Lizard Squad: Xbox Live, PSN Attacks Were a 'Marketing Scheme' For DDoS Service 139
blottsie writes The devastating Christmas Day attacks against the gaming networks of Sony and Microsoft were a marketing scheme for a commercial cyberattack service, according to the hackers claiming responsibility for the attacks. Known as Lizard Squad, the hacker collective says it shut down the PlayStation Network (PSN) and Xbox Live network on Dec. 25 using a distributed denial-of-service (DDoS) attack, a common technique that overloads servers with data requests. The powerful attacks rendered the networks unusable for days, infuriating gamers around the world and causing yet-untold losses of revenue. Now, members of Lizard Squad say the group is selling the DDoS service they used against Sony and Microsoft to anyone willing to pay.
how is it different than any day 0 game? (Score:3, Insightful)
not like you can play any game on the first day anyway
everything is virtualized to the point where they support average players months after release and not the day of release and idiots not only pre-order the games, they change the store country to play it the second it goes live somewhere in the world.
Public Stoning is too good... (Score:1)
Re: (Score:2)
MS and Sony should just code their services the right way and have 10000000000000 hyperbytes of bandwidth
Re: (Score:3)
Its not the service coding that is the issue - there's only so much network pipe to go round, and unless we build our entire networks to handle gigabits of traffic for ever server that will almost never be used (at great expense) we'll have to find other ways to stop such attacks.
Of course, egress filtering would be a good first step. If only every big ISP did this, we'd make most DDoS attacks useless instantly. Then we only have to deal with compromised computers sending data, but if they cannot fake their
Re: (Score:3)
You scrub the data first where bandwidth is crazy cheap. You can purchase 100gb/100gb for $6k/month at many IXs.
The second part to this is you need to
Re: (Score:2)
but what data is "good" data?
is an NTP request good or bad? You can't always tell the difference as they're all good, only not if you're getting 10,000 of them per second.
I'm sure every little website can afford to have a filtering proxy at all the exchanges around the world - after all, rack space in one of those is crazy cheap, and they let anyone put servers in there. Microsoft may be able to, but that doesn't help anyone else who will be subject to extortion from these scumbags. We need to improve our o
Re: (Score:2)
Your NTP is a bad example because the issues being discussed focuses on stateful connections that require authentication and authorization, both of which can be done at the edge. Once a connection is authenticated and authorized, then its traffic may make its way back to the datacenter. Even UDP connections could be considered "stateful" in the sense that the proxy/firewall may not allow your tr
Re: (Score:2)
You seriously want an edge router to track every user that passes through them, the same routers you say handle gigabits of traffic per second? How would you handle such authentication? Do you have to have a user account with every ISP between you and your destination?
You don't need to authenticate users - they're already authenticated on every source ISP network, or you wouldn't be allowed to send packets at all. The problem is the ISPs are sloppy with everything after that, they assume you're legit, when
Re: (Score:1)
"is an NTP request good or bad? You can't always tell the difference as they're all good, only not if you're getting 10,000 of them per second."
As someone who works in this field... Is an NTP request good or bad? In order of processing overhead:
1.) Is the packet 76 bytes (or 96 with symmetric signing)? Normal packet sizes for a request or response. Stops amplification.
2.) Did you ask for it? (Most NTP doesn't expect to serve NTP requests from the Internet). Stateful filtering is hardly new.
3.) Is it a mod
GP knows - he was already stoned (Score:2)
GP knows what he's talking about - he was already stoned when he wrote that.
Re: (Score:2)
Well, the game I wanted to play relied on massive online interaction anyway, so depending on other systems is sort of in the cards...
Re: (Score:1)
... what is this "sun" thing you speak of?
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
I think the point here is they are wanting to SELL this "service" to any asshole with cash and a target, like maybe something important enough to have a greater real world impact or cause actual injury or death.
Re:Public Stoning is too good... (Score:4, Funny)
Son, this is the United States of America. Messing with a big corporation here is like slapping momma, spitting on the flag, and fucking an apple pie--in that order.
