September 26, 2020

Online Dispute Becomes Internet-Snarling Attack

A squabble between a group fighting spam and a Dutch company that hosts Web sites said to be sending spam has escalated into one of the largest computer attacks on the Internet, causing widespread congestion and jamming crucial infrastructure around the world.

Millions of ordinary Internet users have experienced delays in services like Netflix or could not reach a particular Web site for a short time.

However, for the Internet engineers who run the global network the problem is more worrisome. The attacks are becoming increasingly powerful, and computer security experts worry that if they continue to escalate people may not be able to reach basic Internet services, like e-mail and online banking.

The dispute started when the spam-fighting group, called Spamhaus, added the Dutch company Cyberbunker to its blacklist, which is used by e-mail providers to weed out spam. Cyberbunker, named for its headquarters, a five-story former NATO bunker, offers hosting services to any Web site “except child porn and anything related to terrorism,” according to its Web site.

A spokesman for Spamhaus, which is based in Europe, said the attacks began on March 19, but had not stopped the group from distributing its blacklist.

Patrick Gilmore, chief architect at Akamai Networks, a digital content provider, said Spamhaus’s role was to generate a list of Internet spammers.

Of Cyberbunker, he added: “These guys are just mad. To be frank, they got caught. They think they should be allowed to spam.”

Mr. Gilmore said that the attacks, which are generated by swarms of computers called botnets, concentrate data streams that are larger than the Internet connections of entire countries. He likened the technique, which uses a long-known flaw in the Internet’s basic plumbing, to using a machine gun to spray an entire crowd when the intent is to kill one person.

The attacks were first mentioned publicly last week by Cloudflare, an Internet security firm in Silicon Valley that was trying to defend against the attacks and as a result became a target.

“These things are essentially like nuclear bombs,” said Matthew Prince, chief executive of Cloudflare. “It’s so easy to cause so much damage.”

The so-called distributed denial of service, or DDoS, attacks have reached previously unknown magnitudes, growing to a data stream of 300 billion bits per second.

“It is a real number,” Mr. Gilmore said. “It is the largest publicly announced DDoS attack in the history of the Internet.”

Spamhaus, one of the most prominent groups tracking spammers on the Internet, uses volunteers to identify spammers and has been described as an online vigilante group.

In the past, blacklisted sites have retaliated against Spamhaus with denial-of-service attacks, in which they flood Spamhaus with traffic requests from personal computers until its servers become unreachable. But in recent weeks, the attackers hit back with a far more powerful strike that exploited the Internet’s core infrastructure, called the Domain Name System, or DNS.

That system functions like a telephone switchboard for the Internet. It translates the names of Web sites like or into a string of numbers that the Internet’s underlying technology can understand. Millions of computer servers around the world perform the actual translation.

In the latest incident, attackers sent messages, masquerading as ones coming from Spamhaus, to those machines, which were then amplified drastically by the servers, causing torrents of data to be aimed back at the Spamhaus computers.

When Spamhaus requested aid from Cloudflare, the attackers began to focus their digital ire on the companies that provide data connections for both Spamhaus and Cloudflare.

Questioned about the attacks, Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers, said in an online message that, “We are aware that this is one of the largest DDoS attacks the world had publicly seen.” Mr. Kamphuis said Cyberbunker was retaliating against Spamhaus for “abusing their influence.”

Article source:

British Police Charge Teenager in Connection With Hacking Attacks

But charges by the British police link Mr. Cleary to a hacking group called Lulz Security, or LulzSec, which has been on an Internet crime spree in recent weeks, attacking Web sites and computer networks including those of the United States Senate, the Central Intelligence Agency and Sony.

The British tabloids have been quick to cast Mr. Cleary as the young criminal mastermind behind LulzSec, calling him “Hack the Lad” in front-page headlines. His mother, Rita, has said her son is highly intelligent but has a history of mental illness, including agoraphobia. His lawyer, Ben Cooper, described Mr. Cleary as “a vulnerable young man.”

Though it is not clear how much notoriety he deserves, Mr. Cleary’s arrest has made him a focus of the public fascination with a wave of computer hacking cases, carried out by amorphous online collectives.

The police say Mr. Cleary is guilty of illegally using a computer to perform denial of service attacks — bombarding Web sites with so many automated messages that they shut down. They say his targets were organizations including the British Serious Organized Crime Agency.

In the hierarchy of computer hacking, the accusations against Mr. Cleary and the actions of LulzSec fall broadly into the category known as hacktivism. Hackers of this type are not motivated by money, but are mainly interested in protesting against or antagonizing their targets, or in showing off technical skills.

Hacktivists, according to computer security experts, are a different breed from mainstream cybercriminals, who seek financial gain. Such criminals, for example, manipulated Citigroup’s Web site to steal the personal information of credit card holders.

The third category, experts say, are warriors, either working in the “cybercommands” of governments like those of the United States and other countries, or for mercenary or terrorist groups. They defend computer networks, power grids and state secrets of their own country, while devising tactics to attack enemies.

Hacktivists tend to portray their activities as digital sit-ins, a form of protest. But security experts say their attacks often cause real damage to computer networks and financial losses. LulzSec has been more aggressive than most, and more brazen in its choice of targets.

“This is organized criminal activity that is typically distributed across many different countries,” said Mark Rasch, a former prosecutor in the Justice Department, who is director of security for CSC, a computer services company. “It’s a serious crime.”

On Thursday evening LulzSec released what it said were hundreds of internal documents from the Arizona Department of Public Safety, including material related to border patrol and counterterrorism operations. It said it was taking aim at the agency because of Arizona’s anti-immigrant policies. A Department of Public Safety spokesman, Capt. Steve Harrison, said the documents appeared to be authentic but were sensitive, not confidential.

Hacking has been a pursuit of mischievous young men — and they are nearly all men — since shortly after computers were invented. But the Internet made it an increasingly international pursuit. The intruders quickly became power users of online bulletin boards and Internet chat software, using those tools to communicate and organize activities.

“Hackers were among the first to figure out the benefits of social networking,” said Alan Brill, a senior managing director of Kroll, a security consulting firm.

The far-flung hacker networks present a formidable challenge for law enforcement. But in recent years, they and prosecutors have more and more formed their own international networks of communication, sharing information across borders. Mr. Cleary’s arrest, for example, involved cooperation between Scotland Yard and the F.B.I.

LulzSec, on a Twitter feed that it uses to communicate with more than 250,000 followers, has said that Mr. Cleary is “at best mildly associated with us.” The group did not respond to a Twitter message seeking comment for this article.

LulzSec, experts say, is a splinter group from Anonymous, another online hacking collective. Anonymous is best known for its attacks last year in support of WikiLeaks, led by Julian Assange. The group went after the Web sites of companies like MasterCard and PayPal, which had refused to process donations to WikiLeaks after it disclosed confidential diplomatic cables.

Earlier this year, said Barrett Brown, a former Anonymous activist, “some of the most prominent leaders and hackers broke off and are now LulzSec.”

The two hacker groups certainly strike different poses. LulzSec’s statements and its actions display a spirit of exuberant anarchic glee. Lulz, in essence, means mean-spirited laughter, and LulzSec’s Web site describes the group as “a small team of lulzy individuals who feel the drabness of the cybercommunity is a burden on what matters: fun.”

The group is strongly antagonistic to the media. When a TV journalist for Russia Today asked for an interview, she was told it would be granted only if she and her producer wore shoes on their heads and wrestled in mud while singing. They declined.

There seems to be far less glee in the Anonymous culture. In a YouTube video describing the group, a voice intones: “There is no control, no leadership, only influence. The influence of thought.” Later, the video adds that Anonymous’s actions have “brought justice to our world.”

LulzSec’s exploits have riled others in the hacker world who object to its activities, particularly exposure of personal information of innocent Internet users. Those people are now working to stop LulzSec by investigating its members’ identities and providing information to the F.B.I.

The core LulzSec group, according to Mr. Brown, the former Anonymous activist, numbers between five and 10. Mr. Brown said the members he had dealt with — known by online nicknames like Topiary and Sabu — are mostly men in their early 20s.

Mr. Brown said he had dealt with Mr. Cleary, and that he believed — contrary to LulzSec’s statement — that he was involved with the group. But a person involved with Anonymous, who declined to be named for fear of prosecution, said Mr. Cleary was peripheral.

On Thursday the court agreed to delay Mr. Cleary’s application for bail while police investigated.

Hacker networks and their activities are murky by design, said Bruce Schneier, chief security technology officer of the British company BT Group. LulzSec, Mr. Schneier said, “is a badge, a name you call each other if you’re one of the cool hacker kids now.”

Riva Richmond contributed from New York.

Article source: