Six UK Teens Arrested For Being "Customers" of Lizard Squad's DDoS Service

An anonymous reader writes: UK officials have arrested six teenagers suspected of utilizing Lizard Squad's website attack tool called "Lizzard Stresser". Lizard Squad claimed responsibility for the infamous Christmas Day Xbox Live and PlayStation Network attacks. The teenagers "are suspected of maliciously deploying Lizard Stresser, having bought the tool using alternative payment services such as Bitcoin in a bid to remain anonymous," an NCA spokesperson wrote in an official statement on the case. "Organizations believed to have been targeted by the suspects include a leading national newspaper, a school, gaming companies, and a number of online retailers."

Comments

I disagree that this tool should be illegal

[Karmashock]

that it should be illegal to use it against someone against their will... sure.

But to even own it? No.

You can't do system testing without tools that are effectively hack tools. And even if you've no good reason to have it, it isn't the government's place to say what programs we have or don't have.

Re:I disagree that this tool should be illegal

[o_ferguson]

Depends how this tool works. If it simulates a botnet attack, then sure, totally legal. But if it's just a paid front-end client for an illegal zombie botnet, then I can see how it could be considered illegal.

Re: I disagree that this tool should be illegal

[Anonymous Coward]

Unfortunately for you, the government seems to see things another way and since they have the power and a lot of mean men with guns, they're right and you're not. :)

Re:I disagree that this tool should be illegal

[Gaygirlie]

that it should be illegal to use it against someone against their will... sure.

But to even own it? No.

You can't do system testing without tools that are effectively hack tools. And even if you've no good reason to have it, it isn't the government's place to say what programs we have or don't have.

I think you missed something: considering the tool is built on hacked routers, hubs and other kinds of devices yes, it is illegal. Regular systems testing tools aren't built on hacked devices owned by others.

Re:I disagree that this tool should be illegal

[Gaygirlie]

No, if you wish to investigate such things then build your own on hardware you own.

Re:I disagree that this tool should be illegal

[Idimmu Xul]

it's not a 'hack tool' it's a front end website to a backend zombie army of compromised routers, where do you think all the bandwidth for the DDOS is coming from? Their wordpress hosting plan?

Re: I disagree that this tool should be illegal

[Gaygirlie]

Strawman - argument. Nuclear weapons are physical objects that require specialized tools and materials to build. DDoS-tools dont; anyone with a text-editor and a translator or compiler can create those out of thin air and thus it is literally impossible to control them. Also, criminals don't care about your silly regulations and as is rather evident DDoS-attacks *are* carried out in practice on a daily basis (nuclear attacks, surprisingly, aren't) -- there definitely is a need for the tools for people to test and develop counters to those attacks.

Re: I disagree that this tool should be illegal

[ThatsMyNick]

No ISP would agree to have one of their end points being stress tested by a DDoS (I dont think they can agree either without consulting their upstreams). DDoS causes a lot of problems for your ISP, and the entire internet backbone. It is absolutely illegal, even if you own the end point equipment.

Re: I disagree that this tool should be illegal

[Gaygirlie]

Who said anything about doing it over the Internet? You can test and research such even in an internal network. Besides, DDoSing your own equipment using equipment you own is not illegal, even if it did happen over the Internet. It's only when you're DDoSing someone else's equipment or using someone else's equipment that it becomes illegal.

Re: I disagree that this tool should be illegal

[Anonymous Coward]

To be able to regulate such things you'd have to somehow magically be able to control who can be allowed to program anything in the first place

Which is EXACTLY what should be done. All programmers must be registered and only use a specific machine, which can be remotely inspected and audited at random. It's time to tighten the vise.

Re: I disagree that this tool should be illegal

[ThatsMyNick]

I have never heard of anyone DDoS (even as a test) on their an internal network. It is generally understood to be on the internet.

Unless you have the permission of the networks in between your equipment, it would be illegal. It is like disrupting a city by organizing a rally. The rally is meant to reach your residence, but it does traverse though the city. It would be illegal.

Re: I disagree that this tool should be illegal

[Anonymous Coward]

Then have professionals test your network with approved tools. There is absolutely no reason whatsoever for the ordinary citizen to be in possession of such tools.

