8 ms·

Empty DDoS Threats: Meet the Armada Collective

65 points by shade23 10y ago

deleted 10y ago
[deleted]
cft 10y ago
Cloudflare publishes these marketing articles, spinning them as "helpful" for the community. The biggest community help Cloudflare could provide is kicking booters [1] from their network. They won't however, since it needs to protect the booters for Cloudflare's business to prosper. 1. http://whois.domaintools.com/booter.xyz http://whois.domaintools.com/booter.xyz (Repeat this whois search for the top 10 booters found in Google)
- rmdoss 10y ago
  It is a business decision for them. If they kick the booters off, they will DDoS each other to death and no one will be able to use the booters anymore. You may not agree, but financially makes sense for them. They need the booters to be alive to sell their service. -->not saying I agree at all with that mindset
  - prymitive 10y ago
    > They need the booters to be alive to sell their service. Well, I think this blog post clearly demonstrate that people are willing to pay for DDoS protection even without any attacks. This is pretty much a conspiracy theory way of thinking.
    - totall 10y ago
      But paying customers of Cloudflare think otherwise.
      - prymitive 10y ago
        Did you run any study to claim you know why are they buying those services? Security is not a one time purchase when someone is threatening you.
- gist 10y ago
  > publishes these marketing articles What's funny is that it's obvious to anyone who would received an email like this is that it's spam to be ignored. What makes an email like this any more believable than anything you get unsolicited by email making any claims or demand? The fact that it is mentioning DDOS instead Nigerian money? I am surprised that cloudflare feels the need to even write this up and the fact they they take it seriously is only mitigated by the marketing angle (which makes them smart instead of naive I guess).
  - NegatioN 10y ago
    Well, these mails are almost an exact copy of the ones the real armada collective sent out last year though? It would make sense to be wary of them if you heard about attacks carried out by them. The question is, what should a small enterprise without protection against ddos do? Of course it's wiser to actually implement said protection, but it's a lot easier for the human mind to jump to the short-term and easy solution.
    - gist 10y ago
      Well now if you were going to pull a scheme like that for real (and not just spray and pray 10,000 sites hoping a few would pay) wouldn't it makes sense to give the site at least a taste of what you can do for a short period of time? And do you honestly think that it's good business practice when receiving an email like that to just assume it's truthful and you need to swing into some kind of fire drill? I don't.
      - NegatioN 10y ago
        No, I never said I thought it was good business practice. But I'm saying it's not good business practice to ignore it. If you can afford to ignore it, then there's no issue, but there's plenty of sites that don't have protection against this, and have money on the line if they get taken down. The cost of paying off (a semi-probable) attack, might be better than going down the next day, and having to firefight it. I'm playing the devil's advocate here. I would not pay x thousand dollars because of an email from said group, but I can understand it slightly better than sending money for nigerian scams.
- buro9 10y ago
  I work for CloudFlare, just an engineer and not a lawyer, etc. This is my opinion but I recognise I work here and am a dumb person from a legal perspective. One of the things that CloudFlare cares about is due process. That has been blogged about too: https://blog.cloudflare.com/fighting-back-responsibly/ https://blog.cloudflare.com/fighting-back-responsibly/ If CloudFlare were to subjectively decide to remove websites or DNS zones, due process goes out of the window as we'd be able to just do whatever we pleased to whomever. We (collective HN readers, etc) cannot wish to restrict and prevent overreach if we indulge in the very same action by subjectively removing/blocking access. Either a company follows due process, or it does not. Due process is extremely valuable to a society, relying on a transparent system that has an appeals process should be important to everyone... the legal system gives this, and it's value is so great to society in restricting overreach, that as individuals and as the wider company we have embraced due process, and rejected the things that would weaken it... our own actions. If you wish to have booters or whomever else removed, please present our legal team with a valid legal request.
  - cft 10y ago
    Indeed, it is the purpose of a court to follow due process, but not of a private entity. From CloudFlare's business standpoint, your decision makers should seriously weigh the reputation damage that this (perfectly legal) "willful negligence" attitude provides: a marketing director of your competitor pointed out that "CouldFlare is protecting most booters" in a phone call with me.
