Botnet Clients Integrate Exploit

Friday, March 9, 2012 @ 03:03 PM gHale


Armageddon, the latest version of a distributed denial-of-service (DDoS) bot, integrates a new exploit known as Apache Killer, said mitigation vendor Arbor Networks.

The Apache Killer exploit released in August 2011 and it exploits a vulnerability in the Apache Web server by sending a specially crafted “Range” HTTP header to trigger a denial-of-service condition.

RELATED STORIES
New Botnet Goes to Market
Malware has Bots Acting as C&C Server
Stealth Trojan Hijacks DLL File
New Bot a Phishing Attack

The attack is dangerous because it can execute from a single computer and the entire targeted machine needs to reboot in order to recover from it.

“The Kill Apache attack abuses the HTTP protocol by requesting that the target web server return the requested URL content in a huge number of individual chunks, or byte ranges,” said Arbor research analyst Jeff Edwards. “This can cause a surprisingly heavy load on the target server.”

The vulnerability exploited by Apache Killer is CVE-2011-3192 and it ended up patched in Apache HTTPD 2.2.20, a week after the exploit publicly released. Apache 2.2.21 contains an improved fix.

This is the first time Arbor researchers saw the exploit integrated into a DDoS botnet client actively used by attackers, Edwards said.

Armageddon is a Russian malware family exclusively designed to launch DDoS attacks. Because they sell it as a toolkit on underground forums, there is more than one Armageddon-powered botnet on the Internet.

Aside from the Apache Killer exploit, the latest Armageddon version also incorporates other application-layer DDoS techniques that target popular Internet forum platforms like vBulletin or phpBB, however these are not particularly ground-breaking, Edwards said.

Arbor’s researchers have cracked the encryption scheme used by the Armageddon botnets to communicate securely with their command and control servers and found in at least one case, an Armageddon botnet could launch politically motivated DDoS attacks related to the elections in Russia.



Leave a Reply

You must be logged in to post a comment.