A leaked database from a hacked denial-of-service site has provided some insight into what sorts of targets individuals will pay to knock offline for a few dollars or bitcoin. And it's safe to say that a significant percentage of them are not the brightest stars in the sky. To get an idea of who would use such a service and for what purposes, Ars analyzed the data from a recently hacked DDoS for hire site: LizardSquad's LizardStresser.
"Booter" or "stresser" sites offer users the ability to pay for distributed denial of service attacks against a target, and these sites promise to try to disguise the nature of the attack with the fig leaf of being legitimate load testing sites. That wasn't so much the case with LizardStresser, the botnet-for-hire set up by the distributed denial of service crew known as LizardSquad. The group used its Christmas week DDoS attacks on Microsoft's Xbox Live network and Sony's Playstation Network as a form of advertising for the new service.
Since then, attacks on gamers have made up a significant percentage of the LizardStresser's workload. While more than half of the attacks launched by customers of the service have been against Web servers, a significant portion have targeted individuals or small community gaming servers—including Minecraft servers.
Things have not gone all that well for LizardSquad since the launch of LizardStresser. Shortly after the service—which uses a botnet of hacked home and institutional routers—was launched, members of LizardSquad started getting arrested. Last week the LizardStresser server was hacked, and its database was dumped and posted to Mega by the former operator of the darknet "doxing" site Doxbin.
As a result, the usernames and passwords of LizardSquad's "customers," along with logs of the Internet addresses that had been attacked by the router botnet, were laid bare for everyone to see. The database dump was pulled by Mega after LizardSquad made, believe it or not, a DMCA takedown request. But the file has been mirrored elsewhere, and now customers of the service who made the mistake of re-using their passwords and registering with actual e-mail addresses have been exposed to a different sort of attack.
Another potential problem is the obfuscated log of users' IP addresses. To prevent users from sharing a "booter" account with their friends, LizardStresser checks the user's IP address against a hash of the address used when the account is set up. This is potential gold for anyone willing to spend a little while cracking the MD5 hash of users' IP addresses included in the database—a task that, given the structure of the data hashed, is not the most difficult of cryptography problems. Any potential crackers would have complete attribution for several thousand denial of service attacks over the past month.
The unwashed masses
Though nearly 13,000 users signed up for the LizardStresser service, only about 250 actually did anything with it. More than half the users launched less than 20 short attacks, with only 30 users launching more than 100. And LizardSquad's customer support was clearly based on the lulz, because many of those users apparently couldn't follow directions—a clear indicator of the technical skills of the majority of those trying to purchase (or begging for free) DDOS time.
The most frequent message in the logs in response to trouble tickets was, "This is an automated response from our ticket system to say that we have closed your ticket without response as you obviously haven't read the FAQ, in the future please read it before opening a ticket and this will not happen again."
Then there was this message left by one user:
Greetings y'all Lizards.
I heard on your twitter account that your booter was running trough a loooooooad of hacked routers.
An idea came into my mind.I, in the near future, plan to infect a few thousand people with a malware of my own (Won't do anything DDoS side.).
I know 1 or 2/3k people won't add much power but is there any way I could help you infect those people when I do my stuff with them?You might wonder why I want to help.
Well... Let's say I'm having fun watching all the fuss and well, I plan to get a lifetime package in the future so, why not help my future DDoS provider.
I'll be waiting for an answer, best regards.
LizardSquad's reply:
You're retarded, if we wanted people then we would just get them that way? Why would we involve you in this if we can have dedicated bots.
Yo, I booted you from Minecraft, lol
Almost none of the attacks launched by LizardStresser were against major websites. Most of the Web attacks focused on servers at smaller hosting companies, though many went after sites protected behind CloudFlare that were unidentifiable by their IP addresses. A single server at Centauri Communications, a San Francisco-based hosting company, was the single most targeted address, receiving 1,468 attacks from LizardStresser ordered up by a single user.
That user, who attacked 20 sites in all (and often repeatedly), was LizardSquad's best customer, responsible for a fifth of all the attacks launched by the service in the logs. Ironically, his username was "ryanbrogan"—the name of an FBI agent who investigates cybercrime for the bureau's division in Newark, New Jersey. Brogan was involved in the investigation of the hacking of hosting provider Linode in 2013.
An Ars analysis of theLizardStresser database found that the service launched nearly 16,000 individual attacks over the past month, targeting just over 3,900 IP addresses. The vast majority of these attacks—67 percent—targeted common Web server ports (port 80 and 8080 for HTTP; and a small but significant number of attacks on port 443 for HTTPS). The next most popular target—accounting for nearly 7 percent of the attacks—was port 25565, the network port used by Minecraft servers.
The next most popular target was Parallels' Plesk control panel for shared hosting accounts, which accounted for about 5.5 percent of the attacks. LizardStresser's customers also tried out attacks on Domain Name Service and File Transfer Protocol services. And rounding out the top attacks were assaults on Xbox Live and Battlefield 4 game traffic, likely aimed at interrupting service to specific individuals based on the fact that they were pointed at residential IP addresses.
Other big targets were hosting companies in Nevada, Quebec, Poland, and Malaysia. It's likely that these attacks were focused on Web forums and personal sites that the attackers held a grudge against. Ars attempted to reach Centauri and other hosting companies to ask them about the attacks, but we only reached a live person at one company who declined to be identified. "We get attacked all the time," he said, noting that there was nothing particularly noteworthy about the last month in terms of the volume of denial-of-service attacks.
Listing image by Lizard photograph by Leo Reynolds (illustration by Aurich Lawson)
reader comments
45