19 ms·
Lizard Squad attacks Brian Krebs
- codyb 12y agoI wonder how he tracks them down? And if he can find two so easily (on his own?) how had they not be outed already?
- sp332 12y agoHe probably found them because they did something stupid. Maybe not all of them have screwed up (yet). They certainly don't look very careful. Krebs figures the first two will turn over the rest as part of a plea deal, and that will be the end of it. https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail...
- hysterix 12y agoWell quite frankly if you've been in the scene for a while, you'd be able to tell using other clues, speech patterns, and reused nicks. Julius Kivimäki aka zee, aka Zeekill (https://encyclopediadramatica.se/Zeekill https://encyclopediadramatica.se/Zeekill) has an extensive history, he actually has been dox'd and outed numerous times prior to this. I knew lizard squad was zee by zee's idiotic behaviour. He constantly used the moniker "Ryan" or "Ryan Clearly" the name of another unrelated hacker. Well sure enough he gave an interview to someone using that moniker. Having even the tiniest bit of inside knowledge it was easy to piece together 1 + 1 = 2 and lizard squad is zee, aka julius. There are other clues too, believe it or not, not too many entities are capable of massing as large a ddos as they were. Those that have the technical capability, normally don't advertise as such. Zee was a "special" case, in that he had the capability, and advertised it as such, I was astounded the boy hadn't been jailed years prior. As I mentioned earlier he has an extensive history, and was involved in many of the large site take downs and ddos's that have made public news.
- rudolf0 12y agoZee/"ryanc" has indeed been involved in things like these for many years. HTP (Linode + much more) is just a small part of it. I'm also very surprised it's taken this long for him to be arrested. He's completely brazen and has committed countless crimes despite knowing full well the general public and law enforcement know exactly who he is. And if he truly was/is involved in carding, he probably won't get out for a while. I can hold some respect for blackhat groups, and hell, even a tiny, miniscule bit of respect for script kiddies like Lizard Squad, but once they get into financial fraud and theft my sympathy is gone.
- tacojuan 12y agoThe HTP dudes actually seemed sophisticated. Lizardsquad is just some dudes with a botnet.
- rudolf0 12y agoZee was apparently involved with both groups. He was likely the only skilled member of Lizard Squad.
- deleted 12y ago[deleted]
- ryanlol 12y agoJust because someone knows who I am does not mean that'll matter when it comes to proving things in court, which in real life isn't as easy as one might imagine. >he probably won't get out for a while If only I'd get sentenced in the first place.
- bobcostas55 12y agoHow the hell do these little kids get control of big botnets?
- ef4 12y agoThe bar is pretty low. When there are tens of millions of unpatched machines floating around on the internet, and hundreds of weaponized exploits already written by other people, all it takes is patience and lack of good judgement.
- hysterix 12y agoThe reply to your question is already on point. There is a sickening amount of open systems on the net. I know zee used tends of thousands of routers as only some of his ddos tools. I also know of dudes who wrote custom scripts specifically for zee's ddosing, would scan for incoming connections matching whatever signature identified at the time, automatically connect to the router using whatever exploit to get in, change the root pass and restart it. Zee got his net taken away from him numerous times hitting the wrong people. But yes in a nutshell, the digital world is mostly unprotected open and unlocked houses, with little pockets of protected castles here and there, and some locked houses too.
- meowface 12y agoBy incoming connections, do you mean web visitors who fell victim to CSRF/XSS exploits in their router management web panels? Or was he hijacking routers another way?
- hysterix 12y agoI don't know if zee gained any skill over time, but I believe he simply used public exploits. So for example remote command injection vulns: http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20598 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20602 http://en.1337day.com/exploit/description/20671 http://en.1337day.com/exploit/description/20671 Then it is just a matter of figuring out where these routers are, and then writing a few scripts to exploit and command them in mass. I don't think CSRF/XSS would net him the vast numbers he'd need to make a significant ddos. And to more specifically answer your question, by "incoming connections", I mean like monitoring the ddos via netstat on a box zee was actively attacking.
- mikeryan 12y agoHe's got a few articles up on that touch on this. http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/whos-in-the-lizard-squad/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/ http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-...
