US credit card processing firm Authorize.Net is fighting a sustained distributed denial of service (DDoS) attack that has left it struggling to stay online.
In a statement to users posted yesterday, Authorize.Net said it "continues to experience intermittent distributed denial of service (DDoS) attacks. Our system engineers have successfully minimised the impact of each attack and have quickly restored services to affected merchants. Industry experts are onsite and working with Authorize.Net to expedite a resolution. Please be aware that the stability and reliability of the Authorize.Net platform remains our top priority; and we are doing everything we can to restore and maintain secure transaction processing despite these unforeseen attacks."
Glen Zimmerman, a spokesman for Authorize.Net's parent company, Lightbridge, told the Boston Globe that the attacks followed an extortion letter. Lightbridge said it was working with law enforcements officials to track down the attackers.
The Authorize.Net attack follows the usual modus operandi of the DDOS extortionists, who kick off with blackmail threats, before progressing to various attempts to take a site offline using progressively more sophisticated techniques. In recent months, DDoS extortion attacks have become endemic in the online gambling industry.
In July three men suspected of masterminding a cyber-extortion racket targeting online bookies were arrested in a joint operation between the UK's National Hi-Tech Crime Unit and its counterparts in the Russian Federation. The trio, who investigators reckon netted hundreds of thousands of pounds from the shakedowns, were picked up in a series of raids both in St Petersburg, and in the Saratov and Stavropol regions in southwest Russia.
Extortion is not the only motive behind DDoS attacks. In August six men were charged by the Californian courts over the first-ever case involving the use of sophisticated denial of service attacks directed against business rivals. Jay Echouafni, chief exec of Orbit Communication Corporation in Massachusetts, along with a business partner allegedly hired computer hackers in Arizona, Louisiana, Ohio, and the UK to launch computer attacks against Orbit online competitors. "These sustained attacks allegedly began in October 2003 and caused the victims to lose over $2m in revenue and costs associated with responding to the attacks," according to investigators. Echouafni, who faces a five-count federal indictment, is on the run.
The modus operandi of DDoS attacks, whatever their motives, remains broadly consistent. Worms such as MyDoom and Bagle (and Trojans such as Phatbot) surrender the control of infected PCs to hackers. These expanding networks of zombie PCs (dubbed 'botnets' by the computer underground) are most often used for spam distribution but they also serve as effective platforms for DDoS attacks. Attacks typically start with crude SYN Flood attacks. If that doesn't scare targets into paying then attackers resort to more sophisticated attacks (SYN Floods, UDP Floods, NB-Gets, ICMP Ping Floods and UDP Fragment Attacks). The effect on unprotected sites can be devastating. ®
Related stories
Feds bust DDoS 'Mafia'
Extradition ruled out in bookie extortion case
DDoSers attack DoubleClick
Online extortionists target Cheltenham
WorldPay recovers from massive attack
