Attacks/Breaches

8/16/2017
02:55 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Websites Selling DDoS Services and Tools on the Rise in China

Researchers detect an increase in Chinese websites offering online DDoS services within the past six months.

Cyberattackers in China are gravitating toward online DDoS platforms, as evidenced by a recent surge in Chinese websites offering DDoS services.

Researchers at Cisco Talos, a division of Cisco focused on threat intelligence, detected a spike in the number of Chinese websites selling DDoS tools in the past three to six months. The shift was first detected while monitoring conversations in group chats populated by Chinese hackers.

"We monitor Chinese hacker forums and group chats, where we observed numerous groups advertising the websites for their online DDoS platforms," says Talos senior threat researcher David Liebenberg.

Social media apps WeChat and QQ host hundreds of chats where hackers, customers, agents, and advertisers discuss DDoS groups, tools, malware, and targets. DDoS tools and services are among the most sought-after products on the Chinese underground market. It's easy for even novice attackers to operate these platforms and launch attacks, he notes.

"Online DDoS services potentially expand the customer base by providing a more convenient user experience and relatively safer payment options through third-party sites," Liebenberg says of the increase. "Chinese actors could also have observed the popularity of online booter services in other countries and the profits they have yielded."

Many recently discovered websites share "nearly identical" functionality and design, displaying the number of active users and servers, and total number of successful attacks, researchers found. They also have announcements on tool updates, capabilities, and restrictions. Users can register accounts, buy activation codes to launch attacks, and attack their targets.

Talos researchers noticed many websites had "ddos" in their domain names, a finding that helped identify the increase in sellers and confirm 32 nearly-identical Chinese online DDoS websites. It's assumed there are more out there since not all share sites have "ddos" in the domain.

Given the similarities, they initially suspected one actor was operating under multiple aliases. Nearly all of the sites used Chinese registrars, most were registered in the past three months (nearly all in the last year), and more than half were hosted on Cloudllare IPS.

The single-actor theory was discarded when they found sites were using different third-party Chinese payment platforms and displaying different tool capabilities, contact info, and numbers for active users and attacks. Most websites had different registrant names and emails, and different registrars listed, leading researchers to think multiple actors are involved.

The sites' similarities are likely due to shared source code, which actors can purchase on Chinese forums and marketplaces. This code "lowers the bar" for groups wanting to create their own DDoS service, Liebenberg says. Chinese hacker forums began distributing source code for DDoS platforms in late 2016, explaining the recent uptick this year.

"As other actors see more sites being stood up and making money, they attempt to create their own websites," he adds.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

It's unknown where the source code originated, though it was originally written in English. There are many English-language booters sharing similarities like the Bootstrap design, Cloudflare hosting, and related graphics and toolbars, Liebenberg continues.

"My best guess is that a Chinese actor obtained source code for one of these tools and adjusted it," he says. "What most stands out is the degree to which it has been localized for Chinese consumers, such as changing the PayPal logo to an Alipay pogo, or automatically including a Terms of Service written in Chinese."

Researchers also saw DDoS platforms requesting attacks on one another. Actors in several group chats discussed attacks on rival groups, and traffic indicated some were hit with attacks.

"I believe they are attacking each other because they are competing for customers," says Liebenberg. "It is not uncommon to see Chinese 'grey market' services, such as pirated online game servers, using means such as DDoS to take out rivals."

Could these attacks extend to foreign victims? It's possible, he says. In fact, it would be consistent with Chinese DDoS targeting practices seen in other hacker forums and group chats. There is no restriction preventing customers from targeting hosts in other countries.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8948
PUBLISHED: 2019-02-20
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
CVE-2019-8950
PUBLISHED: 2019-02-20
The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.
CVE-2019-8942
PUBLISHED: 2019-02-20
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image c...
CVE-2019-8943
PUBLISHED: 2019-02-20
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring...
CVE-2019-8944
PUBLISHED: 2019-02-20
An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.