FBI Shuts Down 15 DDoS-For-Hire Sites (techcrunch.com)

The FBI has shut down the domains of 15 high-profile distributed denial-of-service (DDoS) websites. "Several seizure warrants granted by a California federal judge went into effect Thursday, removing several of these 'border' or 'stresser' sites off the internet 'as part of coordinated law enforcement action taken against illegal DDoS-for-hire services,'" reports TechCrunch. "The orders were granted under federal seizure laws, and the domains were replaced with a federal notice." From the report: Prosecutors have charged three men, Matthew Gatrel and Juan Martinez in California and David Bukoski in Alaska, with operating the sites, according to affidavits filed in three U.S. federal courts, which were unsealed Thursday. The FBI had assistance from the U.K.'s National Crime Agency and the Dutch national police, and the Justice Department named several companies, including Cloudflare, Flashpoint and Google, for providing authorities with additional assistance. In all, several sites were knocked offline -- including downthem.org, netstress.org, quantumstress.net, vbooter.org and defcon.pro and more -- which allowed would-be attackers to sign up to rent time and servers to launch large-scale bandwidth attacks against systems and servers.

Comments

Cool something besides politics

[Seven Spirals]

Jesus thank you FBI for giving us ONE FUCKING STORY that didn't bring in some more dipshit partisans.

Re:Cool something besides politics

[Antique Geekmeister]

From personal experience with the FBI's Computer Crime Lab, I'd not give them credit for this action without compelling proof. They've not yet shown they're capable of doing the actual work to block, capture, or prosecute any computer criminals in any of the cases I know of personally. The few crimes listed on their website show no sign that they've done nothing successful except to claim credit for others', and they've passively interfered in every investigation I do know of personally. They accept reports and evidence, they do not act on any of it.

Re:Cool something besides politics

[ShanghaiBill]

I have also had direct dealings with the FBI's Computer Crime Lab. The team leader had a degree in history, and his subordinates were even more clueless than he was. The only way they could have done this is if the three named companies that provided them "addition assistance", handed them all the evidence on a silver platter. Even then, it is a miracle that they didn't screw it up.

The FBI prides themselves on their "special agents" being able to "do it all" without any actually being "special". But, at least with tech crimes, that clearly isn't working.

Re: Cool something besides politics

[Zero__Kelvin]

So your claim is that you never posted?

Re:Cool something besides politics

[Seven Spirals]

Well, I my original post was a bit tongue and cheek. However, I had one experience that validates your main assertion. I did a contract job about 15 years ago for a company that had a severe internal IT vandalism incident (a "hack" as journalist would say). This guy was really, really, wanting prison. He used the corporate VPN and didn't make tremendous efforts to hide his tracks (they made him really made, I heard). The company apparently used an Excel spreadsheet to keep their passwords in. They were like "but we encrypted it!" (referring to some kind of M$ password lock on the file *shrug* I don't know Excel) which made me giggle inside. Anyhow, Joe Hacker was a sysadmin and from what I can tell a real firecracker of a person mixed with the fact this this company was run by some puffed up business weasel jerks who made for an explosive mix. The guy destroyed their print servers, destroyed a few file servers (mainly ones with "fun" files on them like MP3s), destroyed their fax servers, and erased their sales databases and leads. Then he moved on to worse things. He backdoored their software repos for devs with all kinds of nasty code and then erased version logs to cover his tracks so they didn't know who wrote what code. He put tons of malware and viruses on their file servers he didn't destroy and named it innocent things like "customer_data.xls.exe" which some fell for. He poison-pilled their Netbackup infrastructure and manually swapped row data in the Sysbase database it uses to mix up media IDs so they basically lost their backups. He put at least 20 backdoors in routers, servers, workstations and test machines (stuff like Sub7 and then ACLs in the router that allowed traffic from everywhere to their crown jewels and even NAT'd some to obscure the source addresses). He land-mined their WSUS and Jumpstart servers with malicious post-install scripts. He physically stole/swapped some of their Decru keycards for their PKI infrastructure so they lost most of their security logs and encrypted tapes. Then as he was getting fired, he put some scripts or some kind of final trigger in place that brought down their Sonnet networking gear for about 30 hours. Took like three Cisco CCIEs to fix that working continuously. Man, I'm just scratching the surface, too. This guy just unleashed hell on this company AND he did a great deal of it across state lines. We recovered some VPN logs that were pretty much smoking gun correlation to other security event data. It took me about two months to unravel the stuff he did. If he wasn't so malicious, I'd actually have some respect for his criminal ass because of how devilish some of the shit he did was (ie.. setting Solaris inittdefault to 6) "Why do these boxes keep rebooting!?". So, we gathered ALL this evidence along with some local law enforcement. The company tried to get the FBI involved and so did the local detectives. The Feds sent out one bunghole non-IT guy who basically shrugged it all off and walked away. Then, after that point, they were pretty much disconnected and checked out + not interested in it. So, I gotta wonder how much firepower they really have and when they'd bring it to bear. It's a one-off anecdote and thus probably doesn't mean shit. However, it does make me wonder. The guy did go down for some shit and did a small amount of time, but he was lucky as hell a jury never saw the evidence I gathered.

