11 ms·
Six charged in mass takedown of DDoS-for-hire sites
- ericpauley 4y agoIt's funny (kind of cute, honestly) that these site operators pretended that the outbound (booting) side of the service was the only legal risk, and that they could address this with click-through terms. Clearly, compromising third-party devices and services, or misusing services for amplification, is just as legally fraught as the attack itself. That being said, I wonder if these services are actually the limiting factor here. There is probably some zero-sum game here, with a fixed quantity of exploitable booter hosts available and all the providers vying for control of these. Shutting down a set of providers would then just make others more powerful.
- RVRX 4y agoTBF these sites have been up for years, I recognize some from >decade ago, so it took quite some time for the law to catch up to them. They've probably taken in quite a bit of cash since their inception.
- duskwuff 4y ago> ... and that they could address this with click-through terms Honestly, this part is pretty funny on its own. Approximately nobody actually uses these services to test their own networks, and I'm sure the site operators are perfectly aware of that.
- DangitBobby 4y agoFor sure. If they were legitimately owners of the domain, they'd have no issue placing a TXT record attesting to that fact.
- deleted 4y ago[deleted]
- TheHappyOddish 4y agoFor the record, a company I worked for absolutely used one of the listed sits to test our own network. We used it regularly enough and requested so many new features that the operator (one of the men arrested here) set up <ourcompanyname>.php on there for our specific testing.
- wolverine876 4y agoYou funded a criminal operation? That runs DDoS attacks? On behalf of owners of domains and websites everywhere, thanks a lot.
- TheHappyOddish 4y agoNope. I worked for a company who paid another company to send large amounts of attack traffic to our network. We were a DDoS mitigation provider. It's very hard to test without real world traffic.
- wolverine876 4y agoThose payments funded criminals and crimes. 'It's hard to do it otherwise' is not a defense.
- TheHappyOddish 4y agoI'm not defending anything, although you clearly seem on the attack. I worked for the company, I was not the decision maker. Many of us have worked at companies where decisions are made that are questionable or unethical, sometimes even illegal (although I don't believe this would have been illegal in my country at the time).
- wolverine876 4y agoI've never worked someplace that paid criminals to do anything, and I'd resign before I did it. For one thing, who knows what my personal liability is. Much more importantly, it's plainly the wrong thing to do, and my society and community are in my hands as much as anyone else's.
- pgeorgi 4y agoI reminded me of those warez sites in the 90s that asked "Are you a cop?", with "Yes" pointing to some other site (disney, nytimes, you name it) and "No" going to the actual content, because "cops mustn't lie about their position." That worked approximately as well as you would imagine.
- technion 4y agoI'm having flash backs to talking to some guy on a BBS and him informing me that cops can't say they are not cops, or it's entrapment. 25 years later some guy at a party was telling me this last month. It's amazing how this silly myth persisted.
- wolverine876 4y agoYou can see people making similar post-truth legal arguments on HN (and doing the same in other domains). It elides from a rhetorical or philosophical game into people thinking it's reality or advocating the post-truth culture like it's a cause. When it doesn't map to reality it's going to hurt, like Wiley E Coyote running too far off that cliff. What a bunch of super-geniuses.
- deleted 4y ago[deleted]
- RVRX 4y agoBack when I was a teenager I used to come across these sites all the time when playing with Skype-to-IP revolvers. I just checked, and I'm surprised Google actually still shows these sites when you search for them. Most of them have partner links to these DDoS sites, many of which are on this list of takedowns.
- jacquesm 4y agoI hope they will go after the customers as well, just like they did here in Europe.
- luckyshot 4y agoI would be very grateful if you could share any info about this. Our small company's site got DDoSed a month ago and we just let it pass since we're not too convinced that the authorities will take us seriously. We don't even know where to start, just saved the logs with a few hundred random IPs from different countries hoping some day we can do something about it...
- slothsarecool 4y agoWe report each DDoS attack our company receives to a special department our police has, your country likely has something similar and I guess it doesn't hurt reaching out to them. From my experience they will get back to you quickly (usually in <1-2 hour) and they can try helping out if you are still under attack / need some consultation. Will we ever get compensated for the wasted engineering time to stop these attacks? probably not, but if the police ever finds them and they have extra logs of companies that reported issues, its likely an aggravation of the case.
- luckyshot 4y agoYou're right, I guess I'm still thinking on a few experiences I had way in the past when the Internet was still early and contacting them was a waste of time: they couldn't understand you nor had the time to do so. It's true they now have many more resources and experts in their departments and, as you say, may at least give some good advice on what to do during the panic stage to try and at least mitigate it. Providing them with logs and proof would have been a good idea too. Oh my, the attack caused so much wasted time and stress that it's still haunting me and the team, specially when thinking that it may not stop there and the attacker/s is just waiting for the next chance to hit us. The days after the attack the first thing I did after waking up was check the servers to see everything was safe. And our roadmap was severely affected too, prioritizing many security features we had in the backlog. Thank you so much.
- xmichael999111 4y agoWhat kind of jail time these people looking at?
- jacquesm 4y agoNot enough...
- tptacek 4y agoThe sentence will scale with the money they made added to the amount of damage attributed to the victims; they're in essentially the same boat as SBF with respect to sentencing, albeit with lower numbers. If they made + caused more than six figures, they'll be looking at multiple years; over a million, something in the vicinity of 5-6 years. (I'm not a lawyer, I've just got the sentencing guidelines hotkeyed).
- joshmn 4y agoThey are not in the same boat in terms of sentencing whatsoever. SBF's guidelines are going to be maxed because of the loss amount. His criminal history score will be 0, yes, but I imagine a few of these young men will have a criminal history score of 0 as well. The scale for financial loss is really weird. $150k will get you 10 points. $1.5MM will get you 16 points. $550MM will get you 30 points. https://guidelines.ussc.gov/gl/%C2%A72B1.1 https://guidelines.ussc.gov/gl/%C2%A72B1.1
- tptacek 4y agoWe are saying the same thing. I agree, of course, that SBF's sentence will be much higher than these dipshits. But the mechanism by which they're calculated is basically the same --- SBF will have some level accelerators that the DDoS'ers don't have, and the DDoS'ers will have some 18 USC 1030 accelerators (circumvention devices, domain names, maybe PII) that SBF doesn't. If you do the actual exercise of picking out a realistic loss number and doing the calculation, you'll find that the 2B1.1 loss table dominates the sentence.
- 4y ago
- paulpauper 4y agoFed-level computer crime is one of those things that has huuuge sentences.
- from 4y agoA brief survey of courtlistener.com shows they are not that high at least not compared to usual white collar stuff like PPP or Medicare fraud. The cases that aren't connected to banking fraud usually result in < 3 year sentences. Here are some I found: Mirai authors - Home confinement Peter Levashov - Time served (33 months) Fabio Gasperini - 1 year Maxim Senakh - 4 years Marcus Hutchins - No prison Sergey Vovnenko - 41 months Aleksei Burkov - 9 years, released after 3.5 due to some sort of diplomatic intervention Andrii Kolpakov - 7 years Nikita Kuzmin - Time served Karim Baratov - 5 years Ruslan Bondars - 14 years but he went to trial, lost, and had a loss amount of $20 billion attributed to him
- bolangi 4y agoDoes anyone have trouble parsing this headline? To me it reads like the charges are against people attacking DDoS-for-hire sites.
- jwagenet 4y agoI initially had the same thought. A helpful insertion: "Six charged in [DOJ] mass takedown of DDoS-for-hire sites"
- ArmandTanzarian 4y agoMy thought was something similar: "Six charged after mass takedown of DDoS for hire sites"
- Baeocystin 4y agoI was prepared for a this-is-why-we-can't-have-nice-things story on how people doing good work got screwed over in some way. Glad to be wrong!
- jwagenet 4y ago> “None of these sites ever required the FBI to confirm that it owned, operated, or had any property right to the computer that the FBI attacked during its testing (as would be appropriate if the attacks were for a legitimate or authorized purpose),” reads an affidavit (PDF) filed by Elliott Peterson, a special agent in the FBI’s Anchorage field office. So perhaps the next wave of booter sites can avoid scrutiny by adding a dialog asking the customer if they own the target or are authorized to attack it (in addition to not publishing ads advertising targets like websites and game servers) ?
- scandinavian 4y agoSure, if they implement verification steps to ensure that the site is owned by the person attacking it. The verification steps could be similar to the ACME challenges: https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
- hannob 4y agoThat would still be a terrible idea. If you do it domain-based it's obviously insecure (validate -> change a-record -> attack), if you do it IP based you basically allow attacks on cloud services that rent cheap virtual servers. Also keep in mind that a DDoS affects infrastructure on the way whose operators have not consented. I don't really think there's an ethical way to run a DDoS "stresser" service on the public Internet.
- MajimasEyepatch 4y agoHow is domain-based insecure? There are tons of services that use DNS records to validate ownership of a domain. If someone has managed to get control of a domain and modify its DNS records, they can do a lot more damage than a DDOS.
