DDOS For Hire

Speaker 1: So we probably owe you an explanation. But before we get to that, here's a story. It's 11/03/2016, and you're sitting in a cafe in Monrovia, capital of Liberia. It's around the last time an episode of Hack went up. If you're a Liberian and you're online, you're probably using one of two networks, Lone Star or Cellcom. Statistically, you're on Lone Star. So November 3 in Monrovia, when it's still warm but the winter rains have turned the market to mud, as you sit in a plastic chair at the edge of that restaurant, and you look down at your smartphone, and you got no signal what the heck is going on. And as you look up from your phone at the wash of umbrellas and taxis and corrugated tin roofs, you pretty quickly figure out that you're not the only one. It does not matter what network you are connected to, what device you are using, the Internet has gone off for everyone. All at once, the river of data has stopped flowing to an entire country. The whole thing, from Nguangama to harbor, is offline. And if we wanna understand why, we need to hop on a plane and take the breezy thirteen hour flight to China. Not because the culprit is Chinese or tied to the Chinese government or even living in China. Because on that rainy afternoon in November, moments before all of Liberia's internet flickered out of operation, all at once, thousands upon thousands of cheaply made security cameras, and wifi routers, and internet of things accessories all over China, turned in eerie unison towards the country of Liberia, and shut it all down. Like plugging in a million blenders and turning them on at the same time, and the breaker blows on the entire neighborhood.

Speaker 2: Except the neighborhood is the internet of a

Speaker 1: country with 5,000,000 people living in it. This is called a DDoS attack. And if you know what that is, you might rightly be wondering why two years after it happened, three years since we posted an episode, this is what we're talking about. You see, DDoS attacks are actually pretty common. We are talking about it because this attack, this blow to the national infrastructure of a country that brought down a core utility, was cheap. Not just because it came from within Liberia's own borders, not because last year they finally charged the guy who did it, but because an act of internationally coordinated corporate sabotage cost the person responsible less than the price of a used car. This is DDoS for Hire on this very special episode of Fact. It's been a while.

Speaker 3: Has been a while.

Speaker 1: It's been a little while. It's been a minute. So what happened? Where'd we go?

Speaker 3: We haven't gone anywhere, actually.

Speaker 1: We've been right here in the studio.

Speaker 3: Well, we've moved 60 linear feet from where the old recording studio used to be to the new recording studio.

Speaker 1: That took three years.

Speaker 3: It took us a long time.

Speaker 1: So we stopped making episodes because we were focusing on trying to get a show made.

Speaker 3: And we didn't get a show made.

Speaker 1: It didn't get made.

Speaker 3: But we did make a documentary.

Speaker 1: We did. And it has nothing

Speaker 3: to do with computer technology and post sec.

Speaker 1: No. But we got demotivated.

Speaker 3: And we got remotivated.

Speaker 1: And we went and did a bunch of other stuff.

Speaker 3: And I got I gotta just jump in and say that I I really appreciate all of the fan mail. It really makes us remember that people actually like this show, and it was a worthwhile, like, investment of our time.

Speaker 1: Yeah. Those messages, every single time we'd get one, it would be the first thing we would talk about when we came into work. We'd work together. That's true. And we didn't always reply, but we always kept thinking about Hacked. We never forgot you. So here's what we're gonna do. Moving forward, we're gonna be putting out one episode on the last Tuesday of every month. And we're also gonna be launching a Patreon. You can find us there at patreon.com/hackedpodcast. Our first goal on that Patreon is gonna be to double that production schedule to two episodes per month. We're doing all of that stuff, Patreon and ads, because the reality is that we have bills to pay and jobs that tend to pull us away from doing this show at the quality level that we wanna do it at, and we wanna do it right. So if you're still listening, all this time later, thank you, and we hope you'll stick around just a little bit longer.

Speaker 4: On with the episode. Tonight, the financial and banking industry is on high alert as a massive cyber attack remains underway.

Speaker 1: Cyber warfare, the most extensive attack on American banks ever.

Speaker 3: There is an elevated level of of threat. There's there's the threat is now high.

Speaker 4: Sources tell ABC News it's a denial of service attack where hackers from The Middle East have secretly commandeered thousands of computers worldwide. Those computers or zombies have overwhelmed bank websites with a barrage of electronic traffic.

Speaker 1: That was ABC Nightly News coverage of a 2012 DDoS attack. Scott, as a reminder, what is a DDoS attack?

Speaker 3: Well, a DDoS attack means distributed denial of service. So, really, what it means is you're denying something's service, which is typically access to the Internet. And the first d is for distributed, so it means that it's coming from many sources. The attack's coming from, coming from many sources. The attack's coming from lots of origin points.

