Europol Shuts Down World's Largest DDoS-for-Hire Service (bleepingcomputer.com)

In what is being seen as a major hit against cybercriminals, Europol, an international police operation, has taken down the world's biggest provider of potentially crippling Distributed Denial of Service attacks. From a report: Europol officials have shut down WebStresser, a website where users could register and launch DDoS attacks after paying for a monthly plan, with prices starting as low as $18.25. The website, considered the largest DDoS-for-hire service online, had over 136,000 users at the time it was shut down. Europol said it had been responsible for over 4 million DDoS attacks in recent years. Visitors to the web site will now see a notice stating that the site has been seized in conjunction with "Operation Power Off," which is the name of the multi-country operation that took down the site.

Comments

The users should be prosecuted too

[sjbe]

Europol officials have shut down WebStresser, a website where users could register and launch DDoS attacks after paying for a monthly plan, with prices starting as low as $18.25.

So someone who signs up for a service like this really is saying they intend to cause harm. While logistically difficult to prosecute everyone, it would seem logical that every user of this service should find themselves in some legal hot water. I cannot think of a single lawful reason why someone would need to use a service like this. And if there isn't a law against using a service like this there darn well should be. Obviously the providers of this "service" should be put in jail but I would argue the users of the service are really no less culpable.

Re:The users should be prosecuted too

[110010001000]

You might use a service like this to stress test your website. Maybe that is why they called it WebStresser.

Re:The users should be prosecuted too

[lbmouse]

There are legitimate reason for stress testing. The problem with this company is that they didn't confirm that the addresses tested belonged to their customers. They knew what they were doing and thought they could skirt the law.

Re:The users should be prosecuted too

[Anonymous Coward]

You should think a little harder ;-)

Re:The users should be prosecuted too

[OverlordQ]

*eyeroll*

And those water pipes are for tobacco.

Re:The users should be prosecuted too

[RandomFactor]

I can see no legitimate rationale for not performing validation on a destination to prove control/ownership.

For example with with various online services it is common to require a cryptographically signed DNS entry to prove domain ownership.

If stress testing an 'IP' you should be able to require a specific website response at http://ip/testingapproved.html or other similar method before starting.

Re:The users should be prosecuted too

[Luckyo]

If you use the service to stress test your site against DDoS attacks, how is this in any way criminal?

Any sane court would laugh your arguments of guilt by association out. As they should.

Re: The users should be prosecuted too

[Anonymous Coward]

Aren't they?

Re:The users should be prosecuted too

[Anonymous Coward]

and bitorrent is useful.

Re:The users should be prosecuted too

[Anonymous Coward]

And ACAB means "Always Carry A Bible"

Re:The users should be prosecuted too

[Anonymous Coward]

Prosecute ?? HAHA ... hahahaha. Make public names + pictures + address of DDos byteboiz involved. Stand back and munch popcorn. Let bloody-handed vigilante justice take its course on both malware developers and sociopath usrs. Profit !

Re:The users should be prosecuted too

[Anonymous Coward]

Agreed. @berniesanders from steemit.com uses these types of services. I wonder if he'll stop attacking folks, all of a sudden?

Re:The users should be prosecuted too

[Anonymous Coward]

You mean Justin? He's already been doxxed on Steemit. Vigilante (as a below poster commented) hasn't worked so far.

https://steemit.com/berniesanders/@naturalista/justin-bay-salmeron-is-berniesanders

Re:The users should be prosecuted too

[Anonymous Coward]

Exactly, anyone who's disagreed has never downloaded a linux distro, big (or small) files from archive.org or some university/academic files which are only avalible with bittorent.

Re:The users should be prosecuted too

[DRJlaw]

I cannot think of a single lawful reason why someone would need to use a service like this

*eyeroll*

And those water pipes are for tobacco.

Set yourself up with a challenge like that and you'll get that sort of answer. It doesn't matter whether 99.9% use it for something else, you need only point to the lawful example.