- zo1 12y agoBoth those links are currently unavailable for me. However, their content is still available on the main page if you scroll further down to the relevant blog posts.
- neotek 12y agoKrebs is really well connected to the underworld, plenty of people pass him information confidentally, just like any other journalist. He also understands this field far better than most people, so although he probably did find them "easily", it probably wasn't "on his own" and it almost certainly wouldn't have been anywhere near as easy for you or me to do it.
- freshyill 12y agoThe article says they knocked him offline only briefly, but I'm actually having trouble loading krebsonsecurity.com right now.
- vlad003 12y agoIt looks like it's unstable. I can connect to it occasionally but most of the time Firefox is saying the connection was reset.
- drzaiusapelord 12y agoIts up now. Tops story is about the lizard squad. This is an interesting tidbit: >These two services, like most booters, are hidden behind CloudFlare Wow, is cloudflare so poorly run they have no idea they're hosting/caching/accelerating Lizard Squad tools? CF plays up itself as this strong security minded service, but it looks like they're in bed with the blackhats. I was on the fence with them, but now I think I'm just going to roll my own mod_security/mod_evasive proxy and call it a day. If they dont care about or can't detect these types of clients, then I don't want to do business with them.
- newaccountfool 12y agoUntil cloudflare are contacted by police then I see no reason to drop a client.
- jcrawfordor 12y agoIndeed, this might be useful to law enforcement - it means that there's at least a bit of info about our criminals in possession of a US-based company that won't have to be chased for months to comply with a warrant/subpoena.
- MichaelGG 12y agoCloudflare takes the right approach of being content neutral.
- 12y ago
- Buge 12y agoIn the past he's also been swatted and had drugs mailed to him, and a flower cross saying RIP Brian Krebs.
- icanhasfay 12y agoMy favorite might have to be the time when someone cut down a tree in his front yard. https://twitter.com/briankrebs/status/334422653475627008 https://twitter.com/briankrebs/status/334422653475627008
- 13 12y agoI'm at a complete loss as to what cutting down a tree is supposed to achieve.
- dmix 12y agoIntimidation? She is also wearing a mask and is extremely creepy. I agree with the OP, this is creepier and more personal (being his home) than getting drugs mailed to him. Or continually DDOS'd..
- ceejayoz 12y ago"I know where you live and am prepared to commit crimes" sends a bit of a message, don't you think?
- nemo 12y agoThey wanted to show they were such l33t hackers that they could even hack down trees?
- ProAm 12y agoDoes Twitter hijack everyones back button on Mobile? Im using FF Mobile and whenever I visit a twitter link I have to close the tab because I cant go back.
- jacquesm 12y agoStrange use of the word favorite.
- sroerick 12y agoHah, why does CNN have a "Happy Birthday Playstation" message on this page?
- ExpiredLink 12y ago> Lizard Squad ruined Christmas for people around the world Come on!
- victormx 12y agoA few days ago I saw how some children felt the Christmas ruined and was the worst of his life by not playing GTA online with their friends, I think the most disturbing should not be the attack but how people are seeing the dates which should in more family matter junction and other things.
- Argorak 12y agoSome people decided to spend their christmas gaming with other people. That is a valid wish and an enjoyable group activity. And they were obviously "ruined". How would you feel if you went to an amusement park with your family and found it is closed, because a group of kids spent the night destroying things?
- acheron 12y agoWhy would anyone be able to prevent someone from connecting to another machine to play a game? Oh, because they use centralized servers. Well, don't do that. Live by the cloud, die by the cloud.
- justizin 12y agoyawn, brian krebs is like the tom clancy of internet security
- tptacek 12y agoWhat does that even mean?
- Donzo 12y agoI think it means that he doesn't just print submarine articles that PR firms handed him. He actually digs through data, has sources, and engages in practices formally associated with journalism.
- justizin 12y agono, it means that i think he has an active imagination and is inclined to write fiction which is dramatic enough to sell ads.
- meowface 12y agoHe can be a little bombastic at times, but his reporting is solid and he's one of very few journalists left who does real investigative work.
- bhouston 12y agoBrian Krebs is a master of publicity, often a little predictable though.