Re: Cool something besides politics

[Seven Spirals]

Well, I wouldn't consider myself any type of partisan since I don't hold views that are compatible with any party. I have right, left, and centrist political opinions. However, those that want to label me as such are free to do so. I do believe in freedom.

Re:Cool something besides politics

[Seven Spirals]

I'd like to thank the ACs for a perfect illustration of "dipshit partisans".

Re:Cool something besides politics

[Seven Spirals]

I didn't really come down one way or another on if the case was a good use of FBI resources. Despite your anger and insults you have some valid points. What I'm saying is more that just because something is a federal crime, doesn't mean that the FBI will automatically get involved. I did find the manner of the FBI investigator to be a bit lofty and he treated the locals pretty badly, too. It was clear they didn't like him. Of course, all that was just one incident and as we both say with more or less vitriol, it was an anecdote. Does the FBI have better things to do? Probably so, as you angrily attest. However, do people who commit real federal crimes that hurt real people always get the book thrown at them by the feds? No way. That's my main point.

Re:Cool something besides politics

[Antique Geekmeister]

I'm afraid I've seen no sign that they "have anything better to do" but accept reports and evidence gathered by others, reports on which they refuse to act, and on occasion take credit for other people's work in which they've interfered until the moment of prosecution.. That they accept reports and evidence but then ignore it actually deters other criminal or civil prosecution,

Re:Cool something besides politics

[Antique Geekmeister]

I hesitate to name the labs I've dealt with to preserve my pseudonymous status. I'm willing to say that I've dealt with them on 4 distinct occasions in the last 10 years, simply to report criminal activity I or my colleagues had tracked back to its source, and they did nothing with the information. Their position as the agency to report criminal computer activity actively and refusing to release the evidence to others interferes with other agencies.

Now if they could just take down "Lisa"

[Ungrounded Lightning]

Now if they could just take down "Lisa from Credit Card Services" the phone scammer that called me on my cellphone just before I got to this.

Re:Now if they could just take down "Lisa"

[ShanghaiBill]

Don't answer calls from people you don't know.

Many of us rely on our phones for business. I get calls almost every day from clients and prospective clients. If I don't take the call, I starve.

I have an iPhone. Almost all spam calls say "Scam Likely" in the name field. If Apple can identify scammers, why can't the phone company, or the FBI?

Slashdot Is Safe

[Anonymous Coward]

Luckily slashdotting is a thing of the past with this piddely audience.

Re:Slashdot Is Safe

[fredrated]

No shit, I think the ship has just about sunk, is it time to jump?

How will 4chan ruin Christmas now?

[cfalcon]

Maybe we can get through Christmas without some online game going down because something they did offended a 4chan anon.

Maybe?

Domain Seizure

[XArtur0]

Domain Seizure means we can still reach the actual site by its translated IP Address, right?

Not that I support their Business Model, just to know how much power the US Guv-a-mint actually does have.

Thanks.

its about time

[Revek]

I turned in several sites about four years ago and never heard anything back.

Slashdot is safe!

[easyTree]

No one RTFAs these days...

Depends

[Solandri]

If the site has a dedicated web server, then yeah the IP address will work even if the domain name gets taken down and DNS redirected.

But most small websites are hosted on shared servers. Dozens or hundreds of websites are hosted on a single server and all have the same IP address. The site that gets loaded in your browser depends on the domain name you used to get to that IP address.