    - stcredzero 10y ago
      Indeed, it is the purpose of a court to follow due process, but not of a private entity. Laws and courts constitute a minimum or a "floor" standard for civic and commercial behavior. A society that has due process in its laws and on its books, but whose civic and commercial institutions all exhibit draconian knee-jerk behaviors is succeeding at being benevolent and just to the same extent that the Jim Crow south enfranchised black people. The comparison is unpleasant, but it is operationally correct. Laws on the books are only a skeleton. Values and principles have to be enacted by the flesh of civic and commercial society to be meaningful to people. The values embodied by the laws on the books have also to be alive in civic society, or else they are not truly meaningful. It's not enough for only the government and courts to embody humanist and democratic values. Civic and commercial society has to embody them too. (Ask yourself, are you a part of civic and commercial institutions and intellectual movements that embody humanist and democratic values? Or are they authoritarian and withhold justice and free speech from those the group deems "unworthy?")
- mootothemax 10y ago
  >Cloudflare publishes these marketing articles, spinning them as "helpful" for the community. The biggest community help Cloudflare could provide is kicking booters [1] from their network. They won't however, since it needs to protect the booters for Cloudflare's business to prosper. Why do you get to decide who should and shouldn't get kicked off a given company's platform? I mean, I positively detest Uber and am convinced they're making the world a worse place. Can I now hound everyone involved with their online presence? And then claim the only reason that they're not complying is because, one way or another, they're making money from Uber's existence? As has been pointed out below, due process exists for a reason, and a good part of that is stopping the likes of you and me from dictating what other people should do.
  - cft 10y ago
    > Why do you get to decide Because I am a customer with a $35,000 yearly DDoS mitigation contract budget. Customers like me (a.k.a. the market) will decide, based on the provider's reputation, among other things.
    - toomuchtodo 10y ago
      Lots of customers in the world. You're going to need to spend a lot more than that to have the sort of leverage you're asking for. Disclaimer: Not affiliated with Cloudflare in any way.
      - totall 10y ago
        Cloudflare is not only selling DDoS protection; they are in the business of harboring DDoS booters. Their business work like a mafia, collecting a protection fee while hosting booters themselves. It's disgusting.
    - mnem 10y ago
      Customers merely decide where to spend money. That doesn't let them control the product anymore than buying a stamp lets them decide who can use the postal service.
  - 10y ago
- hellbanner 10y ago
  What is a booter? That just looks like the name of their domain.
  - jkaunisv1 10y ago
    I had to google it, seems like it's a term for DDOS-for-hire services.
  - kbuck 10y ago
    A booter is a DDoS-for-hire service. You pay them $X and they will DDoS someone for you.
- biot 10y ago
  If CloudFlare is friendly towards DDoS services, that's awesome. Maybe I'll do the reverse of this article: create a DDoS-for-hire site, have CloudFlare protect my site, I'll charge for the service in Bitcoin, then not launch any attack. Maybe I, too, can rake in $100K for doing nothing. /s
Aelinsaar 10y ago
It's always shocking to me, that people who can rise to a position where they can make the call to pay a ransom, can be this incredibly gullible/stupid/naive!
- takeda 10y ago
  This is more complex. $4k is not really that much for a company to spend. If you were wrong, well you lost someone's conference trip, if you were right you saved company much more. Anyway, I hate this CloudFlare articles, it's clever marketing. Essentially they say that if you would use their service you could call bluff, and save that $4k, while they also contribute to the problem by protecting all DDoS for pay services.
  - Aelinsaar 10y ago
    If you're wrong, you're potentially spending $4K to mark yourself as an especially likely target for someone who doesn't even have the resources to attack you. It's not JUST risk mitigation, it's also about furthering this ridiculous economy that's been springing up since the first XDCC bots were born.
davepeck 10y ago
My company received one of these threats last week. We took it seriously, despite our suspicion it was an empty copycat threat.
gesman 10y ago
Why redact bitcoin address that was used for threats? Let crowd do analysis on address that belongs to criminal.