- thirsteh 12y agoIs that supposed to be derogatory? Don't be peanut butter and jealous.
- bhouston 12y agoThis has happened repeatedly with other groups and he reports it to CNN or other news media and gets coverage. It was very brief outage on a really small site but it is good for lots of coverage on national media. I am not jealous, I think it is lame and not newsworthy. His site being down for less than an hour is not news. Seriously, why do you think I am motivated by jealousy? I am not in his space, have no interactions with him or his foes. I think it is not a newswirthy story. I stand by that.
- newaccountfool 12y agoI have to say that Brians recent posts seem a little pissy and childish in his wordings. He also stated facts that are untrue such as that most of Lulzsec are in jail...currently most of them are out and never served much time.
- mike_hearn 12y agoBig mistake. People who mess with Brian Krebs tend to end up fully doxed and arrested shortly afterwards. You'd think the blackhat world would understand this by now. Krebs is not a guy want to be investigated by.
- jonursenbach 12y agoYou really think people like Lizard Squad, who called their DDOS attack on Sony and Microsoft "security work", understand how the world works?
- joshmn 12y agoI don't think they take themselves too seriously. Nor should we.
- ChrisGranger 12y agoSome people have to learn everything the hard way.
- trippy_biscuits 12y agoLizard Squad was already being doxed, 27 Dec 2014. http://i.imgur.com/vQTaCKx.png http://i.imgur.com/vQTaCKx.png
- pmalynin 12y agoKrebs Cycle....
- BillFranklin 12y agoAttacks consisted of a briefly successful DDoS and this: > the group jokes incessantly about Krebs' hairline and proudly proclaims, "You can't arrest a lizard."
- sporkenfang 12y agoBecause clearly his hairline is the deciding factor in whether he can punt their stupidity back where it belongs.
- krschultz 12y agoWhat is the actual law that someone that engages in DDOS'ing violates? I feel like we might need one specifically for the activity. It's effectively the internet version of criminal mischief. It's not hacking and all of that, but it's also not something that we should just let go all the time. I'm getting sick of hearing about script kiddies DDOSing random websites, I'd be happy to see some fines.
- greenyoda 12y agoDDOS attacks are generally launched from botnets consisting of computers that are illegally accessed without their owners' permission. While the DDOS itself may not violate any laws, executing it via hijacked computers certainly does.
- PostOnce 12y agoExactly. Fining them isn't the hard part, finding them is. Spend $200K on an investigation to find a kid to fine him $10K? Maybe not worth the time and money unless it provably worked as a deterrent.
- jokoon 12y agohow can you sped $200k to find a kid ?
- omegaham 12y agoIf you employ a certain number of people, it's assumed that they're doing other things. When you have to devote them to a different project, you're doing a few things: 1. Making your staff work overtime. 2. Leaving other work undone. 3. Hiring new staff to make up for this. 4. Keeping redundant personnel on board in case something like this happens again. 5. Hiring temporary contractors and services to help you with this specific task. All of these cost money.
- PostOnce 12y agothe salaries for staffing a coordinated multinational police investigation and possible computer forensics contractors? All of the following need to be paid: Police agency in country where DDoS target resides, police agency in country where criminal resides, police agency in countries where dummy computers reside, etc? 200k was a random number but i doubt it's necessarily cheap to find any random DDoS-starter
- UhUhUhUh 12y agoThose attacks have the elegance of a sledgehammer and the content of a plastic bottle washed off on a beach. I am utterly uninterested.
- normloman 12y agoDoes anyone know lizard squad's motivation? Are they just out to get attention, or do they have some grudge against gaming companies? Regardless, their criminal behavior doesn't impress me or strike me as making a lasting impact.
- landr0id 12y agoIt looks like their motivation behind the holiday attacks on Xbox LIVE and PSN was to get following on their Twitter account to advertise their DDoS-as-a-service platform.
- dsl 12y agoFame.
- RunningWild 12y agoTheir parents didn't hug them enough.
- Cub3 12y agoHis latest tweet Looks like the Finnish kid Julius aka Ryan/zee was arrested in Lizard Squad roundup http://ow.ly/GFeeM