Re: (Score:2)
I'm not sure how to work in slapping momma and spitting on the flag, but fucking an apple pie can rake in over $100 million [boxofficemojo.com].
Re:Public Stoning is too good... (Score:5, Insightful)
Oh get off your high horse. You've got kids opening consoles on Xmas day and unable to play, you've got adults with a rare few days off work unable to play, this has basically ruined Xmas for a shit ton of people. You think whatever you do on Xmas day is more "important" or more "worthwhile"? You're arguing with kids on Slashdot, clearly your life isn't all that.
Meanwhile you seem to think that someone saying "they should stone them" on the internet carries similar weight to an actual stoning, so maybe you also need to "do something with your life".
Re: (Score:1)
Perhaps should we as a society (American, World, whatever) should put Christmas as a concept away in the attic for a few centuries?
Re: (Score:2)
Re: (Score:2)
(a) Not everyone celebrates Christmas, and even those people who do might stage their celebrations on other days to accommodate complex family schedules; and
(b) Don't be a dick because we don't all enjoy the things you enjoy.
In my house, to accommodate a blended family schedule, we celebrated on Christmas eve. On Christmas day, with all the children safely shipped off to another set of parents, I made plans to go to a friend's house, where we'd online game together, in old-school LAN-style solidarity while
Re: (Score:2)
Re: (Score:3)
In any case, the much larger threat from these douches is their willingness to sell these services; someone could do some real damage. I hope they see some serious fines or jail time.
Re: (Score:2)
Did it ever occur to you guys that his title was just hyperbole? I doubt he seriously, literally meant they should be stoned to death, for real.
Are you new here? Your geek card is threatened with revocation if you don't support public execution of spammers. It could be he was employing hyperbole but in this crowd it is more likely he was actually speaking what he really thinks.
Re: (Score:1)
Holy shit, put on your big boy underwear and take your inhaler. Some hackers disrupted a couple of gaming services. This was not even remotely close to that level of offense. Did you happen to notice that the sun still went up that morning and went down that evening, or were you just to furious to look at the window? So you were prevented from sending more money to your favorite console maker for around 24 hours; did it occur to you to maybe spend that time with real live people or do actually DO something with your life (even if only for one day)? If you wonder why "gamers" get such a bad rap in the real world, look in the mirror and think about how worked up you just got over this.
Funny, I heard the same thing from the kid in the Lizard Squad interview.
Re: (Score:2)
Re: (Score:1)
Also, a friend's hand made chess board (inlaid wood) that was also a gift this Christmas still worked.
The doors of a hand-made maple and cherry toy box that I made for my sister for Christmas of 1999 (15 years ago) still work fine. No hacker was able to disable that gift.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2, Troll)
What business do you work in? I bet it isn't important. Hospice, I bet. Some hackers disrupted your hospice, and the old people's heating went out, and they all froze to death. Well, who fucking cares? They're just old people; the sun went up that morning AND went down that evening, and only a bunch of old people who were in hospice to die anyway died.
It's business. There are businesses. They make money, and they loose money. YOU are unimportant; yet the police would arrest me for raping and beatin
Re: Public Stoning is too good... (Score:2)
You're pretty judgmental of what random people on the Internet do with their time. Who died and made you King? They cost companies a lot of revenue, and ruined Xmas for thousands of children who don't care about epeen wars. They just know they can't play games with their family or friends on a holiday bc some script kiddies wanted to advertise to make a few thousand dollars selling ddos. Which BTW takes far less effort to implement than defend against due to inherent flaws in Internet protocols.
Re: (Score:1)
Re: (Score:2)
Researchers!!! (Score:2)
Dammit, get it right!
They were just exploring for unsecured systems in order to benevolently improve the Internet.
Re: (Score:3)
Does Anonymous have teeth anymore? Since their big players were de-Anonymized and rounded up by the FBI I haven't seen them do...much...