- tedunangst 4y agoHow do you stop me from pointing my DNS record at your server?
- sjapps 4y ago
- linuxftw 4y agoISPs are really at fault here. They've done practically nothing to prevent botnets and DDoS from continuing to exist. But man, the defendants, how can you be dumb enough to run something like this from US soil, like you're not going to end up in a cage?
- cft 4y agoFrom the FBI affidavit: 42. Finally, many of the booter services also use DDoSprotection services,3 such as those provided by the company Cloudflare (a company headquartered in the United States). While Cloudflare offers both paid and free services, the operator of one of the SUBJECT DOMAINS, bootyou.net paid Cloudflare for services relating to the operation of their website.
- KerrAvon 4y agoSo we should probably talk about CloudFlare as an accessory. Are they protected under Section 230? This appears to be illegal behavior and it was brought to their attention and they failed to take action.
- creeble 4y agoHa, they'll probably get credited by the FBI for assisting in the investigation, as they did last time. Cloudflare gets the low-integrity prize.
- from 4y agoCloudflare responds to subpoenas and is probably very useful from an intelligence perspective. 99% of Cloudflare criticism boils down to media companies being mad that they have to ask Cloudflare for the origin IP address and then complain to the hoster instead of just complaining directly.
- kbuck 4y agoCloudflare won't tell you the abuse contact or the origin IP, they'll just forward your entire abuse report verbatim to the hosting provider of the booter, who will either ignore it or forward it (also verbatim and unredacted) to the operator of the booter. So nothing happens from the abuse report except that you tell the booter operator exactly who you are. How many "stressers" do you think the feds don't have time or motivation to care about getting subpoenas for? Because I can guarantee you there are more than the "four dozen" taken down here, and the vast majority have their identities and infrastructure protected by Cloudflare -- who also profits from their existence.
- greyface- 4y agoFrom a business perspective, Cloudflare benefits from the existence of DDoS-for-hire sites, since they can sell protection to would-be victims.
- tptacek 4y agoCloudflare isn't required to take action against the crimes of random strangers. Even if they supposedly benefit from them.
- joshmn 4y agoThis is cool and all, but I'm still waiting for the FBI to pivot from investing time into piracy and DDoS-for-hire to website operators who run sites that distribute truly awful media. I get that there are anti-piracy lobbies. I get that if you piss off enough companies they're going to put heat on you (see: this). But there are dozens of copycats of Ruben Rosales (https://www.justice.gov/usao-az/pr/mexican-national-sentenced-over-34-years-producing-child-pornography-and-cyberstalking https://www.justice.gov/usao-az/pr/mexican-national-sentence...) and they are truly awful people.
- jrm4 4y agoFollow the money, sadly. Honestly, one weird/humorous/sad thing I've noticed is that -- for purposes of "what is actually censored," messing around with celebrity images is often literally the worst thing you can do, ostensibly worse than violence, racism, etc.
- gwright 4y agoWhy do they need to "pivot"? They should be prosecuting all those crimes, not just some of them.
- greggarious 4y agoWhy would anyone pay for a denial of service attack when DOS bugs are so ubiquitous that you can often not even get paid for finding one? Folks seem to only want remote code execution... so damn nebby. (That type of bug bounty policy is how you get folks hording them for a cold winter rather than disclosing them to vendors.)
- 293984j29384 4y agoI don't think you understand the article. This is regular people who are paying for access to these services. None of these people have any interest in launching their own attacks, they want to input an IP on a webpage and click "go".
- from 4y ago> The charges unsealed today stemmed from investigations launched by the FBI’s field offices in Los Angeles and Alaska, which spent months purchasing and testing attack services offered by the booter sites. Anyone know why so many cybercrime prosecutions happen out of Alaska? I know at least Mirai, Kelihos, and some Mirai clones were all charged in District of Alaska.
- radicaldreamer 4y agoLots of indoor time during the winters?
- Avamander 4y agoMost likely just worse relevant career options, if any.
- cromka 4y agoAren’t these illegal activities fully remote, so to speak?
- bobkazamakis 4y ago...yes...because they have no local options that are going to pay nearly as well...
- cromka 4y agoI was making a point that they don’t have to choose an illegal online activity only because there are no local jobs. Making money legally remotely is way easier.
- from 4y agoIt happens even when the case does not involve Alaska residents like the Mirai people were from New Jersey or the Kelihos botnet guy who was Russian. It's probably just they have a prosecutor who's more versed in computer stuff than in other states but I was hoping there'd be a more interesting reason.
