The distributed denial-of-service (DDoS) attack that on Friday impacted the availability of numerous high-profile website across the United States was likely not the work of hacktivists or nation-state actors, according to researchers.
Flashpoint, one of the security firms to first identify the variety of attack that affected Twitter, Amazon, Netflix, and Spotify, among dozens of other major sites, said in a report released Tuesday that infrastructure used in at least one portion of the attack—initiated by a so-called Mirai Command and Control server—also targeted “a well-known video game company.” The assessment casts further doubt on prior assertions that Russia or a group of WikiLeaks supporters may have perpetrated the attack.
Mirai is a type of malware capable of silently infiltrating and consolidating internet devices into what’s called a botnet: a swarm of machines that on Friday overloaded three Dyn data centers, which provide sites with key access functionality, with nonsense traffic, effectively obstructing legitimate internet traffic in those regions. The Mirai botnet, though similar, is apparently “distinct” from those recently used in attacks on the Krebs on Security blog and French internet service provider OVH.
“The development of Internet of Things (IoT) botnets over the past few years has enabled those in the hacking community to launch DDoS attacks at a scale that was previously impossible,” Flashpoint said in its report. “These developments have culminated in the Mirai botnets used in these attacks. Mirai targets IoT devices like routers, DVRs, and web-enabled security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Mirai malware has strategically targeted the right IoT devices that allow for botnets of immense size that maximize disruption potential.”
Flashpoint said with “medium confidence” that speculation the attack originated with political hacktivists, WikiLeaks supporters, or foreign state actors are likely to be false.
In a report Friday, Politico spoke to a group of apparent hacktivists called “New World Hackers” who claimed responsibility for the attack, indicating it was a response to the Ecuadorian government’s decision to severe WikiLeaks founder Julian Assange’s internet access. Flashpoint told Politico the hackers were “imposters.” WikiLeaks appeared willing to accept the attribution as fact, tweeting its supporters had “proved [their] point.”
The focus of the U.S. government’s cybersecurity concerns throughout the 2016 election, Russia was, naturally, almost immediately credited with the attack. Flashpoint, however, disagrees with this assessment, telling the Daily Dot by email that “the perpetrators behind this attack are most likely not politically motivated, and most likely not nation-state actors.”
Flashpoint said its investigation suggests the attack may be tied to online hacking forums, citing “infrastructure used in the attack” that also “targeted a well-known video game company.”
“While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums,” wrote Flashpoint.
Flashpoint—again emphasizing a “moderate degree of confidence” in its assessment—states that most recent Mirai attacks are likely tied to the website Hack Forums. “The personalities involved in these communities are known for creating and using commercial DDoS tools called ‘boosters’ or ‘stressors,’” Flashpoint wrote. “The hackers offer these services online for pay, essentially operating a ‘DDoS-for-hire’ service. One of the few known personalities that have been associated with Mirai malware and botnets is known to frequent these forums.”
Nation-states, hacktivists and “higher-tier” criminal actors are unlikely to launch attacks as impactful as the one that hit Dyn “without a clear financial, political, or strategic objective,” Flashpoint concluded. “Participants in the Hack Forums community have been known to launch DDoS attacks against video game companies to show off their credentials as hackers of skill, or to ‘troll’ and gain attention by causing disruption to popular services,” the firm said.
The Daily Dot reached out to Hack Forums for comment and will update this post if there’s a response.