Re: I disagree that this tool should be illegal

[tburkhol]

To be able to regulate such things you'd have to somehow magically be able to control who can be allowed to program anything in the first place, then you'd have to control all the possible tools for that

"Regulating" does not necessarily mean "strangling." For example, electrical devices are already required to be UL or CE certified before they can be marketed, but any numbnut with some wire and a soldering iron can build his own power strip, hair dryer, or Tesla coil.

It's patently ridiculous for a government to require software be bug- and exploit-free. It's also true that some disclosures would provide consumer benefit: does the software/device "phone home"? What information does it disclose if it does so? Does it implement encryption? Properly, using a widely recognized protocol? Does it run locally or is it a remote front-end?

Apple already claims to do some kind of review (or at least have some kind of conditions) for an iTunes listing. So does Google Play. That's self-regulation - it may not be perfect; it may not catch all the malware, but Apple and Google seem to think limited regulation provides some consumer benefit.

Re: I disagree that this tool should be illegal

[gbjbaanb]

First thing to do is to regulate the ISPs so they implement egress filtering to stop spoofed packets from leaving their domains.

That would strop a lot of DDoS, and the rest - at least you'd then know who was sending the packets, and could take action against them (or tell them to stop it)

Re: I disagree that this tool should be illegal

[gbjbaanb]

Its stretching the point a little, but 1 man's performance testing tools is another's DDoS attack tool.

I've stress tested our company's website on an internal network to see how much load it could handle with the hardware available to us before now. Everybody who does that hits it until it starts to degrade its service to make nice response graphs.

Re:I disagree that this tool should be illegal

[MrKaos]

that it should be illegal to use it against someone against their will... sure.

But to even own it? No.

You can't do system testing without tools that are effectively hack tools. And even if you've no good reason to have it, it isn't the government's place to say what programs we have or don't have.

The Australian government tried to do this in the '90's. I wrote to them making exactly that point as I was securing clients to what is now ISO17799. Legislators around the world are getting a lot of bad advice about what laws should be constructed. Geeks/Nerds should participate more when laws are being made regarding technology.

I've often find myself wondering how much more actual business and computer work I could do, personally, without writing to say 'that's a bad idea and it will hurt us thus' and making sure the communications are respectful enough to have an impact.

Like it or not Geeks and Nerds have found themselves at the apex of activity where new laws are being constructed around the world and my experiences are that it makes sense to read and understand proposed laws so as to understand the potential impact on work in technology. Reading the laws proposed for many countries is no harder to read than a shell script, except you are the shell. You are subject to the effect of law as it's the language used to program the behavioral boundaries of a community, so sometimes you can shape it in a very small, but meaningful, way.

Re: I disagree that this tool should be illegal

[behrooz0az]

pssh -h every-server-i-have-access-to.txt -l root ping -fi 0 -w 1 example.com
Does that make a hacker? I have ping installed on every single piece of equipment I own.

Re:I disagree that this tool should be illegal

[dave420]

They were arrested because they "are suspected of maliciously deploying Lizard Stresser". It's not just because they owned a copy.

Re: I disagree that this tool should be illegal

[KingMotley]

Please respond if you haven't been arrest yet.

Re: I disagree that this tool should be illegal

[KingMotley]

Are you kidding? I've DDoS'd every webserver and website I've ever built. It's how to find it's weaknesses, so that you can identify performance bottlenecks under stress and fix them.

Perhaps, that's why none of my websites have ever gone down from too much traffic. Coincidence perhaps. Maybe others just aren't doing it often enough. See: slashdot effect.

Re: I disagree that this tool should be illegal

[ThatsMyNick]

May be, you can handle a 100 Gbps DDoS thrown at you, without your ISP throwing a fit and kicking you off. Mine will handle a layer 7 DDoS, but nothing else (I did not have to DDoS my system through an external network to simulate this)

Re: I disagree that this tool should be illegal

[tlhIngan]

DDoS-tools are a perfectly legitimate tool in network testing and research and both individuals and various companies do use them for those things. Just because you fail to see any use for them other than illegal attacks on others doesn't make it so.

And the kids weren't charged with having the tools. They were charged with illegally deploying it on systems they don't own, and for using them against sites without permission.