Re: (Score:2)
Anonymous did what?
And cue the story about how they were infiltrated. (Score:5, Insightful)
"anyone willing to pay" -- you mean like an FBI agent with a credit card?
Re: (Score:3)
I wonder how much target validation they do.
If I were sony I might pay someone to be their first customer. Target of course would be important backend infrastructure for a major retailer..... then hand them a list of DoD IPs to hit.
Oh you want me to pay you to poke sticks at sleeping animals? Here is $10 go poke that bear.
Re: (Score:2)
> The hackers would cash in, order their bots to do the job they were hired to do and go on with their lives.
and then they would likely find their botnet being rapidly dismantled, and identified as a threat since they obviously can't keep their activities in the civilian world. Not too many really want state security apparatus, who have little sense of humor and no qualms about working overtime, actually looking to identify them.
> If caught, Sony would be in a heap of trouble explaining why they hire
Re: (Score:2)
Correction: an FBI agent with some Bitcoins.
Great! (Score:5, Insightful)
Holy Hyperbole, Batman! (Score:5, Insightful)
devastating
No, there are lots of things that have happened in the past week that qualify as devastating, but these were not on that list. A major annoyance? Sure. Devastating? Not so much. Just because some people who paid too much for a gaming system weren't able to use it the first day after they got it; and the companies who sold it to them had to wait a little longer to get credit card numbers to charge monthly fees for these people, doesn't make it devastating.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It must have been devastating to Sony's and Microsoft's profits, right?
It is quite hard to demonstrate that notion, one way or the other. How many people who would have registered that day would have purchased something through it that same day? Would they not have purchased it 1 or 2 days later once things worked?
Were any consoles returned 1 day later because they couldn't connect that day? $400 is not a trivial amount of money to spend on a gaming system; I wouldn't expect many people would give up on it after only one day - especially considering how well known the
Why pay for something that can be found (Score:1)
"We'll pay," says the FBI (Score:5, Funny)
"Just send us your address, so we can mail you the check."
The past, the future (Score:2)
Re: (Score:3)
Re: (Score:2)
Lizard Squad ... (Score:2)
... it's a code name for FBI sting op.
Re: (Score:2)
The silver lining (Score:3)
The positive side is that hopefully it provides further incentives for companies like Microsoft to work harder to try to mitigate DDoS problems at the source.
Microsoft are in a unique position as their operating system is - it seems - in many cases the base platform for launching these attacks. It'd be great to see a concerted effort along with a company like Google to start actively trying to massively reduce the number of systems that are regularly involved in DDoS attacks.
Re: (Score:3)
Yeah, there you go. "Microsoft should make a secure operating system." You don't understand the problem.
To mitigate DDoS as you say, at the OS level, we would need to make the OS only run software that the Great Benevolent Dictator allows. Microsoft could publish a list of software Microsoft has decided you can install, and you can install only those softwares. Mind you, if the softwares have any security holes, it's still possible to hack in and use the node as a DDOS source.
Think about it. No inst
Re: (Score:2)
No, the problem is that the Microsoft philosophy is still to keep layering tweaks on hacks on mods of a design that was originally intended to be an application running on a single-user PC not on a network.
Consequently installing or even just running apps can still extend/modify/override the operating system itself i.e. write files into c:/windows and/or modify the registry (even having a registry in the first place is a completely stupid idea for exactly this and many other reasons).
If Microsoft had ever d
Re: (Score:2)
If I got you to install a Chromium extension that started when you log into your desktop (KDE, Unity, Gnome, whatnot), I could have you install an extension which runs in the background (like Google Hangouts) and simply pings the shit out of things I tell it to.
In other words: if I can get you to download and run a program on Linux, as a regular user, with no root privileges and no write access outside $HOME, I can turn your machine into a DDOS node in a botnet.
The problem we have on Windows is users
Re: (Score:2)
So what you're saying is that with Linux I have to do something deliberately stupid ( install an UNTRUSTED Chromium extension that started when you log into your desktop).
