DDos attack using Google Plus Servers

[CuraHack]

A security penetration tester at Italian security firm AIR Sicurezza Informatica has claimed that flaws exist in Google's servers that will allow would-be hackers to exploit the search giant's bandwidth and launch a distributed denial-of-service (DDoS) attack on a server of their choosing.

On the IHTeam Security Blog, Simone Quatrini, also known as R00T.ATI, demonstrates how users can make Google's servers act as a proxy to fetch content on their behalf. Quatrini has written a shell script that will repeatedly prompt Google's servers to make requests to a site of the attacker's choice, effectively using Google's bandwidth rather than their own. The advantage of using Google and make requests through their servers, is to be even more anonymous when you attack some site (TOR+This method); The funny thing is that apache will log Google IPs. But beware: gadgets/proxy? will send your ip in apache log, if you want to attack, you?ll need to use /_/sharebox/linkpreview/.

How does it work?
The vulnerable pages are ?/_/sharebox/linkpreview/? and ?gadgets/proxy??
Is possible to request any file type, and G+ will download and show all the content. So, if you parallelize so many requests, is possible to DDoS any site with Google bandwidth. Is also possible to start the attack without be logged in G+. If anything, Google will notice [attack attempts] and probably blacklist you.


Source: TheHackerNews.com

Scriptkiddies, watch out!

CuraHack Reviewed by CuraHack on 10th Dec 2011. DDos attack using Google Plus Servers http://3.bp.blogspot.com/_mm4GLe4Th4M/TFoUoClXGUI/AAAAAAAAAkg/UdIDVYf-k0s/1-twitter-dos-data.jpg A security penetration tester at Italian security firm AIR Sicurezza Informatica has claimed that flaws exist in Google's servers that will allow would-be hackers to exploit the search giant's bandwidth and launch a distributed denial-of-service (DDoS) attack on a server of their choosing. On the IHTeam Security Blog, Simone Quatrini, also known as R00T.ATI, demonstrates how users can Rating: 5

[trace]

Strange

[jokerhacker]

cool! but i have faith in google's engineers lol

[ShareShiz]

well this has been announced.. google probably has it blocked already. if not it will be blocked very soon.

still amazing news that stuff like this can be done.

[jayfella]

old news. it has been patched.

[-Im.z2ight-]

Patched by now.

[Loonycgb2]

hehe i leaked the hack here on KWWHunction when a couple of figured it out... Not many people believed me about it i even posted the hack

[nirmalpattara]

LOL this was on other forums before u posted this.

[Loonycgb2]

how? i was one out of 3 who found the exploit :/

[nirmalpattara]

LOL last post 9/4, here it is posted just 1 week before.