Popular Dirt Jumper DDoS toolkit riddled with security flaws, research finds

The criminal creators of the hugely popular Dirt Jumper DDoS toolkit appear to have been sloppy with their own security, introducing software vulnerabilities that leave the software’s command and control (C&C) servers open to attack, security firm Prolexic has discovered.

Overwhelmingly, the business of DDoS defence is usually about blocking attacks once they start, or finding a conventional route to access the C&C servers on a case-by-case basis, so Prolexic’s discovery of flaws in the code itself counts as noteworthy.

Despite Dirt Jumper’s well-developed attack features, Prolexic found holes in the simplest part of the program, namely the GUI control panels used to control bots created by it which turned out to be cobbled together using hastily-coded PHP/MySQL scripts.

In Prolexic’s words, these proved open to compromise on a number of levels including “weak authentication mechanisms, file inclusion vulnerabilities, directory traversal vulnerabilities, and SQL injections.”

Irony of ironies; a criminal toolkit open to a SQL injection flaw in the front end used to control a botnet. Anyone gaining access to the C&C would be able to control what the DDoS software is doing, right down to the bots it controls and its target list. Game over, potentially.

“DDoS attackers take pride in finding and exploiting weaknesses in the architecture and code of their targets. With this vulnerability report, we’ve turned the tables and exposed crucial weaknesses in their own tools,” said Prolexic’s CEO, Scott Hammack.

“With this information, it is possible to access the C&C server and stop the attack,” Hammack said. “Part of our mission is to clean up the Internet. It is our duty to share this vulnerability with the security community at large.”

Importantly, the flaws found by the company affect all versions of the toolkit, which traces its lineage back as far as 2008, including a recent, multi-capable version called ‘Pandora’.

Dirt Jumper seems to have overtaken rivals to become one of the most successful DDoS toolkits available on the Russian underground. Nobody knows why this has happened – rivals such as Black Energy and Optima had dominated before its appearance – but it could be down to its features or lively development.

Can attacks be stymied with this new knowledge? Prolexic said it had stopped a small but crafted 27 July Pandora DDoS on the website of security journalist Brian Krebs, which represents a start.

In theory the developers could fix the vulnerabilities spotted by Prolexic and come up with a version immune to interception. That remains a danger but because the source code was made available for Dirt Jumper and the number of different versions that exist, doing that for all of its bots built with it would be a major task at least in the short term.

It may not last but at least researchers can finally say that DDoS has one bad day.