Windows is FAR easier to hack than linux. I mean if nothing else just look at all the open ports on a windows box compared to a linux box.
Re: (Score:2)
So what you're saying is that with Linux I have to do something deliberately stupid
Well, on Windows, you have to run an external program, install an extension, or use a Web browser or e-mail client with a security hole. For example, Firefox and Chrome have had dozens of bugs over the past 6 months which allowed for the automatic background downloading and executing of programs without informing the user, or which would execute some data (images, java script variables) as code (which could then download a program and run it).
On Linux, the same has been true. If you haven't run apt-get
Re: (Score:2)
True but I'm not holding my breath. Microsoft have had multiple decades to secure Windows, and still haven't done anything credible. They just keep coming up with clueless crap like UAE.
It looks to me like this problem will only go away when people finally get a clue and stop buying/using Windows.
Unfortunately ... (Score:2)
I really doubt these fellows are behind it (Score:2)
Next-generation load testing software (Score:1)
It's merely a sucker's bet.
What if it were Netflix? (Score:1)
DDOS = lame (Score:2)
I can appreciate the skill behind a clever, intelligent hack, but DDOS is just lame squared.
For ruining Christmas for so many kids, I hope those skript kiddie fuckers get caught and have their whole lives ruined.
Re: (Score:1)
It could be that I've read too much cyberpunk, but I'd like to see MS and Sony do the catching and ruining. Assuming that these pricks aren't located entirely in a nation willing and capable of handling them legally of course.
But how satisfying would it be if photos of their corpses with Surface Pros through their heads started appearing? Or the outlines of PlayStation controllers protruding from their necks?
not if they dont have a botnet (Score:2)
1. The IPs they used for the DDoS are almost certainly known now.
2. There are several groups (Sony, FBI, probably Microsoft, some infosec companies) who want to see the botnet dismantled.
3. As each host is remediated or blocked (ISP walled garden), said botnet shrinks.
Unless these guys have some zero-days and malware kits up their sleeves, their DDoS capabilities will not be around for long.
Corporate security needs to get aggressive. (Score:1)
Re:But what laws are they breaking? (Score:5, Informative)
1) Yes, DDoSing someone is illegal
2) In order to carry out the DDoS they very likely have millions of PCs in a botnet. Every single one of those is a count of unauthorised use of a computer system.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
As regards to a solution, you can't really defend against a DDoS.
Incorrect, we defend ourselves all the time. It takes manpower to do this, but it's absolutely possible. Sure, not many companies want to invest in the manpower and expertise required, but that is not the same thing as what you said. If you are lazy or the attack is too big, there are companies that will block the DDoS for you.
Re: (Score:3)
Re: (Score:2)
As written your point is complete nonsense. My point was not defending your Comcast@home account from a DDoS, it was about protecting a business from DDoS. I work at an ISP and we defend ourselves just about every day from various DDoS attacks. We have had to bring in additional bandwidth at times to cope with massive attacks, but the majority we handle in house with a strong staff and good setup (multiple access points, and layering for entry points).
If your point was correct as written, companies like
Re: But what laws are they breaking? (Score:1)
If you work for an ISP, you should be fired because you're an idiot. When bits haven been delivered to you, it doesn't matter what you do with them, because they still took some of your available bandwidth when they were delivered. If several hundred gigabits per second of bits are delivered to you, you are fucked...unless you are a tier 1 or 2 ISP or you are a DDoS mitigation service provider. Sure, you can block or filter the traffic, but it still took bandwidth. Sure, you can advertise blocks with pre-ne
Re: (Score:2)
1) Buy up terabits of bandwidth around the world at prices as low as $0.06/mbit at an IX
2) Filter data at the edge
3) Forward filtered data back to your non-general-Internet-routable datacenter.
You just need to move your edge to where bandwidth is plentiful and cheap and do all of your filtering there.
