Hack attack! Taking down criminal media sites

Just one example of many | Mid-to-late March '03 | Various Psuedonyms

[John Robinson]

"It's so easy, even a lefty can do it."

http://southafrica.indymedia.org/news/2003/03/3451.php

---

Download a copy of this webpage (address above) to your computer, unzip it, and click on index.htm to bring it up in your browser (you must be on line). No installation is required - it's an ordinary web page. This nice little gizmo will automatically do a search on CNN (or the White House and other sites) for "anti-war protest" and will repeat it every ten seconds.

This may not seem like much, but 3000 people with this page open in just one window would give them a million page views per hour.

---

[John Robinson]

Old news ...

http://www.securityfocus.com/news/3288

Web Sites Vandalized With Antiwar Messages
By Brian Krebs, Washington Post Mar 20 2003 2:57PM

A hacker group marred hundreds of Web sites with digital graffiti last night in an apparent response to the onset of the U.S.-led war against Iraq, prompting security experts to warn of further cyberattacks in the days to come.

Unix Security Guards, a pro-Islamic hacking group, defaced nearly 400 Web sites Wednesday evening with antiwar slogans written in Arabic and English, according to iDefense, a Reston, Va.-based Internet security firm.

More

[JoJo Gunn]

http://www.phillyimc.org/article.pl?sid=03/03/31/0636221

[JoJo Gunn]

http://cleveland.indymedia.org/front.php3?article_id=3954&group=webcast

[John Robinson]

Re: http://www.phillyimc.org/article.pl?sid=03/03/31/0636221

---

The electrohippies Iraq action continues. Check their website for details and protest tools you can use. Also check the WarTools site at http://www.kbiz.ca/wartools/ for another tool you can use in this and future online protests.

WarTools was recently launched and received over 2 million hits the first day. The following day brought a complaint from Free Republic (one of many sites on the WarTools "blacklist") that their server had received almost 12,000 search requests, or 25% of all searches that day.

---

True. And that was reportedly from just three searches. "Please check your information. Although we are indeed hosting a copy of WarTools on the KBiz site, I only see 3 searches of your site in the log."

If three "searches" can cause that much harm, imagine the damage hundreds could do.

For days I had been wondering why our search engine had been falling down. It seemed intermittent, like a sudden surge of traffic overwhelmed it. It occurred to me something like this might have been going down, so I did a little investigation. Was I surprised.

[JoJo Gunn]

I almost posted the link from Michigan's IMC, but that page was verbatim the ones from Cleveland and Philadelphia. I can keep going, but suspect most every IMC has this message posted.

(Have you actually seen this yet?)

http://www.kbiz.ca/wartools/

[John Robinson]

View source it. Yes. I have been in dialog.

[John Robinson]

Just a little background on this wartool:

The main window opens 16 hidden windows that, every ten seconds, each submit a request to a search engine of choice--maybe FR's search engine, all at the same time. [At least this was so a few days ago, the "tool" is being actively developed.] This is advertised to inflict "a hundred hits every minute" and with "3000 people with this page open in just one window" would inflict "a million page views per hour."

This belies the claims that it is used to "[k]eep tabs on corporate media coverage"--the windows are hidden, discarded after ten seconds, unused. "Increase the popularity of "peace", "anti-war" and "protest" as search words."--sure, if the website even bothers to compile such statistics--and if those statistics aren't immediately thrown out as completely bogus. "Give them a lot of hits" (closer to the truth) "This is great for their ratings if their servers can take it. " BINGO! It is a thinly disguised DDoS, plain and simple.

It's written for the masses "This web page is ordinary HTML and JavaScript and will work on your own computer or any website." Participation is encouraged "Download a copy of it (http://www.kbiz.ca/wartools/), unzip it, and click on index.htm to bring it up in your browser (you must be on line). No installation is required."

[JoJo Gunn]

I might have misunderstood what you said in #3, about posting links. Been looking at IMC's only so far. I checked Ontario, Nigeria, India, Melbourne, and it's all over the globe. But by now you figured that out, right?

