TL;DR
Low Orbit Ion Cannon (LOIC) is a freely available stress-testing tool that hacktivists frequently weaponize to launch distributed denial-of-service (DDoS) attacks — flooding servers with traffic until they go offline. Unlike typical cybercriminals, LOIC attackers rarely seek ransom or data theft; their goal is disruption for political or social reasons. Defending against LOIC attacks involves deploying a robust firewall, monitoring server logs for suspicious IP addresses, and severing malicious connections. Because LOIC does not support proxies, attacker IPs are visible and reportable to authorities.
Understanding LOIC: Attack mechanics and defense strategies
Low orbit ion cannon (LOIC) is an open-source program anyone can download and use to stress test a website or app. But that same tool can be used to enact a distributed denial of service (DDoS) attack.
Hackers using LOIC rarely ask for a payment or ransom. And they can't use the tool to steal any information. In most cases, LOIC is used by so-called "hacktivists" that hope to make you pay attention and change some policy or stance.
But an attack like this can be devastating, as a downed website simply can't serve your customers.
Let's walk through what an attack looks like, and we'll explain how you can protect yourself.
How does an ion cannon DDoS work?
During an LOIC attack, a hacker bombards your server with User Datagram Protocol (UDP), Transmission Control Protocol (TCP), or Hypertext Transfer Protocol (HTTP) packets. Connections stay open, and eventually, your server can't handle all of the demands.
Individuals can launch attacks from one server, but their influence is limited. But when several people join together, they're much more powerful, and their work can be catastrophic for your site.
What are some real-world examples of LOIC attacks?
LOIC has been used in several devastating attacks. In 2010, for example, hackers targeted a corporate site that stopped supporting Wikileaks. Hackers also attacked Recording Industry Association of America (RIAA) in 2010 as a protest against copyright laws.
How can you protect yourself from LOIC attacks?
- Deploy a robust firewall: A well-designed firewall should protect you from most LOIC attacks. You can also use LOIC itself to stress-test your own setup and measure how long your server withstands sustained pressure.
- Monitor logs and block suspicious IPs: Hacktivists rarely shield their IP addresses, and LOIC does not support proxies, making attacker IPs easy to identify. Review your server logs regularly and sever connections from flagged addresses.
- Report attacks to authorities: Using LOIC against someone else's server is illegal under federal law. If you come under attack, report the incident so investigators can identify and prosecute the responsible parties.
Get the best protection available
Strong security measures can protect your servers from hacktivists, thieves, and other dangers. At Okta, we've built some of the strongest protections available in the market today, and we'd love to help you. Learn more about how these products work and how you can implement them today.
Frequently asked questions
What is Low Orbit Ion Cannon (LOIC) and what is it used for?
LOIC is an open-source network stress-testing tool that anyone can download freely. While it has legitimate uses for testing a server's resilience under load, it is frequently misused by hacktivists to launch distributed denial-of-service (DDoS) attacks that overwhelm a target's server with traffic until it goes offline.
What types of traffic does an LOIC attack use?
An LOIC attack floods a target server with User Datagram Protocol (UDP), Transmission Control Protocol (TCP), or Hypertext Transfer Protocol (HTTP) packets. These connections remain open, consuming server resources until the server can no longer respond to legitimate requests.
Why do hacktivists use LOIC instead of other attack tools?
Hacktivists typically use LOIC because their goal is disruption and public attention rather than financial gain or data theft. They want to force organizations to acknowledge a political or social stance, and a downed website achieves that visibility without requiring the complexity of other attack methods.
Can LOIC attackers hide their identity?
Generally, no. LOIC does not support proxy connections, which means an attacker's IP address is visible in server logs. Additionally, many hacktivists deliberately avoid masking their identity because they view their actions as a form of justified protest.
Is it legal to use LOIC?
Using LOIC to stress-test your own servers is legal. However, using it to attack another person's or organization's server is a federal crime under U.S. law. Victims of LOIC attacks are encouraged to report incidents to law enforcement for investigation and prosecution.
What is the most effective way to defend against an LOIC attack?
A well-configured firewall is the primary line of defense against LOIC attacks. Organizations should also actively monitor server logs to identify and block suspicious IP addresses. Because LOIC exposes attacker IPs, severing those connections quickly can limit the damage of an ongoing attack.
References
- Hacking for a Cause. (July 2005). First Monday.
- The Aussie who Blitzed Visa, MasterCard, and PayPal With the Low Orbit Ion Cannon. (December 2010). The Age.
- Anonymous Wikileaks Supporters Explain Web Attacks. (December 2010). BBC News.
- Anonymous DDoS Attack Takes Down RIAA Site. (October 2010). PC Magazine.
- For Suspected Hackers, a Sense of Social Protest. (July 2011). The New York Times.
- 18 U.S. Code 1030: Fraud and Related Activity in Connection with Computers. Cornell Law School.
