DDoS-for-hire service is legal and even lets FBI peek in, says a guy with an attorney

22 May

Paying a site to DDoS other sites is perfectly legal, the proprietor behind one such outfit told security journalist Brian Krebs.

Besides which, he says, his service, called RageBooter, even features a nifty backdoor that lets the FBI monitor customer activity.

RageBooter site

The conversation took place recently between Krebs and Justin Poland, the US man from Memphis, Tennessee whom Krebs sniffed out via WHOIS lookup and Facebook.

According to Poland, DDoSing the beejezus out of sites is perfectly legal/justifiable/morally kosher because:

  1. It’s “a public service on a public connection to other public servers”;
  2. His service merely takes advantage of default settings of some DNS servers; and
  3. Spoofing a sender address is legal and OK because if a root user of the server doesn’t like it they just have to disable recursive DNS.

Regarding item No. 3, recursion is the act of querying additional DNS servers to resolve queries a DNS server can’t resolve from its own database.

Microsoft, for its part, confirms that yes, attackers can use recursion to deny the DNS Server service and has this TechNet article on how to disable it.

In short, Poland told Krebs, RageBooter is just a “legal testing service”:

How individuals use it is at there [sic] own risk and responsibilitys [sic]. I do not advertise this service anywhere nor do I entice or encourage illegal usage of the product.

How the user uses it is at their own risk. I provide logs to any legal law enforcement and keep logs for up to 7 days.

About that ready accommodation of “any legal law enforcement”: when Krebs asked Poland whether police or other authorities had ever asked for information about his customers, Poland told him that well, actually, he works for the FBI.

From Krebs’ account of the Facebook chat he had with Poland:

I also work for the FBI on Tuesdays at 1pm in memphis, tn. They allow me to continue this business and have full access.

The FBI also use the site so that they can moniter [sic] the activitys [sic] of online users.. They even added a nice IP logger that logs the users IP when they login.

When Krebs called the number Poland gave him to check with the FBI, the man on the other end got peeved and referred him to the FBI’s press office, which in turn wouldn’t confirm or deny any of this.

Poland, for his part, stopped talking with Krebs, saying he’d been instructed to block him. His Facebook page disappeared within moments of Krebs receiving this message:

I have been asked to block you. Have a nice day.

DDoS image, courtesy of ShutterstockRegarding the legality of hiring a DDoS service, Krebs checked with Mark Rasch, a security expert and former attorney for the US Department of Justice.

Rasch told Krebs that while companies regularly hire network stress-testing services, it’s generally part of a more inclusive penetration testing engagement in which those conducting the tests insist on first getting a “get out of jail free card” – e.g., a notarized letter from the customer stating that the testing firm was hired to break into and probe the security and stability of a targeted site.

Krebs quotes Rasch:

This is also why locksmiths generally force you to show ID that proves your address before they’ll break into a house for you...

The standard in the security industry is not only to require proof that you own the sites that are going to be shut down or attacked, but also an indemnification provision.

I checked with Sophos’ IT security manager, Ross McKerchar, who regularly fends off DDoS attacks, to see what he thought of DDoS legality. Unsurprisingly, he says DDoS should “clearly” be illegal, and the fact that it’s not illegal everywhere is just evidence of the law lagging:

To use an analogy, even if I have a very poor lock and no alarm system it’s still illegal to break in to my property.

The argument regarding reflected DNS attacks is “even weaker”, McKerchar says:

You are at risk to these attacks regardless of your own DNS servers: the problem is that any misconfigured DNS server can be used to attack someone else.

To say that it’s legit to attack company A, because unrelated companies B, C & D have poor security doesn’t really hold water.

None of this is meant to excuse poor security, of course.

To extend the lock analogy even further, McKerchar says:

If a bank had a rubbish lock and no alarm system, I think most people would agree that they bore some responsibility for a break-in. Larger companies should recognize and plan for the risk of DDoS attacks, given they are so easy to execute.

I think it would be fair to say that any company that doesn’t, and depends on their internet-facing systems for revenue is running a major risk, bordering on negligence.

Krebs’ sleuthing on this issue is far more extensive than this write-up. It’s definitely worth a read to check his original article, which provides more on the booter market, the nature of the backdoor which the FBI may or may not have into RageBooter, and how booters’ biggest threats are attacks from each other.

PayPal logoOne interesting aspect of these services is how they use PayPal to fund their activities.

When Krebs checked with PayPal about this, the company told him that the use of its service for DDoS-for-hire sites would violate its terms of use agreement.

From its statement to Krebs:

While we cannot share specifics on our customers’ accounts due to our privacy policy, we can confirm that we will review suspicious accounts for malicious activity and work with law enforcement to ensure cyber criminals are reported properly.

We take security very seriously at PayPal and we do not condone the use of our site in the sale or dissemination of tools, which have the sole purpose to attack customers and illegally take down web sites.

PayPal will work with law enforcement to take down something that the FBI might well have its hand in? Up to the elbow and beyond?

Sure. OK. Right.

Eyebrow arched.


Posted by on May 22, 2013 in Uncategorized


7 responses to “DDoS-for-hire service is legal and even lets FBI peek in, says a guy with an attorney

  1. surgery to stop snoring

    May 26, 2013 at 2:38 am

    What i don’t realize is in reality how you’re
    no longer actually much more neatly-preferred than you may
    be right now. You are so intelligent. You understand therefore significantly relating to
    this matter, produced me in my view imagine it from numerous various angles.
    Its like women and men aren’t fascinated unless it’s one thing to accomplish with Girl gaga!
    Your individual stuffs excellent. At all times care for it up!

  2. Ulysses

    May 31, 2013 at 8:24 am

    Hi there would you mind sharing which blog platform you’re using? I’m planning to start my own blog
    in the near future but I’m having a tough time making a decision between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design seems different then most blogs and I’m looking for something completely
    unique. P.S Apologies for getting off-topic but I
    had to ask!

  3. baseball coaching

    May 31, 2013 at 9:39 pm

    Wow, incredible blog structure! How lengthy have you been running a blog for?
    you made running a blog look easy. The entire glance
    of your website is wonderful, as neatly as the content material!

  4. women cowboy boots

    June 2, 2013 at 9:22 pm

    You really make it seem so easy with your presentation but I find
    this topic to be actually something that I think I would never understand.

    It seems too complex and extremely broad for me.
    I’m looking forward for your next post, I’ll try to get the hang of

  5. Kian

    June 3, 2013 at 8:08 am

    I got this web site from my friend who shared with me on
    the topic of this site and at the moment this time I
    am visiting this site and reading very informative articles at this

  6. Arlen

    June 4, 2013 at 7:58 am

    Normally I don’t learn article on blogs, however I would like to say that this write-up very forced me to try and do so! Your writing style has been amazed me. Thanks, very great article.

  7. used storage containers for sale

    June 5, 2013 at 9:42 pm

    I really like your blog.. very nice colors & theme.
    Did you make this website yourself or did you hire someone to do
    it for you? Plz reply as I’m looking to create my own blog and would like to know where u got this from. thanks a lot


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: