DDoS Hide & Seek: On the effectiveness of a booter services takedown

Daniel Kopp; Jair Santanna; Matthias Wichtlhuber; Oliver Hohlfeld; Ingmar Poese; Christoph Dietzel

doi:10.1145/3355369.3355590

DDoS Hide & Seek: On the effectiveness of a booter services takedown

Daniel Kopp, Jair Santanna, Matthias Wichtlhuber, Oliver Hohlfeld, Ingmar Poese, Christoph Dietzel

Design and Analysis of Communication Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

11 Citations (Scopus)

44 Downloads (Pure)

Abstract

Booter services continue to provide popular DDoS-as-a-service platforms and enable anyone irrespective of their technical ability, to execute DDoS attacks with devastating impact. Since booters are a serious threat to Internet operations and can cause significant financial and reputational damage, they also draw the attention of law enforcement agencies and related counter activities. In this paper, we investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting 15 booter websites in December 2018 from the perspective of a major IXP and two ISPs. We study and compare attack properties of multiple booter services by launching Gbps-level attacks against our own infrastructure. To understand spatial and temporal trends of the DDoS traffic originating from booters we scrutinize 5 months, worth of inter-domain traffic. We observe that the takedown only leads to a temporary reduction in attack traffic. Additionally, one booter was found to quickly continue operation by using a new domain for its website.

Original language	English
Title of host publication	IMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference
Publisher	Association for Computing Machinery
Pages	65-72
Number of pages	8
ISBN (Electronic)	9781450369480
DOIs	https://doi.org/10.1145/3355369.3355590
Publication status	Published - 21 Oct 2019
Event	Internet Measurement Conference, IMC 2019 - Koninklijk Instituut voor de Tropen, Amsterdam, Netherlands Duration: 21 Oct 2019 → 23 Oct 2019 https://conferences.sigcomm.org/imc/2019/

Conference

Conference	Internet Measurement Conference, IMC 2019
Abbreviated title	IMC
Country/Territory	Netherlands
City	Amsterdam
Period	21/10/19 → 23/10/19
Internet address	https://conferences.sigcomm.org/imc/2019/

Keywords

Booter
DDoS
DDos-for-Hire
Internet Security
ISP
IXP
Stresser

Access to Document

10.1145/3355369.3355590

Cite this

@inproceedings{c55c9a7793dc42b8b5fa5886eb37369a,

title = "DDoS Hide & Seek: On the effectiveness of a booter services takedown",

abstract = "Booter services continue to provide popular DDoS-as-a-service platforms and enable anyone irrespective of their technical ability, to execute DDoS attacks with devastating impact. Since booters are a serious threat to Internet operations and can cause significant financial and reputational damage, they also draw the attention of law enforcement agencies and related counter activities. In this paper, we investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting 15 booter websites in December 2018 from the perspective of a major IXP and two ISPs. We study and compare attack properties of multiple booter services by launching Gbps-level attacks against our own infrastructure. To understand spatial and temporal trends of the DDoS traffic originating from booters we scrutinize 5 months, worth of inter-domain traffic. We observe that the takedown only leads to a temporary reduction in attack traffic. Additionally, one booter was found to quickly continue operation by using a new domain for its website.",

keywords = "Booter, DDoS, DDos-for-Hire, Internet Security, ISP, IXP, Stresser",

author = "Daniel Kopp and Jair Santanna and Matthias Wichtlhuber and Oliver Hohlfeld and Ingmar Poese and Christoph Dietzel",

note = "Funding Information: We thank the IMC anonymous reviewers and our shepherd, J. Alex Halderman (University of Michigan), for their constructive comments, as well as our colleague Tim Tr{\"a}ris, and our significant others for their tremendous patience. This work was supported in part by the German Federal Ministry of Education and Research project AIDOS (6KIS0975K, 16KIS0976), by EC H2020 project CONCORDIA (GA 830927) and the SIDN fonds project DDoSDB (174058). Funding Information: We thank the IMC anonymous reviewers and our shepherd, J. Alex Halderman (University of Michigan), for their constructive comments, as well as our colleague Tim Tr?ris, and our significant others for their tremendous patience. This work was supported in part by the German Federal Ministry of Education and Research project AIDOS (6KIS0975K, 16KIS0976), by EC H2020 project CONCORDIA (GA 830927) and the SIDN fonds project DDoSDB (174058). Publisher Copyright: {\textcopyright} 2019 Association for Computing Machinery. ACM ISBN 978-1-4503-6948-0/19/10...$15.00; Internet Measurement Conference, IMC 2019, IMC ; Conference date: 21-10-2019 Through 23-10-2019",

year = "2019",

month = oct,

day = "21",

doi = "10.1145/3355369.3355590",

language = "English",

pages = "65--72",

booktitle = "IMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference",

publisher = "Association for Computing Machinery",

address = "United States",

url = "https://conferences.sigcomm.org/imc/2019/",

}

Kopp, D, Santanna, J, Wichtlhuber, M, Hohlfeld, O, Poese, I & Dietzel, C 2019, DDoS Hide & Seek: On the effectiveness of a booter services takedown. in IMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference. Association for Computing Machinery, pp. 65-72, Internet Measurement Conference, IMC 2019, Amsterdam, Netherlands, 21/10/19. https://doi.org/10.1145/3355369.3355590

DDoS Hide & Seek: On the effectiveness of a booter services takedown. / Kopp, Daniel; Santanna, Jair; Wichtlhuber, Matthias et al.
IMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference. Association for Computing Machinery, 2019. p. 65-72.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - DDoS Hide & Seek

T2 - Internet Measurement Conference, IMC 2019

AU - Kopp, Daniel

AU - Santanna, Jair

AU - Wichtlhuber, Matthias

AU - Hohlfeld, Oliver

AU - Poese, Ingmar

AU - Dietzel, Christoph

N1 - Funding Information: We thank the IMC anonymous reviewers and our shepherd, J. Alex Halderman (University of Michigan), for their constructive comments, as well as our colleague Tim Träris, and our significant others for their tremendous patience. This work was supported in part by the German Federal Ministry of Education and Research project AIDOS (6KIS0975K, 16KIS0976), by EC H2020 project CONCORDIA (GA 830927) and the SIDN fonds project DDoSDB (174058). Funding Information: We thank the IMC anonymous reviewers and our shepherd, J. Alex Halderman (University of Michigan), for their constructive comments, as well as our colleague Tim Tr?ris, and our significant others for their tremendous patience. This work was supported in part by the German Federal Ministry of Education and Research project AIDOS (6KIS0975K, 16KIS0976), by EC H2020 project CONCORDIA (GA 830927) and the SIDN fonds project DDoSDB (174058). Publisher Copyright: © 2019 Association for Computing Machinery. ACM ISBN 978-1-4503-6948-0/19/10...$15.00

PY - 2019/10/21

Y1 - 2019/10/21

N2 - Booter services continue to provide popular DDoS-as-a-service platforms and enable anyone irrespective of their technical ability, to execute DDoS attacks with devastating impact. Since booters are a serious threat to Internet operations and can cause significant financial and reputational damage, they also draw the attention of law enforcement agencies and related counter activities. In this paper, we investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting 15 booter websites in December 2018 from the perspective of a major IXP and two ISPs. We study and compare attack properties of multiple booter services by launching Gbps-level attacks against our own infrastructure. To understand spatial and temporal trends of the DDoS traffic originating from booters we scrutinize 5 months, worth of inter-domain traffic. We observe that the takedown only leads to a temporary reduction in attack traffic. Additionally, one booter was found to quickly continue operation by using a new domain for its website.

AB - Booter services continue to provide popular DDoS-as-a-service platforms and enable anyone irrespective of their technical ability, to execute DDoS attacks with devastating impact. Since booters are a serious threat to Internet operations and can cause significant financial and reputational damage, they also draw the attention of law enforcement agencies and related counter activities. In this paper, we investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting 15 booter websites in December 2018 from the perspective of a major IXP and two ISPs. We study and compare attack properties of multiple booter services by launching Gbps-level attacks against our own infrastructure. To understand spatial and temporal trends of the DDoS traffic originating from booters we scrutinize 5 months, worth of inter-domain traffic. We observe that the takedown only leads to a temporary reduction in attack traffic. Additionally, one booter was found to quickly continue operation by using a new domain for its website.

KW - Booter

KW - DDoS

KW - DDos-for-Hire

KW - Internet Security

KW - ISP

KW - IXP

KW - Stresser

UR - http://www.scopus.com/inward/record.url?scp=85074868127&partnerID=8YFLogxK

U2 - 10.1145/3355369.3355590

DO - 10.1145/3355369.3355590

M3 - Conference contribution

AN - SCOPUS:85074868127

SP - 65

EP - 72

BT - IMC 2019 - Proceedings of the 2019 ACM Internet Measurement Conference

PB - Association for Computing Machinery

Y2 - 21 October 2019 through 23 October 2019

ER -

DDoS Hide & Seek: On the effectiveness of a booter services takedown

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this