10 ms·
FBI kicks some of the worst ‘DDoS for hire’ sites off the internet
- shawn 8y agoSince a new story with no comments is my only chance to talk to anyone whatsoever, I just wanted to point out that I made a site. https://www.laarc.io https://www.laarc.io It uses the same codebase as Hacker News, but you can submit items to different lists. (Basically subreddits.) It’s kind of like a free version of pinboard. Feel free to spam the site with anything you want. I’ve been collecting videos (https://laarc.io/l/videos https://laarc.io/l/videos) some essays (https://laarc.io/l/classics https://laarc.io/l/classics) and music (https://www.laarc.io/l/music https://www.laarc.io/l/music). It’s mostly an experiment, and unfortunately it’s quite unrelated to the FBI wiping DDoS sites off the internet. But on the other hand, if someone would like to try DDoSing the site, I would appreciate it. I can’t generate enough traffic to figure out whether the site will go down if it gets picked up by Reddit. (Is there a legit DDoS for hire service that I can use on my own sites? `vegeta attack` is nice for local testing, but not so much simulating a massive influx of visitors.) Come say hello. I miss you guys. https://discord.gg/qaqkc9z https://discord.gg/qaqkc9z
- PhasmaFelis 8y agoHadn't heard them called "stressers" before. Is that for sites that were pretending they were for stress-testing your own site, not DDoSing someone else's? Glad it didn't work out for them.
- Cyph0n 8y agoYep, especially on the more "public" forums like HF. The same approach is used with malware crypters or RATs (remote administration tools, heh).
- Namrog84 8y agoI take it then that there are legitimate sites that do offer this service but properly verify owners first?
- ceejayoz 8y agoYes. I used Blitz.io a couple of times; they'd require you to put either a DNS entry in place or upload a file to a specific location in the domain's root.
- yepguy 8y agoThat doesn't really prevent anyone from attacking a hosting service like GitHub Pages or Netlify, though.
- giancarlostoro 8y agoYou could check the existing DNS of a domain, if they're GitHub or Netlify's DNS addresses / IP's then you don't stress those.
- lelandbatey 8y agoThe idea is that the stress testing site dictates where the file must go, not the user. So for them to run the test, they may need to see a specific file at "subjectsite.com/secretguid" The idea being that unless you have total domain control, you can't get that file where they want you to put it.
- msmith 8y agoI was a lead on Blitz. You’re right that there are ways to get around this domain ownership check, but in practice it was enough of a hurdle to avoid bad actors. Also, I’m pretty sure that these stressors were way more cost effective if your only goal is to DDoS a site.
- saagarjha 8y agoYes, that was the general way they marketed their services: “we’ll help you stress test your site, except we don’t verify whether you own the domain we’ll point our traffic to”.
- astura 8y agoYes, thats exactly what they claimed they were for, stress testing your own site.
- creaghpatr 8y agoDid the FBI add the santa hats? Because that's pretty savage if they did.
- olooney 8y agoProbably the stack overflow winter bash. https://stackoverflow.blog/2018/12/12/winter-bash-2018-2/ https://stackoverflow.blog/2018/12/12/winter-bash-2018-2/
- deleted 8y ago[deleted]
- atonse 8y agoI was thinking that... a hell of a sense of humor. Merry Christmas, DDoS jackasses.
- brian_herman__ 8y agoNo I thing arstechnica did that...
- jolmg 8y ago> arstechnica techcrunch you mean
- brian_herman__ 8y agoyea sorry i was reading ars in another window
- zantana 8y agoYes if you go to the sites via the links to the domains in the article they don't have the santa hats. I had to check for myself.
- atonse 8y ago
- graphememes 8y agoCan't they just move them?
- tyingq 8y agoThey can, but whatever existing links or organic rankings they had are now gone.
- hiccuphippo 8y agoAnd now copycats will probably release their own site claming they are the same guys. This happens with torrent sites whenever they get taken down.
- wolco 8y agoFBI domain takeovers is abuse of power, pure and simple.
- ddtaylor 8y agoAlso doesn't affect any users on Tor, which for that kind of thing is a lot.
- jammygit 8y agoPardon my ignorance, but what about Tor keeps the FBI from being able to take a site down? Is it distributed or something?
- ddtaylor 8y agoLaw enforcement does one of two things to "take down" a site: 1. Seize servers via an IP address 2. Seize a domain record itself and redirect it Both of these "attacks" are not possible with Tor hidden services, because a.) there is no IP associated with the hidden service (although Tor in theory is subject to traffic correlation) and b.) there is no domain record that can be redirected unless you actually have the corresponding private key since Tor hidden service addresses are the public component of that keypair.
- lostgame 8y agoWell, the obvious difficulty is in nailing the specific IP address, and thusly the location of the server hosting the content, due to the obfuscation that TOR provides. It’s essentially the same reason you’re safe browsing it. The issue, however, is that web sites always need to be hosted on a physical server somewhere, and all it takes is one social media account or email that gives away some aspect of your identity or location for them to find it - assuming you’re doing something illegal of course. There’s nothing inherently illegal with hosting TOR sites. :P That doesn’t mean that shutdowns don’t happen, though. The FBI recently shut down a number of TOR sites with illegal content.
