- Fan uncovers ‘Westworld’ trailers hidden on fictional company’s website Sunday 8:18 PM
- This trending Twitter hashtag is a lot less sexy than you think Sunday 7:23 PM
- TikTok users share life-changing realizations they’ve had while in the shower Sunday 7:04 PM
- People are torn over viral TikTok of girl cleaning friend’s room Sunday 4:01 PM
- Did Pete Buttigieg seriously just rip-off a famous Obama speech? Sunday 2:50 PM
- The most dangerous TikTok challenges we’ve seen—so far Sunday 2:22 PM
- PewDiePie wants Bernie Sanders to host meme review Sunday 1:44 PM
- Hilary Duff records confrontation with ‘creep’ taking photos of kids Sunday 1:08 PM
- BTS may have used Twitch streamer’s voice in song without permission Sunday 12:15 PM
- Gigi Hadid absolutely obliterates Jake Paul over Zayn Malik diss Sunday 10:26 AM
- People really want Chris Matthews fired after he compared Sanders’ Nevada win to Nazi invasion of France Sunday 9:35 AM
- Bernie Sanders wins Nevada Caucuses Saturday 6:54 PM
- MSNBC is out of its mind over Sanders leading Nevada Saturday 5:20 PM
- Kim Kardashian dragged for using makeup to darken her hands Saturday 4:13 PM
- TikTok users show how they turned their vehicles into incredible tiny homes Saturday 3:44 PM
The distributed denial-of-service (DDoS) attack that on Friday impacted the availability of numerous high-profile website across the United States was likely not the work of hacktivists or nation-state actors, according to researchers.
Flashpoint, one of the security firms to first identify the variety of attack that affected Twitter, Amazon, Netflix, and Spotify, among dozens of other major sites, said in a report released Tuesday that infrastructure used in at least one portion of the attack—initiated by a so-called Mirai Command and Control server—also targeted “a well-known video game company.” The assessment casts further doubt on prior assertions that Russia or a group of WikiLeaks supporters may have perpetrated the attack.
Mirai is a type of malware capable of silently infiltrating and consolidating internet devices into what’s called a botnet: a swarm of machines that on Friday overloaded three Dyn data centers, which provide sites with key access functionality, with nonsense traffic, effectively obstructing legitimate internet traffic in those regions. The Mirai botnet, though similar, is apparently “distinct” from those recently used in attacks on the Krebs on Security blog and French internet service provider OVH.
“The development of Internet of Things (IoT) botnets over the past few years has enabled those in the hacking community to launch DDoS attacks at a scale that was previously impossible,” Flashpoint said in its report. “These developments have culminated in the Mirai botnets used in these attacks. Mirai targets IoT devices like routers, DVRs, and web-enabled security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Mirai malware has strategically targeted the right IoT devices that allow for botnets of immense size that maximize disruption potential.”
Flashpoint said with “medium confidence” that speculation the attack originated with political hacktivists, WikiLeaks supporters, or foreign state actors are likely to be false.
In a report Friday, Politico spoke to a group of apparent hacktivists called “New World Hackers” who claimed responsibility for the attack, indicating it was a response to the Ecuadorian government’s decision to severe WikiLeaks founder Julian Assange’s internet access. Flashpoint told Politico the hackers were “imposters.” WikiLeaks appeared willing to accept the attribution as fact, tweeting its supporters had “proved [their] point.”
The focus of the U.S. government’s cybersecurity concerns throughout the 2016 election, Russia was, naturally, almost immediately credited with the attack. Flashpoint, however, disagrees with this assessment, telling the Daily Dot by email that “the perpetrators behind this attack are most likely not politically motivated, and most likely not nation-state actors.”
Flashpoint said its investigation suggests the attack may be tied to online hacking forums, citing “infrastructure used in the attack” that also “targeted a well-known video game company.”
“While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums,” wrote Flashpoint.
Flashpoint—again emphasizing a “moderate degree of confidence” in its assessment—states that most recent Mirai attacks are likely tied to the website Hack Forums. “The personalities involved in these communities are known for creating and using commercial DDoS tools called ‘boosters’ or ‘stressors,’” Flashpoint wrote. “The hackers offer these services online for pay, essentially operating a ‘DDoS-for-hire’ service. One of the few known personalities that have been associated with Mirai malware and botnets is known to frequent these forums.”
Nation-states, hacktivists and “higher-tier” criminal actors are unlikely to launch attacks as impactful as the one that hit Dyn “without a clear financial, political, or strategic objective,” Flashpoint concluded. “Participants in the Hack Forums community have been known to launch DDoS attacks against video game companies to show off their credentials as hackers of skill, or to ‘troll’ and gain attention by causing disruption to popular services,” the firm said.
The Daily Dot reached out to Hack Forums for comment and will update this post if there’s a response.
Dell Cameron was a reporter at the Daily Dot who covered security and politics. In 2015, he revealed the existence of an American hacker on the U.S. government's terrorist watchlist. He is a co-author of the Sabu Files, an award-nominated investigation into the FBI's use of cyber-informants. He became a staff writer at Gizmodo in 2017.