136
Hal Roberts, Ethan Zuckerman, and John Palfrey
The diffi culty of diagnosing (and defending against) these attacks is further complicated by the large set of actors, many of whose precise roles are unclear. For example,
the attacks on http://bauxitevietnam.info may have involved the following:
• Attackers A set of attackers, which may or may not have included the Vietnamese
and Chinese governments, whose precise identity is unknown and who are responsible
for a number of DDoS attacks, intrusions, and forgeries; the hundreds or thousands
of compromised computers used to attack http://bauxitevietnam.info , most likely
without knowledge of their owners.
• Defenders The administrators of bauxitevietnam.info, and administrators of the
hosting services and Internet service providers (ISPs) they use.
• Affected third parties The Vietnamese Professionals Society (which inadvertently
distributed malware), McAfee (which detected the attack), and Google (responsible for
both investigating the DDoS attack and defending against the attacks via Blogger).
The use of malware particularly complicates this type of analysis. Researchers
usually consider malware the province of commercial actors who compromise computers to participate in schemes designed for fi nancial gain. This type of example demonstrates how malware is now playing a major role in how political actors seek to
constrain Internet users both within and beyond their borders.
8 These interconnected
controls make diagnosing DDoS attacks an enormous challenge in many cases simply
because it is diffi cult to understand the full array of methods used with the attacks as
well as who is executing those methods. In this case, it is likely that some of the
computers that attacked bauxitevietnam.info were owned by individuals who supported the goals of the organization. This possibility, in turn, made the attack even
harder to block because distinguishing between legitimate and attack traffi c was
impossible to do on an IP basis.
Finally, this example demonstrates what relatively sophisticated activists can do to
defend themselves from DDoS attacks. A common strategy is to diversify hosting and,
especially, to fl ee to large blog hosts, often based in the United States, for cover. While
simple to understand and implement, the strategy is extremely effective, allowing the
activists behind bauxitevietnam.info to maintain an online presence in the face of a
sustained attack without paying for a fee-based DDoS-protection service, the most
effective of which start at thousands of dollars per month.
DDoS and Other Next-Generation Control Measures
This chapter is a deep dive into the growing phenomenon of DDoS attacks. We seek
to describe the state of DDoS attacks in the context of the interconnected contests to
control online content. Our central goal is to situate the phenomenon of DDoS attacks
within the theoretical framework developed in OpenNet Initiative (ONI) research. In
Hal Roberts, Ethan Zuckerman, and John Palfrey
The diffi culty of diagnosing (and defending against) these attacks is further complicated by the large set of actors, many of whose precise roles are unclear. For example,
the attacks on http://bauxitevietnam.info may have involved the following:
• Attackers A set of attackers, which may or may not have included the Vietnamese
and Chinese governments, whose precise identity is unknown and who are responsible
for a number of DDoS attacks, intrusions, and forgeries; the hundreds or thousands
of compromised computers used to attack http://bauxitevietnam.info , most likely
without knowledge of their owners.
• Defenders The administrators of bauxitevietnam.info, and administrators of the
hosting services and Internet service providers (ISPs) they use.
• Affected third parties The Vietnamese Professionals Society (which inadvertently
distributed malware), McAfee (which detected the attack), and Google (responsible for
both investigating the DDoS attack and defending against the attacks via Blogger).
The use of malware particularly complicates this type of analysis. Researchers
usually consider malware the province of commercial actors who compromise computers to participate in schemes designed for fi nancial gain. This type of example demonstrates how malware is now playing a major role in how political actors seek to
constrain Internet users both within and beyond their borders.
8 These interconnected
controls make diagnosing DDoS attacks an enormous challenge in many cases simply
because it is diffi cult to understand the full array of methods used with the attacks as
well as who is executing those methods. In this case, it is likely that some of the
computers that attacked bauxitevietnam.info were owned by individuals who supported the goals of the organization. This possibility, in turn, made the attack even
harder to block because distinguishing between legitimate and attack traffi c was
impossible to do on an IP basis.
Finally, this example demonstrates what relatively sophisticated activists can do to
defend themselves from DDoS attacks. A common strategy is to diversify hosting and,
especially, to fl ee to large blog hosts, often based in the United States, for cover. While
simple to understand and implement, the strategy is extremely effective, allowing the
activists behind bauxitevietnam.info to maintain an online presence in the face of a
sustained attack without paying for a fee-based DDoS-protection service, the most
effective of which start at thousands of dollars per month.
DDoS and Other Next-Generation Control Measures
This chapter is a deep dive into the growing phenomenon of DDoS attacks. We seek
to describe the state of DDoS attacks in the context of the interconnected contests to
control online content. Our central goal is to situate the phenomenon of DDoS attacks
within the theoretical framework developed in OpenNet Initiative (ONI) research. In