{"id":505,"date":"2010-12-10T09:43:43","date_gmt":"2010-12-10T16:43:43","guid":{"rendered":"http:\/\/www.techiewhizkid.com\/?p=505"},"modified":"2010-12-10T09:47:19","modified_gmt":"2010-12-10T16:47:19","slug":"how-operation-payback-hacked-mastercard-paypal-using-ddos-hacks-in-defense-wikileaks-project","status":"publish","type":"post","link":"https:\/\/www.techiewhizkid.com\/how-operation-payback-hacked-mastercard-paypal-using-ddos-hacks-in-defense-wikileaks-project\/","title":{"rendered":"How Operation Payback Hacked into Mastercard and PayPal Using DDOS in Defense of WikiLeaks Project"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft\" src=\"https:\/\/i0.wp.com\/mashable.com\/wp-content\/uploads\/2010\/12\/wikileaks1.jpg?resize=225%2C225\" alt=\"\" width=\"225\" height=\"225\" data-recalc-dims=\"1\" \/><\/p>\n<p>Over the last few days, companies like <a href=\"http:\/\/mashable.com\/2010\/12\/08\/hackers-take-down-visa-com-in-the-name-of-wikileaks\/\" target=\"_blank\" rel=\"noopener\">Visa<\/a>, <a href=\"http:\/\/mashable.com\/2010\/12\/08\/hackers-wikileaks-paypal-postfinance\/\" target=\"_blank\" rel=\"noopener\">Mastercard<\/a>, PayPal and <a href=\"http:\/\/mashable.com\/2010\/12\/09\/operation-payback-amazo\/\" target=\"_blank\" rel=\"noopener\">Amazon.com<\/a> have found themselves targets of coordinated distributed  denial-of-service attacks, designed to force their websites and other  infrastructure elements offline.<\/p><div class=\"7a7853692f91f1c3aa9fe870b4069c5d\" data-index=\"1\" style=\"float: none; margin:0px;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- techiewhizkid_link_1 -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-8372396756447573\"\r\n     data-ad-slot=\"9242151396\"\r\n     data-ad-format=\"link\"><\/ins>\r\n<script>\r\n(adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n\n<p>The campaign, which is called  \u201c<a title=\"Operation PayBack\" href=\"http:\/\/twitter.com\/Op_Payback\" target=\"_blank\" rel=\"noopener\">Operation Payback<\/a>\u201d (and is reportedly headed up by Anonymous), is  targeting companies that have denied service to <a href=\"http:\/\/mashable.com\/tag\/wikileaks\" target=\"_blank\" rel=\"noopener\">WikiLeaks<\/a> and its founder, Julian Assange.<\/p>\n<p>In  essence, what is happening is that lots and lots of individuals are  hammering specific websites with TCP or UDP packets or HTTP requests.  There are only so many resources to go around, which means that with  enough individuals involved, even large websites can be taken down very  quickly.<\/p>\n<p>Most of the participants in Operation Payback are not  hackers \u2014 at least not in the true sense of the word. Instead, these  users are using computer programs \u2014 or more recently, simply visiting  websites \u2014 in order to stage their attack.<\/p>\n<p><!--more--><\/p>\n<p>The tool being used to power these attacks is called <a href=\"http:\/\/en.wikipedia.org\/wiki\/LOIC\" target=\"_blank\" rel=\"noopener\">LOIC (Low Orbit Ion Canon)<\/a>.  This tool, which was purportedly originally created to stress test  networks, is written in C# and can be downloaded off open source code  repositories like Github and Sourceforge.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" title=\"js-loic-640\" src=\"https:\/\/i0.wp.com\/cdn.mashable.com\/wp-content\/uploads\/2010\/12\/js-loic-640.jpg?resize=640%2C298\" alt=\"\" width=\"640\" height=\"298\" data-recalc-dims=\"1\" \/><\/p>\n<p>LOIC can be used to target a website the user inputs, or using an option called Hive Mind, to connect to IRC or <a href=\"http:\/\/isc.sans.edu\/diary.html?storyid=10051\" target=\"_blank\" rel=\"noopener\">even Twitter<\/a>, and grab information for a targeted web attack.<\/p>\n<p>Sophos\u2019s <a href=\"http:\/\/nakedsecurity.sophos.com\/2010\/12\/09\/low-orbit-ion-cannon-the-tool-used-in-anonops-ddos-attacks\/\" target=\"_blank\" rel=\"noopener\"><em>Naked Security<\/em> blog<\/a> and Mark Hofman at the <a href=\"http:\/\/isc.sans.edu\/diary.html?storyid=10051\" target=\"_blank\" rel=\"noopener\"><em>Internet Storm Center<\/em><\/a> have more technical write-ups on how the program actually works.<\/p>\n<p>Because C# will only work on Windows<a rel=\"http:\/\/www.blippr.com\/apps\/574203-Windows.whtml noopener\" href=\"http:\/\/www.blippr.com\/apps\/574203-Windows\" target=\"_blank\"> (<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/cdn.blippr.com\/images\/inline-face_03.png?resize=14%2C14\" alt=\"Windows\" width=\"14\" height=\"14\" data-recalc-dims=\"1\" \/>)<\/a> computers out of the box (Mac and Linux<a rel=\"http:\/\/www.blippr.com\/apps\/392202-Linux.whtml noopener\" href=\"http:\/\/www.blippr.com\/apps\/392202-Linux\" target=\"_blank\"> (<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/cdn.blippr.com\/images\/inline-face_05.png?resize=14%2C14\" alt=\"Linux\" width=\"14\" height=\"14\" data-recalc-dims=\"1\" \/>)<\/a> users have to install additional libraries and do extra configuration), a Java port of LOIC also exists.<\/p>\n<hr \/>\n<h2>One-Click DDoS Attack<\/h2>\n<hr \/>\n<p>The  most recent variant of LOIC is a new proof of concept that is floating  around called JS LOIC. The \u201cJS\u201d in the title stands for JavaScript.<\/p>\n<p>This  proof of concept, which doesn\u2019t appear to have as many features as LOIC  or Java LOIC \u2014 and may also be easier to stop \u2014 is actually pretty  clever.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" title=\"op-payback-tweet\" src=\"https:\/\/i0.wp.com\/cdn.mashable.com\/wp-content\/uploads\/2010\/12\/op-payback-tweet.jpg?resize=640%2C573\" alt=\"\" width=\"640\" height=\"573\" data-recalc-dims=\"1\" \/><\/p>\n<p>Rather  than requiring a user download program to run, someone can just visit a  web page with a single HTML file and press a button to carry out their  part of an attack.<\/p>\n<p>On the one hand, the trick of using JavaScript  to carry out this kind of flooding attack is pretty clever. On the other  hand, it\u2019s also pretty scary.<\/p>\n<p>From what we can gather, the majority of the attacks on Operation Payback targets are <em>not<\/em> coming from web clients. However, that could change.<\/p>\n<p>We  would caution users against clicking on any links claiming to aid in  this series of attacks. Not only is willfully participating in a DDoS  illegal in many countries, you never know what is behind the file you  download or what action clicking on that web button could trigger.<\/p>\n<p>As with many other aspects of the WikiLeaks<a rel=\"http:\/\/www.blippr.com\/apps\/642444-Wikileaks.whtml noopener\" href=\"http:\/\/www.blippr.com\/apps\/642444-Wikileaks\" target=\"_blank\"> (<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/cdn.blippr.com\/images\/inline-face_05.png?resize=14%2C14\" alt=\"Wikileaks\" width=\"14\" height=\"14\" data-recalc-dims=\"1\" \/>)<\/a> saga, the distributed and de-centralized nature of the Internet<a rel=\"http:\/\/www.blippr.com\/apps\/603086-Internet.whtml noopener\" href=\"http:\/\/www.blippr.com\/apps\/603086-Internet\" target=\"_blank\"> (<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/cdn.blippr.com\/images\/inline-face_05.png?resize=14%2C14\" alt=\"Internet\" width=\"14\" height=\"14\" data-recalc-dims=\"1\" \/>)<\/a> means that shutting down all mirrors for documents \u2014 or even for attack tools \u2014 is an exercise in futility.<\/p>\n<p><a href=\"http:\/\/mashable.com\/2010\/12\/09\/how-operation-payback-executes-its-attacks\/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+mashable%2Ftech+%28Mashable+%C2%BB+Tech%29\" target=\"_blank\" rel=\"noopener\">via Mashable<\/a><\/p>\n\n\n<div class=\"kk-star-ratings kksr-auto kksr-align-left kksr-valign-bottom\"\n    data-payload='{&quot;align&quot;:&quot;left&quot;,&quot;id&quot;:&quot;505&quot;,&quot;slug&quot;:&quot;default&quot;,&quot;valign&quot;:&quot;bottom&quot;,&quot;ignore&quot;:&quot;&quot;,&quot;reference&quot;:&quot;auto&quot;,&quot;class&quot;:&quot;&quot;,&quot;count&quot;:&quot;0&quot;,&quot;legendonly&quot;:&quot;&quot;,&quot;readonly&quot;:&quot;&quot;,&quot;score&quot;:&quot;0&quot;,&quot;starsonly&quot;:&quot;&quot;,&quot;best&quot;:&quot;5&quot;,&quot;gap&quot;:&quot;5&quot;,&quot;greet&quot;:&quot;Rate this post&quot;,&quot;legend&quot;:&quot;0\\\/5 - (0 votes)&quot;,&quot;size&quot;:&quot;24&quot;,&quot;title&quot;:&quot;How Operation Payback Hacked into Mastercard and PayPal Using DDOS in Defense of WikiLeaks Project&quot;,&quot;width&quot;:&quot;0&quot;,&quot;_legend&quot;:&quot;{score}\\\/{best} - ({count} {votes})&quot;,&quot;font_factor&quot;:&quot;1.25&quot;}'>\n            \n<div class=\"kksr-stars\">\n    \n<div class=\"kksr-stars-inactive\">\n            <div class=\"kksr-star\" data-star=\"1\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"2\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"3\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"4\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" data-star=\"5\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n    <\/div>\n    \n<div class=\"kksr-stars-active\" style=\"width: 0px;\">\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n            <div class=\"kksr-star\" style=\"padding-right: 5px\">\n            \n\n<div class=\"kksr-icon\" style=\"width: 24px; height: 24px;\"><\/div>\n        <\/div>\n    <\/div>\n<\/div>\n                \n\n<div class=\"kksr-legend\" style=\"font-size: 19.2px;\">\n            <span class=\"kksr-muted\">Rate this post<\/span>\n    <\/div>\n    <\/div>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>How Operation Payback Hacked into Mastercard and PayPal Using DDOS in Defense of WikiLeaks Project<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[87,48],"tags":[369,366,763,363,370,365,371,367,368,766,364],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pLn90-89","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/posts\/505"}],"collection":[{"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/comments?post=505"}],"version-history":[{"count":0,"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/posts\/505\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/media?parent=505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/categories?post=505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techiewhizkid.com\/wp-json\/wp\/v2\/tags?post=505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}