Gambling Sites Battle DDoS Attacks

the-dark-kangaroo writes "Gambling sites are fighting back against extortion from hackers using Distributed Denial of Service (DDoS) attacks. According to the report released by the BBC many of these attacks are coming from infected home PCs which have succumbed to a worm or virus. The gambling sites are bringing in reinforcements: Pipex, Cisco and security firm Energis are creating 'intelligent' traffic monitoring systems to help stop these attacks."

Comments

Where's my violin?

[mizhi]

I know these gambling sites are legitimate companies, but it seems the worms that most people get are advertising either porno shops or gambling shops.

It's difficult for me to feel sorry for gambling sites getting DDoSed.

Filtering doesn't save incoming bandwidth

[A1kmm]

The bottleneck is probably bandwidth, not CPU. A network of drones can send traffic in the GBit/s range, and even if these packets are not replied to and the CPU and memory resources can cope, a lot of damage will still be caused.

The only way to make this work is to block traffic at a site far enough back to cope with the level of traffic(and the size of botnets will only grow, so even a reasonably large network company could be knocked out).

Re:Filtering doesn't save incoming bandwidth

[Oddly_Drac]

"The only way to make this work is to block traffic at a site far enough back to cope with the level of traffic"

And build a list of IP addresses to allow the botnets' ISPs to cut their accounts until they speak to someone about not being a Typhoid Mary.

In fact, it's getting close to the time when we should be doing this.

Re:I try and try..

[LordNightwalker]

Yah, and I'd feel sorry for them if they'd play nice and stop writing worms to crawl blogs and paste poker spam in the comments. You wouldn't believe the amount of spam I had to clear from my blog comment area already. Imagine my surprise when I saw the same poker spam in the comments of every single post in my blog on some computer graphics project I'm working on... Feel sorry for them? Not really.

Re:Legal issues?

[LordNightwalker]

Cisco is just working on solutions against DDOS attacks; it's not Cisco's responsibility if that technology is used to protect the Pentagon or some online gambling site. Following your logic, Cisco is already in trouble because those online gambling companies already use Cisco hardware in their setup... And so is Dell, 'coz they made the PCs used by the casino staff, and so is the company who made the bricks for the building their HQ is located in etc...

See how ridiculous it gets if you stop to think about it? ;)

Re:I try and try..

[really?]

Two wrongs=right?? To each his own I guess.

Devils advocate...

[John Seminal]

Many extortionists are targeting net-based betting firms and threatening to cripple their websites with deluges of data unless a ransom is paid.

Okay, I understand that we're talking about gambling websites. But these same methods can be used to take down just about any website. Society makes the final call on what is legal and illegal. Some might say the hackers are using their ethics to take down a vice. But if that was the hackers goal, why ask for money? Second, the tax revenue gambling generates often goes to schools. By taking them down, it would seem harm is being done in unexpected places. Politicans are responsible for planning funding, and if a bubble bursts, the community is in trouble.

Second, do we want one, or a small group of people, telling society what they can and can't do? What if a group of Jehova's Witnesses hackers decided to remove ALL porn off the web. People would freak out. One man's utopia is another mans hell.

Re:I try and try..

[John Seminal]

But I just can't feel too sorry for them. I mean, I know it's wrong, but when you get into that business I'm sure this isn't really that uncommon. Gambling is a shady 'business' in the first place, so if you have to deal with other shady people to keep it going, then them's the breaks, buddy.

Would you prefer to deal with a bookie or a regulated buisness? At least the on-line gambling websites have to pay taxes.

Re:Legal issues?

[wildBoar]

The Colombian cartels are illegal in their own countries as well as in the US, the internet Gambling operations are legitimate companies operating in compliance with their local laws.

It is a big difference.

I'm afraid despite all attempts (wishes) to the contrary the US can't apply any law it likes on any country in the world.

Well, not without invading it first ;-)

Re:I try and try..

[really?]

Why is gambling a shady biz? I don't gamble myself, but as long as they don't come to my house and force me to gamble, I don't see the shady part.
Tax on those poor at math? Perhaps. But, why shady?

Hackers

[jnguy]

Why are a bunch of script kiddies being called hackers again?

Re:Hackers

[DingerX]

I think the hacker line is a troll man. Just call script kiddies/crackers/wire defrauders/pirates "hackers" and you automatically generate 25 indignant posts on slashdot from folks like us who remember when hacking meant turning a spare cassette port into an audio device, and a 1200-baud touchscreen vector graphics terminal was a hotrod.