Re: (Score:2)
As long as you define "getting more bandwidth" as "defending against DDOS," I suppose your statement is true.
Re: (Score:3)
I work at a broadcast company. I have worked for the Government. I have worked for a Government contractor.
In all of these cases, Verizon or Comcast or Qwest run a cable to your site. You plug in your router, your firewall, demarc equipment. A packet sent to your network comes to that before you can do anything; you can't get on the backbone of the Internet and block it.
For businesses who do not control the Internet backbone, 1000Mbit/s coming down their 1Gbit/s pipe means they can no longer receive c
Re: (Score:2)
I also worked at numerous companies, and I can tell you that at exactly 0 companies have we had a _single_ access point to the Internet. At the DOD we ran no less than 3 vendors at every site with access, and in commercial work I have seen not less than 2. At an ISP we obviously have more than the average commercial company.
If a Level3 line is getting hit with a DDoS you reroute traffic to the AT&T line, etc.. etc... and obviously you start blocking protocols, networks, etc.. when transitioning routes
Re: (Score:3)
If a Level3 line is getting hit with a DDoS you reroute traffic to the AT&T line
72.133.15.2, which is on your assigned 72.133.15.0/24 block, is being hit by gigabits of traffic per second. That means everything else on the 72.133.15.0/24 block is affected.
To reroute, you have to call your ISP and failover your incoming route. It comes off the Level 3 line, and onto your AT&T line.
Now your AT&T line is being hit by gigabits of traffic per second, as the traffic is still going to 72.133.15.2, which is routed to the 72.133.15.0/24 subnet.
I'm not talking about fiber traffic
Re: (Score:2)
Writing in all caps does not make you correct, so try normal dialogue. Following the normal Socratic method lets simplify this down to a question.
If you have a mail server on the Internet and your line is from Level3 what do you do if your line gets cut? Say fuck it, it'll be back in a few days time or do you have a second line that you can move some DNS entries and reroute all the traffic. (Routing is obviously not just the 'route' command).
In nearly all cases you need a second access point. Sure, you
Re: (Score:2)
Writing in all caps does not make you correct,
The bold and emphasis tags haven't worked for me in 4 years.
If you have a mail server on the Internet and your line is from Level3 what do you do if your line gets cut?
A line getting cut is not a DDOS. A DDOS is when you open a web browser, go to the page, and hit REFRESH 40 times a second. On 80,000 computers. At the same time. For 2 hours.
A DDoS attack is similar, except that you need to figure out what the target is so that you can start rerouting everything else and filter unwanted content (or non-critical content)
Wrong. DDOS you black hole the server: you shut it off by having the backbone of the Internet route your shit elsewhere. That means your upstream ISP has to insert a static route into their routers--their equipment, not yours.
Not hosting your own DNS is a cost issue, not an impossible task.
You don't fix DDOS by DNS. www.Slashdo
Re: (Score:2)
A line getting cut is not a DDOS. A DDOS is when you open a web browser, go to the page, and hit REFRESH 40 times a second. On 80,000 computers. At the same time. For 2 hours.
No, it's not the same but the reaction a company should have is similar because the result of the attack is almost exactly the same. Notice that you completely ignore the question and go off on a tangent back to your same "I only have 1 IP for access" bullshit answer. Sorry, but at this point there is no other explanation for your position. You ignore logic and reason and continue with faulty logic based on an invalid premise.
If you fail over the link from Verizon to Comcast, the packets start coming down Comcast immediately.
The only way this would be true is if I had the same IP space on the two carrie
Re: (Score:2)
No, it's not the same but the reaction a company should have is similar because the result of the attack is almost exactly the same.
Choking on a hotdog is almost exactly the same as an angry biker wrapping a half-inch steel chain around your neck and choking you to death. The reaction should be similar.
The only way this would be true is if I had the same IP space on the two carriers, and we don't. In fact the amount of work to move IPs between carriers means that nobody does.
