Twitter plays key role in DoS attacks in Iran

Social networking tools make it easier to mobilize cyber-attacks

The unrest in Iran is serving as a warning on how easy it is for individuals and groups to use a social networking tool like Twitter to mobilize a cyber-army against a political or commercial target anywhere in the world.

Over the past few days, news media reports have described how Twitter is being used by ordinary Iranians to receive and broadcast real-time information on the political unrest in the country after recent elections.

But a still developing and less benign use of Twitter in Iran has been its application in denial-of-service attacks against key government officials, including those affiliated with President Mahmoud Ahmedinejad.

Initially, the tweets directed users to online locations with links that users could click on to participate in a DoS attack against a particular Iranian Web site, said Richard Stiennon, founder of IT-Harvest, a Birmingham, Mich.-based consultancy.

A Google Doc circulating on the Web, for instance, lists several URLs pointing to Iranian Web sites listed by categories such as "Governmental and HARDLINE NEWS," "Police, Ministry of Interior," "Central Bank," "Commerce Banks" and "Office of Ahmadijenad and Khameneie." When a user clicks on any of the links, it initiates a continuous stream of page refresh requests to the targeted Web site that will eventually overcome the site if enough people click on the link.

More recently, tweets have begun circulating that allows users to achieve the same result by simply clicking on the embedded URL in the message. As soon as a user hits the page, as many as 24 frames open up simultaneously and refresh continuously, causing a DoS attack against the 24 separate Web sites Stiennon said.

"Once you click on what you see in Twitter, you immediately become part of the cyber-army," in Iran, he said.

Another tool that is available via Twitter is called bandwidth raep (bwraep), which is also a sort of DoS attack. This attack works by bombarding a Web server with fake requests to serve up content-heavy images.

Tweets are also circulating that offer information on where to find malware capable of initiating so-called Ping and Syn flood attacks, which are designed to overwhelm servers with an incessant flood of useless requests, Stiennon said.

A Cyberwar guide for Iran elections reposted on BoingBoing exhorts would-be cyber warriors to be careful about using Twitter to launch such DoS attacks.

"If you don't know what you are doing, stay out of this game," the guide writes while asking volunteers to only target sites that "legitimate Iranian bloggers" pinpoint. "Be aware that these attacks can have detrimental effects to the network the protesters are relying on. Keep monitoring their traffic to note when you should turn the taps on or off."

It's unclear how successful these attacks have been. However, the use of Twitter in this way represents a new and potentially disturbing way to mobilize people for a cyber attack, Stiennon said.

"After this experience, the general populace has learned how to participate in cyber civil unrest," he said. In the past, when hactivists have wanted to enlist volunteers to participate in cyber attacks, such as happened in the nation of Georgia, they have typically directed people to go to specific forums and download software tools needed to attack the target sites. Or, they have simply used previously infected PCs to launch automated distributed DoS attacks against target sites.

"Twitter represents a socialization of such attacks. It has a much broader reach than IRC channels and hacker discussion forums. It is a way to enlist cyber-volunteers very quickly and with very little effort," Stiennon said.

After seeing what's happening in Iran, it is not hard to see how similar attacks could be quickly mobilized against any political or business entity going forward, he said.

"It was interesting to see that proponents are inviting people to support their case over Twitter," by posting instructions on how to launch denial of service attacks against Iranian sites, said Bojan Zdrnja, a member of the SANS Internet Storm Center in a post earlier this week.

"It's clear that Twitter became increasingly interesting to hacktivists due to a large user base," Zdrnja wrote. But so far, the attacks appear to be "technically very, very simple" and relatively easy to mitigate.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags irantwitter

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?