Taking on an Online Extortionist

An anonymous reader writes "When an online exortionist comes a knocking, threatining a DDoS, do you pay or fight? For many, paying may seem like a sensible option when compared to going out of buisness. CSO Magazine has a riveting article about how an online gambling site and a DDoS specialist teamed up to take on such an extortionist. When everybody else was rolling over and paying, this company risked its very existence to fight back. From the article: '"The attack went to 1.5Gb, with bursts up to 3Gb. It wasn't targeted at one thing. It was going to routers, DNS servers, mail servers, websites. It was like a battlefield, where there's an explosion over here, then over there, then it's quiet, then another explosion somewhere else," says Lyon. "They threw everything they had at us. I was just in shock."'"

Comments

oblig Churchill

[isecore]

"We will fight them in the CAT5, on the routers, in the packets. We will never surrender"

Or however he said it :)

Re:oblig Churchill

[sqlgeek]

"We shall not flag nor fail. We shall go on to the end. We shall fight in France and on the seas and oceans; we shall fight with growing confidence and growing strength in the air. We shall defend our island whatever the cost may be; we shall fight on beaches, landing grounds, in fields, in streets and on the hills. We shall never surrender and even if, which I do not for the moment believe, this island or a large part of it were subjugated and starving, then our empire beyond the seas, armed and guarded by the British Fleet, will carry on the struggle until in God's good time the New World with all its power and might, sets forth to the liberation and rescue of the Old."

Re:oblig Churchill

[ShaniaTwain]

"I may be drunk, Miss, but in the morning I will be sober and you will still be ugly."

Re:oblig Churchill

[Knara]

The sad thing is that I remember that speech entirely because its used as an intro to the Iron Maiden song "Aces High"

Re:oblig Churchill

[kfg]

We really need to put a stop to damned terrorists and insurgents like this.

KFG

Re:oblig Churchill

[3770]

Would you have been happier if you remembered it because you were there in person?

God knows your /. ID is low enough that it might be true. ;)

Re:oblig Churchill

[RichardX]

Churchill definitely had some of the best quotes in history.
He also looked like every baby ever born.
It's true! all babies look like Winston Churchill.
Quite scary, really...

Re:oblig Churchill

[mcmonkey]

"we shall fight on beaches, landing grounds, in fields, in streets and on the hills"

Hay Winston, why not try fighting them in Germany?

Re:oblig Churchill

[Pig Hogger]

Lady Astor, first woman elected to the House of Commons, to Winston Churchill:

-- If you were my husband, I would poison your coffee.

-- If you were my wife, I would drink it.

Re:oblig Churchill

[sphealey]

Me? I'm just this guy, ya know?

I hear ya.

sPh

Re:oblig Churchill

[flink]

And some pretty questionable ones:

"I do not agree that the dog in a manger has the final right to the manger even though he may have lain there for a very long time. I do not admit that right. I do not admit for instance, that a great wrong has been done to the Red Indians of America or the black people of Australia. I do not admit that a wrong has been done to these people by the fact that a stronger race, a higher-grade race, a more worldly wise race to put it that way, has come in and taken their place."

He also had no problem with using gas to put down uprisings by colonized indigenous peoples. I'm not saying he's a saint, just pointing out that popular leaders tend to get viewed through a rose colored filter.

Re:oblig Churchill

[shreevatsa]

"History will be kind to me, for I intend to write it"
--Winston Churchill

Re:oblig Churchill

[PatMouser]

Bah.

Re:oblig Churchill

[donutello]

We shall fight in France and on the seas and oceans; we shall fight on beaches, landing grounds, in fields, in streets and on the hills.

Hey, sounds like our last family vacation!

Re:oblig Churchill

[mikael]

Humbug.

Re:oblig Churchill

[mikeswi]

_Selling_ material was how we justified it to an isolationist Congress and population. Actually, we _lent_ most of what went over because England was running out of money. And we didn't want it back once the war was over.

Plus several squadrons worth of American figher pilots went over to help before we declared war.

Plus our navy was fighting an unofficial war with the German U-boats for about a year before we went to war while we escorted the convoys heading from Canada to England.

FYI, we're just as grateful to England for remaining a friend ever since. Although personally I wish your government would try to hold mine in check rather than just going along with everything Bush does. Your government may be our friend but I don't think your people like us very much at this point.

Re:oblig Churchill

[kalamazoo904]

Because he knew England didn't have the manpower for an amphibious landing in France or Germany. They'd sent troops to France, but the incompetency of the French High Command in the face of Blitzkreig forced the Dunkirk evacuation.

That's where the line about "the New World coming to rescue the Old" comes in -- Churchill knew he couldn't invade France until the US entered the war. He knew that was likely by early '42, i.e., about two years after that speech. If Pearl Harbor hadn't happen, Roosevelt was prepared to make German attacks on American shipping a casus belli.

Did they teach you the history of WW II, or are you just being obnoxious?

Re:oblig Churchill

[drgonzo59]

And if it wasn't for ze Russians the Europe would have been the 3rd Reich today. Its amazing how much the West underestimates that Russians went all the way to Berlin to Hitler's bunker. I guess with the Cold War, the Russians just had to be evil, and while the Soviets defintely sugar-coated the history in their favor, I would not have expected that the "free" and "democtratic" US would also do it. Yeah I know, the Americans helped plenty,they gave the Ruskies Jeeps and other vehicles. But the still it those the Russians that died from Hiltler's and Stalin's hand.

Re:oblig Churchill

[mav[LAG]]

This is not to underplay the Russian fighting ability (a mere 40 of them in a grain silo held an entire German battalion at bay for 3 months at Stalingrad for instance), but in Stalin's words: "My two best generals are January and February."

Hitler wasted time putting down a silly uprising in the Balkans when he should have been invading, thereby delaying operations for a crucial six weeks and ensuring the Russian winter played a decisive role.

Re:oblig Churchill

[king-manic]

The Russians were actually allied with Germany, and would have taken no significant part in the war if Hitler had not decided that he wantesd Russia as part of his empire, and decided to attack them.

Just a little historical note, both sides were going to renege on that alliance/truce. Except the germans though they could gain the upper hand by a decisive pre-emptive attack. Their intelligence reported russia was marshalling it's forces to attack germany.

They got bod down in russia in winter and they got crushed byt the combined might of the cold and the ruskies.

Re:oblig Churchill

[Muhammar]

The speech was even better:

"we shall fight on beaches, landing grounds, in fields, in streets and on the hills. We shall throw bottles on them if that is what we have"

The sentence about bottles was actualy cut out by the BBC censor because the humor was too black. (UK had very few heavy arms left after fiasco in France.)

Re:oblig Churchill

[Mathieu Lu]

3 digit amateurs :-)

Re:oblig Churchill

[dokkeri]

Oh great... The one time something I have is large and the people want it to be small.

Re:oblig Churchill

[badmammajamma]

Early in his political career he said many many things considered politically incorrect (especially about women). As he got older he toned it down a lot more, although, I don't know if that's because he had a change of heart or just didn't want to deal with the hassle of offending people.

Certainly, he was no saint...not even close. Nor was he trying to be. He was simply trying to save his country and he was the perfect man for the job at the time.

Re:oblig Churchill

[davidu]

*yawn* ;-)

-davidu

Re:oblig Churchill

[Xtifr]

Actually, anyone with a UID below 4 or 5000 or so probably dates back to the early days before /. had accounts, and you really can't tell all that much about who came first or anything with numbers that low. I mean, I signed up the day they announced that that they were offering accounts, and I ended up with this crappy four-digit number! :)

Here's a tip

[dtfinch]

Don't respond. They'll think you didn't see their email.

Re:Here's a tip

[frikazoyd]

I would think in the situation that the e-mail was ignored, it would enrage the extortionist into firing a warning shot, one that would for SURE get the guy's attention. In fact, from the article, it looks like that is sort of what happened. He didn't respond, just first sought consultation and alerted his ISP. Then the extortionist sent a second threat, but not until he had crashed a few ISP servers to get some attention.

Re:Here's a tip

[suso]

Actually, in relation to that, what happens when your spamfilter marks such an email as spam. I guess you can say that's a major false positive.

Re:Here's a tip

[ReverendLoki]

I can't help but wonder how the extortionist might have reacted to an error reply:

MAILSERVER: Error, mailbox does not exist

Not saying it would necessarily work, and as it was probably sent to a published address, would at best delay the threat while lowering the extortionist's expectation of your ability to defend your network.

Re:Here's a tip

[bigberk]

When they fire that warning shot, you dump all the attacking IPs to a log and circulate the list to AHBL, Spamhaus, CBL etc so that the extortionist's zombie network is now worth half of what it was before. Zombies are only worth anything if they are novel. And you tell the extortionist that for each additional shot, their botnet monetary value will decrease by 10% or whatever.

Re:Here's a tip

[imuffin]

When I threaten to extort someone by email and they don't answer, I usually just deface their homepage with a big blinking red message that screams

READ YOUR EMAIL, DUMBASS!

