Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spamhaus DDoS Suspect Arrested

Cyberbunker leader traveled Spain in a van, accessed Wi-Fi hotspots to launch DDoS attacks against anti-spam opponents, Dutch authorities allege.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Police in the Netherlands Friday announced the arrest of a 35-year-old Dutchman on charges of having launched "unprecedented heavy attacks on the non-profit organization Spamhaus."

The suspect, identified only as "S.K." by Dutch police, has been named in multiple news reports as Sven Kamphuis, the leader of Amsterdam-based "bulletproof hosting provider" Cyberbunker, as well as service provider CB3ROB. Kamphuis has been a vocal proponent of -- although not, he's claimed, participant in -- the Stophaus.com movement that seeks to undercut anti-spam intelligence service Spamhaus.

"S.K." was arrested Thursday on a European arrest warrant by Spanish police, 22 miles north of Barcelona, after a 25-day investigation that was coordinated via Eurojust, which is a collaboration between European Union law enforcement agencies. As part of the arrest, Spanish police also seized two laptops, as well as multiple mobile phones and storage devices.

According to a statement released by Spain's Interior Ministry, "the suspect was traveling across Spain in a van that he used as mobile computing office," which was "equipped with various antennas to scan frequencies," which allowed him to access Wi-Fi networks, through which authorities said he not only conducted media interviews but also launched DDoS attacks.

[ What are your takeaways from the "Stophaus" DDoS campaign? Read Spamhaus DDoS Attacks: What Business Should Learn. ]

Spanish police said that upon his arrest, the suspect identified himself as a diplomat, saying he was the Minister of Telecommunications and Foreign Affairs for the Republic of Cyberbunker.

According to the High Tech Crime Team police unit in the Netherlands, the DDoS attacks launched against Spamhaus -- of which Kamphuis is being accused -- targeted servers in the United States, United Kingdom and the Netherlands, and employed fake IP addresses. The DDoS attacks gained notoriety by peaking at an unprecedented 300 gigabits per second, leading some commentators to falsely assert that the attacks slowed down the Internet.

The Spamhaus Project maintains real-time spam-blocking databases used by a variety of service providers, as well as government and military network operators, to help them block spam. According to Matthew Prince, CEO of DDoS prevention service CloudFlare -- of which Spamhaus is a customer -- 80% of spam traveling across the Internet gets filtered thanks to Spamhaus.

The dispute between Cyberbunker and Spamhaus stems from the anti-spam service previously requesting that Cyberbunker block pharmaceutical spam and botnet communications emanating from its networks.

"A year ago, we started seeing pharma and botnet controllers at Cyberbunker's address ranges, so we started to list them," an anonymous Spamhaus member told security reporter Brian Krebs Friday. "We got a rude reply back, and he made claims about being his own independent country in the Republic of Cyberbunker, and said he was not bound by any laws and whatnot. He also would sign his emails 'Prince of Cyberbunker Republic.' On Facebook, he even claimed that he had diplomatic immunity."

That response led Spamhaus to request that Cyberbunker's service provider, DataHouse, and ultimately its service provider, A2B Internet, block all of Cyberbunker's traffic. When they refused to do so, however, Spamhaus added both service providers to its spam-blocking list. Even as the service providers complied by blocking Cyberbunker's traffic, they decried what they saw as strong-arm tactics.

"Cyberbunker isn't even a customer of ours, but is rather a customer of DataHouse (who also has their own network and IP addresses) and to move up two ISPs and start complaining there is just insane," said A2B Internet director Erik Bais at the time. "On top of that, putting the IPs of that ISP on a blacklist to 'make your point' is something I don't have a good word for."

Ultimately, Stophaus last month launched a DDoS attack against Spamhaus. But both Stophaus and Cyberbunker soon found themselves at the receiving end of a DDoS attack that disrupted their own operations.

E2 is the only event of its kind, bringing together business and technology leaders across IT, marketing, and other lines of business looking for new ways to evolve their enterprise applications strategy and transform their organizations to achieve business value. Join us June 17-19 for three days of 40+ conference sessions and workshops across eight tracks and discover the latest insights in enterprise social software, big data and analytics, mobility, cloud, SaaS and APIs, UI/UX and more. Register for E2 Conference Boston today and save $200 off Full Event Passes, $100 off Conference, or get a FREE Keynote + Expo Pass!

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jries921
50%
50%
jries921,
User Rank: Ninja
4/29/2013 | 4:56:35 PM
re: Spamhaus DDoS Suspect Arrested
I see the attacks on Spamhaus and other sites as rebuttals to the claim recently advanced by Anonymous that DDoS is free speech. Indeed, it seems to me that DDoS attacks are by definition attempts to hamper the ability of others to communicate with the public.
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34202
PUBLISHED: 2021-06-16
There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remot...
CVE-2021-32659
PUBLISHED: 2021-06-16
Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombs...
CVE-2020-25755
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.
CVE-2020-25754
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an una...
CVE-2020-25753
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.