Booters — An analysis of DDoS-as-a-service attacks

Abstract

In 2012, the Dutch National Research and Education Network, SURFnet, observed a multitude of Distributed Denial of Service (DDoS) attacks against educational institutions. These attacks were effective enough to cause the online exams of hundreds of students to be cancelled. Surprisingly, these attacks were purchased by students from websites, known as Booters. These sites provide DDoS attacks as a paid service (DDoS-as-a-Service) at costs starting from 1 USD. Since this problem was first identified by SURFnet, Booters have been used repeatedly to perform attacks on schools in SURFnet's constituency. Very little is known, however, about the characteristics of Booters, and particularly how their attacks are structure. This is vital information needed to mitigate these attacks. In this paper we analyse the characteristics of 14 distinct Booters based on more than 250 GB of network data from real attacks. Our findings show that Booters pose a real threat that should not be underestimated, especially since our analysis suggests that they can easily increase their firepower based on their current infrastructure.

Model for detection and classification of DDoS traffic based on artificial neural network

“…Four publicly available datasets were used from which we created a unique dataset of 4986 network traffic records [15], [16], [17]. Each of the used sets of records contained certain classes of traffic:…”

DDoS 3.0 - How Terrorists Bring Down the Internet

“…Such websites, which are called "Booters" or Stressers", are able to generate attacks with strengths of many Gbps. A simple Google search shows that hundreds of such Booters are currently active; the costs to perform a series of attacks is typically a few dollars [1] [2]. In general Booters do not attack their targets directly, but use one or two levels of intermediate systems to strengthen and anonymise the attacks.…”

“…To understand how Booters operate, we will discuss a series of attacks which we performed on our own infrastructure [2]. Nine Booters were used; two of which generated so-called CharGen attacks whereas the other seven performed DNS amplification attacks.…”

DDoS-as-a-Service

“…First, it is known that some booters owners use copies of source codes easily found on the Internet to create their booter [80]. Another explanation is that there are multiple booters that have the same owner, and also same database structure [81]. In section 3.5, we compare the records from booter databases to reveal whether they are copies of each other (i.e., exact same record).…”

“…One of the main arguments for this, presented in the next chapter, is that the attack infrastructure used by booters mostly consists of compromised/misused machines (e.g., botnets and amplifier services). Others have attested to this argument by hiring attacks from booters and testing them against controlled environments [39,17,81];…”