- deleted 8y ago[deleted]
- ourmandave 8y agoWonder if they managed to get their hardware or a list of compromised machines they use for their attacks. Maybe let some people know their router is f'd.
- Medox 8y agoAny idea what percentage of all (at least the biggest ones) were taken down? '15 high-profile [...] websites' could be most of the high-profile ones or just 10%. Sadly, few articles put things into perspective.
- hiccuphippo 8y agoI'd be more wary of the low-profile sites. Those will be more difficult to take down.
- thosakwe 8y agoAll seriousness aside, the "domain seizure" actually made me laugh. I guess there was deliberately a bit of humor it. Random hex numbers scattered all around, glassy blue, and a massive red "THIS DOMAIN HAS BEEN SEIZED," feel at least a little tongue-in-cheek.
- starbeast 8y agoThis site is still up.
- Jedi72 8y agoI watched a documentary on Scientology ages ago about how they were suing the crap out of people for DDoSing their site. The problem was these people were basically just kids, most were ~14 years old, who saw something on 4chan and followed instructions. I believe this was ~2001 [correction: 2008]. One of their lawyers was going with the defence that DDoS was equivalent to a sit-in protest, not unlike those used during the segregation protests in the US in the 1960s, specifically of diners who refused black customers. Sending 200 people into a diner and refusing to move is basically IRL denial of service. Unfortunately I can't remember the exact name of the documentary but this wiki page covers the events https://en.m.wikipedia.org/wiki/Project_Chanology https://en.m.wikipedia.org/wiki/Project_Chanology. I always wondered how successful that defence was, I havent been able to find a follow-up.
- muthdra 8y agoSounds like a good doc. Perhaps it was this one? http://wearelegionthedocumentary.com/ http://wearelegionthedocumentary.com/
- lcw 8y agoI saw this documentary also, but personally I thought the defense was seriously flawed. A sit in costs the business money by preventing them from making money, but ddos'ing not only cost money because people can't use the site but also costs the company money to deal with the excess traffic. So to me the adequate metaphor is throwing bricks through the window of an establishment you don't like. Would love to here others thoughts?
- matuszeg 8y agoHaving to pay for the extra traffic is similar to having to pay for rent and staffing for that day of the sit in. Its built in costs of operating that have to be paid because their time of running the business was temporarily suspended.
- lcw 8y agoIf you have to hire 10x more staff then usual and have them sit around.
- TheGrassyKnoll 8y ago‘DDoS for hire’ == Aaas == Assholes as a Service
- mickael-kerjean 8y agoNot necessarily, a DDoS for hire is of great way to test things before deployment
- chipperyman573 8y agoThis is exactly how they're marketed - they're not DDoS services, they're "stress testing" services you can use to make sure your server can withstand a real DDoS. Obviously nobody (including the FBI) believes that.
- thecatspaw 8y agoProfessional load testing tools usually require you to proof ownership of the server
- sandov 8y agoThe US is such a weird country. They probably have the best free speech protection in the world, for which I admire them, but then they do this kind of stuff. They sometimes are an example in freedom and sometimes they're the complete opposite.
- symfoniq 8y agoMaybe we "do this kind of stuff" specifically _because_ we value free speech. DDoS perpetrators restrict the online speech of their victims. There is nothing inconsistent about America's First Amendment protections and the FBI's actions here.
- slang800 8y agoThey just seized the marketing sites domain names? How is this a victory? If the people running these sites are still able to continue their operations then they'll just get a new domain name and host a new signup page. The only thing they might have lost is some brand recognition.
- bcaa7f3a8bbc 8y agoSure, some particular DDoS campaigns can be seen as a sit-in protest and personally I'm not personal objective or supportive to these campaigns, but under the current architecture of the Internet and World Wide Web, DDoS cannot be prevented, and as a vulnerability, it not only enables "sit-in protest", but essentially enables a mechanism of censorship, especially after the rise of these "DDoS as a service" vendors, they are effectively a "Censorship on Demand" service. Any self-published speech on a personal webserver now can be kicked out of the Internet by anyone. For example, during the Hong Kong Occupy Central protest in 2014, some news websites experienced a government-sponsored 500 Gbps DDoS attack. The recent example was Krebs On Security blog, which has been a target for blackhat groups and hit by a 1 Tbps attack. The World Wide Web was supposed to be a (to some extent) permissionless publishing platform, that means if you are already connected to the Internet via a commercial ISP, as long as the content is legal and the law of your jurisdiction protects the freedom of speech, you don't need anyone's particular approval to run a HTTP server. But now under the threats of DDoS attack, no independent webserver can survive, the only solution is utilizing a centralized CDN / reverse-proxy, and accepts EULA of their choice and theoretically they can modify and censor your traffic arbitrarily. I think decentralized systems such as ZeroNet or IPFS may be a solution, and I hope they can be integrated into a web browser one day.
- hannob 8y agoI won't shed a tear for DDoS services, but I seriously doubt this will have any relevant impact. These DDoS services exist because we have an Internet full of devices that you can trivially take over by logging into them with admin/admin or other default credentials you can find in public lists. As long as these exist there will be people abusing them. If you want to do something about DDoS the thing that needs to happen is that the number of trivially vulnerable devices needs to be reduced. That likely means thinking about device security regulations and minimum security requirements, probably also vendor liability.