Death Knell For DDoS Extortion? 101
Ron writes "Symantec security researcher Yazan Gable has put forward an explanation as to why the number of denial of service attacks has been declining (coincident with the rise of spam). His theory is that DoS attacks are no longer profitable to attackers. While spam and phishing attacks directly generate profit, he argues that extortion techniques often used with DoS attacks are far more risky and often make an attacker no profit at all. Gable writes: 'So what happens if the target of the attack refuses to pay? The DoS extortionist is obligated to carry out a prolonged DoS attack against them to follow through on their threats. For a DoS extortionist, this is the worst scenario because they have to risk their bot network for nothing at all. Since the target has refused to pay, it is likely that they will never pay. As a consequence, the attacker has to spend time and resources on a lost cause.'"
Still potent (Score:2, Insightful)
DDoS will be around for a while still
Re: (Score:2)
Not the point (Score:4, Insightful)
If you can choose two ventures, one of which will almost certainly generate revenue with very little risk to you, and the other of which often generates no revenue at all but poses a high risk to your liberty and your resources, which do you choose?
Re: (Score:2)
I would state the reason somewhat differently though. A traditional extortion racket is called protection for a reason - to get paid the extortionist has to provide a guarantee of safety from attack against other gangs, not just his own.
The DDoS extortion rings can't stop any attacks other than their own. So they cannot provide a guarantee of service. Paying up does not guarantee service.
Ano
Re: (Score:2)
All things considered the logical response to targetting by a DDoS attack is to call the police first, then call a DDoS protection specialist. The only time it makes sense to pay up is if you can do a sting and get the perps arrested.
Hmm, I'd go for a slightly more proactive approach. Just get your pipes from an ISP that provides DoS protection. That way when they send the DDoS attack your ISP will call and say, "hey we're rate limiting some really suspicious traffic. Do you want to log on and take a look and decide what should be dropped?" Then you can call the police.
Somebody please think of the Zombies! (Score:2, Funny)
Maybe not even spam so much... there is worse: (Score:5, Interesting)
I mean, what better place (from an objective POV) to park warez and illicit data (e.g. certain types of illegal pr0n), than on some unsuspecting schlep's machinery?
The mobsters then charge admittance by way of proxies (conceptual term, not 'w.x.y.z:8080') and advertise by way of spam?
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Re: (Score:2)
Only if egress filtering were outlawed by congress, or a serious serious hole was found in the 2.6 Linux kernel. One of the other things that makes botnets yummy for spam is the fact that port 25 is often NOT filtered on egress, so if your able to escape / inject and get a shell, you're home free.
Bot's aren't so hot at accepting incoming connections because the
Re: (Score:1)
No extortion ever, then! (Score:3, Insightful)
Re:No extortion ever, then! (Score:5, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
In the present scenario the potential extortionist has a choice - spam or extort. Spamming is currently more profitable, or so the argument goes, and therefore, there are fewer extortions.
That's a nice theory, but I don't think that is what happens in practice. From what I've seen no one runs a botnet that is constantly sending spam or performing attacks. They spend most of their time idle. If you know the right places to look there are some nice Web interfaces where you can transfer money from paypal to rent out control of a botnet for a set amount of time. The operator doesn't care if you're spamming or DDoSing people, only that he got paid. Thus, while people may find spamming more prof
Re:No extortion ever, then! (Score:5, Insightful)
Way back when, kidnapping was a pretty good way to make some quick cash. Grab somebody's significant other and tell them to deliver money to see them again. The automobile was pretty new and you could grab somebody and get them far enough away in a short amount of time that local law enforcement couldn't deal with it.
Thus, the feds were immediately brought in to any kidnapping case. Because the FBI had kidnapping specialists who knew all the angles, kidnapping for ransom became very unsuccessful. Nowadays, you rarely hear of a kidnapping case with a ransom demand here in the United States. It's just not worh it.
Re: (Score:2)
This guy threw in a new wrinkle: http://www.firstcoastnews.com/news/florida/news-a
He obviously has some self-esteem issues.
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:3, Informative)
If.
Re: (Score:3, Funny)
Re: (Score:1)
Re: (Score:1)
Revenge (Score:3, Funny)
Money isn't everything (Score:2)
..at least not directly. A DoS attack, whilst it may not win money, is a very useful thing indeed if you are taking down competition, or trying to affect the share price of a company, or taking on a political enemy.
We may be seeing the fall of random attacks, but attackers will still be busy doing jobs for money.
Re: (Score:3, Interesting)
On the relative benign side we know that people crack security just to see if it can be done, to test their wits against a verified expert. On the less benign side, fanatics might attack because they t
Re: (Score:2)
Right on. Richard Dawkins (noted Atheist) has a forum which was DoS not long ago (the DoS'er bragged about it too, on their own forum). Sad, really. The forum stayed up, but was slow, so it wasn't that bad. T
What??? (Score:1, Troll)
Tell that to this guy... http://www.microsoft.com/presspass/exec/billg/defa ult.mspx [microsoft.com]
The payment risk has also prolly risen as well. (Score:5, Interesting)
They still want the money somehow, and getting it bears higher risk with extortion than by simply grabbing dough under-the-table from spammers.
I suspect (okay, hope?) that spamming will begin to lose its profit motive as well, as users become computer-literate enough en masse to ignore emailed pitches... making the reward not really worth the effort. Even the dumbest user can get ripped off only so many times before they either a) go broke, or b) figure out that maybe they should stop buying stuff from spammers.
Re:The payment risk has also prolly risen as well. (Score:5, Insightful)
You can't put a pricetag on being an asshole to the internet community.
Re: (Score:2)
Really lame passion, but so it goes.
I don't think that's his concern.. (Score:3, Insightful)
Suggesting that DDOS attacks will go away would be silly, but as a business concern which security companies have whipped up to a somewhat feverish pitch this is a sign that these concerns are changing. Anyway, DDOS solutions where probably nowhere near as lucrative as other more trendy areas of network protection (spam/worms/malicious web-con
Re: (Score:2)
It's a numbers game. If you are getting millions of spams into inboxes worldwide daily you don't need that many people to buy your product/service to make significant profits. 1% of 1 million is still 10,000. (And in the US, 1.5% if us have an IQ BELOW 60.)
Don't worry guys (Score:1)
it is likely that they will never pay (Score:1)
Re: (Score:2)
Even if you do, would you trust other criminals not to extort you once it's known that you have a history of caving to such threats?
Bot network? (Score:3, Funny)
The extortion part is difficult though, since the target must decide whether to comply with your demands (i.e. payment) or else just give you a good thrashing.
Re:Bot network? (Score:5, Funny)
I think I see where you are coming from; my ISP is some kind of DoS extortionist... if I stop paying them they DoS me.
Help, I am being exploited!
Re: (Score:2)
(Groucho or Harpo, I forget which).
botnet for personal projects? (Score:4, Funny)
Perhaps we could make them into a self-aware AI one day, imagine that. an AI running on poorly secured Windows boxes
Re: (Score:1)
Re: (Score:3, Insightful)
Re: (Score:2)
Especially if those poorly secured Windows boxes were running Windows for Warheads/Warships...
Re: (Score:3, Interesting)
Funny, but unlikely I think.
Botnets wouldn't be all that good for supercomputing, except maybe of highly parallelizable problems (voluntary networks like SETI@home already work on those). Botnets don't have the fast communication links between nodes which are vital to the performance of most supercomputers... which often incorporate fancy network technologies like Infiniband or Fiber Channel or
Re: (Score:2)
Prices from my inbox:
50Mbps sustained, burstable to 100mbit, $2,000/month.
100Mbps sustained, $3,700/month.
300Mbps sustained, $10,800/month.
(Of course, there's also the fact that botnets are a lot harder to isolate and blacklist than a single server.)
Bingo.
Virus? (Score:2, Funny)
Re: (Score:1)
We Don't Know (Score:2)
DDoS attacks were profitable for years. The author is citing challenges that have always been a part of the practice as the reason they turned to an older technique - as if the idea hadn't panned out. As far as the risk involved, everything I've heard about people responding to botnets was pretty much about people watching to see how big a problem it was. The only thing I've ever heard about someone fighting back was this guy [slashdot.org], and unless there were a lot more like him over the following year than I heard
One assumption though... (Score:5, Insightful)
Re: (Score:2)
So the moral of this story, kids, is never give in to the blackmailers.
Re: (Score:2)
The victim still pays indirectly (Score:4, Insightful)
Re: (Score:2)
Things that might be transported via botnet: pr0n, spying, video downloads, terrorist messaging, and apparently none of the RNC messages. Anyth
Re: (Score:2)
If it hasn't happened already, all what someone needs to do is get their competitor onto the front page during a critical service.
Re: (Score:2)
I think it has been done or attempted. The name escapes me right now. The few details I remember was that the owner or a manager asked an employee to do it, the employee did it and then the management denied ever asking.
Interesting Idea but (Score:2)
So while I think
Re: (Score:1)
Someone from Symantic Said That? Ha, ha, ha! (Score:1, Flamebait)
Symantec security researcher Yazan Gable has put forward an explanation as to why the number of denial of service attacks has been declining (coincident with the rise of spam). His theory is that DoS attacks are no longer profitable to attackers.
Surely he meant it was because their super efficient Windoze clients had secured the world and saved us all from this and other dastardly threats! No? Oh well.
Re: (Score:1)
Re: (Score:2)
Believe me when I say, Yazan doesn't care whether or not people are running Norton's products.
Oh, I can believe that and I'm sure Yazan is good at what he does. That's not what amused me.
