document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2025-01-25 23:11:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

translated

Browse Source
This commit is contained in:
Kenneth Hawk 2017-04-14 10:50:01 +08:00
parent a85a07ca15
commit 0ac03f092e
1 changed files with 17 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
sources/talk/20170315 Hire a DDoS service to take down your enemies.md
View File

@ -1,68 +1,54 @@
translating by [kenxx](https://github.com/kenxx)
Hire a DDoS service to take down your enemies
雇个 `DDoS` 服务干掉你的对手
========================
>With the rampant availability of IoT devices, cybercriminals offer denial of service attacks to take advantage of password problems.
>随着物联网设备的普及，网络犯罪分子提供拒绝服务攻击来占密码问题的便宜。
![](http://images.techhive.com/images/article/2016/12/7606416730_e659cea89c_o-100698667-large.jpg)
With the onrush of connected internet of things (IoT) devices, distributed denial-of-service attacks are becoming a dangerous trend. Similar to what happened to [DNS service provider Dyn last fall][3], anyone and everyone is in the crosshairs. The idea of using unprotected IoT devices as a way to bombard networks is gaining momentum.
随物联网设备飞速发展，分布式拒绝服务攻击也变得越来越具有危险性了。就如 [DNS 服务商 Dyn 上年秋季之遭遇][3] 一样，黑客似乎瞄上了每个人，使用未受保护的物联网设备来轰炸网络正迎面而来。
The advent of DDoS-for-hire services means that even the least tech-savvy individual can exact  revenge on some website. Step on up to the counter and purchase a stresser that can systemically take down a company.
可雇用的分布式拒绝服务攻击的出现意味着每个会点技术的人都能精准报复一些网站。加大攻击能力甚至可以从系统级别的让一个公司完蛋。
According to [Neustar][4], almost three quarters of all global brands, organizations and companies have been victims of a DDoS attack. And more than 3,700 [DDoS attacks occur each day][5].
根据 [Neustar][4] 的报告，全球四分之三的品牌、组织和公司都是 `DDos` 攻击的受害者。[每天 `DDoS` 攻击发生次数][5] 不少于 3700 次。
#### [■ RELATED: How can you detect a fake ransom letter?][1]
#### [■ 相关阅读：如何判断假绑架信？][1]
Chase Cunningham, director of cyber operations at A10 Networks, said to find IoT-enabled devices, all you have to do is go on an underground site and ask around for the Mirai scanner code. Once you have that you can scan for anything talking to the internet that can be used for that type of attack.
 睿科网络公司（A10 Networks）网络运营总监 Chase Cunningham 说：“想要找个可用的物联网设备，你只需要在地下网站找一个 `Mirai` 扫描器，一旦你得到了这款扫描器，你将能够利用在线的每一台设备来进行攻击”。
“Or you can go to a site like Shodan and craft a couple of simple queries to look for device specific requests. Once you get that information you just go to your DDoS for hire tool and change the configuration to point at the right target and use the right type of traffic emulator and bingo, nuke whatever you like,” he said.
或者你可以去一些类似 `Shodan` 的网站然后简单的搜一下设备特殊请求，
“或者你可以去一些类似 `Shodan` 的网站，然后简单的搜一下特殊设备的请求。当你得到这些信息之后，你就可以将你的雇佣的 `DDoS` 工具配置正确的流量模拟器类型、指向正确的目标并发动攻击。”
“Basically everything is for sale," he added. "You can buy a 'stresser', which is just a simple botnet type offering that will allow anyone who knows how to click the start button access to a functional DDoS botnet.”
“几乎所有东西都是可售的。”他补充道，“你可以购买一个‘stresser’，这就是个随便哪个会点按钮的人都会使用的 `DDoS` 功能的僵尸网络。”
>Once you get that information you just go to your DDoS for hire tool and change the configuration to point at the right target and use the right type of traffic emulator and bingo, nuke whatever you like.
>当你得到这些信息之后，你就可以将你的雇佣的 `DDoS` 工具配置正确的流量模拟器类型、指向正确的目标并发动攻击。
>Chase Cunningham, A10 director of cyber operations
>Chase Cunningham，睿科网络公司（A10 Networks）网络运营总监
Cybersecurity vendor Imperva says for just a few dozen dollars, users can quickly get an attack up and running. The company writes on its website that these kits contain the bot payload and the CnC (command and control) files. Using these, aspiring bot masters (a.k.a. herders) can start distributing malware, infecting devices through a use of spam email, vulnerability scanners, brute force attacks and more.
网络安全提供商 Imperva 说，用户只需要出几十元美金，就可以快速发动攻击。有些公司编写了一些工具包含了肉鸡负载和 `CnC`（命令与控制）文件。使用这些工具，那些有点想法的肉鸡大师（或者说 `herders`）就可以开始通过垃圾邮件来传播使设备感染恶意软件、漏洞扫描程序、暴力攻击等等。
