Colloquium at the Faculty of Technology, Policy and Management, TU Delft, the Netherlands. To researchers from Prof. Michel van Eeten's group.

1. DDoS for Hire
Websites
Lessons learned in four years
of investigation
Jair Santanna
jairsantanna.com
j.j.santanna@utwente.nl
and beyond
06-April-2017

2. Do I need to say what a Booter is?

3. 3

5. Understand the BOOTER phenomenon
in a systematic way
to identify their VULNERABILITIES and
collect EVIDENCES for mitigation and prosecution.
My Goal:

6. Booters Ecosystem

7. International Conference on Autonomous Infrastructure, Management and Security (AIMS), 2014.

9. Booters Ecosystem
What Else?

10. Journal of Information, Communication & Ethics in Society (JICES), 15 (1), 2017
Booters: Can Anything Justify Distributed Denial-of-Service (DDoS) Attacks for Hire?

11. Booters Ecosystem
What Else?

12. IFIP/IEEE International Symposium on Integrated Network Management (IM), 2015.

13. # Booter URL
Offer
[Gbps]
1 http://booter.tw ?
2
http://restricted-
stresser.info
5
3
http://anonymous-
stresser.net
5
4 http://destressbooter.com 25
5 http://flashstresser.net ?
6 http://dejabooter.com 10
7 http://rebel-security.com Up to 3
8 http://grimboot.com 6
9 http://quantumbooter.net 1,5
10 http://olympusstresser.org Up to 3
11 http://ebooter.5gbfree.com ?
12 http://vdoss.net ?
13 http://respawn.ca 8
14 http://onionstresser.com ?
Price
[€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35
Unique
IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS

14. Booters Ecosystem
Direct
Indirect
Reflected
What Else?

15. IFIP/IEEE International Symposium on Integrated Network Management (IM), 2015.

16. Timeline
Domain Registration
First attack
Passive DNS
15 Databases

17. Booters Ecosystem
Direct
Indirect
Reflected
What Else?

18. Brazilian Symposium on Computer Networks and Distributed Systems (SBRC), 2015.

19. International Conference on Network and Service Management (CNSM)., 2016.

20. Scrapper ClassifierCrawler
Website classification
Website filtering
Blacklist generation

21. • Fractional distance
• Cosine distance
• k-Nearest Neighbors (k-NN)
• Naive Bayes
• Machine Learn
• Euclidean distance
• Squared Euclidean distance
• Manhattan distance
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
92,00% 3,00% 4,90%
92,70% 2,40% 4,90%
91,40% 2,40% 6,20%
91,40% 4,90% 3,70%
90,80% 3,00% 6,20%
CAR FPer FNer
Objective function:
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
Accuracy
Threshold
1
0.8
0.6
0.4
0.2
0.2 0.4 0.6 0.8 1
0
0
93,30% 1,70% 4,90%
94,00% 2,20% 3,90%
93,10% 1,90% 4,90%
92,30% 2,20% 5,60%
94,40% 2,20% 3,40%

22. http://booterblacklist.com

23. Direct
Indirect
Reflected
Booters Ecosystem
What Else?

24. IEEE Communication Magazine (ComMag) [to appear], July , 2017.

26. TLDs Operators, Domain Registrars, Web Hosting Companies, and CBSPs
Payment systems
Web searching companies
DNS resolver operators
registrars (Whois)

28. “it is really tricky when
private organisations
act as law enforcement“
https://www.youtube.com/watch?v=wW5vJyI_HcU

29. Direct
Indirect
Reflected
Registrar
DNS Hosting
What Else?

32. Please JUDGE my presentation at
http://jairsantanna.com/judgemypresentation