I finally finished the report summarizing what we learned from yesterday's denial of service attack. Luckily it was small and easily defeated. The interesting part with attacks like this is to try to attribute them to a group or individual. In this case, my best guess is that this is an individual living in England. The individual appears to have some ties to Iran. Probably a student going to school in England.

The attack itself was rather simple, and required little skill. We got some great help from some of the administrators of the system attacking us. Most likely, the root cause was unprotected FTP accounts. These unprotected FTP accounts got used to upload a malicious ASP script, which was then used to attack our site. The script was very simple and had no "command and control" channel. Instead, it required a GET request hitting the specific URL to activate the attack.

The full report got a bit long for a diary, so I wrote it up as a PDF for download. I know... yet another PDF ;-).

Link to the PDF: http://isc.sans.org/presentations/jan4ddos.pdf

To make you feel better, here the checksums:

md5: 8eb9d6ef20c05875688d97fd3192a7e9
sha1: c097c740669869349bb5f8a3d3447ffa0376f928
ripemd160: 227feacd529de68c0634e1b5ca574d55cacf31ef

GPG signature:

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)

iEYEABEDAAYFAktEDmIACgkQPNuXYcm/v/3qzQCfRLKM64UiiWgWp0QDEomX1VAE
/gsAn2Dxst/Pe8kYsNz+QCmSZng+yRNj
=Or18
-----END PGP SIGNATURE-----
 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter