5 ms·

> It might be surprising that DDoS providers could advertise openly on the Web. After all, DDoSing another website is illegal everywhere. To get around this, th

> It might be surprising that DDoS providers could advertise openly on the Web. After all, DDoSing another website is illegal everywhere. To get around this, these “booter services” have long argued they perform a legitimate function: providing those who set up Web pages a means to stress test websites. This reminded me of a Wired article[1] from a few weeks back that argued that many of the kids using these services to DDoS their friends/rivals don't realize they're illegal—so federal agencies are taking out keyword ads to warn potential users: > In fact, he and other members of [cybercrime-busting group] Big Pipes argue that most booter customers seem to believe—or convince themselves—that merely paying to use one of the services to knock out an adversary’s internet connection isn’t against the law, or at least isn’t an enforceable crime. When the UK’s National Crime Agency (NCA) ran a six-month Google advertising campaign in 2018 to intercept people seeking booter services and warn them about their illegality, Clayton’s research group found that attack traffic in the UK remained flat for those six months, while it increased at its usual pace in other countries. > In the years since, law enforcement agencies seem to have learned from that experiment: The FBI now also buys similar Google advertisements to warn potential booter customers that paying for the services is a crime. The UK’s NCA, meanwhile, has not only launched new advertising campaigns but even run its own fake booter services to identify would-be customers and then send them warnings—sometimes even with in-person visits—about the consequences of paying for criminal DDOS attacks. [1] https://www.wired.com/story/big-pipes-ddos-for-hire-fbi/ https://www.wired.com/story/big-pipes-ddos-for-hire-fbi/ (For the relevant bits, scroll to the "Honeypots, Google Ads, Knock-and-Talks" section)

jrochkind1 3y ago
> The UK’s NCA, meanwhile, has not only launched new advertising campaigns but even run its own fake booter services to identify would-be customers and then send them warnings—sometimes even with in-person visits—about the consequences of paying for criminal DDOS attacks. The FBI would be indicting them, not just warning them -- go to all that trouble of setting up a fake site, and then you just give up actually indicting them for their crime? What's even the point of that? That they didn't know it was a fake site is no defense, the FBI routinely, say, sells people fake bombs and then indicts them.
- spondylosaurus 3y ago
  The NCA too, not just the FBI. But the Wired article goes on to say: > Big Pipes’ Allison Nixon says she hopes that softer tactics like those can intercept would-be booter service operators early, before they start committing felonies: She’s found that most booter operators start as customers before launching their own service. But for people who aren’t dissuaded by those interventions, she says, Big Pipes and its partners at the FBI will still be watching them. > “The hope is that this whole show of force will convince some of them to quit and get a real job,” Nixon says. “We want to send a message that there are people tracking you. There are people paying attention to you. We have our eyes on you, we might get you next. And it might not even be on Christmas.” So the honeypots sound like a sort of catch-and-release strategy to scare kids before they start their own DDoS enterprises.
  - jrochkind1 3y ago
    Right, I was amazed that the NCA seemed to be kinder and gentler than the FBI, which has no problem entrapping people and then putting them in prison.
    - lmm 3y ago
      Wait until you hear about how British law enforcement approaches gun issues.
      - thombat 3y ago
        That seems to imply that they're notably heavy-handed - would you like to expand on this?
- florbo 3y ago
  There's an extreme difference in severity between trying to buy a bomb and trying to pay for DDoSaaS. I'd rather people come out of this sort of thing unscathed but wiser, especially if they're simply ignorant of the law, which seems to be the objective of that tactic. Besides, if something is illegal and there's a significant portion of offenders who are truly ignorant of its illegality, perhaps a new approach to education is needed, which this tactic also covers. Maybe other organizations will take notes...
itronitron 3y ago
During that time frame, I recall some top players being directy impacted by targeted DDOS attacks from other players. It wasn't too common only because people learned to protect their IP addresses, or change them periodically. The Mirai botnet had a very negative impact on game play for several servers, and I would argue it was the key factor in the demise of at least one of the servers simply because it rendered certain games unplayable.
- weq 3y ago
  I remmeber this happening when i was gaming back in the 90s. back then then u didnt need much bandwidth to be a big guy either.
  - saganus 3y ago
    Ah, nuking. That brings back memories. I remember you had to use NukeNabber to block attacks to TCP port 139 IIRC.
- smolder 3y ago
  > The Mirai botnet had a very negative impact on game play for several servers It's not clear what you're talking about when you say "several servers" or "one of the servers". What servers are you referring to?
charcircuit 3y ago
[flagged]
- SkyPuncher 3y ago
  Computer Fraud and Abuse Act: https://sgp.fas.org/crs/misc/R46536.pdf https://sgp.fas.org/crs/misc/R46536.pdf > Broadly speaking, § 1030(a)(5)141 prohibits a variety of acts that result in damage to a computer. Subsection 1030(a)(5) may be used to prosecute many of the activities that are commonly associated with hacking, such as the transmission of viruses or worms and unauthorized access by intruders who delete files or shut off computers.142 The provision may also be used to prosecute the perpetrators of Distributed Denial of Service (DDoS) attacks,143 which occur, for example, when an attacker overwhelms a server’s ability to process legitimate requests by overloading the server with a flood of illegitimate traffic.1 Kicking your friend offline (via DDOS or other) would prevent it from processing legitimate requests and count as a breach of CFAA.
  - charcircuit 3y ago
    >would prevent it from processing legitimate requests Your friend is not hosting a server and they are not incurring damages due to having trouble connecting to the internet. The damages from not being able process legitimate requests is like if you DDoS an ecommerce site which means that they are unable to receive orders from legitimate customers which causes them damage.
    - anoonmoose 3y ago
      I don't agree with that. If your DDoS prevents me from using services I paid for, I could rightfully sue you in small claims for the damages. They'd be small- a percentage of a monthly Internet bill. It's still damages.
      - charcircuit 3y ago
        It would depend on if being unable to access services you paid for would be considered damage to a "protected computer" which is specifically the kind of damage 1030(a)(5) protects against.
thatguy0900 3y ago
I find it extremely interesting that the fbi buys ads for illegal stuff, rather than Google Just putting up a warning when you search for ddos services
- HDThoreaun 3y ago
  Why would google do that for free when they can get paid?
- spondylosaurus 3y ago
  I mean, it's not illegal to search for those keywords, so Google doesn't have much of an incentive to stop running ads on them (at least of their own free will). I'm sure "triple homicide" is a hot keyword for advertising the latest true crime podcast or whatever. Granted, I'm also a little surprised that the FBI didn't just twist Google's arm about it, but who knows. Maybe Google did them a solid and doesn't actually charge for the ad space, or maybe the FBI is just trying to play nice since Google has plenty of federal contracts.
  - 2OEH8eoCRo0 3y ago
    > I'm also a little surprised that the FBI didn't just twist Google's arm about it Just twist their arm? What does it mean for the FBI to twist Google's arm?
    - spondylosaurus 3y ago
      ? I'm not entirely sure what you mean. What I was trying to convey was that the FBI could have exerted some kind of pressure to get Google to run the anti-booter ads of their own volition instead of the FBI (presumably) buying the ads like anyone else would buy ads. I have no idea what that kind of pressure would entail cuz I don't work for the feds and couldn't say what their "do this or else" strategies are like, lol.
      - not2b 3y ago
        It doesn't cost that much compared to their budget, so it's easier to pay for ads than get into a fight with Google lawyers.
amelius 3y ago
> To get around this, these “booter services” have long argued they perform a legitimate function: providing those who set up Web pages a means to stress test websites. Don't these botnet services run on compromised computer systems?
- 3np 3y ago
  This is abstracted away from the customer and there is a wider and richer grayscale than at least I imagined before working at a data company and looking at IP providers for outbound. You have your TV sticks and VPN providers where a careful squinting at the ToS will tell you that users on the other end are signing off on the right to have their bandwidth leased. I don't see how else the supposedly legitimate providers of residential IPs could possibly offer the supply, geo-diversity, and pricing they do.
- tough 3y ago
  free hosting
- catminou 3y ago
  For botnets, yes. For L7 request floods - they spin up a few dozen machines and use open & private proxies to funnel http requests thru. Sometimes those proxies are misconfigured squid, sometimes it's private proxy services, sometimes it's compromised machines converted into proxies (which may be open or require auth / has been sold). For L3/L4 amplification/reflection they're buying machines where they can spoof and using UDP amplification lists (other people's machines) to reflect off of (and obviously not getting permission to, etc.).
deleted 3y ago
[deleted]

jrochkind1 3y ago

> The UK’s NCA, meanwhile, has not only launched new advertising campaigns but even run its own fake booter services to identify would-be customers and then send them warnings—sometimes even with in-person visits—about the consequences of paying for criminal DDOS attacks. The FBI would be indicting them, not just warning them -- go to all that trouble of setting up a fake site, and then you just give up actually indicting them for their crime? What's even the point of that? That they didn't know it was a fake site is no defense, the FBI routinely, say, sells people fake bombs and then indicts them.

spondylosaurus 3y ago
The NCA too, not just the FBI. But the Wired article goes on to say: > Big Pipes’ Allison Nixon says she hopes that softer tactics like those can intercept would-be booter service operators early, before they start committing felonies: She’s found that most booter operators start as customers before launching their own service. But for people who aren’t dissuaded by those interventions, she says, Big Pipes and its partners at the FBI will still be watching them. > “The hope is that this whole show of force will convince some of them to quit and get a real job,” Nixon says. “We want to send a message that there are people tracking you. There are people paying attention to you. We have our eyes on you, we might get you next. And it might not even be on Christmas.” So the honeypots sound like a sort of catch-and-release strategy to scare kids before they start their own DDoS enterprises.
- jrochkind1 3y ago
  Right, I was amazed that the NCA seemed to be kinder and gentler than the FBI, which has no problem entrapping people and then putting them in prison.
  - lmm 3y ago
    Wait until you hear about how British law enforcement approaches gun issues.
    - thombat 3y ago
      That seems to imply that they're notably heavy-handed - would you like to expand on this?
florbo 3y ago
There's an extreme difference in severity between trying to buy a bomb and trying to pay for DDoSaaS. I'd rather people come out of this sort of thing unscathed but wiser, especially if they're simply ignorant of the law, which seems to be the objective of that tactic. Besides, if something is illegal and there's a significant portion of offenders who are truly ignorant of its illegality, perhaps a new approach to education is needed, which this tactic also covers. Maybe other organizations will take notes...

itronitron 3y ago

During that time frame, I recall some top players being directy impacted by targeted DDOS attacks from other players. It wasn't too common only because people learned to protect their IP addresses, or change them periodically. The Mirai botnet had a very negative impact on game play for several servers, and I would argue it was the key factor in the demise of at least one of the servers simply because it rendered certain games unplayable.

weq 3y ago
I remmeber this happening when i was gaming back in the 90s. back then then u didnt need much bandwidth to be a big guy either.
- saganus 3y ago
  Ah, nuking. That brings back memories. I remember you had to use NukeNabber to block attacks to TCP port 139 IIRC.
smolder 3y ago
> The Mirai botnet had a very negative impact on game play for several servers It's not clear what you're talking about when you say "several servers" or "one of the servers". What servers are you referring to?

charcircuit 3y ago

[flagged]

SkyPuncher 3y ago
Computer Fraud and Abuse Act: https://sgp.fas.org/crs/misc/R46536.pdf https://sgp.fas.org/crs/misc/R46536.pdf > Broadly speaking, § 1030(a)(5)141 prohibits a variety of acts that result in damage to a computer. Subsection 1030(a)(5) may be used to prosecute many of the activities that are commonly associated with hacking, such as the transmission of viruses or worms and unauthorized access by intruders who delete files or shut off computers.142 The provision may also be used to prosecute the perpetrators of Distributed Denial of Service (DDoS) attacks,143 which occur, for example, when an attacker overwhelms a server’s ability to process legitimate requests by overloading the server with a flood of illegitimate traffic.1 Kicking your friend offline (via DDOS or other) would prevent it from processing legitimate requests and count as a breach of CFAA.
- charcircuit 3y ago
  >would prevent it from processing legitimate requests Your friend is not hosting a server and they are not incurring damages due to having trouble connecting to the internet. The damages from not being able process legitimate requests is like if you DDoS an ecommerce site which means that they are unable to receive orders from legitimate customers which causes them damage.
  - anoonmoose 3y ago
    I don't agree with that. If your DDoS prevents me from using services I paid for, I could rightfully sue you in small claims for the damages. They'd be small- a percentage of a monthly Internet bill. It's still damages.
    - charcircuit 3y ago
      It would depend on if being unable to access services you paid for would be considered damage to a "protected computer" which is specifically the kind of damage 1030(a)(5) protects against.

thatguy0900 3y ago

I find it extremely interesting that the fbi buys ads for illegal stuff, rather than Google Just putting up a warning when you search for ddos services

HDThoreaun 3y ago
Why would google do that for free when they can get paid?
spondylosaurus 3y ago
I mean, it's not illegal to search for those keywords, so Google doesn't have much of an incentive to stop running ads on them (at least of their own free will). I'm sure "triple homicide" is a hot keyword for advertising the latest true crime podcast or whatever. Granted, I'm also a little surprised that the FBI didn't just twist Google's arm about it, but who knows. Maybe Google did them a solid and doesn't actually charge for the ad space, or maybe the FBI is just trying to play nice since Google has plenty of federal contracts.
- 2OEH8eoCRo0 3y ago
  > I'm also a little surprised that the FBI didn't just twist Google's arm about it Just twist their arm? What does it mean for the FBI to twist Google's arm?
  - spondylosaurus 3y ago
    ? I'm not entirely sure what you mean. What I was trying to convey was that the FBI could have exerted some kind of pressure to get Google to run the anti-booter ads of their own volition instead of the FBI (presumably) buying the ads like anyone else would buy ads. I have no idea what that kind of pressure would entail cuz I don't work for the feds and couldn't say what their "do this or else" strategies are like, lol.
    - not2b 3y ago
      It doesn't cost that much compared to their budget, so it's easier to pay for ads than get into a fight with Google lawyers.

amelius 3y ago

> To get around this, these “booter services” have long argued they perform a legitimate function: providing those who set up Web pages a means to stress test websites. Don't these botnet services run on compromised computer systems?

3np 3y ago
This is abstracted away from the customer and there is a wider and richer grayscale than at least I imagined before working at a data company and looking at IP providers for outbound. You have your TV sticks and VPN providers where a careful squinting at the ToS will tell you that users on the other end are signing off on the right to have their bandwidth leased. I don't see how else the supposedly legitimate providers of residential IPs could possibly offer the supply, geo-diversity, and pricing they do.
tough 3y ago
free hosting
catminou 3y ago
For botnets, yes. For L7 request floods - they spin up a few dozen machines and use open & private proxies to funnel http requests thru. Sometimes those proxies are misconfigured squid, sometimes it's private proxy services, sometimes it's compromised machines converted into proxies (which may be open or require auth / has been sold). For L3/L4 amplification/reflection they're buying machines where they can spoof and using UDP amplification lists (other people's machines) to reflect off of (and obviously not getting permission to, etc.).

deleted 3y ago

[deleted]