Speaker 1: You said you're denying something access to the Internet. What exactly is it that you're blocking?

Speaker 3: Well, you're not really blocking anything as much as you are, like, knocking something off. So if you imagine you're playing video games, you know, you're playing a first person shooter against a friend of yours, and you wanna make them worse at the game if you can choke their Internet connection out or punt them straight off the server, they lose. So, like, that would be a primitive use case. You know? And way back in the day when, you know, the Internet was dial up or, you know, the bandwidth that each Internet connection had was so minor, you could very easily do this. Two or three Internet connections could knock one off. No problem.

Speaker 1: So that's the denial. What's the service?

Speaker 3: So the service is typically Internet access. In in in in regards of this show and this conversation, the the service would be typically Internet connectivity. So, like, imagine you're amazon.com. You know, the Internet's a very important thing to you. All of your traffic, consumers, and customers come through the Internet. So if we can take that away from you, we literally take millions of dollars probably per second out of your pocket.

Speaker 1: Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US, from household names like, well, hacked podcasts merch, to brands just getting started. You can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 5: Thinking about refreshing the carpet in your home? Now's the time to do it. For a limited time at the Home Depot, get 10% off installed carpet projects on trusted brands like Lifeproof, Lifeproof with PetProof Technology, Home Decorators Collection, and Traffic Master. Plus, with installation starting at just 49¢ per square foot, upgrading your space is more affordable than ever at The Home Depot. Offer valid, 06/11/2026 through 06/28/2026. Exclusions apply for licenses. See homedepot.com/ license numbers.

Speaker 1: That first deed distributed, take me a bit further down that whole rabbit hole.

Speaker 3: Essentially, the attack comes from multiple origin points. So instead of it just coming from me so imagine back in the day, you know, I'm annoyed with you, and I wanna take you off the Internet. You have one Internet connection. And say I have a huge Internet connection. I can generate enough traffic out of my Internet connection to actually push you off the Internet. Where today, the Internet connections are so vast and big, you know, you can have three, four, 600 megabyte per second or megabit per second fiber Internet in your house now. It's really hard to come up with enough data to knock that off. And that only gets bigger and bigger. So imagine, you know, as I said with Amazon, if you're trying to knock Amazon off the Internet, they have so much data, so much pipe to the Internet that to create so much traffic that it actually impacts their network equipment, impacts their servers, impacts, you know, any of the infrastructure that runs their site, you'd have to create terabytes per second.

Speaker 1: How do you go about creating that much data to take something offline?

Speaker 3: Yeah. So so kind of in the current form, you know, there's kind of been an an evolution to this. And what happened was is it started with malware. So you get a a little malware on someone's computer, and all of a sudden you have control over their computer. And what you can do is actually turn their computer into a device that you can use to then attack somebody. So if you imagine back in the day when you and I were playing a first person shooter on dial up, if I had two computers attacking you, you'd get knocked off the Internet. You know, even if they were also on dial up because they'd be able to send so much traffic, twice the amount that your Internet connectivity pipe has. To send so much traffic twice the amount that your Internet connectivity pipe had allowances for to you while you're trying to play this game. And it would essentially just suppress the amount of data that the game could use to the point that the game couldn't stay connected. So now to create enough data to really cause trouble, you need to have lots of computers. So then, you know, in the evolution, the botnets would take over, and it was hundreds or thousands or tens of thousands of computers that all had malware on them that they could just send an IP address out to them, and they would all, you know, attack in in at the same time. So it's actually gone a little bit further now where they've started writing botnets that take over Internet of Things devices. So imagine, like, the most obvious example and the best use of this is, surveillance cameras. These Wi Fi surveillance cameras, your nest kind of equivalents. And what they do is cameras generate so much information that if you can literally just retarget the pipe of that data to somewhere else. It just streams tons of data to a random IP address, which is enough to crash most IP addresses if you have enough of these Internet of Things devices.

Speaker 1: So I wanna take down a really, really big target. And I know that in order to do that, I need this really, really big army of essentially traffic, and I can get that traffic from individual users, I can get that traffic from an Internet of Things connected device that's, you know, gonna send all of this signal with, like, a smart fridge, I guess. I don't know what Correct. Data that produces, but it's gonna send all of this data. The larger point is, like, I wanna take down this big fish. How do I go about creating that giant army of, say, Internet of Things devices?

Speaker 3: Well, the the Internet of Things devices probably were all default configuration, you know, generic username and passwords. I think the largest IoT botnet was using the software called Mirai, and it literally just had a huge file, like, that it went through with usernames and password defaults for all these devices. So it would just find these devices on the Internet and

Speaker 1: then log in to them. That sounds like a surprisingly easy thing.