---
watch funny commercials

Re:Here's a tip

[JimmytheGeek]

Depends. You can't forge tcp connections, which make really good DoS packets because they tie the target server up much more.

Granted: a raw bandwidth attack can use UDP, ICMP, or a TCP SYN, ACK, SYN-ACK or RST packet, and could be usefully forged.

There's a fairly riviting thread on the Intrusions list about a DDoS attack in Jan-Feb (may still be going on) that eventually involved some 80,000+ bots. It was defeated with Squid (on OBSD), as well as active upstream providers. The bots repeatedly went to load a file via http, which tied up the web server. Since the tcp connection was actually made, the src ip was known. The bots were apparently installed via drive-by download, rather than worm or email.

Re:Here's a tip

[Qzukk]

could be usefully forged.

Unless ISPs got off their asses and implemented egress filtering for packets leaving their networks. Cable modem in Florida spewing packets addressed from China? Holy shit, I think they're bogus! The closer you filter these bogus packets to the source, the less traffic any given filter has to deal with, PLUS the smaller network size it has to accept packets from, leading to a reduced chance of dropping or allowing the wrong packets.

Interesting article

[Nova1313]

Very long but very interesting. Glad to see they caught some of them. They mentioned a hacked icq account.. That just seemed odd to me since ICQ accounts are free.. Anyone know what they were talking about?

Re:Interesting article

[snorklewacker]

They prefer to use cracked ICQ accounts because it adds some misdirection to point to an existing entity, an older account may be less likely to be instantly shut off by automatic processes, and well, they're L33T H4X0RZ and cracking is what they like to do (at least the kids working for the extortionists -- the folks running the show are probably pretty rational organized crime types).

Re:Interesting article

[Roofus]

Wow, 4 replies and not one of them understand why.

ICQ accounts aren't named, they're numbered (you can assign names, but they were always changeable). Low ICQ account numbers are like 2 or 3 digit Slashdot ids....a source of pride.

The hacker probably gave Lyon a low ID account, and to those fuckers it's a nice gift for status.

Re:Interesting article

[golgotha007]

No no no, Russians sell stolen hacked ICQ accounts because everyone wants either an easy to remember ICQ# or a really low ICQ#.

I frequent these Russian forums frequently where they are giving away 5 digit ICQ# to the first person to read the post.

However, the most amazing thing is, if I had the ability to direct 10,000 zombie systems to attack websites for extortion money, you could bet that every type of online communication I engaged in would be done thru no less than 5 different proxies, for every type of service, with an excrypted tunnel between me and the first proxy, and with complete control of that first proxy to erase full logs afterward.

You think that these guys are brilliant, but they're really just a bunch of stupid script using kidhacks.

I would be interesting to know what percentage of the zombie machines were windows...

Even Slashdot?

[troc]

"They threw everything they had at us. I was just in shock."

I guess that includes getting a mention on Slashdot?

Troc

Re:Even Slashdot?

[kpwoodr]

Very true, this post could have much worse consequences than they could ever throw at you.

I have determined that my personal website would stand for less than 4 seconds if it were to receive a propper slashdotting.

Needless to say I don't take threats like this very seriously. Here are the options I see:

1. Give in and pay up like a good pansy
2. Form a team of cyber attack monkeys to do your bidding
3. Launch a counter offensive with a team of script kiddies and their IRC Bots
4. Contact the authorities and report the threat, block the IPs delivering said packets, carefully monitor your servers like a good admin, and prevent the traffic that you deem as harmful.

If they really threw all that much at you, it would take a very sophisticated attack to not leave a large enough trail to figure out where it came from and actually do something about it.

Re:Even Slashdot?

[alienw]

Looks like you don't understand how DDOSs work. They get a whole lot of hijacked computers with DDOS trojans installed on them. MSIE makes this quite easy. Then they launch a DDOS at a website. You can't "block" the packets on the server because by the time your server gets them it's too late -- they have already clogged up your pipe. In fact, the traffic will probably overwhelm your ISP unless they are very large. The only place to block them would be on the ISPs main router, and that's pretty hard to do given that there could be thousands of different bots and they aren't that terribly different from ordinary users (other than the amount of traffic they generate).

Re:Even Slashdot?

[Martin Blank]

I've had some experience with this, having worked at an ISP, and we got assistance from our own upstream provider (telco with terabits of connectivity) to start putting blocks in place. This filtered out a several-hundred-megabit flood on one occasion, and was demonstrated later again when Slammer hit (done on their own starting about an hour or so after the ISP world was so harshly awakened by it).

Re:Even Slashdot?

[caluml]

Is "gambel" in those "bad words" lists?

Re:Even Slashdot?

[Saxerman]

Speaking of mentions on Slashdot, has anyone else ever seen an article wherein someone was portrayed as such a complete shining genius? Anybody else find this even slightly suspicious?

I don't know... I found the last paragraph grated against his super-hero image:

That's right. Lyon is one of the good guys. Still, Lyon's heroics weren't possible without Mickey Richardson's resolve. It's easy to forget that as Lyon worked to save him, Richardson considered paying off the extortionists. Now Richardson has a better option. Pay Lyon $50,000 a year and he's protected. He doesn't have to worry about paying extortionist's protection fees.

I've always found there to be a rather fine line between insurance and extortion. If the story is true, he probably is one of the good guys, but he's merely tapped into the revenue stream the extortionists created.

Re:Even Slashdot?

[RexDart]

5. Determine the hacker's RL name, location, etc. 6. Contact an independent bounty hunter (Mad Dog, anyone?) to launch a "Denial of Freedom" attack 7. Tape the whole thing as a reality show so that G4/TechTV could have at least one interesting program.

Re:Even Slashdot?

[jonadab]

> Very true, this post could have much worse consequences than they
> could ever throw at you.

I doubt it. As near as I can figure, a solid slashdotting comes to at most a two-digit MBPS figure, and that can only be kept up for a day or so. If you RTFA, it was talking about attacks of over 1GBPS sustained for weeks. That's something like fifty slashdottings at a time, more than once a day. The article didn't say what kinds of packets these were (forged-source SYN, reflected ACK, or what), but you get the idea that it was different kinds at different points.

In any event, the attack was apparently more bandwidth-consumptive brute-force than any particular cleverness. In practice, that's probably the most effective type of attack, because a clever attack (such as a traditional SYN flood) is subject to being thwarted by greater cleverness on the defensive end (e.g., SYN cookies). But a bandwidth-consumptive distributed attack is hard to defend against without having a bigger pipe than the aggregate bandwidth of the zombies.

(In the short term, that is; in the long term, given adequate resources and expertise, you eventually track the whole thing down and set the authorities on the perp, or failing that (e.g., if the whole operation is being run from the Federated People's Democratic Republic of Bob's Two-Acre One-Inch-Above-Sea-Level South-Pacific Coral Atol In International Waters (FPDRBTAOIASLSPCAIIW)) get his ISP to shut him down, but that all takes time, and meanwhile you want to keep your network online as much as possible.)

Re:Even Slashdot?

[Big Mark]

SQL Slammer worked by infecting computers over ports that barely need to be open to the immediate local network, let alone open to some guy in a Belgian basement. The port exploited was used to tell prospective SQL clients where to connect for their SQL needs, which if needed to be done remotely should've been done so over VPN.

In this case, boneheaded admins should've received the mother of all wakeup calls.

Re:Even Slashdot?

[fataugie]

OK, I should have clarified. In slammer's case, I understand what you've said.

What I should have said was, in the case of a DDoS for say a website or mailserver, how do you differentiate between legitimate traffic vs. the DDoS?

So now we're gonna slashdot 'em?

[LordByronStyrofoam]

Seems kinda brutal to hit them with another DDOS.

Re:So now we're gonna slashdot 'em?

[Manfre]

The casino site was hit for money. CSO was throw in for free!

The DDoS worked apparently.

[Anonymous Coward]

Or maybe it was planned this way. Nothing says offline like a link from slashdot.

That's frightening

[plover]

It's a brilliant story, and you've got to applaud the guys at the victim site for sticking up for themselves.

It makes me wonder if this new anti-DDoS company can somehow establish relationships with ISPs to track back the zombies and get them shut down more quickly? Seems that would be the sanest and most effective tool -- take away the bots. No bots -- no botnet -- no attacks.

Re:That's frightening

[KiloByte]

Uhm, to take away the bots, you would have to cut them at the root. And the root is a certain mega-corporation that's a bit difficult to be rooted out.

Re:That's frightening

[Talking Goat]

Or, the ISP's can do as the smart ones have done and deploy Tipping Point begin to mitigate these attacks the moment they are detetcted on the border routers. It's smart, fast, and really good at shutting down the traffic generated by these botnets by giving the admin the ability to apply vendor-supplied templates, or to create your own. However, you'd need additional deployments inside the network to avoid fratricide, but you can't beat the intelligence behind this aproach.

Re:That's frightening

[Anonymous Brave Guy]

"Sorry sir, no email for you until you reformat"...uhh huh. That'll happen.

Doubtful, but perhaps it should.

