- Get ready to argue about the alternate-history politics of HBO’s ‘Watchmen’ 3 Years Ago
- Third instance of Justin Trudeau wearing racist makeup emerges after he apologized for first 2 3 Years Ago
- 6 must-watch college football games to stream this weekend 3 Years Ago
- What is the Hinge dating app, and how does it work? Today 7:00 AM
- ‘Inside Bill’s Brain’ is nothing more than a Bill Gates infomercial Today 6:30 AM
- Swipe This! He hasn’t texted me back. Should I text him again? Today 6:00 AM
- New Loch Ness monster video may just confirm giant eel theory Wednesday 8:04 PM
- Instagram to restrict posts promoting diet culture and plastic surgery Wednesday 6:58 PM
- Apple wants to trademark ‘Slofie,’ its term for slow-motion selfies Wednesday 5:51 PM
- Fortnite leak reveals a Batman crossover event may be happening Wednesday 5:32 PM
- The explosion at a bull semen factory generated a lot of obvious jokes Wednesday 4:33 PM
- Jessica Jaymes, adult film star, dead at 43 Wednesday 4:18 PM
- How to stream Falcons vs. Colts in Week 3 Wednesday 4:05 PM
- Beto O’Rourke says he opposes police use of facial recognition tech Wednesday 4:01 PM
- Lawsuit alleges woman was kidnapped by Lyft driver and gang-raped Wednesday 3:19 PM
The distributed denial-of-service (DDoS) attack that on Friday impacted the availability of numerous high-profile website across the United States was likely not the work of hacktivists or nation-state actors, according to researchers.
Flashpoint, one of the security firms to first identify the variety of attack that affected Twitter, Amazon, Netflix, and Spotify, among dozens of other major sites, said in a report released Tuesday that infrastructure used in at least one portion of the attack—initiated by a so-called Mirai Command and Control server—also targeted “a well-known video game company.” The assessment casts further doubt on prior assertions that Russia or a group of WikiLeaks supporters may have perpetrated the attack.
Mirai is a type of malware capable of silently infiltrating and consolidating internet devices into what’s called a botnet: a swarm of machines that on Friday overloaded three Dyn data centers, which provide sites with key access functionality, with nonsense traffic, effectively obstructing legitimate internet traffic in those regions. The Mirai botnet, though similar, is apparently “distinct” from those recently used in attacks on the Krebs on Security blog and French internet service provider OVH.
“The development of Internet of Things (IoT) botnets over the past few years has enabled those in the hacking community to launch DDoS attacks at a scale that was previously impossible,” Flashpoint said in its report. “These developments have culminated in the Mirai botnets used in these attacks. Mirai targets IoT devices like routers, DVRs, and web-enabled security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Mirai malware has strategically targeted the right IoT devices that allow for botnets of immense size that maximize disruption potential.”
Flashpoint said with “medium confidence” that speculation the attack originated with political hacktivists, WikiLeaks supporters, or foreign state actors are likely to be false.
In a report Friday, Politico spoke to a group of apparent hacktivists called “New World Hackers” who claimed responsibility for the attack, indicating it was a response to the Ecuadorian government’s decision to severe WikiLeaks founder Julian Assange’s internet access. Flashpoint told Politico the hackers were “imposters.” WikiLeaks appeared willing to accept the attribution as fact, tweeting its supporters had “proved [their] point.”
The focus of the U.S. government’s cybersecurity concerns throughout the 2016 election, Russia was, naturally, almost immediately credited with the attack. Flashpoint, however, disagrees with this assessment, telling the Daily Dot by email that “the perpetrators behind this attack are most likely not politically motivated, and most likely not nation-state actors.”
Flashpoint said its investigation suggests the attack may be tied to online hacking forums, citing “infrastructure used in the attack” that also “targeted a well-known video game company.”
“While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums,” wrote Flashpoint.
Flashpoint—again emphasizing a “moderate degree of confidence” in its assessment—states that most recent Mirai attacks are likely tied to the website Hack Forums. “The personalities involved in these communities are known for creating and using commercial DDoS tools called ‘boosters’ or ‘stressors,’” Flashpoint wrote. “The hackers offer these services online for pay, essentially operating a ‘DDoS-for-hire’ service. One of the few known personalities that have been associated with Mirai malware and botnets is known to frequent these forums.”
Nation-states, hacktivists and “higher-tier” criminal actors are unlikely to launch attacks as impactful as the one that hit Dyn “without a clear financial, political, or strategic objective,” Flashpoint concluded. “Participants in the Hack Forums community have been known to launch DDoS attacks against video game companies to show off their credentials as hackers of skill, or to ‘troll’ and gain attention by causing disruption to popular services,” the firm said.
The Daily Dot reached out to Hack Forums for comment and will update this post if there’s a response.
Dell Cameron was a reporter at the Daily Dot who covered security and politics. In 2015, he revealed the existence of an American hacker on the U.S. government's terrorist watchlist. He is a co-author of the Sabu Files, an award-nominated investigation into the FBI's use of cyber-informants. He became a staff writer at Gizmodo in 2017.