Story about DDoS
By: Andrius Lukminas
Tags: Ddos Attack, China, India, Thailand, Ddos Protection

I’m about to share my life experience about IT industry in general and the hidden stuff that you don’t get warned when you buy equipment or use it daily.

My name is Andrius and i am a regular guy from small country named Lithuania. This is a beutiful country and no matter who says what i think there is no other place on earth where i could live and feel like home. From the young days i loved to sneak to fathers workshop and spend my whole day there experimenting with stuff, trying to understand how stuff works and etc.

Since the start of the PC’s era i wanted to know how the damn thing works, wanted to have one, while it was a luxury at home and we had no money for it. But years passing by and i got my first pc that i had to downclock the memory to have it working stable. Anyways from first crash of windows xp i have started to think that bringing each time to the technician to reinstall the OS is just a waste of time and money, and started to dig in and analize the whole process. That took some time but eventualy i got it and after that everything turned quickly around… I have started to get money fro helping others to fix any PC problem they had at that time. Sure, you would say that is every single one of the IT technician of that time story. Maybe, but that didn’t stopped me to learn programming, scripting mIRC, creating websites, digging in to linux world, server stuff and etc. At one time i got a time to stop and think the direction that i want to go next.

And you would say that i got own bussiness that specializes in IT repair? Nope, this stuff has no money since the Windows 7 came out. So then what? Servers, programming, micro-soldering. And then i got in to the gamers world and stuff with the servers.

You are not even realizing that almost every single one of the device you may own is a specialized server or/and client. Seriously, if you think that smart set-top boxes, smart watches, routers, or even your own phone can’t be a server then you are so wrong. All of them has vulnerabilities and can be used as a server.

Now why all this stuff in the begining of the story? I wanted you to realize that i am a guy that does not have any college degree in IT, did not get to the univercity and did not finished any paid course that is offered online. I did all the research by myself. Learned all the stuff by testing everything. So you can do that to.

Now Why DDoS? What is the DDoS? This is a simple comunication between server and client. Why it is needed? Well all the internet is communication between clients trought servers or client to client directly peer-to-peer. And deniel of service is when one client ask server to answer or provide the info, but the server has limits how many clients he can service at once. Where is the proble then? Well there is limit if the server is fast enought to count the clients and there requests, but immagine if a single guy is asked 200+ questions at once… Same here but the questions are repeated and data keeps comming on from various directions at once while server just crashes and on worse case scenario drops sencitive info to the attacker.

Now you wonder why i was talking about servers and home equipment? Not all but most of the smart stuff that is connected to internet can be hacked and used as botnet client, do what ever the botnet master will ask. Botneting in general started in the early IRC times when there was linux based EGGDrop bots that was stable enought to keep connection alive and strictly do whatever he was programed to. Then it evolved and got to the size of few megabytes and could be dropped almost in every device. Yes, hackers are programmers and they are smart to do that.

The meeting with the DDoS networks was when i started to host a Teamspeak server on my own VPS server that also held a apache server, mysql server and had a website running. Nothing important just my personal playground.

And at that time i did very little of firewalling on the server, most of the ports was open so the first attacks kicked me hard… At the night when the gaming/raids started as i was explained the server started to act strange and drop packets… Ok cleaning the sleep out of my eyes and looking at the screen the output was struggling but in general many many ip’s requesting crap, sending stuff to servers multiple ports. I did quick script to log a small portion of the data to get an general idea where from where those ip’s and how to block them. To get rid of them i blocked everything but myself, then waited a few moments while the flood will stop. The tcpdumb was like crazy and the log file was filling up quickly.

After some time, 20 minutes to be more specific, the flood ended up while the server was not responding to anyone except me and the attacker thought the server died. I started to whois every single ip i found in the log journal. And majority was from the asia (China, Korea, Thailand), then the closer countries like India, Germany and etc. So after investigating everything i thought i will dedicate the server to the Teamspeak team and try to make the most secure server made. The idea is simple: lock down all the ports that is not a teamspeak and filter ip’s that goes trought the teamspeak port, witch was changed from default to. It took some time to gather all the user ip addresses, while some where on dynamic ones so they had to use services or request ISP to assign the IP address. But the result was ok, not perfect but ok. Why is that? Well you can cover up the channel from server side and cover all the ports like i did but the attacker can attack the link to the server that is in the server room. So by flooding the ip address they required more traffic to fill it up and slow down the server connection. Then i realized that the VPS host i choose had no DDoS protections on the servers and it could easy kill all the servers at once…

The turnaments was comming up and the users requested stable server connection to have a good comms so i had to change something to prevent crashing. That is how OVH came to the scene. Yes, same OVH that most uses. So i migrated all the server data to a new server and to minimize downtime i tried to start the new server but while it had a non-profit license it uses a domain check to validate the license. So first run in new server was limited on 32 users (and that was only a third i needed to fill in). So i warned everyone that there will be two small downtimes when move will be done and restart after the domain will refresh to a new ip address to restart it and give the license.

Eveything went smoothly and then the waiting started. After connecting to a firewall that OVH provides i noticed few waves was redirected to a wormholes that OVH made for bogous requests and flooders. And that was just a tests.. After few days the server had another attack from the OVH server network.. Wait, what?? Yes, from inside. Attackers gathered the servers witch are hacked inside the OVH network and used them to attack. That way whole protection from OVH are useless. Yes, the waves was not that big like before but still it managed to slow down the connection and almost kill it few times…

So i have gathered internet for rules to filter the flood and atleast minimize the flood effect to few packet drops. There is few articles about it but you will be making your own in the end of the day while most of them does not fit your needs perfectly and has to be polished. Anyways to get the most of the protection you have to have some sort of limits/iptables banning system that will take care excessive traffic and/or the alicious requests.

After all that i got a glass cube with DDoS killer words inside of it, small thanks from whole team.

But the most vauable i think is the experience that i got. Not everyone knows that most of the websites, when you use scripts that are “nulled”, when u use pirated software or lurking around in the websites that are clearly not well to your pc and specialy if you download anything and run on the pc it can and will install some crap in your pc that eatcher will ake your pc open to everyone and everyone can get any data from you or use it as a bot in a gigantic network of zombies to attack someone…

Most of the phones from china are with android and the system is eather cut down, with most of the stuff removed/replaced with the stuff that they need and i don’t think that they care about security or vulnerability of there devices they just do a cheapest working crap that just looks good on pictures but in reality doesn’t worth a penny from you but people buys that crap and uses everyday becouse the tested and good devices are not that cheap and clearly not everyone can afford them.

In the end i would like to wish everyone to have the funds to buy a proper stuff, specialy smart devices, keep away from cheap china stuff, and i hope that networking companies actualy will start to trace out the malicious devices, block them one by one and start to close down the websites that is full of crap. These are the main sources where the botnets are created from, while direct hacking is not that simple and requires more time and investigation than the phishing and the masked troyans, bots and stuff like that. It is way easyer to put something on the internet and then just wait until people actualy will hook up and use it. Same story with the exploits in websites that may let intruder put some malicious code in your website and use it like own bot. Hope you liked the article and didn’t got borred while i tried to keep away all the technical stuff to get the story readable to everyone. Chears everyone and keep yourself safe.

P.S. Imagine that botnets can actualy attack and crash hospitals, banks, stores, bussiness and etc. Even traffic lights or flight control units. What would happen then?