So yes, network security professionals do need those tools. And generally, they use it against a site they have permission to run the test on.

Alas, these kids were neither security professionals doing legitimate work, nor were they using the tools against sites they were legitimately testing.

It akin to (ignoring the fact that owning them is illegal) having a set of lockpick tools. Yes, you can use them legitimately to open locks you have permission to open, as well as use them to educate yourself on locks and their deficiencies. These kids however, were more into using those tools to open locks they didn't have permission to access.

Use them legitimately, and it's a professional tool. Use them illegitimately and it's a criminal offense. These kids did the latter.

Re: I disagree that this tool should be illegal

[Gaygirlie]

I'm not sure why you're replying to me, did you mean your comment to someone else? I haven't even once defended these morons, I was only arguing about the legitimacy of the tools themselves -- something that you, yourself, seem to agree with me on.

Re: I disagree that this tool should be illegal

[KingMotley]

100 Gbps thrown at my ISP wouldn't kill them (Just double checked), but it sure would raise some eyebrows, and yeah, it probably would take down the stuff I work on -- maybe. But then again, most of those huge attacks are simple amplification type attacks, which are easily detectable and filterable. It'd hurt for about an hour, maybe less depending on how fast the traffic can be blocked. I'm more concerned about a deluge of traffic fueled by bursts of advertising. Being able to handle 1000+ simultaneous users generating 100,000+ web requests without slowing anything down than some DDoS attack from a jilted hacker group.

Smaller DDoS attacks are perfect for this type of test. I don't have a zombie bot army, so I couldn't even generate a 100Gbps DDoS if I wanted to. 1Gbps, to test a single server instance is plenty for my use cases.

Re: I disagree that this tool should be illegal

[kwbauer]

No, as we say in America, open carry is banned but concealed carry is accepted.

Re: I disagree that this tool should be illegal

[kwbauer]

Is causing damage to paper targets and watermelons, etc. considered an unacceptable use. You do realize that 99.9999999999% of privately purchased weapons are not used for any other purpose,don't you?

Re: I disagree that this tool should be illegal

[kwbauer]

Ordinary citizens ARE the professionals doing this.

Re:I disagree that this tool should be illegal

[Stan92057]

Ive made my opinion on this a hundred time. This kinda tool and the person using it should be a licensed professional/or in school to become one. How many times have we seen this kinda tool used for bad purposed when released to the general public? too many. Its not a toy, you need to register a car, a test to get a license to drive said cars,even more school to drive a big trucks,a hair dresser needs a licance, a Doc needs to get a license , a lawyer needs a licance, yet a tool this dangerous is muh who cares.

Re: I disagree that this tool should be illegal

[kwbauer]

If it is good for guns, it is good for computers and cars.

Re: I disagree that this tool should be illegal

[Zephyn]

Is causing damage to paper targets and watermelons, etc. considered an unacceptable use. You do realize that 99.9999999999% of privately purchased weapons are not used for any other purpose,don't you?

Watermelons? Is Gallagher doing his comedy shows with a Sledge-o-semiauto-matic now?

Re: I disagree that this tool should be illegal

[ThatsMyNick]

As someone who has had the unfortunate experience of dealing with a DDoS, it most definitely wouldnt kill your ISP, but it would degrade their services a lot. The larger ISPs* will auto-null route your IPs and call it a day. The smaller ones, unless you have a good relationship at a personal level, will terminate your account and ask you to pack up (and null route the IP of course). Even the ones that advertise 10gbps (or 20 gbps) DDoS mitigation will ask you to pack up.

* The only exception is probably OVH and may be even Voxility (it will cost you a pretty penny with Voxility of course).

I understand this not something you expect on your server or your client's, but it is what a DDoS is.

Re: I disagree that this tool should be illegal

[KingMotley]

Another exception is a client so large that they are their own ISP. I work for such a client, so I have no concerns about being asked to pack up -- I don't manage their network so I can't answer a lot of technical questions about it. Not that I couldn't understand it, just it's not part of my job and I only know enough about their implementation as it affects what I do. Last I checked (3-5 years ago), it had enough bandwidth to host 10x what youtube delivers at it's peak times. That's all I needed to know for the most part.

