International law enforcement has dismantled a website allegedly operating as a launch pad for up to six million distributed denial of service (DDoS) attacks worldwide.
Webstresser.org, said to be the world’s largest peddler of DDoS attack tools, had 136,000 registered users, some of whom have little or no technical knowledge but could buy the service for $15 to take down targeted sites, according to reports. Anyone who wanted to attack a web service could do so without worrying about being traced. But that gig may be up: Police in a number of countries have already arrested or warned some webstresser users about continuing to use the site's DDoS tools, Forbes reported.
So-called “stresser” businesses, which operate in full view on the web, bill themselves as cyber defense testers but actually sell DDoS attack services and tools. Webstresser-sourced DDoS hits have reportedly whacked banks, government agencies, companies, police forces, schools and the gaming industry. According to a BBC report, the site was used to attack major banks in the U.K. last year resulting in significant financial damage. Most targets and customers on webstresser are Americans, Europol's lead case coordinator told Forbes.
An investigation begun last October spearheaded by the U.K. National Crime Agency (NCA) and the Dutch National High Tech Crime Unit, and helped by Europol, culminated on Tuesday in shuttering the site, seizing its infrastructure in Germany and the U.S., and arresting four gang members in the U.K., Canada, Croatia and Serbia. Dutch police identified the location of the website's servers and seized them, subsequently installing a splash page announcing that law enforcement agencies had taken the service offline, the BBC report said.
Jo Goodall, who led the NCA’s operation, told the BBC that more arrests are expected in the coming weeks and months. "The arrests made over the past two days show that the internet does not provide bulletproof anonymity to offenders,” she said.
Judging by the duration and intensity of webstresser’s DDoS attacks, it’s no wonder that it is said to be the biggest fish in the DDoS sea. Europol said the total time of persistent DDoS attacks launched via webstresser.org reached 15.5 years, with the longest single attack lasting roughly 10 hours and the average around 20 minutes per target. (via Forbes).
"The service was professional, the most professional I've seen," Europol's investigator told Forbes.
Distributed denial-of-service (DDoS) attack costs are increasing globally, security provider Kaspersky discovered in a recent survey of some 5,000 business professionals. The study found that enterprises spent $2.3 million to repel a DDoS attack in 2017 compared to $1.6 million in 2016.
