Conversations with a Bulletproof Hoster Criminal commerce on the Internet would mostly grind to a halt were it not for the protection offered by so-called “bulletproof hosting†providers – the online equivalent of offshore havens where shady dealings go ignored. Last month I had an opportunity to interview a provider of bulletproof services for one of the Web’s most notorious cybercrime forums, and who appears to have been at least partly responsible for launching what’s been called the largest cyber attack the Internet has ever seen. Earlier this year, the closely-guarded English-language crime forum darkode.com was compromised and came under a series of heavy distributed denial-of-service (DDoS) attacks aimed at keeping it offline. Around that same time, darkode.com welcomed a new member — a bulletproof hosting broker aptly named “Off-sho.re†— who promised to defend the site from future DDoS attacks. Off-sho.re also said he could offer more robust and crime-friendly hosting services than darkode’s previous provider — Santrex, literally an offshore hosting facility located in the Seychelles, a 115-island country that spans an archipelago in the Indian Ocean. Off-sho.re’s timing was perfect: Darkode desperately needed both, and Off-sho.re seemed to know his stuff, so he was admitted to the forum and given stewardship of the site’s defense and hosting. STOPHAUS V. SPAMHAUS Of course, to successfully defend a network against DDoS attacks one must know a great deal about how to launch such assaults. Indeed, Off-sho.re was an integral member of Stophaus, an upstart group of bulletproof hosters that banded together in March to launch a massive Internet attack against anti-spam group Spamhaus.org. Hundreds of ISPs route or deny traffic based in part on Spamhaus’s blacklists of known, cybercrime-friendly ISPs, and Stophaus formed in response to Spamhaus’s listing of bulletproof hosting provider in particular: A network known alternatively as CB3ROB, a.k.a. “Cyberbunker†because it operated from a heavily fortified NATO bunker in The Netherlands. Off-sho.re is moderator of the Stophaus forum, and not long after joining darkode.com, he was recruiting fellow darkode members for the Stophaus cause. Stophaus’s records show that another core member was “0ptik,†a competing bulletproof hosting provider. Spamhaus had listed dozens of Optik’s domains, as well as virtually all of the IP address ranges Off-sho.re had rented at abuse-friendly Romanian hosting provider Voxility. It was payback time. In late March, Spamhaus became the target of what experts called one of the largest computer attacks on the Internet. The method of attack — a DNS amplification attack — was similar to that first seen used in attacks more than a decade ago that targeted the heart of the Internet’s routing system, except that it was by most accounts much larger. “DNS amplification attacks can bring up to 140 Gbps to a single resource from a single controller,†Off-sho.re wrote in a darkode.com posting less than 24 hours after the attack on Spamhaus began. “The beauty of it [is] that the ‘bots’ are just open DNS resolvers in the world.†Linking to a writeup from Cloudflare.com about the attack, Off-sho.re stated that “Some BP hosters were lately united, check out our latest prank.†Last month, authorities in Spain arrested Sven Kamphuis, a 35-year-old Dutch man, thought to be responsible for coordinating the unprecedented attack on Spamhaus. According to Spamhaus, Kamphuis made claims about being his own independent country in the Republic of Cyberbunker. But according to Off-Sho.re, Kamphuis was just the public face of the movement. “Sven didn’t attack anyone,†Off-Sho.re wrote in an online chat with KrebsOnSecurity. If Kamphuis was just a mouthpiece, who was responsible for the attack? What is interesting about the Stophaus movement is that Off-sho.re very well may have prompted Spamhaus to finally place CB3ROB/Cyberbunker at the top of its World’s Worst Spam-Support ISPs list, a move that helped to precipitate this conflict. According to Spamhaus, while Cyberbunker and Spamhaus certainly have a bit of a history together, Cyberbunker wasn’t really a focus of Spamhaus’s blocking efforts until the fall of 2012. That’s when Spamhaus began noticing a large number of malware and botnet control servers being stood up inside of Cyberbunker’s Internet address ranges. “We didn’t really notice these guys at CB3ROB much until last fall, when they started hosting botnet controllers, malware droppers and a lot of pharma spam stuff,†said a Spamhaus member who would only give his name as “Barry.†“Before that, it was mainly routing for some Chinese guys – Vincent Chan – fake Chinese products.†Oddly enough, this coincides with Off-sho.re’s entrance on the bulletproof hosting scene (at least as advertised on crime forums). In his introduction post to Darkode, Off-sho.re referenced his bulletproof hosting sales threads at two Russian-language forums — expoit.in and damagelab.org. In these threads, which began in Sept. 2012, Off-sho.re advertised the ability to host ZeuS and SpyEye botnet command and control networks for between $99 and $199 per month, and bulletproof domain registration from $30 per month. More importantly, Off-sho.re proudly announced that he was offering a premiere BP hosting service for $400 a month that was housed in an old NATO bunker in Holland and that used IP addresses assigned to CB3ROB (see screenshot to left). CRUELTY-FREE CYBERATTACKS? The attack that hit Spamhaus — known as a DNS reflection and amplification attack — leveraged unmanaged DNS servers on the Web to create huge traffic floods. DNS servers act as the white pages of the Internet, transforming or “resolving†human-friendly domain names into numerical network addresses used by computers. Typically, DNS servers only provide services to machines within a trusted domain. But DNS reflection attacks rely on consumer and business routers equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web. Attackers can send spoofed DNS queries to these so-called “open recursive†DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address. The amplification part of the attack takes advantage of the ability to craft DNS queries so that the responses are much bigger than the requests; they do this by leveraging an extension to the DNS protocol that enables large DNS messages. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification†effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously. I reached out to Off-sho.re via instant message to ask why he thought it was okay to hijack servers that belonged to someone else for use in attacks on third-parties. “No one launched or abused any attack, all DNS resolvers were machines that had this option open,†Off-sho.re explained. “No bots were used and no one was infected. The individuals who did the attack, didn’t harm any computer in order to launch it. So your question about the legal aspect of this thing is not relevant.†Rodney Joffe, vice president and senior technologist at Neustar, a Sterling, Va. based security company that helps firms defend against large cyberattacks, said such attitudes are common criminal delusion. “That’s like saying, hey, all I did was open the car door, put a brick on the gas pedal and let the car run down the road and smash into someone’s house, but the guy who owned the car shouldn’t have left it unlocked. “If you want real world analogues you can say, hey, that car was left open so I broke into it,†Joffe said. “That’s like saying, hey, all I did was open the car door, put a brick on the gas pedal and let the car run down the road and smash into someone’s house, but the guy who owned the car shouldn’t have left it unlocked. Put another way, just because I have a non-functioning lock on my door doesn’t give you permission to use my property.†NOTHING PERSONAL Off-sho.re insisted he did not directly participate in launching the attacks on Spamhaus. But as I discovered in my reporting, he had no qualms about ordering his minions to attack my site prior to our chat conversation. A few days before I reached out to him, Off-sho.re orchestrated an attack against KrebsOnSecurity.com as a means of vetting a new darkode.com member. That assault was part of the initiation process for “Abscond,†a hacker who was seeking admittance to darkode.com and who’d claimed his specialty was providing DDoS services. To prove his firepower, Abscond was told to knock one of three sites offline: Darkode.com, krebsonsecurity.com, or xylibox.com (the blog for a French security researcher who goes by the pseudonym “Xylitolâ€). The conversation below took place between Off-sho.re and Abscond after the latter’s botnet failed to bring down Darkode.com. [00:01:51] <Off-sho.re> You can try on DK enemy sites as well, that will give you my vouch as well [00:01:56] <[email protected]> ok [00:01:58] <[email protected]> ill try that [00:02:04] <[email protected]> let me try attack first [00:02:09] <Off-sho.re> Ok. [00:02:10] <[email protected]> and a few mins for bots to come back [00:02:14] <[email protected]> so im at full power [00:04:26] <[email protected]> whats the enemy site? [00:04:33] <Off-sho.re> there are 2, choose any [00:04:40] <Off-sho.re> krebsonsecurity.com, xylibox.com [00:04:47] <[email protected]> haha [00:04:49] <[email protected]> krebs [00:04:50] <[email protected]> [00:04:52] <[email protected]> fkin fagt [00:05:10] <Off-sho.re> Krebs is on Prolexic [00:05:15] <[email protected]> ok. [00:05:53] <[email protected]> darkode got some good ddos protection [00:08:26] <[email protected]> krebs down? [00:08:30] <Off-sho.re> Checking [00:10:13] <Off-sho.re> Krebs is down, well done this time “I confirm that Abscond can provide DDoS services,†Off-sho.re wrote to the darkode community. Asked about the incident in a private chat via Jabber, Off-sho.re said the attack on my site was just a “stress testâ€. “Regarding the site stress test – nothing personal,†Off-sho.re wrote. By the way, “stress testing†is the new euphemism for launching DDoS attacks. If you aren’t yet familiar with this term as it relates to online attacks, see DDoS Services Advertise Openly, Take PayPal, and Ragebooter: ‘Legit’ DDoS Service, or Fed Backdoor? Off-sho.re’s attitudes about ownership and what’s legal and acceptable online seems common in denizens of groups like Stophaus and other grey- and black-hat hacking collectives: that if something can be done then it is must be legal, allowable and otherwise okay. The governing mantra of these folks seems to be, “what’s-mine-is-mine and what’s-your-is-mine, too.†Source: http://krebsonsecurity.com/2013/05/conversations-with-a-bulletproof-hoster/
wow that was a great article!! thanks for sharing...haah thats hilarious, that guy tried saying he didnt do anything wrong!! what the fuck was he smoking!?!? isn't it amazing how some people spend so much energy into being a parasite to society and the same energy could be used towards running a legit and successful business! that guy knows a shit load about computers, he could help so many people solve problems, but instead he just waists the talent!
You only have the mentality of "If it's openly accessible, without authentication or need for intrusion/exploitation it's mine or it's ok/legal" until the feds come knocking.
Good Article, Very informative. Didn't know the "Anti vs Spammer" war was still going on. lol Guess things never change.
