Slashdot Mirror
Death Knell For DDoS Extortion?
Ron writes "Symantec security researcher Yazan Gable has put forward an explanation as to why the number of denial of service attacks has been declining (coincident with the rise of spam). His theory is that DoS attacks are no longer profitable to attackers. While spam and phishing attacks directly generate profit, he argues that extortion techniques often used with DoS attacks are far more risky and often make an attacker no profit at all. Gable writes: 'So what happens if the target of the attack refuses to pay? The DoS extortionist is obligated to carry out a prolonged DoS attack against them to follow through on their threats. For a DoS extortionist, this is the worst scenario because they have to risk their bot network for nothing at all. Since the target has refused to pay, it is likely that they will never pay. As a consequence, the attacker has to spend time and resources on a lost cause.'"
I mean, what better place (from an objective POV) to park warez and illicit data (e.g. certain types of illegal pr0n), than on some unsuspecting schlep's machinery?
The mobsters then charge admittance by way of proxies (conceptual term, not 'w.x.y.z:8080') and advertise by way of spam?
Quo usque tandem abutere, Nimbus, patientia nostra?
He also doesn't seem to get that sometimes people DoS sites out of spite or out of malice.
You can't put a pricetag on being an asshole to the internet community.
You don't need a bot network to be a DoS extortionist. Unplugging your target's modem is just as effective, and has the virtue of simplicity.
:(
I think I see where you are coming from; my ISP is some kind of DoS extortionist... if I stop paying them they DoS me.
Help, I am being exploited!
In the free world the media isn't government run; the government is media run.
These guys have hit us up before. From what I have seen it is a
-give us $ or we shut you down.
-a small quick ddos to show you they can.
-you say "no thanks", so now they ask for $$$.
-a little bit longer ddos because you pissed them off.
-now they ask for $$$$$. which you certainly are not going to pay.
-another little ddos, more email threats of looming death and destruction, they are "leet" after all.
at this point you begin to factor outages and lost revenues into the business plan, you call ISP's, you consider calling the FBI.
they eventually go away. The best advice we got was from someone who has a "relationship" (pronounced cashcow) with a ddos'r. The scam is that they are looking for regular clients that they know can/will pay, and that they can hit up when they need cash. The word has gotten around that if you pay once, you'll pay twice. At least in the business of online casino's everyone has begun to understand that you just dont pay, ever.
This is sort of a game theory problem.
No individual extortionist wants to actually expend the resources to make good on his threat... but all extortionists recognize that if NO ONE carries out their threats, they will have no power over the victims.
My bicyles