| |
"If I had two equally profitable orders: E-gold or, for example, Fethard, I would choose E-gold DDoS..." - tells the specialist in DDoS attacks in his exclusive interview with ECJ.
Every now and then we can hear in Internet such phrases as: "Liberty Reserve is down, Pecunix is under DDoS, E-gold is cut out for several hours" and etc. Nowadays World Wide Web is a cockpit for a real war between the owners of websites and organizers of DDoS attacks. Sometimes this war is won not by law and discipline, not wit and conscience but it is won by the one who had thought better about security of his site. Organization of DDoS-attacks is a profitable world business. It is a whole industry with its infrastructure, services and hierarchies. It has its leaders and outsiders, professionals and newbies that came to try themselves in so-called "neutralization" of websites. We have manage to contact with one of such specialists in DDoS-attacks and for the first time in Internet to discuss the activity of DDoSers and everything that is related to this exotic profession. It is natural that the specifics of his activity does not allow him to uncover his face and our interlocutor has preferred to call himsel
f as 911 nickname. 911.
ECJ: How popular is the method of DDoS-attacks to eliminate the competitors?
This method is very effective and that is why very popular. Internet is quite densely inhabited by business society, competition is very high and there are no enough business patterns to work and earn with confidence.
ECJ: Does the number of orders increase? May be you have even regular customers?
Yes, with time the number of orders increases and the lion share is regular customers.
ECJ: What education does today's ddoser have?
Medium of DDoS-specialists is dissimilar. Last time the market is entered by the figures without any education - pupils and students that try to coin money, however their methods of work differ from the methods of professionals but their service costs are lower as well.
ECJ: What has changed in pricing policy during the year, do the service costs rise?
Everything depends on concrete executor and customer. There are a lot of middlemen in this business and everybody wants to pull out a bigger piece of cake. During year the situation changed but not significantly. Ddosers have decreased prices for the regular customers but DDoS victims has been strengthening the defense thereafter DDoS costs become higher.
ECJ: Could you please tell about price formation?
First of all price depends on "target" (attacked object):
- its hosting pass bandwidth;
- datacenter;
- presence of protecting software and hardware;
- level of technical training and experience of specialists of hosting company.
The wider channel of target has the more problematical its attack realization and the more difficult to keep it during the time necessary for the customer. This price is added by fees of executors and middlemen who negotiate with the customer and who take the money.
ECJ: The price matter of DDoS attack protection is very important. Prolexi? promises for 20k to repulse even A-bomb... Is it realizable to "drop" such defense?
It is realizable but very expensive and difficult and requires a very big botnet. Prices for such attacks start from $10000 per day.
ECJ: In what business spheres are the sites more frequently attacked by DDoS? Speaking easier what is ordered?
Naturally they order DDoS attacks on the companies maximally dealt with electronic commerce. But DDoS industry lives by the orders; big money is brought by blackmail.
ECJ: Yes, today it is very topical. Could you please tell what the proceeds of activity are and who can be a blackmail object?
The easiest blackmail targets are the companies with illegal business such as HYIPs that cannot ask for help. But they can struggle with DDoS as this is an everyday occurrence in this sphere.
Next are: bookmakers, Internet-casinos, Internet- processing companies.
ECJ: What is a mean income of the blackmailer from one website?
Something likes $40k. But it is easier for company to pay this money than to suffer heavy losses.
ECJ: Do they order DDoS attacks on e-currency exchange providers, payment systems and Internet-banks? Do DDoSers blackmail them?
Yes they do. But as for exchangers and payment systems the customers here are more their rivals than the blackmailers.
ECJ: What paysys in your opinion is the most difficult to attack today?
It does not worth getting involved with those who work and have contacts with spammers, carders, botneters, bulkhosters and other representatives of illegal business in Internet. In other words these ones who mastermind such payment system can easily find the DDoSer.
ECJ: So, it means that the more scaled and famous the payment system is the more difficult is to disable it. And accordingly here can arise a conclusion that the most difficult is to "drop" E-gold and PayPal?
Not exactly. If I had two equally profitable orders: E-gold or, for example, Fethard, I would choose ?-gold DDoS as "Fet" has more contacts in underground circles.
ECJ: What budget can the DDoS of a big paysys have? For example, how did you estimate the recent attack on Pecunix that was lasting more than one month?
I cannot tell at once. I need first learn the infrastructure of the net and etc.
I think that such DDoS costs an experienced specialist not more than 20k- 30k.
ECJ: Let us suppose that DDoSer attacks some website for a short time and then proceed to blackmail the owner. What is the prime cost of such "mini-attack"?
Prime cost of the short-term DDoS is insignificant. However DDoSer should maintain his botnet in operating condition, and the attack should take place in a required time.
ECJ: Indeed, if our reader is an owner of Internet-shop he asked himself a question: "What to do?" then begin a physiological war. Or he will have a desire to wait for a while and hope that DDoSer will be bored with money and time spending, or ddosers will wait until the attacked object will give way. Could you give a piece of advice on how does such owner of Internet shop should act, especially if he cannot afford a protection that costs $20000.
I think that such owner of Internet shop deserves sympathy. Though there is an opinion that in a year there will be a sufficient antiDDoS hosting that will be able to solve DDoS problems of its customers not for 20k but much cheaper.
ECJ: Is it possible to set 100% protection from DDoS?
I think that it is possible without doubt but it is very expensive.
ECJ: And what is the approximate budget? As, for example, it is "impossible to drop" servers of Pentagon. Interestingly, how much do such structures spend on DDoS protection?
Everything depends on summed width of channels. I think if we set such a task, few hundred thousands of dollars per month will protect from any DDoS.
ECJ: How much does DDoSer or DDoS office earn in average per year/month?
Everything depends on concrete office. Not every programmer will write high-end DDoS software, and those who write want a top-high salary. Expense part appears to be very high though this business in any case is super profitable. I estimate profit norm at 40-70% level.
ECJ: Is it possible to punish somehow DDoSer in legal order? Are there any cases that the representatives of your profession were officially prosecuted and sentenced?
Sure, as it is a criminal case and more over a fact of blackmail presents there. The same pupils I've mentioned in the very beginning are very frequently penalized. As it is not difficult to catch them at money receipt, and it's worth mentioning that the same WebMoney system is glad to assist in it.
ECJ: Are any funny cases presented in your work?
Sure! It is a funny and interesting job! There was a case when an owner of the attacked super specialty store had ordered a DDoS of his rival, who as it appeared to be had ordered DDoS of the first one himself. And he made it first. As a result, almost a week both shops were not available and we have got our money.
ECJ: Yes, the story is really funny. Does DDoSer have any code of honour? Particularly you?
I deal with it only to get some profit and never bind my work with any personal ambitions. There are a lot of cases known when DDoSer attacks someone out of revenge, for instance, some payment system that has blocked his money. I have distinctly negative attitude towards such actions.
ECJ: But still, do you have any orders that cannot be accepted for principal reasons? I mean do you have any line that you will never toe the line? Everybody has his own moral and ethical concept but still... For example, will you take up DDoS of some religious site? Will you be able to launch DDoS attack on the site of the president of your country ordered by the other country?
I'm not religious, so I'm not limited in this sphere. As for politics, I try not to get interfered in it as it can be really dangerous. But there were no orders in my practice that I had refused for some moral reasons.
ECJ: And in conclusion of our talk I would like to know your opinion whether DDoS industry has any future or it will die soon as a result of protection means?
Hosters wide their channel width but the bandwidth of usual users - carriers of harmful software also extends. So, DDoS has future, and this kind of illegal business will only develop and at the same time will develop DDoS protection market...
http://www.ecommerce-journal.com/interviews/the_first_in_the_world_interview_with_ddos_specialist_exclusive_for_ecj_0
|
|
- 08/3/5(水) 0:41 -