大部分 [stressers and booters][6] 都会有一个常见的、基于订阅的 `SaaS`（软件即服务）业务模式。来自 Incapsula 公司的 [Q2 2015 DDoS 报告][7] 显示，一个月范围内平均每小时就会有38美元（规模较低的在19.99美元）花在购买 `DDoS` 服务上。
Most [stressers and booters][6] have embraced a commonplace SaaS (software as a service) business model, based on subscriptions. As the Incapsula [Q2 2015 DDoS report][7] has shown, the average one hour/month DDoS package will cost $38 (with $19.99 at the lower end of the scale).
![雇佣ddos服务](http://images.techhive.com/images/article/2017/03/ddos-hire-100713247-large.jpg)
![ddos hire](http://images.techhive.com/images/article/2017/03/ddos-hire-100713247-large.jpg)
“`Stresser` 和 `booter` 只是一个新型现实的副产品，这些可以扳倒企业和组织的服务只被允许运作在灰色领域”，Imperva 写道。
“Stresser and booter services are just a byproduct of a new reality, where services that can bring down businesses and organizations are allowed to operate in a dubious grey area,” Imperva wrote.
虽然成本不同，但是企业受到 [攻击可在任何地方，每次损失在 1.4 万美元到 235 万美元][8]。然而企业受到一次攻击后，[有 82% 的可能性会再次受到攻击][9]。
While cost varies, [attacks can run businesses anywhere from $14,000 to $2.35 million per incident][8]. And once a business is attacked, there’s an [82 percent chance they’ll be attacked again][9].
物联网洪水攻击（DoT, DDoS of Things）使用物联网设备建立僵尸网络可造成非常大规模的 `DDoS` 攻击。物联网洪水攻击会利用成百上千的物联网设备造成杠杆来攻击大型服务提供商。
DDoS of Things (DoT) use IoT devices to build botnets that create large DDoS attacks. The DoT attacks have leveraged hundreds of thousands of IoT devices to attack anything from large service providers to enterprises. 
“大部分可信的 `DDoS` 卖家都会将他们的工具的配置设置的很简单，这样你就可以简单的更换配置开始攻击。虽然我还没怎么看到有哪些可以‘付费’物联网流量模拟器的选项，但我敢肯定准备要有了。如果是我来搞这个服务，我是绝对会加入这个选项的。”Cunningham 如是说。
“Most of the reputable DDoS sellers have changeable configurations for their tool sets so you can easily set the type of attack you want to take place. I haven’t seen many yet that specifically include the option to ‘purchase’ an IoT-specific traffic emulator but I’m sure it’s coming. If it were me running the service I would definitely have that as an option,” Cunningham said.
由 IDG 新闻服务的故事我们可知，要建造一个攻击服务的 `DDoS` 服务也可以很简单。通常黑客会租用 6 到 12 个左右的服务器，然后使用他们随意的攻击任何目标。十月下旬，HackForums.net [关闭][10]了他们的”服务器压力测试“部分，此次做法就是考虑到黑客可能通过使用他们十美元每月的服务建造可雇佣的 `DDoS` 服务。
According to an IDG News Service story, building a DDoS-for-service can also be easy. Often the hackers will rent six to 12 servers, and use them to push out internet traffic to whatever target. In late October, HackForums.net [shut down][10] its "Server Stress Testing" section, amid concerns that hackers were peddling DDoS-for-hire services through the site for as little as $10 a month.
同样地在十二月时，美国和欧洲的执法机构 [逮捕][11] 34个参与可雇佣的 `DDoS` 服务的嫌犯。
Also in December, law enforcement agencies in the U.S. and Europe [arrested][11] 34 suspects involved in DDoS-for-hire services.
如果这很简单，怎么还没有经常发生攻击？
If it is so easy to do so, why don’t these attacks happen more often?  
Cunningham 说这其实每时每刻都在发生，实际上每天每秒没完没了。他说：”你不知道的原因是因为大部分的都是扰乱攻击，而不是大规模的、想要搞倒公司的攻击。“
Cunningham said that these attacks do happen all the time, in fact they happen every second of the day. “You just don’t hear about it because a lot of these are more nuisance attacks than big time bring down the house DDoS type events,” he said.
他说，大部分的攻击平台只出售那些会让系统宕机一个小时或就长一点点的攻击。通常宕机一小时的攻击大概需要15到50美元的成本。当然这得看平台，有些可能想让其一小时就要花上百美元。
Also a lot of the attack platforms being sold only take systems down for an hour or a bit longer. Usually an hour-long attack on a site will cost anywhere from $15 to $50\. It depends, though, sometimes for better attack platforms it can hundreds of dollars an hour, he said.
The solution to cutting down on these attacks involves users resetting factory preset passwords on anything connected to the internet. Change the default password settings and disable things that you really don’t need.
减少这些攻击的解决方案是让用户把所有联网设备的恢复出厂设置的预设密码改掉，改掉默认密码然后还要禁用那些你不需要的功能。
--------------------------------------------------------------------------------