Re:The users should be prosecuted too

[Riceballsan]

Well yes but I think the point is that they shouldn't blindly prosecute the users, for using a service that doesn't check how it is being used first. Just as if you buy alcohol from a store that doesn't check ID. That store should absolutely be in deep crap, but they won't go trying to chase down the customers. I suppose in the process of investigation, they could say go through the records of where the for hire DDOS's went. Compare that to reported hacking crimes, and where there is overlap, prosecute the person who paid for the hit.

Haha

[Anonymous Coward]

lol

My brother had an account there.

Hope he goes to prison so I can get his laptop :))))

Re:Haha

[sjbe]

My brother had an account there.

Then your brother is an asshat.

Re:Haha

[BronsCon]

Or his brother load-tested his own websites, or those of his clients, with permission. I know that's what I use similar services for, legitimately and legally, on a semi-regular basis.

Re:Haha

[Anonymous Coward]

Don't know about you, but I'm here for the trolls

Re:Haha

[Highdude702]

I'm an electrician and computer nerd have been both for 15+ years and have been a computer nerd far longer. I make nowhere hear 6 figures, yet I understand electronics and computers a lot better than most of the users I see on slashdot.

Re:Haha

[Dutch Gun]

Any legitimate web-stressing service should require that you prove ownership of the domain to be stressed by adding specific markers to root-access resources. Not performing this basic safety check is criminally negligent at best, and a criminal enterprise at worst. And anyone who subscribes to and thus promotes a malicious service like that should be prosecuted. Anything else is just excuses.

Re: Haha

[Anonymous Coward]

Fuck off you fascist fuck.

So just because I sign up I should be prosecuted? You need to step away from
That slippery slope you are approaching.

Re: Haha

[Anonymous Coward]

just because you're an idiot doesn't mean its a slippery slope. johns get busted too for using prostitutes. so U FUCK OFF.

Re:Haha

[Anonymous Coward]

what's his laptop anyway? A gamer rig or a speed demon or a macbook air?

Re:Haha

[Anonymous Coward]

No. Websites shouldn't be responsible for how users utilize them. If I make a power tool, it's not my fault if you use it to murder your family.

In this same hypothetical situation, if Bob's Home Repair has an account at Home Depot, should he get in trouble because of your purchase?

Re:Haha

[BronsCon]

Any legitimate web-stressing service should require that you prove ownership of the domain to be stressed by adding specific markers to root-access resources.

Well, since the site is offline now, we can't very well see for ourselves whether or not they did so. More to the point, that's a weak check anyway since, for many sites, it is trivial to host your domain with the same provider the target site uses and send enough traffic that way to take down not only your own domain, but also any domains hosted on the same server, the same subnet or, if you send enough of the right traffic, the entire provider. The only difference is, then, the target site won't have information in their logs detailing what happened, because you directed the attack at your own domain.

Personally, if someone's gonna come at me, I'd rather they did it directly.

Re: Haha

[BronsCon]

Sure they do, but who's to say I'm paying her to do anything more than talk, until I ask how much a handy j costs? And paying a girl to talk to you is perfectly legal, despite other services she may or may not be offering; some call it therapy.

Crime against humanity

[bigmacx]

For years, it seemed SPAM email blasting companies were the worst Internet villain imaginable, but then came the for-hire DDOS companies. Eventually they didn't even have to hide on the DarkWeb and appeared on public websites. Now anyone with even the most minor beef can take someone or something offline for a few hours for a few dollars. These things whack indie multiplayer games all the time. It's soo easy to phish someone's IP address and then target them after getting frag'd, tk'd, or blog-flamed.

I think we should livestream the torture of these DDOS company owners & operators. That would be totally worth a monthly fee...

Dr. Seuss

[Anonymous Coward]

White Hat
  Black Hat
Grey Hat
  Ass Hat

Re:Dr. Seuss

[nnet]

Free Hat!

Congradulations

[cwsumner]

Congradulations to Europol all of the people who worked to take this website down! The fight is not over, but at least we got in a "good hit".