Speaker 3: Yeah. Not that hard.

Speaker 1: It wouldn't be that hard to get a giant rogue army of Internet of Things devices Right. To take down well, probably couldn't take down Amazon, but to take down a pretty big target.

Speaker 3: Yeah. Like, I think some notable targets. I know the US government's been attacked a bunch of times. They've hit lots of things. So, yeah, smart fridges against the world.

Speaker 1: Okay. So I have this I build this machine. I build this thing that lets me take down these targets. First off, why would a person want to do that?

Speaker 3: Well, there's I think so there's an interesting story here if if I'm correct in recalling this, but the guy who one of the developers who made Mirai, the Internet Internet of Things botnet software or malware Built it for fun and literally only used it to defer his calculus final in college So, like, he built this huge botnet of things out of probably sheer interest to know that he could do it. But then when he the only times he ever used it weren't really for the most malicious things. They were just kind of more for, you know, life things, like I'm not ready for my calc final, so I'm gonna

Speaker 1: Shut it down.

Speaker 3: Shut down the internet

Speaker 1: the university. So That's a pretty baller mind.

Speaker 3: I guess with all that power comes great responsibility.

Speaker 6: No one goes to Hank's for his spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 2: Where is Daredevil? A minor. Don't miss the return of Marvel Television's Daredevil Born Again.

Speaker 3: So what's next?

Speaker 4: I'll be liberated. We're

Speaker 1: gonna take this city back.

Speaker 4: Over Medicaid.

Speaker 2: In an all new season now streaming only on Disney plus.

Speaker 7: They're hunting us. It's time we started hunting them.

Speaker 1: I can work with that.

Speaker 2: This should be tons of fun. Marvel television's Dare Devil Born Again, now streaming only on Disney plus.

Speaker 1: Okay. So aside from like the dude who invented it, using it to get out of a calc final. Mhmm. Why else would someone try and knock someone off the Internet?

Speaker 3: It's a great question. You know, denial of service attacks, especially DDoS attacks, are often used as cover when you're actually doing other hacks. So that's one reason. Because it creates such a headache for the IT department that they stop looking at all these things, and they're focused on this one huge problem. Two is just strictly to be a nuisance. Like, I'm opposed to, you know, this law. I'm gonna take down this government website. Three, you know, maybe it's, maybe you're an activist or a quote unquote hacktivist, and you wanna take down, you know, some pipeline organization. If you're a climate change, you know, kind of warrior, you know, there's tons of reasons why you do it. But I think, you know, given the subject of the show is that you just do it for money.

Speaker 1: Is that a new thing?

Speaker 3: New ish. I don't think there's always been an undercurrent economy online for hacking tools and hacking stuff and credit card lists and things like that, but I I can't remember the first time I'd heard about DDoS attacks for hire. Probably was twenty thirteen, fourteen. I think it was some Israeli guys. You know, I'd have to go back in my history book. But but yeah. So how does

Speaker 1: the money come into it?

Speaker 3: So this is a service that's been provided. Like, people aren't DDoS ing for money. They are DDoS ing for money, but that's not a reason why you do a DDoS attack. The reason why you do the DDoS attack is because you want something to be denied service, like a country, and then you pay somebody to do that. So the guys who own the botnets and run the booters, we're doing that for money, but the people who are paying them probably were definitely not doing them for money. They were doing them to be nuisances, for malfeasance, to cover things for economic reasons, etcetera, etcetera.

Speaker 2: Yeah.

Speaker 1: So it's a service like anything else. If you're in like, the story at the top of the show,

Speaker 2: if you wanna do a little bit

Speaker 1: of corporate sabotage, this is a really, really good way of doing it, and it only takes one person. It's like a way smaller conspiracy than doing physical damage. You just hire one hacker, and they can do all this damage from sitting behind a laptop.

Speaker 3: Yeah. Right. Like, most of these things are controlled from a master console or a master control unit, and they communicate out through this distributed network, and they pass instructions

Speaker 1: to these bots that

Speaker 3: then execute those instructions at the same time. One of these. And by that, I mean, it's probably quite easy. And so say you're a big fish. Yeah. And I mean, it's probably quite easy.

Speaker 1: And so say you're a big fish. You're like a target, and you go, on a long enough timeline, someone's gonna send this army of smart refrigerators after me. What can you do to protect yourself?

Speaker 3: Yeah. So content distribution networks, there's anti DDoS, services now. CloudFlare, I think, is a big one. You essentially pay people to redirect your traffic into you. So they put up a essentially a huge net, and you have to get through the net to get to the real servers and the real infrastructure. But the net is specifically built to tune out and protect you from these kind of attacks.

