirt Jumper DDoS toolkit appear to have been sloppy with their own security, introducing software vulnerabilities that leave the software's command and control (C&C) servers open to attack, security firm Prolexic has discovered.

Overwhelmingly, the business of DDoS defence is usually about blocking attacks once they start, or finding a conventional route to access the C&C servers on a case-by-case basis, so Prolexic's discovery of flaws in the code itself counts as noteworthy.

Despite Dirt Jumper's well-developed attack features, Prolexic found holes in the simplest part of the program, namely the GUI control panels used to control bots created by it which turned out to be cobbled together using hastily-coded PHP/MySQL scripts.

In Prolexic's words, these proved open to compromise on a number of levels including "weak authentication mechanisms, file inclusion vulnerabilities, directory traversal vulnerabilities, and SQL injections."

Irony of ironies; a criminal toolkit open to a SQL injection flaw in the front end used to control a botnet. Anyone gaining access to the C&C would be able to control what the DDoS software is doing, right down to the bots it controls and its target list. Game over, potentially.

"DDoS attackers take pride in finding and exploiting weaknesses in the architecture and code of their targets. With this vulnerability report, we've turned the tables and exposed crucial weaknesses in their own tools," said Prolexic's CEO, Scott Hammack.

"With this information, it is possible to access the C&C server and stop the attack," Hammack said. "Part of our mission is to clean up the Internet. It is our duty to share this vulnerability with the security community at large."

Importantly, the flaws found by the company affect all versions of the toolkit, which traces its lineage back as far as 2008, including a recent, multi-capable version called 'Pandora'.

Dirt Jumper seems to have overtaken rivals to become one of the most successful DDoS toolkits available on the Russian underground. Nobody knows why this has happened - rivals such as Black Energy and Optima had dominated before its appearance - but it could be down to its features or lively development.

Can attacks be stymied with this new knowledge? Prolexic said it had stopped a small but crafted 27 July Pandora DDoS on the website of security journalist Brian Krebs, which represents a start.

In theory the developers could fix the vulnerabilities spotted by Prolexic and come up with a version immune to interception. That remains a danger but because the source code was made available for Dirt Jumper and the number of different versions that exist, doing that for all of its bots built with it would be a major task at least in the short term.

It may not last but at least researchers can finally say that DDoS has one bad day.


IDG UK Sites

LG G Watch R video review: The most desirable Android Wear smartwatch

IDG UK Sites

Apple's 2014 highlights: the most significant Apple news of 2014

IDG UK Sites

2015 creative trends: leading designers & artists reveal the biggest influences & changes coming th)......

IDG UK Sites

Ultimate iOS 8 Tips: 35 awesome and advanced tips for using iOS 8 on iPhone and iPad