Dutch police take down hornets' nest of DDoS botnets | Hacker News Reader

Dutch police take down hornets' nest of DDoS botnets

zdnet.com

136 pointsbad_packets61 comments

Reminds me of that fun time I had to explain to my boss that providing a 'russian contact' of his with a number of servers that would have some sort of 'remote kill switches to delete everything', probably wasn't a smart venture for our hosting business. At some point the cops will come knocking :)

Kill switch?

Maybe just LUKS with dropbear. Then:

    # cryptsetup luksRemoveKey /dev/mapper/foo

Check your local laws on cryptography and destruction of evidence before trying this. You may still be legally obliged to decrypt the material or go to jail.

True. Last I read, that ex cop is still locked up in Philadelphia, for contempt. They don't believe that he forgot his passphrase.

But parent was talking about hosting servers for a client. If the client executed that command, I don't see how the provider could be responsible.

The client could be. But they'd need to extradite him, from Russia, which might not be so easy, these days.

Sometimes going to jail for obstruction/destruction of evidence is a better option than the alternative...

Is it just me, or are the majority of raids of malware/botnet hosters typically in the EU? I mean just 6 days ago a raid was cunducted on a old NATO bunker in Germany. https://news.ycombinator.com/item?id=21090549

Is it that it's easier to become a hosting provider there with more protections (rights) and/or does America/NA lack the legal authority/process to conduct as many raids. Obviously eastern Eurupe/Russia is the wild west but I'm just suprised how much comes out of western Europe.

I'm curious why Eastern Europe/Russia are the wild west of douchey internet behavior. I mean there are seemingly endless bulletproof hosting providers. Who wakes up in the morning with the ultimate goal of being slimy on purpose like that? And why are there so many of them concentrated in Russia/Eastern Europe?

I'd assume that the ultimate goal that motivates most of them is to make money to improve other parts of their lives.

That often boils down to reaping the gains and externalizing the costs, which these hosting solutions seem to do fairly well for their owners (though perhaps not for the operators that get caught up in the eventual stings).

It's a competitive advantage vs legit hosting companies that can be leveraged for profit.

Simple as that. If it pays well someone will do it, slimy or not.

In talking with a guy that was trying to sell me data center space in a Ukranian data center, his pitch was that that as long as your activities targeted "western" countries you could host activities that more local data centers might disallow in their TOS.

He pointed out that they turned off the local DNS function when ever someone was in the building who wasn't a customer. I found that somewhat strange at first and then realized that it was essentially a "bell ringer" protocol for people who might want to wipe their servers in the event of people being there that didn't belong.

All in all, a very different way of operating.

As far as I know, it's at least partially because Russia doesn't extradite citizens and doesn't respond to other countries requesting they investigate.

>And why are there so many of them concentrated in Russia/Eastern Europe?

They aren’t, the vast majority of them are in the Netherlands.

Why NL? Cheap and just the traditional destination.

If you think about it from the host countries’ perspective, stealing money from foreigners or nefariously affecting them doesn’t harm the hosts much but can bring in a lot of money to their economies.

Bandwidth tends to be cheaper in EU. This has nothing to do with legal protections and everything to do with operating costs.

>Obviously eastern Eurupe/Russia is the wild west

What? Maybe if you’re talking about the users, but definitely not true for hosts. And I definitely wouldn’t call any of the eastern EU states the “wild west”.

"hosting all sorts of badies, from phishing pages to vulnerability scanners, and from crypto-mining operations to malware repositories."

Is crypto-mining now a bad thing or is this article leaving out some details that I'm missing?

People mine on systems that they do not own. Try leaving SSH open with weak credentials, or use any software with a recently disclosed RCE. It won't be long until somebody drops a Monero miner.

I mean, I've seen ad-block filters for scripts that try to crypto-mine via peoples browsers through ads on websites, so this is hardly surprising.

Perhaps a virus that uses the computers of unaware victims to crypto-mine. If you infect enough people, I guess you'd stand a chance. Not sure if targeting iot would be the best move for that, and the article seems to insinuate that this was mostly iot based malware, so I don't know.

It absolutely is a bad thing. Unfortunately it's not illegal.

Would you mind explaining that opinion?

Yeah, it wastes an amount of electricity of the scale of a smaller country.

Why didn't their upstream provider just blackhole their IP ranges?

Because law enforcement tends to reach for the law as their tool of choice. And since crimes were committed, their goals include not just "stop it from happening again" but also "prosecute", which needs evidence that cannot be obtained by a routing patch.

I was in elementary school with one of the suspects. He was always a troubled kid. Very sad how that turned out.

This is not bidirectional though,.. many troubled kids become great people.

Many "normal" kids become troubled adults, too.

I thought the initial `D` in DDOS sttod for "distributed". The article reports about "DDoS botnets operating on KV's infrastructure". Wouldn't "DDoS botnets operated from KV's infrastructure" be a better description?

