8.1 KiB
translating by kenxx
Hire a DDoS service to take down your enemies
雇个 DDoS 服务干掉你的对手
With the rampant availability of IoT devices, cybercriminals offer denial of service attacks to take advantage of password problems.
随着物联网设备的普及，网络犯罪分子提供拒绝服务攻击来占密码问题的便宜。
With the onrush of connected internet of things (IoT) devices, distributed denial-of-service attacks are becoming a dangerous trend. Similar to what happened to DNS service provider Dyn last fall, anyone and everyone is in the crosshairs. The idea of using unprotected IoT devices as a way to bombard networks is gaining momentum. 随物联网设备飞速发展，分布式拒绝服务攻击也变得越来越具有危险性了。就如 DNS 服务商 Dyn 上年秋季之遭遇 一样，黑客似乎瞄上了每个人，使用未受保护的物联网设备来轰炸网络正迎面而来。
The advent of DDoS-for-hire services means that even the least tech-savvy individual can exact revenge on some website. Step on up to the counter and purchase a stresser that can systemically take down a company. 可雇用的分布式拒绝服务攻击的出现意味着每个会点技术的人都能精准报复一些网站。加大攻击能力甚至可以从系统级别的让一个公司完蛋。
According to Neustar, almost three quarters of all global brands, organizations and companies have been victims of a DDoS attack. And more than 3,700 DDoS attacks occur each day.
根据 Neustar 的报告，全球四分之三的品牌、组织和公司都是 DDos 攻击的受害者。每天 DDoS 攻击发生次数 不少于 3700 次。
■ RELATED: How can you detect a fake ransom letter?
■ 相关阅读：如何判断假绑架信？
Chase Cunningham, director of cyber operations at A10 Networks, said to find IoT-enabled devices, all you have to do is go on an underground site and ask around for the Mirai scanner code. Once you have that you can scan for anything talking to the internet that can be used for that type of attack.
睿科网络公司（A10 Networks）网络运营总监 Chase Cunningham 说：“想要找个可用的物联网设备，你只需要在地下网站找一个 Mirai 扫描器，一旦你得到了这款扫描器，你将能够利用在线的每一台设备来进行攻击”。
“Or you can go to a site like Shodan and craft a couple of simple queries to look for device specific requests. Once you get that information you just go to your DDoS for hire tool and change the configuration to point at the right target and use the right type of traffic emulator and bingo, nuke whatever you like,” he said.
或者你可以去一些类似 Shodan 的网站然后简单的搜一下设备特殊请求，
“Basically everything is for sale," he added. "You can buy a 'stresser', which is just a simple botnet type offering that will allow anyone who knows how to click the start button access to a functional DDoS botnet.”
Once you get that information you just go to your DDoS for hire tool and change the configuration to point at the right target and use the right type of traffic emulator and bingo, nuke whatever you like.
Chase Cunningham, A10 director of cyber operations
Cybersecurity vendor Imperva says for just a few dozen dollars, users can quickly get an attack up and running. The company writes on its website that these kits contain the bot payload and the CnC (command and control) files. Using these, aspiring bot masters (a.k.a. herders) can start distributing malware, infecting devices through a use of spam email, vulnerability scanners, brute force attacks and more.
Most stressers and booters have embraced a commonplace SaaS (software as a service) business model, based on subscriptions. As the Incapsula Q2 2015 DDoS report has shown, the average one hour/month DDoS package will cost $38 (with $19.99 at the lower end of the scale).
“Stresser and booter services are just a byproduct of a new reality, where services that can bring down businesses and organizations are allowed to operate in a dubious grey area,” Imperva wrote.
While cost varies, attacks can run businesses anywhere from $14,000 to $2.35 million per incident. And once a business is attacked, there’s an 82 percent chance they’ll be attacked again.
DDoS of Things (DoT) use IoT devices to build botnets that create large DDoS attacks. The DoT attacks have leveraged hundreds of thousands of IoT devices to attack anything from large service providers to enterprises.
“Most of the reputable DDoS sellers have changeable configurations for their tool sets so you can easily set the type of attack you want to take place. I haven’t seen many yet that specifically include the option to ‘purchase’ an IoT-specific traffic emulator but I’m sure it’s coming. If it were me running the service I would definitely have that as an option,” Cunningham said.
According to an IDG News Service story, building a DDoS-for-service can also be easy. Often the hackers will rent six to 12 servers, and use them to push out internet traffic to whatever target. In late October, HackForums.net shut down its "Server Stress Testing" section, amid concerns that hackers were peddling DDoS-for-hire services through the site for as little as $10 a month.
Also in December, law enforcement agencies in the U.S. and Europe arrested 34 suspects involved in DDoS-for-hire services.
If it is so easy to do so, why don’t these attacks happen more often?
Cunningham said that these attacks do happen all the time, in fact they happen every second of the day. “You just don’t hear about it because a lot of these are more nuisance attacks than big time bring down the house DDoS type events,” he said.
Also a lot of the attack platforms being sold only take systems down for an hour or a bit longer. Usually an hour-long attack on a site will cost anywhere from $15 to $50. It depends, though, sometimes for better attack platforms it can hundreds of dollars an hour, he said.
The solution to cutting down on these attacks involves users resetting factory preset passwords on anything connected to the internet. Change the default password settings and disable things that you really don’t need.
作者：Ryan Francis 译者：kenxx 校对：校对者ID