65 points by shade23 10y ago

deleted 10y ago

[deleted]

cft 10y ago

Cloudflare publishes these marketing articles, spinning them as "helpful" for the community. The biggest community help Cloudflare could provide is kicking booters [1] from their network. They won't however, since it needs to protect the booters for Cloudflare's business to prosper. 1. http://whois.domaintools.com/booter.xyz http://whois.domaintools.com/booter.xyz (Repeat this whois search for the top 10 booters found in Google)

rmdoss 10y ago
It is a business decision for them. If they kick the booters off, they will DDoS each other to death and no one will be able to use the booters anymore. You may not agree, but financially makes sense for them. They need the booters to be alive to sell their service. -->not saying I agree at all with that mindset
- prymitive 10y ago
  > They need the booters to be alive to sell their service. Well, I think this blog post clearly demonstrate that people are willing to pay for DDoS protection even without any attacks. This is pretty much a conspiracy theory way of thinking.
  - totall 10y ago
    But paying customers of Cloudflare think otherwise.
    - prymitive 10y ago
      Did you run any study to claim you know why are they buying those services? Security is not a one time purchase when someone is threatening you.
gist 10y ago
> publishes these marketing articles What's funny is that it's obvious to anyone who would received an email like this is that it's spam to be ignored. What makes an email like this any more believable than anything you get unsolicited by email making any claims or demand? The fact that it is mentioning DDOS instead Nigerian money? I am surprised that cloudflare feels the need to even write this up and the fact they they take it seriously is only mitigated by the marketing angle (which makes them smart instead of naive I guess).
- NegatioN 10y ago
  Well, these mails are almost an exact copy of the ones the real armada collective sent out last year though? It would make sense to be wary of them if you heard about attacks carried out by them. The question is, what should a small enterprise without protection against ddos do? Of course it's wiser to actually implement said protection, but it's a lot easier for the human mind to jump to the short-term and easy solution.
  - gist 10y ago
    Well now if you were going to pull a scheme like that for real (and not just spray and pray 10,000 sites hoping a few would pay) wouldn't it makes sense to give the site at least a taste of what you can do for a short period of time? And do you honestly think that it's good business practice when receiving an email like that to just assume it's truthful and you need to swing into some kind of fire drill? I don't.
    - NegatioN 10y ago
      No, I never said I thought it was good business practice. But I'm saying it's not good business practice to ignore it. If you can afford to ignore it, then there's no issue, but there's plenty of sites that don't have protection against this, and have money on the line if they get taken down. The cost of paying off (a semi-probable) attack, might be better than going down the next day, and having to firefight it. I'm playing the devil's advocate here. I would not pay x thousand dollars because of an email from said group, but I can understand it slightly better than sending money for nigerian scams.
buro9 10y ago
I work for CloudFlare, just an engineer and not a lawyer, etc. This is my opinion but I recognise I work here and am a dumb person from a legal perspective. One of the things that CloudFlare cares about is due process. That has been blogged about too: https://blog.cloudflare.com/fighting-back-responsibly/ https://blog.cloudflare.com/fighting-back-responsibly/ If CloudFlare were to subjectively decide to remove websites or DNS zones, due process goes out of the window as we'd be able to just do whatever we pleased to whomever. We (collective HN readers, etc) cannot wish to restrict and prevent overreach if we indulge in the very same action by subjectively removing/blocking access. Either a company follows due process, or it does not. Due process is extremely valuable to a society, relying on a transparent system that has an appeals process should be important to everyone... the legal system gives this, and it's value is so great to society in restricting overreach, that as individuals and as the wider company we have embraced due process, and rejected the things that would weaken it... our own actions. If you wish to have booters or whomever else removed, please present our legal team with a valid legal request.
- cft 10y ago
  Indeed, it is the purpose of a court to follow due process, but not of a private entity. From CloudFlare's business standpoint, your decision makers should seriously weigh the reputation damage that this (perfectly legal) "willful negligence" attitude provides: a marketing director of your competitor pointed out that "CouldFlare is protecting most booters" in a phone call with me.