Consider another everyday activity, with a lot of benefits but some inherent risks, which works fine when people take care but goes wrong when they don't: driving. In most places, you don't get to drive without taking a simple test to prove you're reasonably safe and competent. Then if you're caught driving in a way that's hazardous or inconsiderate to others, a nice policeman pulls you over. Depending on the significance of the violation, you get a verbal warning, a formal sanction, or read your rights and your vehicle confiscated.

If a similar principle applied to the Internet, with minor offences attracting a polite warning up to running a grossly insecure system that causes widespread inconvenience to other netizens getting you completely blocked, people would soon learn to respect the technology and others using it. But first we have to get over this strange idea that because it's The Internet, everyone should be allowed to use it, without any traceability or responsibility for their actions whatsoever, regardless of the harm it may cause others. I doubt that'll be a popular viewpoint around these parts.

Re:That's frightening

[halfelven]

I actually tested those appliances fairly thoroughly, and yes, they're good at killing SYN floods and stuff.
But what they don't solve and, indeed, what they cannot solve, no matter how smart, is the problem of sheer volume - the problem of bandwidth. If the attacker overwhelms your pipe, or your ISP's pipe, or your ISP's ISP's pipe, then mission accomplished.
You also have to have enough bandwidth to fight the attack, even if your servers can handle all those SYN packets per se.

Re:That's frightening

[blyon_prolexic]

The story is kinda odd to read when you lived it. Glad you enjoyed it, we have had a lot more attacks since the one in the story.

I don't think we can every take away the bots (it would be nice), because we are seeing P2P bots that run encrypted communications between each other. The attacker guy just tosses his instructions into the P2P stream and they distribute over the entire network - creating a nearly headless command less network that can (once started) operate decentralized. These easy IRC bots are almost a thing of the past now. The point being, as the code base for bot networks grows they will get more complicated and more difficult to shut down.

If a blackhat geek can download source code and knows how to hack it up, he/she can do anything they want. Then it's down to just finding open machines to install their goods on. Policing the Terabits-per-second of backbone traffic for odd-ball P2P traffic like that is a bad idea.

Prolexic also gets attacks now that may not have any botnet, some Ixia (packet generator) connected in Asia-Pac blasting 600 Mbps of generated packets does the same as a 10-20k botnet. We believe to have been attacked by something similar to that at least twice.

The main problem is, there are just bad people out there and you need to create security policy that protects your business. If your revenue stream comes from your online business, then you should protect your online business and not hope your ISP will do that for you.

-Barrett

Re:That's frightening

[maxpublic]

But first we have to get over this strange idea that because it's The Internet, everyone should be allowed to use it, without any traceability or responsibility for their actions whatsoever, regardless of the harm it may cause others.

The sad thing is you could prevent 99% of the hijacking attempts against your (windows) machine by doing just two things:

- don't use IE; and
- install ZoneAlarm

This isn't exactly rocket science. And it doesn't require draconian legislation requiring that all communication from every machine be traced and logged.

Max

Re:That's frightening

[blyon_prolexic]

A "box" to fight multi-gig DDoS attacks is just a bad way to go about it. Ask Tipping Point what their box can do when there is 50,000 SSL TCP sessions (real TCP sessions) with real HTTP headers in there. If their hardware performed as well as marketing engines that TopLayer, Tipping Point, and Cisco have, then everyone in the security industry would all have to go find a new job.

Along with IPS in general, I think a lot of the devices out there have some pretty good rate-limiting and SYN flood mitigation, however, they all seemed to miscalculate the sheer amount of processing power it takes to do deep packet inspections and protocol verification. Prolexic's network is currently representing about 10 Terahertz of processing ability just for the DPI, so hoping a single FPGA based hardware device will do the trick may be a bad idea. Also, most devices can not handle out-of-state TCP based attacks (see: Riverhead), so keep your eyes out on that too.

Prolexic often gets new customers when the TopLayer, Tipping Point, and Riverhead gear fails, so I don't see how anyone could be comfortable with just a single unit to save the day when there are people out there that will take down DNS servers, router serial interfaces, carriers, do long lived TCP sessions to slow down web servers, HTTP connection floods, and anything else they can think of to just hurt the network (75k machines all doing random searche quries on a cgi, etc.)

Further, a box does not have much of a turn-around time, so just call Tipping Point at 2 AM on sunday when the network failed and nobody has any clue with what is going on. Then wait for their one good programmer to fix the FPGA issue and a week later cross their fingers that whatever they did can stop the botnet that is causing someone's business to fail.

I may just be a little beat up from all the traffic we deal with, but it's a little isane to say things like, "we have box X, its magic will fix everything."

-Barrett

Re:That's frightening

[Draknor]

If a similar principle applied to the Internet, with minor offences attracting a polite warning up to running a grossly insecure system that causes widespread inconvenience to other netizens getting you completely blocked, people would soon learn to respect the technology and others using it.

While that's a nice idea in concept, I don't think it would work in The Real World, for a couple of reasons:

1. A license is only required for driving on public property (ie roads). Most of (US) internet access traverses private utility lines (phone/cable), so there's a question of jurisdiction.

2. Risk to free speech - who defines what constitutes an "offense"? Ok, a zombie/spam-relay is against the rules, right? What about a mass-distributed opt-in mail list? What about a targeted marketing email sent to people a user has a "previous business relationship" with? What about P2P? Some P2P use is legal, some is not. Does Big Brother have to watch we're downloading? Or what about political activity? How do you prevent Big Brother from deciding that "questioning the President's decisions constitutes terrorism, hereby revoking your Internet License"?

3. The internet is a global network, so you have the same old issue of making a such in institution as "internet licensing" work across a multitude of laws & cultures. How do ensure that the Russians, British, or Italians enforce the same sort of internet-license policy that we'd create here in the states?

4. Finally, there's the question of efficiency. Plenty of things are already illegal (spam, hacking computers, etc.). That doesn't stop people from doing it, just like people don't stop speeding or driving drunk just because its illegal. It's a question of making policies, and having the resources to enforce them. Since we're talking about computers, there's a lot that can be automated which reduces the manual resource need, but it doesn't eliminate it. There's already a lot of issues regarding RBL's and trying to get legit mail lists off an RBL - scaling that up to accidently (aka based on a false positive) denying internet access to people randomly doesn't seem like a great idea, unless you have the resources in place to resolve those, and that costs $$.

Fight!

[YrWrstNtmr]

When an online exortionist comes a knocking, threatining a DDoS, do you pay or fight?

Presumably, they will give you some way to pay them (else what is the point?). Point the cops and or feds at that contact, and see what happens.

Extortion is extortion, be it physical or bandwidth.

If no joy from the authorities, I'm sure your local newsrag would be glad to shame the cops into doing something. Of course, if the extortionist is overseas, things might be a little difficult.

Re:Fight!

[telecsan]

"Point the cops and or feds at that contact, and see what happens."

That of course, is predicated on your business being 100% legitimate. I'm not sure about this individual case, but I'm sure not all the online gambling sites are uh, trustworthy. That would be a major roadblock to involving the authorities.

Re:Fight!

[Anonymous Coward]

Presumably, they will give you some way to pay them (else what is the point?). Point the cops and or feds at that contact, and see what happens.

This is where R'ingTFA comes in...

If no joy from the authorities, I'm sure your local newsrag would be glad to shame the cops into doing something. Of course, if the extortionist is overseas, things might be a little difficult.

Again, this is where R'ingTFA comes in. I'd also add that one downside of moving your business to an unregulated third world country is that neither the local journalists nor the local cops are especially interested in your gringo problems. I don't understand why Scotland Yard bothered with him.

Re:Fight!

[Fishstick]

If only there was some kind of online medium for news articles where answers to questions like these could be answered!

Oh wait...

You can send us $40K by Western Union [and] your site will be protected

Richardson runs BetCris.com, an online wagering site, one of hundreds of sites ensconced in Costa Rica that take bets from Americans ... without concern for U.S. bookmaking laws

Lyon says, "I could have left it alone, but I had gotten attached, and I started investigating. I came up with some interesting techniques to trace back the attacks." He turned over his work to several law enforcement agencies, but he never heard about it again.

"Um, hello - FBI? Hi. Yes I run a website gambling business offshore in Costa Rica and I just got threated by someone who says they will shut me down unless I wire fourty thousand via Western Union to someone in Belarus who *click* Hello?"

Mirror of article

[apparently]

Mirror here.

gambling and extortion?

[superwiz]

First time those 2 go hand in hand....

Re:gambling and extortion?

[pdbogen]

+5 ironic

Never pay

[nuggz]

If they actually get money, they'll do it again and again.
Any measure of success will encourage more of the same behaviour.

Re:Never pay

[Council]

From TFI:

To ensure a quick, quiet transaction, the extortionists did what all extortionists (in the physical or online world) do: They exploited the problem of the commons. An ecological principle, the problem of the commons states that people will act in self-interest if it profits them in the short term, even if that act will hurt everyone, including themselves, in the long term. Every act, every threat, every negotiation tactic, every single move extortionists make is designed to make paying the protection fee not only appealing, but in fact, the smartest business decision you can make in the short term, even if you know in the long run that you haven't stopped the problem at all.