Uh. When our /23 fails on Verizon, Comcast takes up the link. We even have multi-path, so we can send out stuff from the same IP on Comcast OR Verizon at any time; return packets always route down whichever link is active. We have exactly one /23 address space.
Last month, Comcast managed to lose a fiber line. That line was rerout
Re: (Score:2)
Choking on a hotdog is almost exactly the same as an angry biker wrapping a half-inch steel chain around your neck and choking you to death. The reaction should be similar.
Yawn, reductio ad absurdum is extremely unimpressive.
We have 510 IP addresses for access. They're on a /23 routed subnet.
Really now? How can that be possible when nobody else can function without a broadcast address at a minimum. Or is this just an appeal to emotion trying to demonstrate that you are intelligent? I vote for the latter, and reject it as irrational just like your single point of failure argument.
This is saying, "Oh, you just go change the DNS entry for the host under attack, and the packets go nowhere." Yeah, no. DDoS attacks generally don't use the host name; they use the IP address for access".
You attempted to first claim that a client would have a delay in connecting so HA was impossible. I rejected that as a straw man, so your defense is to then false
Re: (Score:2)
Yawn, reductio ad absurdum is extremely unimpressive.
It was a blunt analogy; considering a DDOS similar to a fiber line cut is patently absurd. One of them is an infrastructure problem, such as the dry rotting of a support timber; the other is an adversarial problem, such as a mob stationed outside your house with siege engines (you know, catapults, ballistas, gunpowder barrels).
Really now? How can that be possible when nobody else can function without a broadcast address at a minimum.
The broadcast address is the highest address in a subnet. For 200.100.100.0/24, the broadcast address would be 200.100.100.255. Maybe you should learn about networking.
You attempted to first claim that a client would have a delay in connecting so HA was impossible.
Yes, I
Re: (Score:2)
You can't block a DDOS at your doorstep; it has to be blocked on the Internet backbone itself.
If the bottleneck is your border router, sure. For many services, I would imagine that the bottleneck hit by a DDoS attack is in the processing, which should be easily mitigated by blocking requests at the border router.
Re: (Score:2)
The bottleneck is the 1Gbit link that's carrying 1Gbit of DDoS traffic to your border router, which is evaluating it and dropping it all. Dropping that traffic doesn't free up additional bandwidth to carry legitimate traffic; you'd have to block the traffic further upstream.
Re: (Score:2)
You are correct, if the DDoS relies on raw bandwidth.
Some DDoS attacks work closer to layer 7. E.g. ask the webserver to do something complicated and slow, maybe something that requires a bunch of database queries.
That kind of DDoS relies on asymmetry. .. The response is much more expensive than the request.
AFAIK nobody has said how the Christmas DDoS attacks worked.
Re: (Score:2)
Re:But what laws are they breaking? (Score:5, Informative)
It comes under the CFAA.- http://www.law.cornell.edu/usc... [cornell.edu]
"knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;"
a DoS is transmitting information at some point.
Damage is broadly defined: "the term “damage” means any impairment to the integrity or availability of data, a program, a system, or information"
Protected computer is broadly defined to include: "which is used in or affecting interstate or foreign commerce or communication"
"without authorization" might be an issue, but I can't see courts not deciding that the DoS wasn't authorized even if one a "public" channel is being used (say slamming the authentication servers).
Re: (Score:1)
Re: (Score:2)
If they live in any first world country what they are doing is illegal. If they live in a country where it is not illegal that is what drones are for.
I am not saying we should use drones. It is definitely not ethical but it is a inevitable outcome. If you do a great deal of damage to powerful people and then try to avoid any punishment they will use other methods to get back at you.
I also doubt that any country is going to keep these people from the USA. The other first world countries won't and the third w
Re: (Score:2)
Sure, which is irrelevant given "fine congress critters" is something I've only ever seen in reference to the US.
Re: (Score:1)
Re: (Score:2)
Change the $ to BTC and you may have what some of the "faucets" are, in fact, doing.