  - stcredzero 10y ago
    Indeed, it is the purpose of a court to follow due process, but not of a private entity. Laws and courts constitute a minimum or a "floor" standard for civic and commercial behavior. A society that has due process in its laws and on its books, but whose civic and commercial institutions all exhibit draconian knee-jerk behaviors is succeeding at being benevolent and just to the same extent that the Jim Crow south enfranchised black people. The comparison is unpleasant, but it is operationally correct. Laws on the books are only a skeleton. Values and principles have to be enacted by the flesh of civic and commercial society to be meaningful to people. The values embodied by the laws on the books have also to be alive in civic society, or else they are not truly meaningful. It's not enough for only the government and courts to embody humanist and democratic values. Civic and commercial society has to embody them too. (Ask yourself, are you a part of civic and commercial institutions and intellectual movements that embody humanist and democratic values? Or are they authoritarian and withhold justice and free speech from those the group deems "unworthy?")
mootothemax 10y ago
>Cloudflare publishes these marketing articles, spinning them as "helpful" for the community. The biggest community help Cloudflare could provide is kicking booters [1] from their network. They won't however, since it needs to protect the booters for Cloudflare's business to prosper. Why do you get to decide who should and shouldn't get kicked off a given company's platform? I mean, I positively detest Uber and am convinced they're making the world a worse place. Can I now hound everyone involved with their online presence? And then claim the only reason that they're not complying is because, one way or another, they're making money from Uber's existence? As has been pointed out below, due process exists for a reason, and a good part of that is stopping the likes of you and me from dictating what other people should do.
- cft 10y ago
  > Why do you get to decide Because I am a customer with a $35,000 yearly DDoS mitigation contract budget. Customers like me (a.k.a. the market) will decide, based on the provider's reputation, among other things.
  - toomuchtodo 10y ago
    Lots of customers in the world. You're going to need to spend a lot more than that to have the sort of leverage you're asking for. Disclaimer: Not affiliated with Cloudflare in any way.
    - totall 10y ago
      Cloudflare is not only selling DDoS protection; they are in the business of harboring DDoS booters. Their business work like a mafia, collecting a protection fee while hosting booters themselves. It's disgusting.
  - mnem 10y ago
    Customers merely decide where to spend money. That doesn't let them control the product anymore than buying a stamp lets them decide who can use the postal service.
- 10y ago
hellbanner 10y ago
What is a booter? That just looks like the name of their domain.
- jkaunisv1 10y ago
  I had to google it, seems like it's a term for DDOS-for-hire services.
- kbuck 10y ago
  A booter is a DDoS-for-hire service. You pay them $X and they will DDoS someone for you.
biot 10y ago
If CloudFlare is friendly towards DDoS services, that's awesome. Maybe I'll do the reverse of this article: create a DDoS-for-hire site, have CloudFlare protect my site, I'll charge for the service in Bitcoin, then not launch any attack. Maybe I, too, can rake in $100K for doing nothing. /s

Aelinsaar 10y ago

It's always shocking to me, that people who can rise to a position where they can make the call to pay a ransom, can be this incredibly gullible/stupid/naive!

takeda 10y ago
This is more complex. $4k is not really that much for a company to spend. If you were wrong, well you lost someone's conference trip, if you were right you saved company much more. Anyway, I hate this CloudFlare articles, it's clever marketing. Essentially they say that if you would use their service you could call bluff, and save that $4k, while they also contribute to the problem by protecting all DDoS for pay services.
- Aelinsaar 10y ago
  If you're wrong, you're potentially spending $4K to mark yourself as an especially likely target for someone who doesn't even have the resources to attack you. It's not JUST risk mitigation, it's also about furthering this ridiculous economy that's been springing up since the first XDCC bots were born.

davepeck 10y ago

My company received one of these threats last week. We took it seriously, despite our suspicion it was an empty copycat threat.

gesman 10y ago

Why redact bitcoin address that was used for threats? Let crowd do analysis on address that belongs to criminal.