Re: I disagree that this tool should be illegal

[Karmashock]

You can't... we're in an age of programmable systems that have entirely harmless uses.

Lets say I have a CNC machine which I could use to make chairs or cabinets or something. Safe right?

I can also make guns with a CNC machine by milling out aluminum.

Increasingly we're going to see machines that could do a lot of things at once.

Is it a 3d printer that can print in metal... that I use to make artistic sculptures... or is it a weapons factory?

There is a new machine recently developed that is to chemical processing what the 3d printer is to additive manufacturing. It can mix very precise amounts of anything... subject the liquids to temperature, pressure... and make anything if you have the base components.

And given that most base components can themselves be refined from other components. The reality is that if people have access to a machine like that they can make drugs, explosives, neuro toxins... anything that a chemical factory could pump out. And here you say "well we need to regulate that"... but that's not all it does.

What you're going to be dealing with increasingly is Omni-Tools... Everything tools. Universal tools. Tools that can make anything and so everyone will have one.

And when everyone has one they can order their omni tool to make anything they could want.

You can't regulate it. You won't.

Which means your entire regulation paradigm collapses.

Imagine a world where everyone has everything they want. Machine guns. Neuro toxins... narcotics... explosives... anything you don't want them to have. Lets say they have it and you can't stop them from having it.

How do you organize your society assuming I am right and you can't stop it?

Anarchy? That's merely an admission of failure. That would just be saying your system would collapse.

Vast aspects of our society are going to change.

Think of how the industrial revolution changed the agricultural culture or how the agricultural revolution transformed the hunter gatherer lifestyle.

That is what we're coming to here. Your regulation paradigm will not survive that transition.

Re: I disagree that this tool should be illegal

[ThatsMyNick]

I am still willing to bet they wouldnt hold up at 100 Gbps attack. The capacity is usually measured in pps (packets per second). Even if you have the throughput, you may not be able to handle as many packets. Unless they own a lot of ASICs that can filter traffic for them, they are going to have a real bad time. All that is required is for one chock-point to multiply the effect.

Anyways, someone self-testing a 100 Gbps sustained attack is going to have a lot of problems with their transit providers. I wish them luck.

Re:I disagree that this tool should be illegal

[Karmashock]

I'm okay with registering so long as any non-felon can do it.

If the registration process becomes something that ultimately keeps it out of the hands of most people then I refuse.

Here you might say "but its dangerous"... only if the security is shit. Don't have shitty security.

Re:I disagree that this tool should be illegal

[tehcyder]

it isn't the government's place to say what programs we have or don't have

Just like it's not "the government's" place to tell us we can't rape or kill or own nuclear weapons?

Gotcha.

Re: I disagree that this tool should be illegal

[tehcyder]

Is causing damage to paper targets and watermelons, etc. considered an unacceptable use. You do realize that 99.9999999999% of privately purchased weapons are not used for any other purpose,don't you?

I calculate that 0.0000000001% of 300 million guns (approximately one per person in the US) would be 0.03. I think the US has more than 0.03 gun deaths a year.

Re:I disagree that this tool should be illegal

[Karmashock]

... Reductio ad absurdum?

Very well, then using your only rules where I can apply the most hyperbolic interpretation of what you say... apparently you believe the government has absolute authority to do anything what so ever... up and including raping you death because Rule 34 subsection A paragraph 2 of the Rape Idiots That Think The Government Should Have Absolute Authority Act of 2015.

Now we see if you have the integrity to admit you made a dumb argument and moderate your position so we can engage the issue in a constrictive way... or if you're a whiny shithead that will dig his little heels in pathetically even though you've got nothing to get a grip on... and I push you into into the abyss of self contradiction.

Your choice.
https://www.youtube.com/watch?...

Fallacies are indefensible. You can't dig your heels in.

Re: I disagree that this tool should be illegal

[tehcyder]

In many countries like here in the UK it is illegal to own an automatic handgun. It doesn't mean it's impossible to get hold of one, merely that you face punishment if you're found with one (never mind actually using it for a crime).

In your exciting world of 3D printing drugs and nuclear weapons, the same will apply. If you get rid of governments and government regulations, all that will happen is that mafia-like organisations will fill the gap.

