Aside from the 'that's not layer 4' point that's already been made, I feel obligated to point out that if you were advised to 'privately disclose to some big players', the NANOG list is pretty much the exact opposite of that. This is a very public list. My paranoid brain doesn't want to completely discount you ; but the onus is on you to provide proof. Are you willing to send me the details to this address if you're not willing to provide any specifics to the list? On Thu, Dec 22, 2016 at 8:27 AM, Jean | ddostest.me <jean@ddostest.me> wrote:
I apologize for my previous email.
After a second thought it might sound like it's a booter even though I want to offer something else.
I don't want the conversation shifting toward business when we talk about a new DDoS technique that operate at Layer 3 with amplification power x100. I disabled the "booter" service and will review this offline with my lawyer. Thanks for pointing this out.
Now back to this new DDoS technique. If it can amplify at Layer 3, it could potentially be use in conjunction with the already known Layer 4 amp DDoS like dns, ntp, ssdp, snmp, etc. It doesn't need to be use in conjunction but it could.
Like mentioned earlier, it doesn't need spoofing so any device could be part of it.
Google already acknowledged through their vulnerability program that there is something interesting there and they are still assessing the risk/impact. They suggested me to start privately disclose this with some big players. I thought NANOG would be a good start. I guess they also need time and maybe partners to test and validate all this data.
Cert-CC is also aware and they are also working out something on their side.
I am in good faith here and time is not against us. I discover something new that I want to share properly and I am not here to make business.
Sincerely, Jean St-Laurent
On 16-12-22 08:21 AM, Tom Beecher wrote:
You're claiming to be able to generate more than 10 times as much traffic as the largest DDoS ever seen in the wild whilst 3 months into a position at a company that sells 'self-DDoS' services for testing purposes.
In that absence of anything more than 'GUYZ THIS IS SERIOUS' , with no technical details, you can surely understand the skepticism.
On Thu, Dec 22, 2016 at 5:45 AM, Jean | ddostest.me via NANOG < nanog@nanog.org> wrote:
I admit that I have a lot of guts.
Not sure who said that I am a booter or that I operate a booter. I fight booter since more than 5 years and who would be stupid enough to put his full name with full address to a respected network operators list? Definitely not me.
I want to help and fix things and I am not the kind of person to break things.
Jean
On 16-12-22 03:46 AM, j.j.santanna@utwente.nl wrote:
Hi Jean,
You are either naive or have a lot of guts to offer a Booter service in one of the most respected network operators list. Man, as long as you use amplifiers (third party services) or botnets your “service” is illegal & immoral. In case you use your own infrastructure or rent a legal (cloud) infrastructure to provide your "service" it will not pay your costs. Not at least by the price that you offer your service: 0, 13, 100 bucks. Even if you have a legal/moral acceptable attack infrastructure, if you throw those big attacks that you advertise will possibly take down many others third-parties on the way.
Sometimes you folks say that (mis)use amplifiers for “testing” purpose is not a problem because those services are open and publicly available on the Internet. Come on… if I leave my car open with the key inside it doesn’t give you the right to use my car to throw into a third party company. And if you do, it is YOUR CRIME, not mine.
I don’t need to explain why using botnets is illegal and immoral, right?
Man, it is up to you decide between cyber crime and cyber security ( https://www.europol.europa.eu/activities-services/public-aw areness-and-prevention-guides/cyber-crime-vs-cyber-security- what-will-you-choose). Now, we are also looking to you on http://booterblacklist.com<http://booterblacklist.com/>. Thanks!
Cheers,
Jair Santanna
On 22 Dec 2016, at 07:51, Alexander Lyamin <la@qrator.net<mailto: la@qrato r.net>> wrote:
I am just trying to grasp what is similarity between networks on the list and why it doesn't include, say NTT or Cogent.
On Wed, Dec 21, 2016 at 7:05 PM, Jean | ddostest.me<http://ddostest.me/
via NANOG < nanog@nanog.org<mailto:nanog@nanog.org>> wrote:
Hello all, I'm a first time poster here and hope to follow all rules.
I found a new way to amplify traffic that would generate really high volume of traffic.+10Tbps
** There is no need for spoofing ** so any device in the world could initiate a really big attack or be part of an attack.
We talk about an amplification factor x100+. This mean that a single computer with 1 Gbps outgoing bandwidth would generate a 100 Gbps DDoS. Imagine what a botnet could do?
The list of affected business is huge and I would like to privately disclose the details to the Tier1 ISP as they are highly vulnerable.
XO Comm PSINET Level 3 Qwest Windstream Comm Eearthlink MCI Comm/Verizon Buss Comcast Cable Comm AT&T Sprint
I know it's Christmas time and there is no rush in disclosing this but, it could be a nice opportunity to meditate and shed some lights on this new DDoS threat. We could start the real work in January.
If you are curious and you operate/manage one of the network mentioned above, please write to me at tornaddos@ddostest.me<mailto:t ornaddos@ddostest.me> from your job email to confirm the identity. I will then forward you the DDoS details.
Best regards
Jean St-Laurent ddostest.me<http://ddostest.me/> 365 boul. Sir-Wilfrid-Laurier #202 Beloeil, QC J3G 4T2
--
Alexander Lyamin
CEO | Qrator <http://qrator.net/>* Labs*
office: 8-800-3333-LAB (522)
mob: +7-916-9086122
skype: melanor9
mailto: la@qrator.net<mailto:la@qrator.net>