- 1vuio0pswjnm7 4y agoWhen I read this title I thought it said that six "vigilantes" were charged for taking down, via DDoS perhaps, DDoS-for-hire sites.
- zapdrive 4y agoYou and me, both. Such a title gore.
- intrasight 4y agoYup same. Some bad grammar there.
- r3trohack3r 4y agoThe comments from the FBI are really confusing. They seem to use terms like “dark web” to make it sound like these were sophisticated cybercriminals and the FBI had to use sophisticated tools to catch them. But looking at the FBIs sophisticated analysis… it looks like the went to a clear web domain name, put in their credit card number, asked them to do an illegal thing, they did the illegal thing, and then they charged the owners of the domain. From my outside view, it looks like the FBI allowed DDoS as a Service providers to operate in public for at least a decade. Talking this up like it was hard work isn’t landing like they think it is.
- ffhhj 4y agoHope the FBI used a credit card generator so they didn't spend tax-payer money. /s
- VectorLock 4y agoSince card generators haven't worked since like the 90s I'd guess probably not. The FBI has no problem spending tax payer money on criminal activities: drug buys, etc. They'll (hopefully) recover it from seized funds, otherwise its just part of their budget.
- KomoD 4y agoCan you guess what "/s" stands for?
- technion 4y agoA related example example would be all the stolen credentials over the years being sold on two or three well known clearnet forums, absolutely always described as "the dark web" in coverage.
- onetimeusename 4y agoIt sounds like these are DDoS-as-a-service providers who try to appear to be legitimate businesses and cover themselves with terms of service. It's basically a legitimate looking site but they do a psst, hey we do DDoS. To do that it sounds like they may advertise themselves on the dark web as an attack web site. They also don't bother to verify ownership of a target, like checking domain ownership for example is probably the most common use case here. They also use other people's mis-configured devices to amplify their attack. That last part is particularly salient I think. It's very stupid to advertise yourself on the dark web for this if you host a site on the clear web. But you are probably right that LE lets this goes on for longer than it needs to. I don't know how long they have known about these sites or how they go about finding them. It sounds like it's just based on victim's sending in reports.
- theGnuMe 4y agoThis is what we like to call “the long arm of the law”.
- greenie_beans 4y agothis headline is confusing...are six people charged for doing a mass takedown of DDos-for-hire sites? or were the six people charged involved with the DDoS-for-hire sites?
- jesuspiece 4y agoIn some other countries these guys would simply be told to not target domestic infrastructure and then the feds would look the other way, in exchange for "borrowing" access from time to time. Shame it had to go this way
- trompetenaccoun 4y agoI.e. countries run by state terrorists like Russia and China.
- thalassophobia 4y agoNot really. While Russia is often very lax with punishing cybercrime that doesn't affect its sphere of influence, it doesn't look into or hire these criminals since, like any other powerful state, it has its own better hackers. I cannot vouch for China but I'm pretty sure they act the same in this regard.
- shahidkarimi 4y agoTime to take the whole internet down because some people are searching "how to commit sucide"
- Obscurity4340 4y agoIs there a particular reason these hackers/businesses can't just go legit for a great deal of money without the worries of long-term prison time? A legal bird in hand is worth so much more than the illegal three in a treacherous forest
- ta8903 4y ago
- jl6 4y agoI wonder if they will be able to follow the payment trail and prosecute those who bought the services too.
- Nathanba 4y agoDDoS is really one of the most disgusting things on the current internet because there is legitimately no way to defend yourself except to have more money than the other guy. And even that might not help, you practically have to be Google or Cloudflare to be able to fight against the largest DDoS attacks. I see DDoS and BGP as fundamental problems undermining our freedoms, somebody needs to solve this.
- smolder 4y agoMaybe there is some passive aggression here. I think DDoS would be aggressively policed, except that there is a strategic advantage in not doing so. You can demand more policing powers if the scourge of DDoS is actively hurting people. Cloudflare can become a powerful business. There are perverse incentives.
- greyface- 4y agoHow exactly is BGP undermining our freedoms?
- langsoul-com 4y agoHow would you stress test your own networks outside DDOS services? Aus had a problem with the census site where everyone logged in at 5-6pm on the census date. So like millions at once. Are there tools to stress test and build graphs about responsive times and such?
- bauruine 4y agoThere are http benchmarking tools like wrk [0]. You don't need a ddos service for that. [0] https://github.com/wg/wrk https://github.com/wg/wrk
- Charlie11 4y ago