[Dont Mention the War]

Is there any evidence whatsoever that Freepers have been spamming Indymedia in mass numbers? It's almost never even mentioned over here except as a joke; I see maybe one reference to them every two to three weeks. They make DU look vibrant and relevant by comparison. Don't we have to care before we would start wasting our time spamming them? The posters at Little Green Footballs are probably 100 times more active on Indymedia, both as readers and posters, than anyone on FR is. Just because you're right-wing (which, from the worldview of the average Indy twerp, includes such conservative luminaries as Hillary Clinton and Eric Alterman) doesn't mean you're a Freeper. F 'em if they can't tell the difference. I'm not going over there. At least DU gives me a laugh; the Indys are just weird, in a not-particularly-pleasant fashion.

[Dont Mention the War]

Visit the WarTools page to flood media search pages with words they are ignoring. Search requests are logged and analyzed. This is valuable data for assessing public response and it definitely gets their attention. WarTools will search news and other sites for you so you can see what they are reporting, or not. It will also let you repeat a search request up to 100 times every minute. Just leave the window open .

Yeah, the editors and producers of major news web sites have nothing better to do with their time than to ask the IT guys to give them daily breakdowns of the search terms plugged into their engines ... engines which are of such overwhleming importance to news sites that most of them barely work in the first place. ::rolling eyes:: What planet are these idiots on? Do they really think that some editor is going to say, "Wow, we got 5 million hits on the words "antiwar" and "protest" yesterday, even though we only served 1.5 million pages! We'd better go wall-to-wall antiwar 24/7!"

Oh, wait, I'm sorry, I just saw how overwhelming the response to WarTools has been:

Protest count: 59,190

Yup. Truly "making a difference," these guys are.

[Dont Mention the War]

As for the reference, I'm not sure if that attack (which was supposed to happen this weekend) ever came to fruition.

John, if we didn't notice it, and you didn't notice it, then it didn't happen, even if it did (if you know what I mean.) If their "mass attack" was all of five people, it's indistinguishable from random noise and should be given no more time and concern than random noise.

[John Robinson]

My fault, I wasn't clear. If you view source the kbiz.ca link and search for freerepublic you will see that we were in there, we were targetted, but I was (partially) successful in dialog with the author to have it removed. She still has freerepublic in the downloadable .zip file, and that issue has not yet been closed. Additionally, I HAVE taken steps to assure we're not abused by that tool any more. (If you're not planning on searching Free Republic for the next hour or so, reload our search page about a dozen times in quick succession.)

[John Robinson]

To be honest, by the traffic I have seen on the threads I have clicked, one Freeper a week posting one message would constitute spamming. Seriously, most of the threads seem pretty dead. A liberal ghosttown.

[Dont Mention the War]

"She?" Impressive, but apparently only book-smart, not street-smart. If you can track her down and have a dialogue with her, so can the lawyers at Microsoft, General Electric and AOL Time Warner, to say nothing of the FBI. Didn't the last person who successfully DDoSed CNN end up doing jail time?

[John Robinson]

If "Protest Count" is the same as "searches" in their opinion, then three "protests" gave us 12,000 hits. What's the math on 60,000 "protests"?

Thankfully Free Republic was not highly trafficked among their targets, mostly CNN, etc. The webmaster once published search statistics, but I didn't see the link last time I looked.

I completely agree with you on the benefit of such an endeavor, and in fact made note of that in my complaint, additionally stating that FreeRepublic compiles no such statistics.

[JoJo Gunn]

I admit I'm still learning the nuts and bolts of computing. I didn't see the Freep listed on the actual web page. As far as threads being empty, it's because they're all in jail???

[John Robinson]

I should disclaim that I don't yet have confirmation on exactly who the author is, the person I am in contact with has taken pains to not implicate herself with its creation (has neither denied nor confirmed authorship.) We'll call it an educated assumption right now.

[John Robinson]

Bump for the a.m. gang.

[thoughtomator]

It does appear that FR is diligent about not letting itself be used in this way. I am a regular reader here and I don't recall seeing any such thing, and whatever you linked to is gone now.