Re:Never pay

[say]

Uhm. And when you're robbed on the street, never give them your wallet. Get beaten, raped, killed. Just don't give them your wallet - they might just get tempted to do it again.

Moral is nice. Getting phucked is not. We can't expect every single person or company to act in public interest if that means they might get killed doing so.

What is really needed, is serious money being pushed into Interpol, and hiring whitehats there. Online criminals aren't going to spend much time in countries with strong federal police, like the US.

Re:Never pay

[nharmon]

Except that in a lot of cases, money is easier to track than spoofed/zombied IP addresses.

Re:Never pay

[prisoner-of-enigma]

Uhm. And when you're robbed on the street, never give them your wallet. Get beaten, raped, killed. Just don't give them your wallet - they might just get tempted to do it again.

So let's try the inverse of your suggestion and see what we get:

Always give them your wallet, without question, without a fight. Therefore they know all they have to do is mildly threaten you and they get free cash. Not much a solution you're proposing there. Sounds more like a welfare system for hoodlums.

Here's a funny solution you seem to have ignored: arm yourself, take defensive shooting classes, and blow the fucker away when he tries to threaten you. True, dealing with the police paperwork after the fact is a bit tedious, but you can rest easy knowing you've rid the world of a lowlife scumbag who wasn't worth the oxygen he was consuming. Bernard Goetz had it right.

The only way to answer threats is with the threat of something worse. Anything less is either impotent or encouraging more threats.

Good, some balls.

[vbrookslv]

Glad to see someone standing up to these thugs. I remember a few years ago, the ISP that I admin'd hosted the connection for http://www.defcon.org/. We had someone start a Smurf attack from the Con, targetting our inbound T3's. We were able to track it down, and actually snatch him out of his seat right there at the con. He promptly apologized (I think, he only spoke german, IIRC). The look on his face was priceless. Oh, did I mentioned that me, and everyone else at the company carry Glock 19's? Yeah, we didn't have any more problems for the rest of the con. Everyone was on their best behaviour. A bunch of fine, upstanding individuals. :)

Re:Good, some balls.

[Anonymous Coward]

Oh, did I mentioned that me, and everyone else at the company carry Glock 19's?

What about the interns?

Re:Good, some balls.

[Anonymous Luddite]

>> and everyone else at the company carry Glock 19's?

Please excuse my asking, oh well-armed-one, but WTF for?

The glock is a fine weapon, and being an admin for an ISP is a fine job, but I can't quite see the relationship between the two things...

Re:Good, some balls.

[Anonymous Coward]

They share one.

Re:Good, some balls.

[vbrookslv]

Of course I have my CCW, as any upstanding, responsible, and capable citizen should. It's one of the things I love about Nevada, we still respect the 2nd Ammendment.

In any case, Nevada is actually an Open Carry state. Meaning, even without a CCW, as long as you carry openly in a holster (IOW, do not meet the criteria to be considered concealed), you are legal. No CCW needed. That doesn't mean someone can't ask you to leave their premises, but that's a different store entirely. That's what your CCW is for. :)

It's so exhilarating being so close to the PR of Commufornia, and still having my Civil Liberties intact. They may have the literal 'greener grass', but we have the more imporant metaphorical kind.

Re:Good, some balls.

[vbrookslv]

THe reason we carried, aside from the stock "Because we can" answer, is simple. We were in a building with a few hundred thousand dollars in routers, and customers such as banks and medical facilities. We were downtown on Fremont and 7th St in Las Vegas. For those who aren't familiar with the area, it's the hood. I regularly had to chase crackheads, as well as hookers with their Johns off of our back steps. We would regularly find people sleeping in our dumpster in the morning.

And to answer the obvious question, our office WAS there for a reason, we were a block from the ILEC's main CO. This made quite a difference in the cost and time to install of new circuits.

Re:Good, some balls.

[ReverendLoki]

I can't quite see the relationship between the two things...

Because, sometimes that Windows box crashes one time to many...

Re:Good, some balls.

[vbrookslv]

Yes, that's what my Fairbairn-Applegate Covert folder is for. But my daddy always told me, never bring a knife to a gun fight. Well, I choose to improve upon his wisdom by having both.

In actual fact, my Batman utility belt is getting kinda crowded. Ipaq 5500, Nokia 6620, Motorola HS850, Knife, and Gun. I think I need a pair of suspenders. (Does Jinx sell geek-spenders?) Fortunately for me, I have a larger circumference than the average geek, which gives me more belt real-estate. I don't know how you twiggy types carry all of your gadgets.. :)

Re:Good, some balls.

[vbrookslv]

We were later tossed in jail for threatening with a weapon

Actually, In Nevada, it's called "brandishing".

Take a fucking joke people, jeez. Yes, the story is true. Yes, we all carry Glocks. No, we didn't point them at anyone. Just snatching the fucker out of his perceived anonymity was enough. (hint to the AC's?)

When asked why we carried, our stock response was "We take Network Security VERY seriously." And follow it up with (in my best Monty Python) "I don't like SPAM!".

Re:Good, some balls.

[jcuervo]

Silly question.

Re:Good, some balls.

[d474]

Some I'm pointing my Taser at your main Switch, you've got your Glock-19 drawn...

"I SWEAR I'll do it man! I'll fry this bitch right now if you don't put your gun down! I crazzzzzy - don't you know I'm loco!?!"

What are you going to do then, mister rent-an-adminCop?

Re:Good, some balls.

[vbrookslv]

Then you misunderstood. In Nevada, lethal force is only allowed when you fear for your life or grave bodily injury.
I guess I could have been more clear. By having that equipment, and those type of customers, and that location, we had multiple reasons to be concerned for our lives. Just like any other time, being armed serves two purposes:

1. To act as a deterrent
2. To defend one's life, should someone disregard #1.

I absolutely repsect the sanctity of life. I just respect the sanctity of my life slightly higher than everyone elses. (except for my kids, of course)

Re:Good, some balls.

[vbrookslv]

Exercising lethal force, and being capable of exercising lethal force are two entireley different things.

If I had to chase crackheads off of our steps everyday, what's the chance that one of them might take offense to that, and decided to stick me with something, or worse? At first, when I was carrying concealed all the time, about once a week I would get some uppity (sp?) dealer that would decide that I was infringing on his urban pharmacuetical business, and give me some lip, get up in my face, as if he was going to start shit. So we put in some video cameras, and started open carrying. Very rarely did anyone give us a hard time after that. I did have one guy who tried to break into one of our cars, and I caught him and arrested him on the spot. Turned out he was a 3-time loser from CA. I actually performed a public service!

Nothing wrong with being prepared, right? It's the same reason I carry a rollover cable in my laptop bag, you just never know when you will need to reconfigure a Cisco router. :)

Re:Good, some balls.

[Albertosaurus]

Why not Glock 23's?

Re:Good, some balls.

[AK Marc]

So that's what someone's life is worth now? A "few hundred thousand dollars"?

In Texas there is no lower limit. You can shoot someone in the back who is running away from you and is no longer on your property, as long as they stole from you and you can expect that you won't see it again if they make off with it and you would be at risk if you caught them. That's pretty much a blank check to shoot a robber in the back.

The very idea of killing someone over something so trivial as a router makes me sick.

I'm a raving liberal when it comes to most things, but I seem to be on the rabid conservative side for this one issue. Why is their right to steal from me greater than my right to stop them? I have the right to be secure in my person and property. They do not have the right to be secure in my property, only their own.

Using deadly force to stop a felony seems quite reasonable. Using deadly force to stop a car chase seems quite reasonable. Deadly force should be used to stop crimes in progress and to stop those after crimes are committed if failure to do so would result in them getting away. If you don't like it, quit committing felonies.

Re:Good, some balls.

[vbrookslv]

Granted, but like I said, we worked for an ISP. We weren't made of money. If I had that kind of money, why not carry two? O wait, when you dual wield, you lose the ability to throw grenades. :0

Re:Good, some balls.

[Albertosaurus]

I see this argument as hypocritical. Why are the police entitled to use force when you aren't in defense of your property? Why is a cop permitted to shoot a perp who is fleeing arrest? What makes his moral judgement superior? The way I look at it is this: When a criminal steals your router he makes an implicit statement, "My life is worth risking to steal your property." The civilized have no obligations towards barbarians.

Re:Good, some balls.

[Agripa]

Usually in states that permit using deadly force to stop a crime you either have to believe your life is in danger or someone else's life is in danger. This would include using deadly force to stop first degree arson (setting fire to an inhabited building) but not necessarily other felonies. Enforcement varies depending on the local district attorney and law enforcement so depending on the location, you could find yourself in a lot of legal trouble even if what you did was expressly permitted under the law.

A majority of the time spent in CCW classes is for studying the laws that apply in these situations.

Re:Good, some balls.

