Monetization of DDoS attacks has been core to online crime
way before the term cybercrime was ever coined. For the first half of the
Internet’s life DDoS was primarily a mechanism to extort money from targeted
organizations. As with just about every Internet threat over time, it has
evolved and broadened in scope and objectives.
The new report by Forcepoint Security Labs covering their
investigation of the Sledgehammer
gamification of DDoS attacks is a beautiful example of that evolution.
Their analysis paper walks through both the malware agents and the scoreboard/leaderboard
mechanics of a Turkish DDoS collaboration program (named Sath-ı Müdafaa or
“Surface Defense”) behind a group that has targeted organizations with
political ties deemed inconsistent with Turkey’s current government.
In this most recent example of DDoS threat evolution, a pool
of hackers is encouraged to join a collective of hackers targeting the websites
of perceived enemies of Turkey’s political establishment.
Using the DDoS agent “Balyoz” (the Turkish word for “sledgehammer”),
members of the collective are tasked with attacking a predefined list of target
sites – but can suggest new sites if they so wish. In parallel, a scoreboard
tracks participants use of the Balyoz attack tool – allocating points that can
be redeemed against acquiring a stand-alone version of the DDoS tool and other
revenue-generating cybercrime tools, for every ten minutes of attack they
conducted.
As is traditional in the dog-eat-dog world of cybercrime,
there are several omissions that the organizers behind the gamification of the
attacks failed to pass on to the participants – such as the backdoor built in
to the malware they’re using.
Back in 2010 I wrote the detailed paper “Understanding
the Modern DDoS Threat” and defined three categories of attacker –
Professional, Gamerz, and Opt-in. This new DDoS threat appears to meld the
Professional and Opt-in categories in to a single political and money-making
venture. Not a surprise evolutionary step, but certainly an unwanted one.
If it’s taken six years of DDoS cybercrime evolution to get
to this hybrid gamification, what else can we expect?
In that same period of time we’ve seen ad hoc website
hacking move from an ignored threat, to forcing a public disclosure discourse,
to acknowledgement of discovery and remediation, and on to commercial bug bounty
platforms.
The bug bounty platforms (such as Bugcrowd, HackerOne,
Vulbox, etc.) have successfully gamified the
low-end business of website vulnerability discovery – where bug hunters and
security researchers around the world compete for premium rewards. Is it not a
logical step that DDoS also make the transition to the commercial world?
Several legitimate organizations provide “DDoS Resilience
Testing” services. Typically, through the use of software bots they spin up
within public cloud infrastructure, DDoS-like attacks are launched at paying
customers. The objectives of such an attack include the measurement and verification
of the defensive capabilities of the targets infrastructure to DDoS attacks, to
exercise and test the companies “blue team” response, and to wargame business
continuity plans.
If we were to apply the principles of bug bounty programs to
gamifying the commercial delivery of DDoS attacks, rather than a contrived limited-scope
public cloud imitation, we’d likely have much more realistic testing capability
– benefiting all participants. I wonder who’ll be the first organization to
master scoreboard construction and incentivisation? I think the new bug bounty
companies are agile enough and likely have the collective community following
needed to reap the financial rewards of the next DDoS evolutionary step.