Re:Congradulations

[AlwinBarni]

Congratulations indeed, however is it only about the site or also about the owners and their infrastructure? How about the customers? It should be easy to check if they just tested their own services or were involved in some malicious activity.
One cannot have DDOS without proper infrastructure, either hacked or own, so there are much more details I would be interested to read about this issue.

Re:Congradulations

[fazig]

Like in most of these cases if it goes to court, they'll be offered significantly reduced sentences in exchange for information that exposes others or even their entire infrastructure. And they usually cave in quickly.

Re:Congradulations

[jiriw]

What I read on my 'local' tech website (page in Dutch) is they arrested several admins in various countries, and a former admin in the Netherlands. Also, it wasn't a Europol lead operation. Law enforcement agencies of eleven nations were involved from Europe, North America and Hong Kong (Asia), 'in corporation with Europol'.

The site is seized by the US DoD. In the coordinated effort the agencies hunted down various admins. The hunt for other personnel and users of the services is ongoing.

Dutch police is answering questions about the case here on Reddit (in English).

Re:Congradulations

[cwsumner]

Interesting!

Re:Congradulations

[Anonymous Coward]

"Further measures were taken against the top users of this marketplace in the Netherlands, Italy, Spain, Croatia, the United Kingdom, Australia, Canada and Hong Kong. The illegal service was shut down and its infrastructure seized in the Netherlands, the US and Germany."

illegal?

[fish_in_the_c]

which country where they in? Where were their servers? I assume this was illegal in their native country and they should have known better.
Of coarse, being a private military contractor isn't illegal, so I'm not sure why this should be. I would think the people who own the site should have known to put it in a country with a small king and include him in on the money.

Re:illegal?

[Anonymous Coward]

I believe being a "private military contractor" is not legal in most European countries. We don't accept private armies. Weapons may not even be allowed, and digital warfare may be included in that.

I think your sentence is pretty funny they way you wrote it. Why would "a small king" help them? You probably meant a small country, with an easily influenced king! :D

There are few kingdoms today where the king has any real power at all. They certainly don't have much power in European kingdoms. Those minor European kingdoms are filthy rich and wouldn't want your money or criminals on their soil. Maybe an Arab kingdom would work better? That would however defeat the purpose of your plan, as those kingdoms are hard pretty on criminals.

From the one-down-but-two-take-their-place dept.

[Anonymous Coward]

"Posted by msmash on Wednesday April 25, 2018 @12:05PM from the end-of-road dept." Hardly the end of the road. You take one of these buggers out and two more take their place. It's like killing cockroaches. When governments decide to start killing people for spamming and running DDoS operations is when everyone who participates in these industries will decide that the risk of death isn't worth getting caught and stop participating in them.

Which countries?

[Alwin Henseler]

From the article: "the site's administrators, located in the United Kingdom, Croatia, Canada, and Serbia. (..) server infrastructure located in the Netherlands, the US and Germany".

I would think the people who own the site should have known to put it in a country with a small king and include him in on the money.

I'm from the NL, which is known for hosting things that are frowned upon elsewhere (eg. the NL is a popular choice for hosting porn sites). Why? Because my country has a long tradition of protecting free speech, protecting minorities, embracing diversity among groups of people etc. Besides well-connected internet infrastructure. Which makes the NL a good choice for hosting stuff that might come under attack either legally, DoS-wise or even physical attacks.

Hosting such things in a 'dirty corner' of the net makes it easier (for folks that don't like your site) to blacklist, remove from search engines, or bribe some officials to cut a line & look the other way. Much more difficult for content hosted in the NL. Similar story for US & Germany.

Same guys ?

[rojash]

Are these the same guys who facilitated bringing down SD every few weeks ??

Re:Same guys ?

[Anonymous Coward]

No, the gerbil was fighting the flu.

Did they use a bot net?

[Required Snark]

There is a real lack of technical information in the reporting, at least so far.