Anyway, yeah, I'm surprised online gambling hasn't been hit earlier: here you have a huge industry that relies on a single technology for all its business, and is completely unregulated. But in such an environment, cyberextortion can be a dangerous game, since unregulated companies can always fall back on "brick and mortar" security. (That is, throw bricks through your window and mortar your house) And most societies in the world have excellent non-governmental agencies who specialize in protection and kneecaps already. A few hits, a little publicity, and problem solved.

In other words, the way to extort money is to promise protection from dDOS attacks. The ones who end up getting the dough will be those who do, whether the name is Cisco or Gotti.

Re:Prevention?

[gtoomey]

Working out whats network traffic is valid becomes the issue. eg you cant easily differentiate between a valid http request and one from a zombie. If you thousands of requests/second then the site may be effectively unreachable.

Re:I try and try..

[WIAKywbfatw]

Sorry but you're displaying your ignorance. Gambling is legal in most societies, and in some (eg, Hong Kong) it's a common activity that the majority of the population enjoy.

Betting on the result of a sporting event, or anything else, via a legally authorised bookmaker is no more shady than having a cup of coffee.

Just because you have this image of gambling that seems to be more to do with smoke-filled secret back rooms where you have to know the password and the guy behind the bar to get in than legitimate, publicly-traded and -scrutinied businesses that doesn't make it a reality.

The gambling sites being DDOSed aren't run by crooks, they're the legitimate and legal online presences of bricks-and-mortar bookmakers as well as internet gambling start-ups.

The root of the problem

[KiloByte]

Can't we finally cut the problem at its roots? And the roots are a criminally insecure poor-excuse-for-an-OS.

If your car notoriously breaks causing harm to other users of the road, you won't get your car's paper prolonged. If a company keeps producing cars that damage other users of the roads, that company has to replace/fix all the cars sold. Now, tell me why exactly Microsoft can get away with selling software that's harmful for the community at large?

Re:The root of the problem

[Anonymous Coward]

You could apply your argument to just about every aspect of modern society. The fact of the matter is that just because something causes SOME harm to society doesn't mean it should be eliminated.

A car (airplane, drug, clothing, computer, energy, food, tobacco, etc, etc) company that has defective products won't recall them unless the recall costs less than the problems caused. This includes hard costs as well as soft costs such as bad press and lower stock prices. I suppose the government could step in at some point, but between special interests and politicians unwilling to test their political spine you won't see this happen very often to a major corporation.

The fact of the matter is that the bulk of Microsoft's consumer Retail and OEM software (Windows and Office) is still quite cheap when ammortized over its lifetime (typically a few years per purchase) AND the overwhelming majority of people are fine living with the defects. Furthermore there isn't a truly viable replacement for Windows that is ready today should the market revolt against Microsoft tomorrow. Sure Linux could fit the bill much of the time, but there are billions if not trillions of dollars worldwide that are invested in 3rd party software that runs solely on Windows. Replacing that would take years.

Lastly - Windows can be made safe. It can be hardened and tweaked more than just about any other operating system out there. I don't blame Microsoft as much as I do large OEMs like Dell, Sony, HP, IBM and Gateway. These are the people who are SELLING the software, typically pre-configured, to be open. They could easily sell their products locked-down from the factory. They choose not to.

Re:The root of the problem

[Spy Hunter]

Because the Internet is not controlled and maintained by the government like the road system is. (Purposely, I might add, and with many benefits. If the government controlled the Internet it would be much different than it is today. It would probably suck.) That is why your analogy is flawed.

The market must act as the force that keeps Microsoft honest. Why the market has not done so is an interesting question. My theory is that since Windows *is* the computer for most people, any problems with Microsoft software are simply blamed on computers in general and seen as unavoidable. Though if you look at interest in Linux, a large chunk has been due to the perception that it is more secure. So there have been some effects. Apple also benefits from this, to a lesser extent I believe.

Re:NAT

[ZorbaTHut]

Oh, yeah. That'd be great. Instead of having to squeeze the public services I want behind a single IP, I'd just be screwed. That's a real step up.

Encouraged? Sure. Forced? I like having my open static IP, thanks.

Re:I try and try..

[WIAKywbfatw]

Casinos seem morally irresponsible to me, letting people run up debt to the point where they put a burdon on society in order to make a profit. I'm sure this is an argument for another place at another time, but that's how I feel.

