To the Vrouwen met Academische Opleiding (VVAO) Delden, The Netherlands

1. Civil Disobedience,
DDoS attacks, Booters,
and Beyond!
Jair Santanna
jairsantanna.com
6/10/2016
To the Vrouwen met Academische Opleiding

2. Who am I?
José Jair Cardoso de Santanna

3. Belém, Pará, Brazil

5. Tacacá Pato no tucupí Maniçoba

6. Castanha do Pará
"Brazilian nuts"

7. Açaí

9. Círio de Nossa Senhora de Nazaré

13. Civil Disobedience

15. 1969

16. Soul Sacrifice [Santana]
e Star-Spangled Banner [Jimi Hendrix]

18. 1979

19. Another brick in the wall [Pink Floyd]

21. 2016

22. 1969
1979
2016

25. Distributed Denial of
Service Attack
DDoS Attack

29. No more opponents!!
No more ONLINE exams!!
Economic Impact!!

30. Booters' Ecosystem

31. Booters' Ecosystem
Customers’ Perspective

32. Booters' Ecosystem
Owners’ Perspective

33. Booters' Ecosystem
Targets’ Perspective

35. # Booter URL
Offer
[Gbps]
1 http://booter.tw ?
2 http://restricted-stresser.info 5
3 http://anonymous-stresser.net 5
4 http://destressbooter.com 25
5 http://flashstresser.net ?
6 http://dejabooter.com 10
7 http://rebel-security.com Up to 3
8 http://grimboot.com 6
9 http://quantumbooter.net 1,5
10 http://olympusstresser.org Up to 3
11 http://ebooter.5gbfree.com ?
12 http://vdoss.net ?
13 http://respawn.ca 8
14 http://onionstresser.com ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS
Attacks

36. Reflection Attack
&
How the Internet works?

37. It is not my fault!

38. Reflection Attack

39. Guilty!

40. 0
1.5
3
4.5
6
7.5
0 20 40 60 80 100
Trafficrate[Gbps]
Time [s]
CharGen-based attacks DNS-based attacks
0
0.4
0.8
1.2
1.6
2
0 20 40 60 80 100
Trafficrate[Gbps]
Time [s]
NTP
CharGen
SSDP
Quake P.
Steam P.
QOTD
BitTorrent
Kad
NetBIOS
SNMP
DNS
556.9x
358.8x
108x

41. 29x
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS

42. 9427x
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS

44. CN
US
KR
RU
IN
TR
UA
FR
TH
DE
Top 10
1755
630
275
192
105
81
76
56
55
530 1755
US
JP
DE
RU
CN
NL
GB
CA
FR
TW
5822
1986
1909
1871
825
731
716
603
561
459
Top 10
0 5822
0
20
40
60
80
100
B1 B2 B3 B4 B5 B6 B7 B8 B9
Percentage
Booter
Europe
North-America
Asia
Others
CharGen-based attacks DNS-based attacks

48. Timeline
Domain Registration
First attack
Passive DNS
15 Databases
Clients

50. 23 Booters

52. “it is really tricky when private
organisations act as law
enforcement“
https://www.youtube.com/watch?v=wW5vJyI_HcU

54. booterblacklist.com

55. https://github.com/jjsantanna/booterblacklist_use_cases/blob/master/
booterblacklist_use_cases.ipynb

57. Civil Disobedience,
DDoS attacks, Booters,
and Beyond!
Jair Santanna
jairsantanna.com
6/10/2016
To the Vrouwen met Academische Opleiding

58. https://www.youtube.com/watch?v=VUSoC5BVZCU
jairsantanna.com

59. http://bit.ly/judge_jairs_presentation