Free Dirt Dozer Scanner Defeats $150 Dirt Jumper DDoS Toolkit

happygeek 1 530 Views

You might not have heard about Dirt Jumper yet, but the bad guys have. In fact, the high-risk and highly-effective DDoS toolkit is probably the most aggressive of the malware tools being employed by DDoS attackers at the moment, and the situation is set to get much worse very quickly as versions of Dirt Jumper are now appearing for sale at underground Web marketplaces for as little as $150 a time.

Prolexic Technologies, which specialises in Distributed Denial of Service (DDoS) mitigation services, has today issued an in-depth threat advisory for Dirt Jumper together with a custom-developed scanning tool that can be used to detect Dirt Jumper command and control servers. Neal Quinn, vice president of operations at Prolexic, warns that his company is "seeing this tool used against clients worldwide and it is likely to become more widespread and effective as distribution spreads."

The Prolexic Security Engineering and Response Team (PLXSERT) has certified the toolkit as a high-risk threat following extensive analysis of Dirt Jumper v3. The newest variant, Dirt Jumper September, which comes with an enhanced control panel making it even easier for attackers to use, has been painstakingly analysed and the threat advisory itself includes full details of the payload as well as a detailed breakdown of attack signatures by attack type.

Most interestingly though, PLXSERT has developed a custom tool to scan for suspected HTTP command and control servers utilizing Dirt Jumper strains. Dirt Dozer is being released as a free public service in order to enable any organisation to protect itself from this nasty little bit of malware and can be downloaded here .

dirtdozer.jpg 30.43 KB

Dani AI

Generated

Short update and practical guidance for ’s post: Dirt Jumper was a commercially sold DDoS toolkit (a successor to the Russkill family) that was widely used in 2011–2012 and prompted a Prolexic (PLXSERT) advisory and a free detection script called Dirt Dozer (dirtdozer.py). It was observed in real attacks (including high-profile incidents) and is known to include HTTP flood modes that rotate Referer and User‑Agent strings to evade simple filtering. [DarkReading coverage of the advisory] (https://www.darkreading.com/vulnerabilities-threats/prolexic-issues-dirt-jumper-threat-advisory-and-releases-free-security-scanner). (darkreading.com)

A few practical notes about the scanner itself: Prolexic published the scanner when Dirt Jumper was active, but Prolexic later became part of Akamai (acquisition closed in early 2014) so original pages and follow‑ups have moved into Akamai/Prolexic channels or archives. Treat any third‑party copy you find as unmaintained until you can verify its origin. [Akamai announcement about Prolexic] (https://www.prnewswire.com/news-releases/akamai-publishes-prolexic-q1-2014-global-ddos-attack-report-255616961.html). (prnewswire.com)

To address ’s concern about crashing an OS: never run unreviewed scripts on your primary host. Recommended quick workflow before executing: 1) fetch the script into an isolated VM/sandbox; 2) inspect it (search for obvious dangerous calls); 3) run static checks. Example quick checks you can run locally (on a disposable analysis VM) are:

grep -nE "exec|eval|os\\.system|subprocess|socket|urllib" dirtdozer.py
python3 -m pip install bandit && bandit -r dirtdozer.py

Follow NIST guidance for malware/sample handling: use isolated, non‑persistent VMs and avoid uploading sensitive samples to public services unless appropriate. ()

If the goal is detection rather than running the tool, hunt for behavior: spikes of HTTP GET/POST floods, rapid rotation of Referer/User‑Agent, unusual request patterns and many short‑lived TCP connections; correlate with passive DNS/Netflow and your IDS/HTTP logs. If a suspected C2 or compromised host is found, isolate and work with your DDoS mitigation or incident‑response provider rather than running potentially aggressive scans from production networks. (secureworks.com)

Member Avatar for Member #949455
Member #949455

Dirt Dozer is being released as a free public service in order to enable any organisation to protect itself from this nasty little bit of malware and can be downloaded here .

Nice article. Thanks for sharing! I will try it out (I'm a bit cautious) but it shouldn't crash my OS.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview