Slashdot Mirror
Prosecuting DDoS Attacks?
dptalia writes "We all have heard of major DDoS attacks taking down countries, companies, and organizations. But how many of them are ever prosecuted? And how many prosecutions are even successful? I've done some research and it appears the answer is very few (Well duh!). And those that are successfully prosecuted tend to have teenagers as the instigators. Does this mean DDoS is a fairly safe crime to conduct? Are the repercussions nonexistent? Does anyone have some knowledge an insight into this that I don't have? How would you go about prosecuting a DDoS attacker? What's your experience with getting the responsible parties to justice?"
We get away with it daily here.
2 chanologists got a year in the slam each thanks to their DDOS of Scientology.
You will wire one million dollars into my Swiss bank account if you want to keep your precious site alive.
HahahahahahHAHAHAHAHAHAAAAAAA!
Well yeah. That's how Ask Slashdot usually works.
One of those "the authorities won't become interested until you take matters into your own hands" situations. And the reason is that, as a law-abiding (ok, more or less) citizen, you're much easier to prosecute.
What's needed is for one of these new "cyber" security agencies (and I hope this isn't offensive, but they really need to be led by combat veterans with modern prostheses) to be tasked with hunting botnets and taking them over. Displaying a "this computer secured by the U.S. Gub'mint" message is probably the only guaranteed method of getting a user to wipe their machine.
Literalism isn't a form of humor, it's you being irritating.
The basic problem with DDoSes is that anyone who isn't a moron(ie. the teenage punks who get caught), is generally working from behind multiple layers of indirection and usually across a number of jurisdictions. What they are doing is probably illegal in all of them; but the degree to which the authorities care, or are on the ball enough to do anything about it can be pretty limited.
It doesn't help that a lot of the DDoS victims are either clueless and irrelevant(Yup, the feds don't really care about dialup users getting ping-flooded on IRC), widely considered to be a little shady themselves(*Call to the FBI* "Hi guys, I run this offshore gambling site in Antigua, and I've been having some problems with DDoS attacks that are really cutting in to my ability to serve American customers during peak sporting-event times...." *click*), or are parties in some sort of nationalist pissing match, of the sort where many "patriotic excesses" have a tendency to be overlooked(Yeah, I'm sure the Russian authorities are working night and day to bring to justice anybody involved in atttacks against Estonia...)
While, as a matter of law, DDoSing is hard to do legally, even in fairly shady areas(if nothing else, your botnet likely implies a fair number of computer-intrusion crimes in jurisdictions where that is an offense, and it is unlikely at best that you are properly reporting and paying taxes on the "protection" money that you are collecting). However, with the complexity of cross-jurisdiction investigation and prosecution, and without the massive public antipathy that something like kiddie porn has, the odds of actually getting brought to justice are fairly low, unless you are basically just a petty vandal, hitting some high-profile target in the same country as you.
My company, and our hosting clients, are victims of DDoS attack at a surprisingly high frequency. Although this has cost us thousands, and if you believe our angry customers it's cost them millions, we've never even attempted to prosecute a DDoS perpetrator for the following reasons:
1) The fact that a DDoS is distributed means we'll be left with a list, in the best case scenario, of hundreds or thousands of IP addresses, without the slightest clue which one might lead to the real troublemaker. In fact, for most types of DDoS, none of them lead to the perp in any special way. Often times DDoS attack machines are just zombied desktop computers, infected by a virus the genius user got from clicking on a porn ad.
2) In my experience, the vast majority of DDoS IPs are zoned to foreign countries. Mostly developing nations, or nations not particularly interested in Internet crimes against a US hosting company.
3) Even if the person or persons responsible for the attack were my next-door neighbors, we'd still need to track their actions through servers zoned in other countries. Try sending a subpoena to a (the?) Chinese ISP, asking for logs (if they even exist) from a server within their borders. Even if the log files showed activity from the perpetrator, it would still be somewhat circumstantial, and up for debate ("My computer has been hacked before / My wifi connection isn't secured / etc").
4) Even if you somehow managed, against all odds, to find the perpetrators, who were within a sane legal jurisdiction, and you won a contentious civil court case against them... Is a 17 year-old script kiddie really going to have any money?
It simply isn't worth the hundreds, if not thousands of man hours for us to jump down the rabbit hole for what's honestly not going to be much, if any, reward. I have never once in my life heard of a single successful DDoS prosecution that justified the cost in doing so.
Does this mean DDoS is a fairly safe crime to conduct?
Oh I see "someone" is very interested in DDoS attacks for "research" right? Dude, listen, just give the link here and your problems will be solved.
And if you're a rich company that can pay for more bandwidth and processing than the other guy, you're virtually immune to DDoS problems.
"Any properly configured web-server can easily handle the slashdot effect."
Obviously your definition of "properly configured" excludes servers designed to handle less than n different machines connecting to it per second, where
n = the number generated by a typical linking from Slashdot.
The guy stuck in the last decade running a web server on an old Pentium machine serving up a streaming video of his latest stupid pet trick comes to mind. Sure, he may be able to serve up a few hundred, maybe thousands, of unique visitors per second, but at some point he's going to fall over and die when the load gets too high, and there's nothing he can do about it short of getting new hardware.
Yes, your point is taken, web sites can be designed so a click on a link here is handled with a minimum of resource utilization while still serving up useful content. But my point is if you are getting burst traffic of BIGGISHNUM unique visitors per second because of the /. effect, your web server and Internet connection better be up to handling those visitors in a graceful manner, preferably one more useful than "server busy, try again later."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
That's ridiculous. First, every nerd knows they don't have a host named www here, it always redirects. Besides, this script is more effective:
#!/bin/bash
while true
do wget -m -p slashdot.org &
done
Second, the easier way is just to submit a popular story that has a link back to slashdot, thus everyone reading will click on the link, and wallah! They /. themselves and self destruct.
Tequila: It's not just for breakfast anymore!
No link tn the article. Smart move.
Here's a link to the article: http://ask.slashdot.org/story/10/06/06/2051226/Prosecuting-DDoS-Attacks
Well, not from what I know.
http://magbiz.net/news-en/unknown-person-extorts-shut-down-of-an-erotic-portal/?lang=en
Windows 2000 - from the guys who brought us edlin
(In a french accent) I fart in your general direction, now go away or I will ping you a second time!
thus everyone reading will click on the link
HAH! A common error!
It wouldn't be a matter of if this blew up in our faces, but when. It's still the only workable method.
Fortunately, since this would be run by the US, oversight would be provided by diligent public servants backed by an informed electorate.
Literalism isn't a form of humor, it's you being irritating.
you mean voila, not wallah
... still waiting for this free-as-in-beer free beer I keep hearing about.
I very, very seriously doubt that vandalism is legal in California.
You should take those urban legends you hear with a larger grain of salt next time.
It could be argued that toilet papering someone's house is legal, but eggs can and will easy cause actual damage that takes actual real money to fix. Eggs on a car can cause the whole car to need to be stripped and repainted.
Eggs are serious fucking business, not a harmless prank.
... still waiting for this free-as-in-beer free beer I keep hearing about.
IIRC, California passed an anti-animal-cruelty referendum, but it's got a couple of years to phase in.
Most eggs are non-fertile; the main people selling fertile eggs are selling them to random health-fooders, or else they're selling them because it's easier not to check whether your free-range hens have had access to a rooster.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Not if you labeled it "Natalie Portman and Olivia Munn rubbing suntan lotion on each other at the beach" or something similar.
I found an interesting article on someone tracking down some botnet masters by contacting a few of the infected users, getting a copy of the trojan and running it in a sandbox.
http://www.bellua.com/bcs/asia07.materials/fredrik_soderblom.pdf (PDF)
i have a button to push on facebook then a 1030 DDoS attack via proxies to launch
and i\\when server went down it cost me 150$ i contacted the isp ISP said to email UUNET UUNET told me to CONTACT the iSP after 3 more times at his shit i sent an email to all involved and said "OK if your not willing or able to stop this i will and do not give me any legal repercussion on how i permanently end the problem" I then made apiece a software that targeted the PERSON in Argentina doing it and 75% of the isps in that country. then handed this software to 150 other hackers i knew around the world a week later i asked all to stop i got email from the arse doing this whom apologized that was the last dos i ever had to deal with and its why you never fuck with a hacker site P.S. i never caved and ever started doing what many did post 9/11 and called themselves "security sites either" most of those were shit heads anyhow. BTW before i did it i informed all the top pirates and said your email host thinks its a joke to attack my site , they weren't happy but i said he needs to learn something. its one reason its kinda good to gt in with hackers at least even if your not to serious , just be nice to them and they'll be nice to you. i used ot have some good chats with some pretty high up webmasters of yahoo and other major sites. AND no i've never used this power to extort or force any actions to anyone.Might be one reason ive been running this org for 16 years with no IT arrests in the membership
Wouldn't want to trigger a DDoS attack on some innocent web server.
I clicked on it just in case.
That was hot!
Natalie Portman /. Olivia Munn slash fiction!
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
What makes you think they don't?