Why even bother to make good on your threat? (Score:3, Insightful)
Re:Why even bother to make good on your threat? (Score:5, Informative)
No individual extortionist wants to actually expend the resources to make good on his threat... but all extortionists recognize that if NO ONE carries out their threats, they will have no power over the victims.
Re: (Score:1)
Re: (Score:2)
You can't lose what you don't have, and the victim has little way of knowing if you are serious anyway.
Re: (Score:1)
From my experience (Score:5, Informative)
-give us $ or we shut you down.
-a small quick ddos to show you they can.
-you say "no thanks", so now they ask for $$$.
-a little bit longer ddos because you pissed them off.
-now they ask for $$$$$. which you certainly are not going to pay.
-another little ddos, more email threats of looming death and destruction, they are "leet" after all.
at this point you begin to factor outages and lost revenues into the business plan, you call ISP's, you consider calling the FBI.
they eventually go away. The best advice we got was from someone who has a "relationship" (pronounced cashcow) with a ddos'r. The scam is that they are looking for regular clients that they know can/will pay, and that they can hit up when they need cash. The word has gotten around that if you pay once, you'll pay twice. At least in the business of online casino's everyone has begun to understand that you just dont pay, ever.
Posible DDoS'r Conversation (Score:1, Funny)
"Oh God...anything but that! I'll Pay!"
Assumptions (Score:1, Interesting)
Think about it. If you run a large corporation that downtime means losses that can run into the millions of dollars even for a short duration, add to this the cost of untangling any sort of mess associated with this downtime and that's a heafty bill. It would be stupid to risk the possibility of losing money (and possibly clients) due to downtim
Re: (Score:2)
in the case on online extortion, so what if you bankrupt them - you don't care, there are thousands upon thousands more marks out there.
spammers use DOS too... (Score:1)
People are better at security (Score:3, Interesting)
more DDoS prevention today as well (Score:4, Interesting)
Another factor why the DDoS extortion of today is less profitable than a few years back is the existence of mechanisms to mitigate attacks more effectively. Companies like Arbor Networks and Cisco make products that let enterprises and Service Providers quickly flip a switch to redirect and protect legitimate customer traffic. I helped design the Sprint IP Defender [sprint.com] solution, providing Sprint customers both quick notification of a security event AND the option to circumvent the issue. This takes all the control away from the extortionists.
Naturally, being employed in the managed security space, I have a dichotomy of interests that should not be forgotten - yes I want to see DDoS incidents being eliminated BUT yes I work for a company where fear of an incident leads companies to buy services from us which in turn drives up my 401k. There is big business in fear, but hey, if you lose $100k in revenue every 10 minutes your network is down, it only makes sense that you protect that income stream. Anyways, for every one extortionist, there are three script-kiddies hanging out in #l33tddos on EFnet wanting to see the level of damage he/she can impose.......
G'night all.Re: (Score:2)
Anyways, for every one extortionist, there are three script-kiddies hanging out in #l33tddos on EFnet wanting to see the level of damage he/she can impose......
Yeah, I've seen a number of session captures from botnet control networks. A lot of botnet operators are simply renting out time on their botnet and they don't care if you're sending spam for profit or trying to DDoS the americans. One session in particular was controlled by a guy attacking Denmark IP blocks during the whole mohammed cartoon debacle. It took the guy multiple tries to figure out the simple commands to launch an attack, he targeted a block of cable modems with no real value and he attacked
It depends on the hosting priovider too (Score:2)
Re: (Score:2)
I've heard that there are some hosting providers out there that are so well connected that any attempt to DDoS them just shuts down one of their upstream links, without any significant effect on global availablity of the web sites they host.
I can understand how such a thing might happen in the short term for a regular DoS attack, but why would a DDoS attack not be incoming on all their upstream links more or less equally? Obviously if you have enough bandwidth it will only clog your smaller pipes, but that is a lot more expensive of a proposition in several ways than mitigating the DDoS using standard routing techniques.
I think the real reason is: (Score:1, Interesting)
There is no real threat. You will never get killed/injured it is just about numbers. And since: If you pay once you will pay twice (and thrice...) is so true it is better/cheaper to never ever pay and just take the pain once. You will just loose chash no fingers!
There is no way to protect a turf. If I pay a) then b) could extort me also or even worse a) could pretend to be b) or c) now to extort even more money. I
No different from other threats (Score:2)
Doesn't work? (Score:3, Insightful)
Most businesses who refuse to pay up get someone in quickly to prevent their internet tubes getting clogged. Either that or (if it's cheaper) just let it happen, and find a way around it or ride it out. Either way, they won't actually publicise the proposed extortion as it's bad PR for them. Similarly, if they do pay up, nobody ever finds out about it - so there's no PR again. (Obviously there are exceptions in both cases, but for every exception yo