- The ‘Feeling Cute Challenge’ turns ugly after correctional officers abuse it 2 Years Ago
- How to watch ‘How High 2’ for free 2 Years Ago
- Swipe This! My ex-BFF keeps sliding into my DMs, but I don’t want to be friends Today 6:30 AM
- Watch ‘I Am Somebody’s Child: The Regina Louise Story’ for free Today 6:00 AM
- How to watch Barcelona vs. Real Sociedad for free Today 6:00 AM
- How to stream UFC Fight Night 149 for free Today 5:30 AM
- PDF Association dunks on Mueller report PDF Friday 7:33 PM
- Robert Downey Jr. says ‘Endgame’ finale is ‘best 8 minutes’ of any MCU film Friday 4:42 PM
- Elizabeth Warren calls on Congress to impeach Trump Friday 3:43 PM
- BlackBerry Messenger is still a thing—but not for much longer Friday 2:56 PM
- Matt Gaetz hires speechwriter fired by White House for attending white nationalist event Friday 1:33 PM
- Here’s why Elon Musk is a sheep on Twitter Friday 12:14 PM
- Trump is already running Facebook ads on the Mueller report Friday 12:07 PM
- 20 thoughtful gifts grads actually want Friday 12:00 PM
- 7 of the best psychological thriller movies on Shudder Friday 11:44 AM
Historic DDoS likely not caused by Russia or WikiLeaks supporters, researchers say
The attack is being tied to an online hacking forum—not Russia.
The distributed denial-of-service (DDoS) attack that on Friday impacted the availability of numerous high-profile website across the United States was likely not the work of hacktivists or nation-state actors, according to researchers.
Flashpoint, one of the security firms to first identify the variety of attack that affected Twitter, Amazon, Netflix, and Spotify, among dozens of other major sites, said in a report released Tuesday that infrastructure used in at least one portion of the attack—initiated by a so-called Mirai Command and Control server—also targeted “a well-known video game company.” The assessment casts further doubt on prior assertions that Russia or a group of WikiLeaks supporters may have perpetrated the attack.
Mirai is a type of malware capable of silently infiltrating and consolidating internet devices into what’s called a botnet: a swarm of machines that on Friday overloaded three Dyn data centers, which provide sites with key access functionality, with nonsense traffic, effectively obstructing legitimate internet traffic in those regions. The Mirai botnet, though similar, is apparently “distinct” from those recently used in attacks on the Krebs on Security blog and French internet service provider OVH.
“The development of Internet of Things (IoT) botnets over the past few years has enabled those in the hacking community to launch DDoS attacks at a scale that was previously impossible,” Flashpoint said in its report. “These developments have culminated in the Mirai botnets used in these attacks. Mirai targets IoT devices like routers, DVRs, and web-enabled security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Mirai malware has strategically targeted the right IoT devices that allow for botnets of immense size that maximize disruption potential.”
Flashpoint said with “medium confidence” that speculation the attack originated with political hacktivists, WikiLeaks supporters, or foreign state actors are likely to be false.
In a report Friday, Politico spoke to a group of apparent hacktivists called “New World Hackers” who claimed responsibility for the attack, indicating it was a response to the Ecuadorian government’s decision to severe WikiLeaks founder Julian Assange’s internet access. Flashpoint told Politico the hackers were “imposters.” WikiLeaks appeared willing to accept the attribution as fact, tweeting its supporters had “proved [their] point.”
The focus of the U.S. government’s cybersecurity concerns throughout the 2016 election, Russia was, naturally, almost immediately credited with the attack. Flashpoint, however, disagrees with this assessment, telling the Daily Dot by email that “the perpetrators behind this attack are most likely not politically motivated, and most likely not nation-state actors.”
Flashpoint said its investigation suggests the attack may be tied to online hacking forums, citing “infrastructure used in the attack” that also “targeted a well-known video game company.”
“While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums,” wrote Flashpoint.
Flashpoint—again emphasizing a “moderate degree of confidence” in its assessment—states that most recent Mirai attacks are likely tied to the website Hack Forums. “The personalities involved in these communities are known for creating and using commercial DDoS tools called ‘boosters’ or ‘stressors,’” Flashpoint wrote. “The hackers offer these services online for pay, essentially operating a ‘DDoS-for-hire’ service. One of the few known personalities that have been associated with Mirai malware and botnets is known to frequent these forums.”
Nation-states, hacktivists and “higher-tier” criminal actors are unlikely to launch attacks as impactful as the one that hit Dyn “without a clear financial, political, or strategic objective,” Flashpoint concluded. “Participants in the Hack Forums community have been known to launch DDoS attacks against video game companies to show off their credentials as hackers of skill, or to ‘troll’ and gain attention by causing disruption to popular services,” the firm said.
The Daily Dot reached out to Hack Forums for comment and will update this post if there’s a response.
Dell Cameron was a reporter at the Daily Dot who covered security and politics. In 2015, he revealed the existence of an American hacker on the U.S. government's terrorist watchlist. He is a co-author of the Sabu Files, an award-nominated investigation into the FBI's use of cyber-informants. He became a staff writer at Gizmodo in 2017.