DDoS for sale

newsguy 0 Tallied Votes 805 Views Share

According to the latest McAfee Labs instances of Distributed Denial of Service attacks are growing in popularity.

In the last quarter the McAfee Labs observed many new attacks demanding ransom money including those aimed at sports betting companies which were taken out of action during key sporting events to cause losses in the millions. Such attacks have not only been used to make money, but also silence political opinion.

But perhaps the growth of DDoS as a service, whereby cybercriminals offer botnets capable of launching such attacks to the highest bidder is the biggest worry. "These botnets are capable of knocking even some of the most-protected sites offline" the report concludes and, of course, the whole concept of DDoS as a Service means that anyone can create a devastating attack provided they have the money to buy the botnet time.

The concern being that not only does it remove the technical requirement from the would be attack equation, but it also reduces the amount of money that they have to invest. It only costs a fraction of the price of establishing a viable DDoS attack botnet to rent one for an hour or two.

Other highlights of the report include:

Despite the Pirate Bay shutdown, there has been a 300% increase in the creation of file sharing websites.

Spam reached its highest level in history, breaking the previous record set in the second quarter of 2009 by 10 percent. Spam now comprises 92 percent of all e-mail. When compared with the third quarter of 2008, spam jumped 24 percent.

Web-based attacks are the newest hot threat vector, and 55% of all malicious URLs are hosted in the US.

Dani AI

Generated

As noted, the DDoS-for-hire trend changes the threat model: attackers no longer need deep skills, they just buy time on a botnet. What the original post does not cover is practical preparation and a short, usable playbook for site owners and ops teams. The checklist below focuses on actions that are effective, low-friction, and usable during an event.

Preparation (do these before you are hit)

  • Identify critical assets and single points of failure (DNS, auth, payment gateways) and document failover paths.
  • Pre-negotiate contact channels and SLAs with your ISP, datacenter and any CDN/scrubbing provider; store NOC phone numbers off-network.
  • Baseline traffic (NetFlow/sFlow), enable ring-buffer PCAP on border devices, and sync clocks (NTP). Alerts should trigger on deviations from baseline.
  • Use layered defenses: Anycast/CDN for volumetric attacks, a WAF for application-layer floods, rate-limits and SYN cookies at the edge, and ACLs for known bad ports/protocols.
  • Separate management/console access from production paths (out-of-band), and rehearse an incident plan quarterly.

Quick incident playbook (first 60 minutes)

  • Contact upstream (ISP/CDN) and request mitigation/scrubbing; provide timestamps, sample flows, and affected IPs.
  • Apply short, surgical blocks first (specific IPs/ASNs, offending ports). Use geo-blocking only if business allows.
  • If required as a last resort, request remote-triggered blackholing from your provider but understand it drops legitimate traffic too.
  • Preserve evidence: export NetFlow, PCAP snippets, logs and configuration snapshots to an offsite location.

Example (very blunt) SYN-rate limit using iptables — use with caution and test first:

iptables -A INPUT -p tcp --syn -m limit --limit 5/s --limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

Report the incident to your national CSIRT and local law enforcement, preserve chain-of-custody for logs, and review contracts with mitigation vendors after the event. Regularly test the plan; tabletop rehearsal matters as much as technical controls.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.