The Low Orbit Ion Cannon, or LOIC, is a popular tool for taking down websites these days. It was used on Visa, Master Card, Paypal and other institutions by "Anonymous" hacktivists.
LOIC is easy to download and requires minimal technological savvy for its use. One runs the program, enters a targeted IP address, confirms, and watches as the program floods a site's host with TCP packets, UDP packets, or HTTP requests. Eventually, the ability to handle further requests is lost and the site goes down, becoming unresponsive. This is termed denial of service and the attack is a distributed denial of service (DDoS) attack on the basis that the attacks are distributed across various sources.
The resulting downtime of the site is temporary, of course, but the attack's perceived consequences can range from slight inconvenience to severe paralysis. As is widely known, the stability of a web site is a strong determinant of its popularity. Yet the goal of such attacks, as articulated by some of the Anonymous group members, is not terminal destruction but to raise awareness.
A new weapon of mass awareness is in the horizon, however, that may very well step up the severity and efficiency of these attacks. If effective, it will set into motion attacks originating from thousands of computers worldwide. The difference? End-users will not necessarily know they are participating in the attacks. Here's how it would work.
A home user navigates to a torrent search engine to download a popular file (a film or TV show, for instance). As this image illustrates, the file may have several thousands of leechers or seeders; these numbers may increase to the hundreds of thousands in some cases, depending on the popularity of the file. For simplicity, think of each leecher as one computer attempting to download the file.
As a presenter at the most recent Chaos Communications Congress articulated, by manipulating the data being communicated through BitTorrent clients, one can create the appearance of availability for a given file and cause leechers to attempt a download. The leecher would not actually be downloading the intended file, but attacking a target IP without their knowledge. This would result in the flooding of the target host and, in many cases, eventual take-down of the target site.
This new technology, termed BotTorrent by TorrentFreak's editor-in-chief, would have revolutionary significance not merely in virtue of its creative underpinnings,* but in terms of legal responsibility. Clearly, it is unlikely that end-users would prosecuted for carrying out an attack of which they had no knowledge. Furthermore, given the number of unknowing users carrying out the attacks, the magnitude of the attacks would expand massively. Word on the tweets is the technology is capturing the imagination of developers.
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer
