An attack that occurred Friday was responsible for taking down major sites like Netflix and Amazon for much of the East Coast. Speculations occurred over the weekend as to who was responsible for these attacks, with fingers pointing to various nations and hacking groups. But new research from Flashpoint shows that amateurs, or 'script kiddies' were most likely behind one of the largest DDoS attacks ever seen.
The security firm was able to analyze the attack infrastructure and determine that it was at least partly comprised of the recently released Mirai botnet source code. While the Mirai malware was used last month against journalist Brian Krebs, as well as the French internet and hosting provider OVH. However, Flashpoint has also determined that the people behind those attacks were mostly likely not responsible for the massive takedown of Dyn DNS providers. While the size and scope of this DDoS attack has yet to be determined, Flashpoint says that the server in this instance is "separate and distinct".
The security firm says that these attacks most likely in line with hackers active on online hacking forums and "are separate and distinct from hacktivists, organized crime, state-actors, and terrorist groups. They can be motivated by financial gain, but just as often will execute attacks such as these to show off, or to cause disruption and chaos for sport."
The attacker(s) did not, as far as we can tell, attempt to gain financially during this attack. Most of the sites taken offline like Spotify, Reddit, and Twitter fit the "Netflix and Chill" profile, rather than extorting money from large banks and Bitcoin sites. The sites also don't exemplify any specific community or political party. Wanting to experiment with launching an attack of that size or simply trying to get cred online seems most likely.
If an attack of this scale can occur with amateur hackers using a code that can easily be found online, how much worse can it get if highly skilled attackers with a distinct motive have the same idea?