Re:I disagree that this tool should be illegal

[tehcyder]

They were arrested because they "are suspected of maliciously deploying Lizard Stresser". It's not just because they owned a copy.

You're spoiling the libertarians' "oh noes teh government are going to take away my freedom to own software and cruise missiles" whining.

Re: I disagree that this tool should be illegal

[Karmashock]

Have all the regulation you want. Anything short of full North Korea levels of suppression will fail.

You're coming to a paradigm shift. Your social model won't survive it.

Think of the social models that existed before agriculture.
Think of the social models that existed immediately after agriculture.
Think of the social models that existed prior to the industrial revolution.
Think of the social models that existed immediately after the industrial revolution.

You have come upon a paradigm shift. I can guess what it will do but its too complicated for me to really reason it all out in detail.

What I do know is that that status quo won't survive. It never does. Things change.

If we all own Omni Tools... anything makers... things that can make explosives, drugs, automatic weapons... you can't stop it.

The reality is that you won't even be able to recognize half of the stuff. Your system is based on regulating stake holding commercial interests. These are economic choke points. But in the new paradigm those won't exist or will be much much less prominent. And who is to say that I have to make my contraband look like anything you'd recognize? if I've got a micro factory that can make custom anything for me... then I can put a gun in an ipad. Imagine the most absurd cold war nonsense. There's no reason the average citizen couldn't be printing out that weapon. What are you going to do? X Ray everything? And even if you do... who is to say that the internal workings of the thing couldn't be made to look harmless or simply not suspicious.

And then you might say "well I could look for certain chemical residues"... sure... but who says I even need to use chemical propellents? A good deal of the cold war assassination weapons were air rifles. Quieter. And then what are you looking for... CO2?

The CIA during the Cold War had an assassination pistol that fired a 3 MM ice bullet that contained a drop of shell fish derived neuro toxin. You could shoot someone with this this thing a crowded room. No one would even hear the shot go off. The toxin causes anyone hit with it to have a fatal heart attack. The body could be examined and the wound would look like scab or a pin prick. The bullet melted into water. The neuro toxin breaks down almost immediately. It is a functionally undetectable assassination weapon that the US has had in its inventory since at least the 1960s.

You're thinking in industrial terms. You're thinking about how you'll regulate blue collar people in the industrial era. That's not the context.

What you're talking about is akin to banning marijuana. Its a plant. Any idiot can grow it in some soil. Its illegal throughout most of the first world and its impossible to control throughout the first world.

Now imagine instead of some drug that a teenager can grow in some soil... you're dealing with microwave sized factories that can produce... just about anything.

Your regulation paradigm won't survive that.

What is my solution? Regulate people... not technology. Its a radical change in policy but the alternative is anarchy. The old paradigm is non-functional in this setting. Totally pointless waste of time.

Regulating people... knowing who is who and where they are and what they're like... Data mining and profiling... using expert systems to estimate the chances of X person doing Y crime.

Short of that ... you're going to be subjected to constant terrorist attacks, mass shootings, drug outbreaks, bombings... whatever. And the tools used to do all that stuff are just going to get better. Better electronics, better sensors... we are already seeing drones being used in crimes... mostly smuggling as of now but there's no reason a drone couldn't buzz a stadium and disperse anthrax or something over 30,000 people.

Its coming. Its not a matter of if but when.

Re: I disagree that this tool should be illegal

[Karmashock]

The NK model is holding. I'm not saying fail as in 1000 years... I'm saying fail as in FUCKING INSTANTLY.

The drug war was lost INSTANTLY. It wasn't like they were winning for a moment. They lost as soon as it started.

And these regulatory regimes based on outmoded contextually irrelevant industrial models will fail when applied to situations and systems they cannot regulate.

Re: I disagree that this tool should be illegal

[KingMotley]

You think the transit providers are going to balk if our traffic merely doubles for a short period? 100Gbps isn't as big as you'd think. My client's TLD is .gov.

Re: I disagree that this tool should be illegal

[Karmashock]

You've missed my point.

I'm not saying you can't write a law down on a piece of paper.

I'm not saying you can't order police to do X in condition Y.

