Even with how much attention DDoS attacks have garnered in the last few years for the immense amount of devastation they cause, the average observer would be forgiven for not quite grasping the seriousness of the situation.
While high-profile victims like the Sony PlayStation Network, the Xbox Live network, Twitter, Reddit and online gaming platforms including Steam, Blizzard and League of Legends are undoubtedly huge and their outages caused major disruptions for millions of users around the world, these targets lack a certain gravitas. Putting aside the economic impact of these attacks, it was easy enough for many to shrug and figure the script kiddies were welcome to duke it out over their precious video games and social media using DDoS.
The warnings have abounded for a while, however: websites big and small, professional and hobbyist, serious and not are all potential targets, and one of the current trends in DDoSing is proof of that, with major global institutions and political power players buckling under these attacks. The script kiddies have made room, and big-time attackers are taking aim.
Activist roots
When DDoS attacks first burst onto the scene they weren’t known as a revenge tool for gamers, or a means of rabble-rousing online. They were a whole lot more serious than that. In fact, one of the first distributed denial of service or DDoS attacks to gain widespread attention took place back in 1995 when an Italian activist group took down the website of the government of France in protest of France’s nuclear policy.
From there, a group called the Electronic Disturbance Theatre grabbed hold of the idea of DDoS as protest and built a DDoS tool that allowed anyone with a computer and internet connection to join in on these so-called virtual sit-ins, targeting the White House website as well as the sites of a number of American politicians.
As the internet grew almost exponentially, so too did the potential effects of cyberattacks that took down websites and left users fuming.
Driven by dollars
A certain segment of cyberattackers came to realize that with the popularity of social media, website users that were angry about an outage now had a soapbox on which to stand. DDoS attacks on online gaming platforms and the like may have started out simply being for the ‘lulz,’ with an end result of thousands of angry users airing their grievances on Twitter, but as the groups behind the attacks gained internet infamy, they saw the opportunity to cash in.
Distributed denial of service attacks used to exact revenge on companies or to carve out an advantage against competing websites began to emerge, putting money in the pockets of those who could launch them. Groups like the Lizard Squad were thinking bigger, however. Using the publicity gained from the social media outcry caused by DDoS outages, they and other groups launched DDoS for hire services, making money from the average person who wants to launch an attack but doesn’t have the know-how to do it on their own.
Average people using DDoS for hire services, in turn, got the bright idea to start targeting random small websites and businesses with DDoS ransom notes, demanding payment in return for not launching attacks. Between the ransom notes and for-hire services those pervasive script kiddie attacks are, in fact, a cottage industry, one that put DDoS attacks back in the spotlight.
Coming full circle
Thanks to enterprising cyberattackers, DDoS attacks are now two main things: highly disruptive, and capable of gaining a lot of attention. For those looking to get serious with these attacks once again, financial incentive is irrelevant. The disruption and attention is more than enough.
To that end, government websites, politicians and other global organizations have found themselves staring down the barrel of powerful distributed denial of service attacks, some launched by hacktivist groups, and some reportedly state-sponsored, with Russia, China and North Korea coming up frequently in allegations. In just the last few years, a citizen-led push for democracy in Hong Kong had its website repeatedly targeted, the Brexit voter registration website was hit and left tens of thousands of people unable to register as voters, and both Donald Trump and Hillary Clinton saw their presidential candidacy websites knocked offline as a result of DDoS attacks. These are just a few notable political incidents among hundreds.
One of the latest seemingly politically-motivated targets is the Al Jazeera Media Network. Based in Qatar, Al Jazeera began suffering both hackings and DDoS attacks in early June as other Persian Gulf nations including Saudi Arabia, the United Arab Emirates and Egypt severed both economic and diplomatic ties with Qatar in the current Gulf crisis.
A versatile weapon
It’s hard to predict where DDoS attacks will go from here, but with these attacks serving as a weapon for so many different types of attackers against so many types of targets, two things are certain: these attacks won’t be easing up any time soon, and just about every website on the internet – no matter how big or small – is a potential target, and those without professional DDoS protection are sure to suffer the very public consequences.