The server that commands the zombies has to run from somewhere. So it's likely the host was used as the Command and Control hub.

I run a distributed system on AWS infrastructure. It's still distributed by all common usage of the word.

If your system goes down together with Amazon, it's not distributed, it just occupies several machines - a farm.

If your system goes down together with (the Earth|DNS Routing|ISPs), it's not distributed, it just occupies several machines - a farm.

Yes but a Farm Systems Engineer is a very different job than a Distributed Systems Engineer.

lol. I work down at the Cloud Farm.

I love how they don't tell the full name of Marco B. and Angelo K., but do tell that they companies were called "Bos IT Holding BV" and "Kreikamp IT Holding BV".

> Good morning, class. A certain... agitator--

> For privacy's sake, let's call her Lisa S.

> No, that's too obvious. Uh, let's say L. Simpson--

I remember articles in the style of: "Dennis B., son of Jan Bredewold". I believe it was the Telegraaf newspaper.

Possibly the newspaper didn't even notice at first, though the abbreviation of the name is usual (and mandatory) in Europe.

It is NOT mandatory. This is courtesy of the press but there are no laws or regulations.

It's mandatory if the newspaper want to continue being a respected newspaper. So for all intents and purposes it's mandatory.

I can second this. You don't read the full names of suspects (!) in a newspaper in Germany. I believe this is actually due to the law here (e.g. if they're innocent, their name is not ruined). That is somewhat relaxed, as long as they're not a public figure (e.g. no one would say "Angela M. is suspected to be a physicist" if it's about the German Chancellor) and as long as it's clear from the article that they're not (yet) convicted.

Can't speak for the rest of Europe of course.

Well I dunno about germany but over here in the netherlands there's no real law about not using full names. However if a paper does use someones full name and then that person gets their reputation ruined they will usually get a lower sentence if guilty. The idea being that getting your reputation ruined is a punishment in itself.

There is currently a court case against a drugs kingpin where one of the reputable newspapers does mention his full name, but each time followed by "-- the suspect's lawyer has indicated the suspect has no objection to his full name being used" (once per article of course)

"Proper" newspapers don't, but yellow press (e.g. BILD) which is consumed by a large chunk of the German population doesn't really care that much about preserving privacy or correctly reporting on conviction status.

Bos means a forest, likely nothing to do with his name

It’s a normal Dutch last name. Also, the naming of the holdings is the same. So they probably registered it at the same time. Anyway, information can always be checked at the chamber of commerce

It costs 2.50 to check the names of the owners of these companies at the chamber of commerce if that makes you doubt whether or not it's actually the name. This means that the owners were effectively outed by the publication anyway.

Especially with the UBO-register* it will be very easy to see which (natural) persons are tied to a company.

* Ultimate Beneficial Owner

Not really, the point of Dutch privacy law (and similar EU laws) in this context is not to deter a dedicated investigator, but to merely put enough of a hurdle in place that everyone reading the article won't see the names of suspects, and they won't show up in web searches etc.

Iirc it's not even an actual law, more of an agreement between all news organizations to not publish names like that. I seem to recall Geenstijl(Dutch "news" site) publishing full names and not getting in trouble over it.

Geenstijl doesn't have high journalist standards.

But they do have to follow the law, which is his point.

Sometimes there is no law necessary because an industry regulates themselves. Which the Dutch press historically has done so, in this example.

If the bar for being a "dedicated investigator" is copy-pasting a string and paying 2.50, I think we just have different views on this. Your views about the intent of specific laws aren't relevant, as there are AFAIK no laws about news publications that apply to what we are talking about.

The convention (I don't think it's actually a law) existed before web searches, but it's a nice side effect.

Not true.

Not mentioning lastnames is only a convention by journalists and the media. Publishing lastnames in the media is not a violation of the law. News website geenstijl.nl regularly publishes full names of suspects or criminals.

The convention already existed before the internet.

Update: I should have read more comments...

it costs google query.

just google the company names, atleast one yields name of 'ceo'...

If even Bulletproof hosts aren't safe why aren't malware authors using P2P infrastructure?

There is a difference between ignoring abuse reports and being immune to a raid by law enforcement. For these authors there is a trade-off between convenience, cost and security: using already available infrastructure is probably easier than to set up your own complicated hosting solution.

If any of them end up getting caught because of the information gathered by this raid they obviously misvalued one of these aspects in their trade-off analysis. Humans all make mistakes.

My guess would be that bulletproof hosts are safe enough for long enough that it's both money and time wise better/easier to deal with than p2p.

In order to keep a coherent network, most (all?) P2P infrastructure still requires some centralized resource to seed initial peers etc for a node. You would still have a single point of failure, if not for the network, at least for your control of it.

Reply on news.ycombinator.com