Targets of cybercrime, many of whom have had to spend hundreds of thousands if not millions of dollars to recover from data breaches and other cyber-attacks have long known that the consequences of cybercrime are just as stark as any other type of crime. And with some of the latest crackdowns on major botnets, perpetrators are learning it too.
Botnet blues
Many of the biggest and most devastating cyber-attacks come in the form of distributed denial of service attacks and accompanying data breaches. Distributed denial of service attacks, or DDoS attacks, are made possible by botnets.
As DDoS protection services provider Imperva Incapsula explains, a botnet is a network of internet connected devices, like computers, tablets and smartphones, that have been hijacked with malware which allows it to be controlled by the botnet owner from a remote location, generally without the device owner ever even knowing it.
Having control of or use of a botnet gives an attacker a tremendous amount of computing resources they can use for malicious purposes. In the case of a distributed denial of service attack, these resources are used to either flood a target website with a huge amount of malicious traffic, or overwhelm its network infrastructure. Whatever the strategy, the goal is to deny the services of the website to its users by either slowing down the website to the point that it is unusable, or taking it entirely offline.
Real-life consequences
Getting taken down by a DDoS attack does a real number on a website or business’s reputation, often causing a loss of trust or loyalty amongst users and customers and potentially leading to a loss of revenue. Distributed denial of service attacks have also been found to cause damage to hardware and software. And if that all isn’t enough, these attacks are commonly used as smoke screens for intrusions or data breaches that result in the theft of users’ personal information, financial information or intellectual property.
It has also been found that for a sizable organization, dealing with an unmitigated DDoS attack can cost an average of $40,000 per hour.
Turning up the heat on botnet bosses
For years it’s been highly unfair that untold thousands of organizations and individuals have been dealing with the consequences of botnet activity and DDoS attacks while the people behind this criminal activity have been seemingly getting away with it. But thanks to major advances in detection and cooperation between nations and law enforcement agencies, that’s all starting to change.
In October of 2015, the United States and United Kingdom worked together to bring charges against the Moldovan administrator of the Bugat/Dridex botnet, a botnet that had been behind the theft of banking information and other highly sensitive credentials. The Bugat botnet, which has been disabled due to the actions of law enforcement, had reportedly been linked to the theft of $10 million from 2011 to 2015. The administrator received a nine-count indictment.
Similarly, the FBI worked with Microsoft to put an end to Dorkbot, a family of malware worms largely spread through Facebook. It was shuttered in December of 2015. And following the arrest of more than 70 people in connection to a raid on cybercriminal forum Darkode last year, one hacker was recently sentenced to jail time for running a botnet and stealing Bitcoin.
Not all good news
Cybercriminals, unfortunately, are nothing if not resilient. After all, the Bugat botnet mentioned above was created to fill the void left when the Gameover ZeuS botnet was the subject of an international takedown in 2014. And while the Darkode forum has been shuttered, its successor is up and running.
Cybercrime and the efforts to stop it are constantly advancing right alongside each other. And while every indication is that cybercriminals are going to be facing more and more real life justice (not to mention prison sentences), botnets, distributed denial of service attacks and other malicious online activities aren’t going away anytime soon.
So let the FBI, the Department of Justice, Europol and other law enforcement agencies worry about taking down the big botnets and their administrators. For your part, invest in professional DDoS protection and other online security to keep from becoming a victim. Save the real life consequences of cybercrime for the cybercriminals.