[Stealth Potato]

I am myself a gun owner and a vocal proponent of the Second Amendment, and I have to say I could not disagree more with what you are saying. It's this kind of testosterone-driven false bravado and thoughtless remarks that give real firearm enthusiasts a bad name.

Deadly force is a last-resort measure that should be employed only when there is direct risk to your life or the lives of others. If someone else is threatening or attacking you with a gun, or if someone comes at you with a knife or something, or someone is subjecting another person to such a threat, you are justified in shooting them. But how can you justify taking someone's life because they're about to make off with your hubcaps or your computer?

The power to take a life carries a tremendous responsibility to use that power only when it is necessary in order to protect the lives of others. Anyone who says otherwise clearly does not understand the responsibility that comes with wielding deadly force, and the sooner the crackpots who kill some poor kid to save their property are hauled off to prison, the better.

Your post smacks of the attitude of a kid who's never actually held a gun, much less been in a situation where it was necessary to use it. I haven't had to fire upon another human being either, but I know people who have; my father's gun saved his life on several occasions, and a friend of mine is a police officer. Think before you speak, maybe.

P.S: I have to say I do agree that sometimes deadly force should be used to stop a car chase. If the suspect represents a direct threat to innocent life, or the moment they make an assault with their vehicle, any measure required to stop them should be employed. However, in a pursuit situation, the best option is to simply let the suspect get away - unless you know that they do in fact pose an immediate threat (say, they're an escaping murder, or they have a hostage, or something of that magnitude), it's simply not worth the risk to public safety that is involved in a high-speed pursuit. It's sad the number of times innocent people have been injured or killed because the cops didn't want to let a drug dealer or two-bit robber get away.

Re:Good, some balls.

[syousef]

sing deadly force to stop a felony seems quite reasonable. Using deadly force to stop a car chase seems quite reasonable. Deadly force should be used to stop crimes in progress and to stop those after crimes are committed if failure to do so would result in them getting away. If you don't like it, quit committing felonies.

So you trust the person who shoots you to determine your innocence or guilt? Last I checked that was for a judge and/or jury.

what if what they're "making off with" turns out to be theirs and only looks like something you own? ...and what if there are no witnesses? Sounds like a good way to commit murder to me! (I swear he was running off with my wallet when I shot him in the back).

No, I think the use of deadly force should be restricted to when yourself or your family/friends come under attack directly. I do however think it's ridiculous that you can be charged and then sued for a burgular tripping over your rug in some places. Frankly I think if a burglar gets held by force (and suffers minor injuries) that's fair enough. If a burgular gets to go home in a coffin that's a bit too much.

I fell for one of these

[Anonymous Coward]

An online wallet inspector demanded I send him my billfold posthaste. I never got it back. Be forewarned.

Just do what we do on IRC

[Anonymous Coward]

Find out where they live and call their mom.

Curious

[Dante Shamest]

I've always wondered...when a site is slashdotted, it implies that the site has been hit by high referrals from slashdot, causing it to become slow or go down totally.

But how does slashdot itself cope with the high traffic?

Re:Curious

[Secrity]

Wormholes.

Re:Curious

[Gzip Christ]

I've always wondered...when a site is slashdotted, it implies that the site has been hit by high referrals from slashdot, causing it to become slow or go down totally. But how does slashdot itself cope with the high traffic?

It's quite simple, really - Slashdot just doesn't link to itself.

Re:Curious

[dougmc]

But how does slashdot itself cope with the high traffic?

Lots of bandwidth, lots of hardware. Since it gets `slashdotted' every single day, it'll be pretty easy to predict how much traffic you'll get tomorrow -- approximately the same as you got yesterday, perhaps a bit more.

But when you're running your own server, and it normally gets 50 hits/day, and then suddenly a Slashdot listing hits it with millions of hits in one day, well, that's harder to prepare for, because 1) you often don't know you're going to be on /. until it's already happened, and 2) is it even worth preparing for? It's just one or two days, and then things will go back to normal. More hardware and bandwidth may cost lots of money, money that you're not going to spend just so people can see pictures of whatever neat thing you did.

Really, the only sites that get /.ed are the smaller ones. The larger ones already have the hardware and bandwidth needed to handle it. Sure, a /.ing probably shows up on their mrtg reports, but it's probably just a 20% or so increase in traffic, not a 1000x fold increase.

Re:Curious

[MyLongNickName]

That's the trick. Most people would say "bigger servers" and "bigger bandwidth". But I know the real reason. Notice how you get 'Service Unavailable'? Every so often? I found that if more than 50 people are accessing Slashdot at the same time, that their database cannot handle it. In reality, this site is hosted on an Amiga. Only 50 users you say? That can't be.... just look at my User ID!

All the 813,621 users before you don't really exist. These messages are randomly generated geek buzzwords. "Users" are given personalities, ranging from "Linux lover" to "Windows loser", from "I'm just a troll" to "IAARS", from "Funny" to "I take myself serious, but no one else does".

Those "personalities" alter the pre-populated phrase list according to topic (actually, I am not even sure the topic matters). Think of it as an advanced Turing simulation.

I was fooled for my first three months. Then, I saw the predictable responses, and realized that there was no actual intellegence here. Just the occassional real life person who wanders in and is fooled for a while. The auto-misspell feature was a nice addition, I have to admit.

Want proof? Pick a user id. Peruse messge list. Notice the lack of variety? Notice the lack of real meaning behind each message? And when there is real content, try browsing earlier messages. You will find phrases ripped verbatim from an earlier post.

Of course, you may also be a bot. CommanderTaco is always making tweaks to the message generation algorithm (though his posts, too, are mostly generated by code). I will have to peruse your message history when I am done posting here.

Re:Curious

[gbulmash]

I've always wondered...when a site is slashdotted, it implies that the site has been hit by high referrals from slashdot, causing it to become slow or go down totally. But how does slashdot itself cope with the high traffic?

Remember that the site in this article was getting hit with over 3 gigabits of traffic a second under the pressure of a DDoS composed of an estimated 35k bots. Now imagine that your average dedicated server account comes with a 10 megabit pipe. It would take a lot fewer consistent requests to slow everything to a crawl. And often these sites are on shared servers, competing with anywhere from 5-200 other sites for the pipe and the processing power.

And in most cases they don't need it. Why would a site used to getting 20,000 hits a day put out the money for capacity 200,000 hits in a few minutes? They try to keep enough capacity to handle 20-50% daily usage spikes, sometimes maybe even 100%, but not a gazillion percent.

Slashdot has big pipes, multiple servers, load balancing and various optimizations that your average site doesn't. They even shut down certain functions under really heavy load (ever notice that sometimes the site search is theirs and sometimes it routes you to Google?). But except when being slashdotted, the average site doesn't need those.

- Greg

Re:Curious

[Jtheletter]

All the 813,621 users before you don't really exist. These messages are randomly generated geek buzzwords. "Users" are given personalities, ranging from "Linux lover" to "Windows loser", from "I'm just a troll" to "IAARS", from "Funny" to "I take myself serious, but no one else does".

Oh cool, this must be one of those meta-tin-hat /.-bots I heard Taco was developing! Sowing seeds of dissent and conspiracy for its own sake.

What a great entry-level comment to test with too! By publicly 'outing' the very system it is a part of no one will take this position as serious anymore and simply decry those who suggest it a yet another foil-hatter, while simultaneously freeing this chat-bot of being accused as one. After all if it were a bot, why would it point out all its own secrets?

Bravo Taco, you are to be commended for this nasty little piece of deception. But of course, if 822545 is a bot, then how can I prove that I am not one? Well, quite easily, you see der lichentttttt ^H^H^H^H
WARNING -- Unhandled parsing error at 0x0E346B22: Core meta-logic rebuttle memory dump in progress! Rebooting comment generation APU at segment data 2501 -- END

Re:Curious

[dougmc]

If you get slashdotted, can't you just coralize your own site for a while?

Coral looks like an obvious solution to this sort of problem -- and to some degree it is. However, there are problems too --

1) If /. has linked to your site, that means your site still needs to serve up the main page. You could coralize your images and such and save some bandwidth that way, but if your web server can't even serve that first page under the load, you're screwed. And if you do find yourself /.ed, and go and coralize your site real quick, then it'll be a while before the traffic slacks off enough for the coral servers to even reach your site to get the images that you've coralized.

Many sites do replace their fancy dynamic pages with a `hi slashdotters!' page after getting /.ed ... saves a lot of cpu on the box. But if what's special about your site is the dynamic aspect of it, well, that won't work.

2) Coral won't do files over 50 or 100 MB. So if you've got some large download, you'd better set up a Bit Torrent instead ... and fast.

3) Currently, Coral uses some non-standard ports that some places may not be able to access due to restrictive firewalls. I understand that this is to change.

4) Coral uses some DNS tricks that don't work with the entire world. Specially, Windows DNS servers tend to have problems with it.

But still, mentioning coral as a way of reducing the /. effect is an excellent idea. It's not the perfect solution, but it's pretty good.

Extorting a gambling site?

[wowbagger]

Extorting a gambling site? That strikes me as a LLM (life limiting move, c.f. career limiting move).

Many gambling sites still have connections to, shall we say, respectible businessmen of the Italian or Asian pursuasion, who are used to handling such matters extra-legally.

You might just wake up one day with your computer's monitor (cables severed with an ax) in bed with you.

Or Guido and Nunzio standing over you, giving you tips on the finer points of extortion while they wait for the concrete to set.

Re:Extorting a gambling site?

[daniel_mcl]

I was just suggesting this as a solution to spamming awhile back; if it's really that expensive to businesses, wouldn't it be more economical for them to arrange to have spammers assasinated? I'm serious about this -- if people are cool with paying Mafia kickbacks to their sanitation company, wouldn't they be willing to pay for something which will save them quite a lot more money?

If such a job were available I'd personally be going through sharpshooter training right now.

I for one...

[Spy der Mann]

welcome our Windows zombie machines overlords. (food for thought).

fighting back with infrastructure

[Ankh]

Some ISPs are doing customer-level ingres filtering -- e.g. if the "other end" of the cable modem gets a packet whose src address is not that of the cable modem, drop it on the floor, it's forged.

The ease of infecting home XP systems remotely means you sometimes find teenagers with tens of thousands of zombie computers at their control. They can sell them to spammers, too.

The ease of doing massive DDoS attacks is why I stopped running an IRC server, and also stopped a research project I was doing related to inter-protocol messaging. It wasn't worth the hassle.

Fighting back is hard if you don't know who to fight, but in the case of extortion, (1) document everything on paper, (2) keep timestamped printed IRC logs of all conversations, and full email printouts; (3) ask some other people to print copies of their IRC logs when appropriate. Then contact the RCMP (or if you are in the USA, the FBI, but in the USA you need to show financial damage of $5,000 or more). Don't wait until it's all over before contacting them.

Good luck!

Liam

Re:fighting back with infrastructure

[FreeTheFurniture!]

Just a little more info for all you Canadians.

If your not sure who you should report this kind of stuff too (local or RCMP), you can make use RECOL.ca(Reporting Economic Crimes On-line). They can direct your complaint to the proper force/department.

In terms of the RCMP, it's usually the Commercial Crimes Division (they'll then bring the Tech. Crime guys in as needed).

Next News Story...

[kniLnamiJ-neB]

"How CSO Online took on Slashdot... and LOST."

I'm glad that somebody's standing up to the jerk though... people who do stuff like that are wasting perfectly good matter.

No protection

[McGiraf]

The thing with these DOS extortionist is that unlike the mafia or other groups they do not protect you from other extortinist. If you pay them thay can stop their attact, but if someone else try to attack you they cannot do anyting.

Re:No protection

[Just Some Guy]

So, how does that actually work out in real life? If Syndicate Foo is "protecting" my business, and Syndicate Bar sends a couple of "salesmen" to offer me competing rates, how do I pick which policy to use? Do we all sit down with lasagna and compare market capitalization, research projects, and offensive/defensive capabilities? Do I have to weigh the relative likelihood of widowerhood if I switch from Foo to Bar, or reject Bar to stick with Foo?

Sorry, but I grew up in a decidedly non-ethnic area and am somewhat ignorant in the finer points of coercee etiquette.

Re:No protection

[CustomDesigned]

Protection rackets have territories. You pay whoever currently controls your territory. If a competing salesman comes by, you let your current "protector" know, and they duke it out. You keep paying the winner.

Blockbuster?

[pakog]

Am i the only one who was sitting on the edge of my seat while reading the battlefield analogy? This is unexplored movie territory with some great potentiol. "Behind CAT5 Lines"

Network admins! Prevent this from happening

[bigberk]

This is an appeal to network admins working at ISPs, whether large or small. You have a responsibility to make sure that spam/attack zombies don't exist on your networks. These days it's a trivial task to check to make sure you're not part of the problem. This can be scripted so that you receive periodic reports of problem hosts on your system, which you can then firewall, disconnect, or restrict access to.

There are so many blacklists these days, so just use rsync to grab fresh copies of AHBL, CBL, DSBL, SORBS, whatever. Then run through grepcidr to see if any IPs from your network(s) are on the blacklists. So easy, and you'll be protecting both yourself and others from malicious zombies.

Re:Network admins! Prevent this from happening

[Sique]

Most black lists are for smtp servers only, and the origial article was about sending "traffic" (which i read icmp or dos, typically not e-mail).

It depends on the type of the attack. "Traffic" is quite unspecific, but it's not necessarily ICMP echo-request (a.k.a. "ping"). For DoS ping is rather uninteresting, because there are enough sites that don't allow ping to their servers and filter it out some hops before the servers anyway. At least I was recommending to customers to allow ping only from monitoring and maintenance sites. (As a side note: A lot of IPs for servers are not coupled with a specified hardware address anyway, but handled and distributed by loadbalancers and serverfarms, so there is no point in having those virtual servers respond on anything else than the service they are supposed to provide.)

So if you have a site that only allows a very limited number of packet types through, attacking it with something outside of the scope of the firewall is somewhat pointless, except you manage to muster such an high bandwidth that it clogs up the pipe at some hops way before the original site. And traffic that is easily to distinguish from legitimate traffic is also easily filtered directly at the backbone routers of the really big ISPs or exchange points ("drop anything not TPC to the site in question").

To make your attack more effective you have at least to mimick the legitimate traffic a little. Your DoS-requests thus should be at least formally correct (or being incorrect in a quite sophisticated manner to trigger complex fault and exception handling.) If you manage to cause the service to calculate a long or data intensive response, it's even better, because then you are clogging up CPU time now missing to handle requests that generate business for the site ("Give me all betting quotes which are either between 1:1 and 1:5 or between 1:4 and 1:10 or between 1:8 and 1:100 or are better than 1:75" forces the site to answer with a large sheet containing all quotes, but the answer set consists of several subsets to be calculated separately. Not every site has middleware in place to change this to "give me all quotes"). If you manage to make your request variable, so filtering out the DoS request with a single pattern doesn't work, it's much better. If you change your attacking pattern during the attack, so the filters in place have to be changed the whole time by the defending site, your DoS will be further more effective.

In the end for an effective DoS you should a) fill all available bandwidth with traffic indistinguishable from legitimate traffic b) use up as much CPU time on the servers as possible to handle your request c) try to generate an asymmetric pattern (your request should use up much less bandwidth for you than the answer of the site is using) d) make it as variable as possible to avoid static filtering.

EVIL!

[jav1231]

Okay, I first read that as "Online Exorcist." I'm thinking, how does THAT work? TO: Satan@littlegirlshead.com
From: Father Mayai (Yes, you may!)
Subject: Notice of Eviction

Re:EVIL!

[Aspherical Cow]

I figured it would have been something like

ssh root@possessed killall daemon

Re:Question

[American AC in Paris]

I don't have a beef with Mr. Piquepalle anymore, but if suggest you dig through some of his early submissions for an answer. As of late, Mr. Piquepalle has been going the full-disclosure route--that is, he makes no secret of the fact that he's affiliated with the sites he submits to Slashdot. Early on, though, Mr. Piquepalle regularly pretended to be "just some guy" who found sites like Engadget interesting. That's not good; if you're affiliated with what you're plugging, you should be candid and open about that fact. Failure to provide full disclosure puts you in the same boat as the likes of Armstrong Williams, who conveniently forgot to mention that he was being paid off by the administration to plug No Child Left Behind in what were ostensibly opinion pieces. It's a dishonest and unethical practice, to say the least.

But like I said, he's cleaned up his act in recent months, so I no longer have a beef with him. Some folks, on the other hand, still hold this against him--which isn't an entirely unreasonable position to take.

Rudyard Kipling's "Dane-geld" - extortion poem

[davidwr]

Dane-geld
(A.D. 980-1016)

IT IS always a temptation to an armed and agile nation,
To call upon a neighbour and to say:--
"We invaded you last night--we are quite prepared to fight,
Unless you pay us cash to go away."

And that is called asking for Dane-geld,
And the people who ask it explain
That you've only to pay 'em the Dane-geld
And then you'll get rid of the Dane!

It is always a temptation to a rich and lazy nation,
To puff and look important and to say:--
"Though we know we should defeat you, we have not the time to meet you.
We will therefore pay you cash to go away."

And that is called paying the Dane-geld;
But we've proved it again and again,
That if once you have paid him the Dane-geld
You never get rid of the Dane.

It is wrong to put temptation in the path of any nation,
For fear they should succumb and go astray,
So when you are requested to pay up or be molested,
You will find it better policy to says:--

"We never pay any one Dane-geld,
No matter how trifling the cost,
For the end of that game is oppression and shame,
And the nation that plays it is lost!"

- Rudyard Kipling

Anyone willing to try their hand at "updating" this to fit online extortion? This could be lots of fun :)

Re:Rudyard Kipling's "Dane-geld" - extortion poem

[howlinmonkey]

It seems a good idea to sit in Eastern Europea
And mail out missives with a threat
"We know that you have gold, and if I may be so bold
If you send me some I will not be a threat"

And that is called running protection
And the scum who demand it defend
That you only have to pay them protection
And your enterprise won't have to end.

It is a real temptation to avoid a confrontation
And pay off the bottom sucking filth
Then the business you created won't be immolated
By the bandwidth sucking zombies and their ilk

And that is called paying protection
But after you've paid up today
They'll come calling for more protection
There will never be an end to what you pay

It's a shame to whimper quietly and meet with their demand
To keep the money flowing fast and free
So when they do demand the little money in your hand
I would suggest that you repeat slowly after me.

"We never pay any scum protection
No matter how hard they may lean
For tomorrow you'll be back threatening to hack
Using any zombies you can glean "

I am no Rudyard Kipling, but I think this captures the essence of it :)

"They threw everything they had at us."

[hiero]

Including, apparently, a good slashdotting.

HALF of the article -- anyone get mopre

[Anonymous Coward]

Online Extortion How a Bookmaker
and a Whiz Kid
Took On an Extortionist
and Won Facing an online extortion threat, Mickey Richardson bet his Web-based business on a networking whiz from Sacramento who first beat back the bad guys, then helped the cops nab them. If you collect revenue online, you'd better read this. Saturday, Nov. 22, 2003, 7:57 a.m.
Origins of an Onslaught

The e-mail began, "Your site is under attack," and it gave Mickey Richardson two choices: "You can send us $40K by Western Union [and] your site will be protected not just this weekend but for the next 12 months," or, "If you choose not to pay...you will be under attack each weekend for the next 20 weeks, or until you close your doors."

Richardson runs BetCris.com, an online wagering site, one of hundreds of sites ensconced in Costa Rica that take bets from Americans (and others around the world) without concern for U.S. bookmaking laws. Richardson received the e-mail just as he and his competitors were preparing for the year's busiest wagering season. With pro and college football, pro and college basketball and other sports in full swing, and with Thanksgiving and Christmas about to create plenty of free time, BetCris and the others stood to rake in millions over the holidays. Richardson was even planning an advertising blitz for the season to drive new traffic to his site.

If BetCris went down, he knew his customers would find another online bookie, "which will cost you tens of thousands of dollars in lost wagers and customers," the extortionists reminded him.

Despite all that, the e-mail didn't have the fearsome effect on Richardson that the extortionists hoped it would. He just asked his network administrator, Glenn Lebumfacil, if they should be concerned. "I saidGod, in hindsight, what an idiotI said, 'We should be safe. I think our network is nice and tight,'" recalls Lebumfacil.

As a precaution, Richardson alerted his ISP, but essentially, he says, "We kind of fluffed it off." The veteran bookmaker didn't panic because, in fact, he had dealt with online extortionists before. Two years earlier, hackers crashed BetCris.com with a denial-of-service (DoS) attack, and then demanded by e-mail a $500 protection fee in eGold (an online form of trading bullion). Richardson paid without a second thought. Compared to downtime, $500 was trivial.

That first attack got his attention, though. Richardson consulted another industry veteran who confessed to having a similar problem, and who told Richardson to call a consultant named Barrett Lyon in Sacramento, Calif. Lyon didn't come to BetCris's officeshe had no interest in baby-sitting infrastructure in Costa Ricabut he did recommend some off-the-shelf products that had recently been developed specifically to fight DoS attacks. Lyon thought (actually he hoped) that he'd never hear from them again. Richardson and Lebumfacil were confident they had protected themselves.

When the attack finally came on that Saturday in November, sometime after that first e-mail but before 11:30 a.m., BetCris crashed hard. The off-the-shelf products Lyon had recommended survived less than 10 minutes. BetCris's ISP crashed, and then the ISP for BetCris's ISP crashed. Richardson ran to the IT department, where Lebumfacil was watching the biggest DoS attack he'd ever seen. He remembers feeling sick to his stomach.

At 1:03 p.m., another e-mail arrived. "I guess you have decided to fight instead of making a deal. We thought you were smart.... You have 1 hour to make a deal today or it will cost you $50K to make a deal on Sunday." Then they knocked BetCris.com offline again.

The Extortion Problem

We know this about online extortion: It happens. Evidence of its prevalence or damage is speculative and anecdotal but useful nonetheless in guiding CSOs to understand the nature of the crime. Anecdotally, experts from law enforcement and information security consultants believe that perhaps one in 10 companies has been threatene

Re:Question

[Just Some Guy]

Mr. Piquepalle regularly pretended to be "just some guy"

Hey, leave me out of this! I can't even get my own articles accepted.

Article

[Peter_Pork]

How a Bookmaker
and a Whiz Kid
Took On an Extortionist --
and Won

Facing an online extortion threat, Mickey Richardson bet his Web-based business on a networking whiz from Sacramento who first beat back the bad guys, then helped the cops nab them. If you collect revenue online, you'd better read this.

CSO Magazine
May 2005
By Scott Berinato

Saturday, Nov. 22, 2003, 7:57 a.m.
Origins of an Onslaught
The e-mail began, "Your site is under attack," and it gave Mickey Richardson two choices: "You can send us $40K by Western Union [and] your site will be protected not just this weekend but for the next 12 months," or, "If you choose not to pay...you will be under attack each weekend for the next 20 weeks, or until you close your doors."

Richardson runs BetCris.com, an online wagering site, one of hundreds of sites ensconced in Costa Rica that take bets from Americans (and others around the world) without concern for U.S. bookmaking laws. Richardson received the e-mail just as he and his competitors were preparing for the year's busiest wagering season. With pro and college football, pro and college basketball and other sports in full swing, and with Thanksgiving and Christmas about to create plenty of free time, BetCris and the others stood to rake in millions over the holidays. Richardson was even planning an advertising blitz for the season to drive new traffic to his site.

If BetCris went down, he knew his customers would find another online bookie, "which will cost you tens of thousands of dollars in lost wagers and customers," the extortionists reminded him.

Despite all that, the e-mail didn't have the fearsome effect on Richardson that the extortionists hoped it would. He just asked his network administrator, Glenn Lebumfacil, if they should be concerned. "I said--God, in hindsight, what an idiot--I said, 'We should be safe. I think our network is nice and tight,'" recalls Lebumfacil.

As a precaution, Richardson alerted his ISP, but essentially, he says, "We kind of fluffed it off." The veteran bookmaker didn't panic because, in fact, he had dealt with online extortionists before. Two years earlier, hackers crashed BetCris.com with a denial-of-service (DoS) attack, and then demanded by e-mail a $500 protection fee in eGold (an online form of trading bullion). Richardson paid without a second thought. Compared to downtime, $500 was trivial.

That first attack got his attention, though. Richardson consulted another industry veteran who confessed to having a similar problem, and who told Richardson to call a consultant named Barrett Lyon in Sacramento, Calif. Lyon didn't come to BetCris's offices--he had no interest in baby-sitting infrastructure in Costa Rica--but he did recommend some off-the-shelf products that had recently been developed specifically to fight DoS attacks. Lyon thought (actually he hoped) that he'd never hear from them again. Richardson and Lebumfacil were confident they had protected themselves.

When the attack finally came on that Saturday in November, sometime after that first e-mail but before 11:30 a.m., BetCris crashed hard. The off-the-shelf products Lyon had recommended survived less than 10 minutes. BetCris's ISP crashed, and then the ISP for BetCris's ISP crashed. Richardson ran to the IT department, where Lebumfacil was watching the biggest DoS attack he'd ever seen. He remembers feeling sick to his stomach.

At 1:03 p.m., another e-mail arrived. "I guess you have decided to fight instead of making a deal. We thought you were smart.... You have 1 hour to make a deal today or it will cost you $50K to make a deal on Sunday." Then they knocked BetCris.com offline again.

The Extortion Problem
We know this about online extortion: It happens. Evidence of its prevalence or damage is speculative and anecdotal but useful nonetheless in guiding CSOs to understand the nature of the crime. Anecdotally, experts from law enforcement and information security consultants believe that perhaps one in 1

Re:Catching them

[wmajik]

The problem is that many of the online gambling and online poker operations are not based in the United States, as it is against the low. More often that not then, the site operators establish their operations in small Caribbean islands and the Isle of Man. As a result, the small island governments are almost aways incapable of handling a large scale international investigation, but at the same time, the FBI cannot get involved because there was no crime committed on US soil. Now, the knee-jerk reaction is to say that the site operators are getting what they deserve for establing off-shore operations and not paying taxes, but that wouldn't be the whole story either. The true fact is that while practically all of the gambling operators are owned and run by US citizens, almost all of those operations want to be regulated by the government and pay taxes as well. Why? Because of exact situations like these with the DDoSers. Between loosing the shirt off your back and paying taxes, one of the options starts to look a lot more business smart. It's a weird world when one of the most profitable online industries that pays little to no tax is also the one most wants to be regulated and taxed at the end of the day. Given the context of the industry however, it can be easily summed up in one easy notion: protection fee. Having the protection of the laws of the US government far outweighs being knocked over, cheated or swindled by the legions of DDoSers, fraudsters and governments that the industry has to deal with. Ambiguities about the morals of gambling aside, if a $2 billion dollar industry that most believe is here to stay wants to come ashore and be taxed and regulated, as a US citizen, I for one would welcome the tax benefits.

Chicks dig it...

[The Angry Mick]

Makes you look less geeky.

Insult?

[JadeNB]

Is it just me, or is the author none-too-subtly suggesting at the end of what seems a pretty flattering article that the one who engineered the defence is in collusion with the exortionists, and that paying him for help is essentially paying a protection fee? The turnabout in tone is so abrupt it seems like the last few paragraphs were written by a different person.

Hacked ICQ?

[SimonShine]

The only thing I'm reminded of is the telling of a guy who sought palindrome ICQ account numbers with email addresses from XS4ALL assigned to them, of which the email accounts had expired. Apparently he found a few, and through XS4ALL, he would re-create these expired email accounts, then have the old password sent to him. A weird collectible, and probably not the story you were looking for. :-)

age discrimination!

[Tumbleweed]

God knows your /. ID is low enough that it might be true.

Watch it with the age slurs there, sonny. That could get ... dangerous. :)

Re:age discrimination!

[Xenophon Fenderson,]

*grumble* . . . get off my web site, you damn kids!

Re:age discrimination!

[dhall]

I guess I'm feeling like a real fossil then... :)

Re:age discrimination!

[AgentSmith]

Holy Crap! You are the lowest ID I've ever seen. It's like elder races have returned. RUN!

Good story

[KZigurs]

I especially liked the ending. Finally a legal criminal that really delivers :P

Re:Complete Mirror

[bgfay]

Thank you. The mirrors of the article have been really clogged.

I fought a DDoS and won

[mikeswi]

Starting Feb 2004, my site was hit by a powerful DDoS attack. It knocked out my web server and it nearly took out my web host's switch in the data center. I never got any demands or letters or figured out who caused it.

Anonymizer.net tried to help me by putting my domain behind a series of rotating proxy servers. Their whole network crashed after 6 hours and they had to stop helping me.

Finally my web host hit on the right idea. I set up a half dozen virtual private servers (VPS) at Globalservers.com (same company that hosts about.com and freeservers) and my host installed a proxy server on each one called twhttpd and set them all to route traffic to and from my web server at his data center.

Then I set up an account at ZoneEdit and added all the IPs for the proxy servers with a failover system. Every time the bastards knocked out one of the proxy servers, ZoneEdit would detect that the server was borked and switch to another one. With the load reduced, the dead proxy came back on its own a few minutes later.

After about 6 months of this, they finally gave up and I won.

Re:I fought a DDoS and won

[mikeswi]

Most of the filtering was done by globalservers. They have a bunch of very serious routers specifically designed to block DDoS attacks and they have more bandwidth than God.

Once the traffic passed through their routers, it went through the proxy and the proxy would pull the data from my webserver.

My host wrote a script that he installed somewhere (on his switch I think) that filtered out a specific type of HTTP GET. Whoever wrote the attack bot made a mistake because it generated some weird error (408 or 508 or something). His script filtered that out and then the webserver would return data to the proxy servers and from there to the end client.

It was a little glitchy and it nearly ruined my message board (all the users had the same 6 IP addresses and that played hell with session IDs), but it kept the site going despite the attacker's best efforts. He/they eventually moved on to attack other antispyware web sites with less resources.

Re:And the lesson is...

[tweek]

The lesson is also that if you pay, they'll know you'll pay more.

There's a point where they keep coming back with higher numbers. If you look, they only guaranteed the protection for a year.

Re:Question

[paronomasia5]

i can't read the story, but a lot of comments suggest contacting the FBI

stoopid question but:

what law did they break?

if they used their own bandwidth, then they just sent packets to your public website, right?

This is kind of like some spammer emailing me saying "i currently spam you lots and lots and lots, if you give me *money* i'll stop spamming". Ironically, this is just one more piece of spam in my inbox. Why would this spam be criminal, and the thousands of XXX VIAGRA CIALIS XXX be fine?

New "business idea"

[3770]

So,

I'm trying to read the article and that is giving me another "business idea".

"Give me $10 000 or I'll submit an article to Slashdot with a link to your web site".

Distributed Denial of Service!

Re:Question

[Greyfox]

Everything that bastard submits gets accepted! You could submit "How scientists cracked the light speed barrier" and get rejected and then he comes along behind you with "Anatomy of a cheez doodle" and gets accepted! God I hate him! Hate hate hate! Yup...

So...

[Theatetus]

...is submitting a story to /. the last revenge of the DDOS extortioner?

Is it just me...

[Bones3D_mac]

... or does this sound like an opening line for a soft-core porn flick?

"Lyon was 23 and looked at least that young. His blond hair offset a tan, handsome face. Allec says Lyon looked like he had given up a day of surfing to swing by and help out."

How to bring the FBI into the mix

[Cheeze]

What would happen if he had changed the dns of his website, to, i dunno, say the ip address of fbi.gov? The criminals would then be dossing fbi.gov and the fbi would immediately notice. If it wasn't a dns-based attack, it should be relatively easy to route all incoming traffic to another ip address.

I wonder if the guy that was originally being dossed would get in trouble for it.

these guys are hardcore

[sejanus]

I'm the head network engineer at an isp.

2 years ago one of our customers recieved a DDOS email and he called me and asked me what he should do.

I told him to ignore it and honestly I found it quite amusing, thinking it was script kiddies.

I wasn't laughing 24hrs later as they completely saturated our pipes and our border routers (7206 VXR's at the time) were locked at 100% cpu.

I've taken serious steps since then to be ready. it wasnt a pleasant experience though and happened right in middle of business day.

Careful picking on the '19

[Bob 4knee]

Oh, did I mentioned that me, and everyone else at the company carry Glock 19's? Yeah, we didn't have any more problems for the rest of the con. Everyone was on their best behaviour. A bunch of fine, upstanding individuals. :)

Ever tried real hard to disappear when your 4 year old kid admonishes a cop (bragging on his new 9mm) for carrying a "girl gun" "like my mom used to use until she learned to shoot"...

Re:Simple solution.

[Lord Bitman]

welcome to the internet! There are many new and exciting technologies which you should look in to now that you are here!

Good guys vs. bad guys

[dmccarty]

That's right. Lyon is one of the good guys. Still, Lyon's heroics weren't possible without Mickey Richardson's resolve. It's easy to forget that as Lyon worked to save him, Richardson considered paying off the extortionists. Now Richardson has a better option. Pay Lyon $50,000 a year and he's protected. He doesn't have to worry about paying extortionist's protection fees.

From a purely economic standpoint, it makes me wonder who's the real "extortionist"...

Can't read the article

[Mr Pippin]

How ironic that a story about fighting DDoS attacks can't be read due to the Slashdot effect.

Re:Can't read the article

[KD5YPT]

That's because ALL traffics from the Slashdot effect are real and legitimate traffic. In another word, we're not attacking them so they don't filter us out.

Lebumfacil

[bleckywelcky]

He just asked his network administrator, Glenn Lebumfacil, if they should be concerned. "I said--God, in hindsight, what an idiot--I said, 'We should be safe. I think our network is nice and tight,'" recalls Lebumfacil.

Is this guy's last name really 'The Easy Bum'? Wow, lol.

I use OpenBSD's pf

[JimmytheGeek]

It's AMAZING, but you have to supply the electricity which will add up to a fair amount for a real pc vs. a little appliance thingy. Got a spare laptop with a borked screen or something? You could probably pick one up for a song at RePC or a similar outfit.

Actually

[chriso11]

In the context of this article, the correct term is slashdos'ed

Thank you

Re:wrong

[AK Marc]

This is plain wrong. I lived in Texas and this is NOT legal. To have a justifiable shooting, the person must be in your house or attempting to break into your house while you are there. Just like other states, if you shoot someone in the back as they are trying to escape, you are breaking the law.

Texas Penal Code 9.42 B (when deadly force is allowed)
to prevent the other who is fleeing immediately after committing burglary, robbery, aggravated robbery, or theft during the nighttime from escaping with the property;

Try reading the law sometime. I won't quote the whole law, but it really means what it looks like. Shooting them in the back is ok based on the way the law is written.

Despite what the press would have you believe, most of us in TX are just like you and me.

I was born and raised in TX and lived 26 years there. What the people are like there is irrelevant to what the law says.

Running away is a capital offense?

[Anonymous Coward]

I wasn't aware that running from the scene of a crime was a capital offense.

Aside from that, your philosophy leaves a huge gaping hole in the murder laws. Suppose you want someone dead. You give them a nice gift. As they are walking away, you shoot them in the back of the head and kill them. You are arrested and claim they were running away with your property.

That is why the law doesn't work the way you claim. When someone claims self-defense, they are generally prosecuted anyway. In most states, if you claim self-defense the burdon of proof is on you to prove that your life was in immediate danger (the prosecution only has to prove that you killed the person, which you will confess to in order to claim self-defense). If you fail to prove that your life was in danger, you will be convicted of murder.