I'm sorry, but in the US couldn't you apply that label to hospitals too? Medical bills that run into 5 or 6 figures aren't uncommon and it's a sad fact that the biggest factor in personal bankrupcy in the US is unpaid (and, more importantly, unpayable) medical bills.

And, out of interest, where do you draw the line at what is and what isn't gambling? Is playing the lottery gambling? And in a so-called "free" society, shouldn't you be able to do what you want with your hard-earned cash? Does anyone really have the right to tell you how you can and can't use it to entertain (and possibly enrich) yourself if you're not hurting anyone else in the process?

To be honest, I'm not in favour of unchecked gambling, but then I'm not in favour of unchecked alcohol abuse either, but you don't see church and state bringing the roof down on that ballgame, do you?

Re:I try and try..

[Anonymous Coward]

Two wrongs=right?? To each his own I guess.

This is _NOT_ an example of two wrongs making a right! I can't believe the crap that gets moderated up here as insightful!

If you consider a DDoS against gambling sites to be a wrong (I don't), then fair enough. But some guy not feeling sorry for them is not a wrong! He can feel any damn way he likes. His opinion is neither a right or a wrong, it is just his opinion.

Re:NAT won't help

[olla podriga]

NAT won't help at all. Most malware comes through mail, browser vulnerabilities or users that click on everthing without thinking (while logged in as admin of course). Besides, with forced NAT, people would start complaining that their favourite P2P or online game won't work.

Re:I try and try..

[vandan]

Sorry but you're displaying your ignorance. Gambling is legal in most societies ...

Sorry but you're displaying your arrogance. Just because something is legal doesn't mean it is ethical. I could give you plenty of examples, but I'll leave it up to people's imagination.

Betting on the result of a sporting event, or anything else, via a legally authorised bookmaker is no more shady than having a cup of coffee.

What sort of a dim-witted comparison is that? Gambling devastates many people's lives. That makes people who push their gambling 'services' onto us 'shady'. Having a cup of coffee has nothing to do with it.

Just because you have this image of gambling that seems to be more to do with smoke-filled secret back rooms where you have to know the password and the guy behind the bar to get in than legitimate, publicly-traded and -scrutinied businesses that doesn't make it a reality.

You don't need smoke-filled, secret rooms or passwords to have a shady business. You just need to have a deficient conscience, or excess greed, and an online gambling site. Then you sit back and wait for the poor suckers to 'click', 'click', 'click', 'click', 'click', 'click', 'click'. People don't rock up to a gambling establishment and try their luck once. They stay their until they're out of money. You can disagree with me if you like, but every time I go to a casino ( get dragged their by workmates once a year or so ), the above is what I witness.

The gambling sites being DDOSed aren't run by crooks, they're the legitimate and legal online presences of bricks-and-mortar bookmakers

I don't think so. People running gambling sites are far more likely to be dodgy than those in a physical establishment. It's far easier to police a 'real' gambling business than a virtual one, especially since a virtual one can hide it's location and reside in a place that has no regulation.

Also, I get a fucking shitload of SPAM from gambling sites. Right away that says to me that the people running the sites are far from innocent, law-abiding citizens.

You seem to try to make the point throughout your post that because something is legal, that somehow blesses the activity. I suppose the opposite of this is that everything which is illegal is patently evil. Both points are absolutely ridiculous. There are plenty of things which are legal which are evil:

- selling carcinogen-soaked cigarettes
- selling alcohol
- selling weapons
- having a monopoly ( esp. a media monopoly )

Likewise, there are plenty of things which are illegal which are quite harmless ... possibly even good ... and should be legal:

- recreational drugs
- not voting if there's no-one worth voting for ( Australia )
- being a member of the Iraqi resistance

I'm pretty sure that I'd get disagreement on all of the above points. This reinforces my argument that:

- you should never use the law to enforce ethical behaviour in private matters
- you should never use an activity's legal status as an indicator of it's ethical status

Back to the topic of the actual article ... I don't really relate to the DDOSers ( they're probably just other gambling sites or spammers who haven't been paid for their advertising services ), but I couldn't give a toss about the online gambling sites.

Re:Blame the right person for that

[geminidomino]

Yeah, because we know they'd NEVER have an AUP like that just for show.

If they don't immediately terminate spamming affiliates,they are knowingly profitting from the spam. If the actually PAY OUT to the spammer, then they are condoning it.

This tends to be the case, or else it wouldn't be a problem.

Re:I try and try..

[csteinle]

So, selling alcohol is "evil", but recreational drug use is morally acceptable. What? Way to go on the consistent argument there.

ISPs

[gilesjuk]

It should be part of your ISPs AUP that you take precautions to prevent your computer becoming infected. In fact I would suggest that it be made possible that you aren't allowed a net account unless you pay for anti-virus software as part of the signup process (if using Windows).

Everyone I know who is using Windows is getting sick of all the viruses and junk, It tires me to hear about it and I'm now at the stage where I say "put up with it or let me install Linux". At some point the pain level will grow such that they will want to try Linux.

Re:I try and try..

[Sircus]

You also don't see "Fly with us! We'll cram you into a tiny seat, next to a fat guy, have former-prison-warder-host(esses) serve you luke-warm food at 3-hour intervals and play a film with anything even potentially offensive cut from it!" ads for airlines. You see wide, open spaces, people sleeping like babies and beautiful hostesses caring for people's every need.

It's common practice to advertise an image of something which bears no relation to reality.

Re:I try and try..

[azaris]

I look at it as a zero sum gain industry. It only re-distributes wealth. It has no wealth creation or real value growth.

Well duh. Most industries today create nothing tangible. Think all of the services you can buy that generate no physical substance. Wash your car for $10, nothing of value is generated. In fact, the act of washing a car consumes large amounts of natural resources in the form of energy consumed and detergents that must be recovered before they are released into the natural water reserves. Does this mean we should abolish all carwashes?

The economy isn't really about creating goods for consumption. Yes, those things are important for sustaining people but in reality as long as there is sufficient natural resources being converted to goods, the rest of the society can just spend their time trading money from one hand to another in exchange for services like gambling. Like it or not, it IS a part of the economy and provides livelyhood for hundreds of thousands.

Many industries such as farming take labor and make a product. Other than entertainment value, gambling has no product.

You can probably come up with a dozen other industries that similarly offer only entertainment.

All gambeling money is re-distributed with no net gain. That's the thing I have against the state lottery or state video poker. The state provides no product and just takes the suckers money.

You can justify all you want, but the truth is that any objection against gambling is purely moral. I'm always amazed at how ass-backward conservative Slashdot is when it comes to things like gambling, but I guess that's the US mentality of "gambling evil" at work.

I would rather see the state earn money by providing services such as affordable broadband such as in Washington State. The state is providing $40/month broadband with telephone and 5 Gig bandwidth. It beats video poker.

Did it ever occur to you that maybe the proceeds from the state lottery are used to subsidize such projects? Duh indeed.

Hate It

[CypherXero]

I've gotten SO MUCH spam on my blog and via e-mail about online poker, that I HATE poker now, and I've never even played it. If the gambling sites are worried about DDoS, tell those bastards to stop pissing off the rest of the world.

US-Centric Shortsightedness

[billstewart]

They're not going after the online casinos because they're opposed to vice - many of the extortionists appear to be Russian mafias, who are perfectly happy to have vice around as long as they get a piece of the action. They're going after the online casinos because they're cranking a lot of money, and they depend on the internet, and their internet connections are easily attacked, and the attacks are relatively untraceable.

You're thinking about this as a US couch potato that believes that what your government tells you applies to the rest of the world, or even to your part of the world. Stop that silliness.... In most of the world, gambling is a legal activity, though many governments require licenses for gambling houses. Tax revenue from gambling is simply tax revenue, like any other business tax revenue. The connection to schools is popularly used in the US when state lotteries are trying to convince the public that there's some moral difference between gambling with the state vs. gambling with your local bookie, which lets them continue the hypocrisy of banning the local bookie's operations.

If you don't like small groups of people telling society what they can and can't do, work on changing your government. The US Feds have tried to stop Internet gambling, and any interstate gambling activities, and are relatively successful at it within the US, and many states are pretty aggressive about it as well. Senator John Kyl is one of the worst offenders. Then there's this drug prohibition thing, which is designed to fund gangs and terrorism and cause government corruption around the world, and the US has bullied a lot of other countries and even the UN into treaties agreeing to let the US politicians' idea of good vs. bad drugs be enforced on everybody else. And then there was that sting a few years ago where the US Feds got some California pornographer to mail videotapes to Tennessee so they could bust them for obscenity, because "community standards" in Tennessee are different than in California.