Make Your Booter A Reality
Recent years have witnessed a rapid proliferation of cheap, Web-based services that troublemakers can hire to knock virtually any person or site offline all day on end. Such services succeed partly because they've enabled users to cover attacks with PayPal. But a collaborative effort by PayPal and security researchers has made it far more problematic for these services to transact using their would-be customers.
By offering a low-cost, shared distributed denial-of-service (DDoS) attack infrastructure, these so-called “booter” and “stresser” services have attracted a large number of malicious customers and are in charge of countless a large number of attacks per year. Indeed, KrebsOnSecurity has repeatedly been targeted in fairly high-volume attacks from booter services — most notably something run by the Lizard Squad band of miscreants who took responsibility for sidelining the Microsoft xBox and Sony Playstation on Christmas Day 2014.
For a lot more than two months in the summertime 2014, researchers with George Mason University, UC Berkeley's International Computer Science Institute, and the University of Maryland began following the money, posing as buyers of nearly two dozen booter services in a bid to discover the PayPal accounts that booter services were utilizing to just accept payments. In response to their investigations, PayPal began seizing booter service PayPal accounts and balances, effectively launching their own preemptive denial-of-service attacks contrary to the payment infrastructure for these services.
PayPal will initially limit reported merchant accounts which are found to violate its terms of service (turns out, accepting payments for abusive services is just a no-no). Once an account is restricted, the merchant cannot withdraw or spend any of the funds in their account. This results in the increasing loss of funds in these accounts during the time of freezing, and potentially additional losses due to opportunity costs the proprietors incur while establishing a brand new account. In addition, PayPal performed their own investigation to spot additional booter domains and limited accounts connected to these domains as well.
The efforts of the research team apparently brought some big-time disruption for nearly two-dozen of the most truly effective booter services. The researchers stated that inside a day or two following their interventions, they saw the percentage of active booters quickly dropping from 70 to 80 percent to around 50 percent, and continuing to decrease to a low of around 10 percent that have been still active.
While some of the best booter services sought out of business shortly thereafter, higher than a half-dozen shifted to accepting payments via Bitcoin (although the researchers found this dramatically lessen the services'overall amount of active customers). Once the mark intervention began, they found the typical lifespan of an account dropped to around 3.5 days, with many booters 'PayPal accounts only averaging around two days before these were no more used again.
The researchers also corroborated the outages by monitoring hacker forums where in fact the services were marketed, chronicling complaints from angry customers and booter service operators who have been inconvenienced by the disruption