Speaker 1: Mhmm.

Speaker 3: So I think that's kind of the de facto standard at this

Speaker 1: point. So how does this escalate? We had this swarm, and now we have this net to catch it. Where does it go from here?

Speaker 3: I think it's just gonna be an escalation in data traffic. So the as the Internet pipes get bigger, I don't think denial of service attacks and and, therefore, DDoS attacks are going anywhere. I think that they're just gonna have to get smarter in how they prepare, create, launch, and execute them. Because I think that they present a lot of value to someone who wants one, you know, whether it's just to be a nuisance or whether it's to have economic gain from it. You know, we're starting to see that. Like, I think recently, mid last year, there was kind of a new style of attack scene with, like, a a standard service that runs on Unix computers, called Memcache. You literally drop an object into a server, no passwords or authentication. This is kind of a service. You connect to it. You give it, you know, an object of some form of file, and then you assign it a key value. And then another computer can connect to it and say, hey, I want that key value. Send it to me. And it'll send the file to that computer. So So these were kind of built, to help application servers and, you know, kind of the whole web two point o world build. But the problem is is some of these servers that are all supposed to be behind firewalls aren't behind firewalls. So when you get 50,000 servers sending 10 megabyte files 10,000 times a second at a web address, all of a sudden you're pushing you you know, instead of pushing a couple 100 gigabytes a second at a at an IP address, imagine the tax and load on the computer infrastructure and the network infrastructure for that. Now all of a sudden you're sending terabyte, a terabyte and a half. You know, so you're sending so much data. So I think that's gonna be the natural escalation. It's just more throughput, faster, harder.

Speaker 1: It's funny. The entire time we've been talking about this, I'm thinking of the the recipients of these attacks. I'm just picturing a website. We kind of just set Amazon off the top, which is funny because it probably would be the last, it would be probably the hardest thing to take down with one of these things.

Speaker 3: Oh Google's probably harder, but yeah.

Speaker 1: Yeah. Bezos is scrappy. But I'm thinking websites. Could this go further? Could this be used to take down I mean, we talked about taking down a utility in the form of the Internet. Like, what theoretically could this look like with a sufficiently ambitious DDoS attack?

Speaker 3: Oh, I think you nailed it with the intro is, you know, if you had an like, if you had 50, a 100,000 servers on huge Internet connections capable of sending constant multi threaded data streams, like, just so much data, you gotta think and, like, remember that, like, the Internet is just a composition of cables and switches and routers. And if you take down the right one, everything after it goes down. So when you take down the switch or the router that's at the doorstep of China, you could take down China. Granted, China is gonna have hundreds of different endpoints, but, like, you know, imagine, like, the Cook Islands. Like, let's go somewhere super remote. There's probably not that much there's probably a fiber line in and out of that country. And if you take it down, if you take the switch that that fiber line connects to you down, overheat it, burn it, just crash it, the whole country gets turned off. Like, that's not an impossible thing.

Speaker 1: Which is what that guy did. Correct. I think the line was for less than the price of a used car. Now he did it kind of by accident. Do you think, and this is just pure speculation, that there's probably one country somewhere that's think sitting there with a button that if they pressed it, they could turn off another country intentionally? Oh, a 100%. Yeah. Yeah. 100%.

Speaker 3: Cool.

Speaker 8: Why is every drop of Two Hearted IPA put through a vigorous 100 quality control process in order to make its way out of the brewery? Because, fact, a vigorous 99 quality control process doesn't sound nearly as impressive. Two hearted IPA, never half hearted, two hearted. Bell's Brewery, Comstock, Michigan. Please drink responsibly.

Speaker 9: The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. At blinds.com, we've spent thirty years making it surprisingly simple to get exactly what your home needs. We've covered over 25,000,000 windows and have 50,005 star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure. Right now, get up to 45% off-site wide, plus get a free professional measure at blinds.com. Rules and restrictions apply.

Speaker 7: Summer weekends are all about family, sunshine, and making memories together. Before everyone arrives, I stop by my local Total Wine and More to pick up a great bottle, maybe a favorite we already love, or something new to enjoy with dinner on the patio. With so many bottles to choose from, it's easy to discover something amazing. And with the lowest prices, it's easy to grab an extra bottle for the table. Not sure what to pick? Their friendly guides are always there to help. Find what you love and love what you find only at Total Wine and more. Curbside pickup and delivery available in most areas. Visit total wine dot com to learn more. Spirits not sold in Virginia and North Carolina. Drink responsibly. Must be 21.