What I am saying is that whatever you do with the civic authorities, you can't stop the process because it isn't going to happen in places where you're going to be able to stop it.

Your regulatory framework presupposes that the police will exist at choke points in the process that allows them to monitor and control the situation.

What I am telling you is that the new paradigm will BYPASS your choke points.

You're like a person saying you can stop smuggling by putting people at border check points when the smuggling is happening through teleportation or some other means that simply doesn't go anywhere near your check points.

I'm not saying you can't putt little booths next to roads and have men with guns come out and inspect cars and people that pass through those checkpoints.

I'm saying that the whole the whole thing will happen no where near your check points and so whether you have them or not will be irrelevant.

I'm not talking about perfect compliance as the standard here. I'm saying your regime will fail COMPLETELY.

I can walk out of this room right now and get as much heroine and cocaine as I want. I can do those drugs while 10 prostitutes lick every exposed bit of skin on my body.

The only thing stopping me is my personal disinterest in spending my evening that way.

Your laws are utterly meaningless.

You think you can ban something that can't be banned absent a regulatory system so complete that it would be politically unacceptable under any conceivable political system short of a dictatorship.

You cannot win. All you can do is lie to yourself and waste your own time and money trying to do something you will fail at before you even start.

Re: I disagree that this tool should be illegal

[Karmashock]

*shoots idiot in the face with a nice white canvas back drop*

Hmmm... Yeah... I like that tooth lodged in the right corner. I think this is a winner.

*sprays some sealant on the splatter covered canvas and hangs it up on a wall*

I call it "how this argument ends".

Life is meaningless so your death is meaningless and the manner in which you were killed was also meaningless thus any moral, ethical, or legal judgment of it is also meaningless.

You've just negated all thought thus negating yourself.

End of discussion.

Re: I disagree that this tool should be illegal

[Karmashock]

*shhhh*

Preserved splatters on canvas have no further rebuttals.

You're done. You rhetorically killed yourself roughly in this manner:
https://www.youtube.com/watch?...

In the next incarnation of the universe assuming any such thing happens... I would suggest you adopt less instantly self destructive arguments least you will sadly go through something of a ground hog day repetition of the same thing until you finally get it right.

Re: I disagree that this tool should be illegal

[Karmashock]

I said *shhhh*, greasy stain. This is over. You're now modern art.

It is I that shall explain you over a glass of wine to friends pretentiously at parties. That is your fate hence forth.

Re: I disagree that this tool should be illegal

[kwbauer]

You are correct. i should have said uses of privately purchased guns. As in, I used my handguns about 1200 times last year (if use equals shot at a target) or about 20 times if you count each outing to shoot at targets.

Re: I disagree that this tool should be illegal

[ThatsMyNick]

I am talking about a persistent DDoS, the ones that last days (and weeks). You are definitely underestimating the effect of 100 Gbps. I can think of many .gov domains (and depts), that would for sure not be able to handle it.

Re: I disagree that this tool should be illegal

[KingMotley]

And that's the really nice thing about tools like this. I don't have to guess.

bitcoin is busted. look at all the arrests lately

[swschrad]

just saying.

Re:bitcoin is busted. look at all the arrests late

[Anonymous Coward]

Bitcoin, as used by most people is not, and has never been, fully anonymous.

It's like having a bank note that records every transaction it is used in. They just back track the transactions until they can find someone they can pressure into giving up personal details. Any US currency to bitcoin exchange should be treated with caution at this point. There's obviously at least one that is cooperating with LEA.

The only bitcoin that is anonymous is the one you find yourself, but good luck with that.

Re:bitcoin is busted. look at all the arrests late

[radarskiy]

US dollars are busted, just look at all of the arrests for a long itme.

Re:bitcoin is busted. look at all the arrests late

[thegarbz]

Bitcoin is no more busted than a balaclava used for anonymity by a person robbing a bank who leaves his fingerprints everywhere and then drives his own registered car away from the heist.

Bitcoin offers anonymity in the wallet alone. It's not possible to identify individual people in a bitcoin transaction at the time of transaction without looking at other details the most obvious of which are IP address, or the times people convert hard currency to bitcoin and visa versa in a traceable fashion.