Hackers Who Shut Down PSN and Xbox Live Now Attacking Tor

http://gizmodo.com/hackers-who-shut-down-psn-and-xbox-live-now-attacking-t-1675331908

by conover • 12 years ago

170 153 12 years ago

chatmasta• 12 years ago

how many bottles of mountain dew?

Kim Dotcom gave them 3000 Mega accounts yesterday, and now they seem to have created 3000 relays. Is the number just a coincidence, or are they doing it through those accounts somehow?

http://torrentfreak.com/kim-dotcom-stops-xbox-and-playstatio...

Shank• 12 years ago

They probably sold the vouchers and bought servers with them. Most of the relay IPs are coming from the Google cloud.

timdorr2• 12 years ago

Those are simply file hosting accounts, so there's ability to run something like a Tor node from them.

More likely is they're using the same botnet that was attacking PSN/XBL to run Tor relays.

AlyssaRowan4• 12 years ago

No, they're all on Google Compute Engine. (Which means one person could very easily stop this cold…)

michaelbuckbee• 12 years ago

As grateful as I was to be able to actually play the games I received on Christmas, it is hard to find anything positive longer term with respect to paying off DDOS attacks (though I'm assuming that this more or less happens constantly away from public view).

tedivm• 12 years ago

There are currently 3346 relays, not 3000. The number is just a coincidence.

alexivanovs• 12 years ago

This is fun to watch, even funnier when you realize that any talk around this is just that - talk. But, I'm intrigued for the future, this type of hacking is starting to make its comeback, and that's a cute thing.

jamescun• 12 years ago

For Tor network status and node list: https://torstatus.blutmagie.de/

All names appear to begin with LizardNSA.

It must be said, however, that all exit and non-exit nodes go through acceptance process over 88 days

https://blog.torproject.org/blog/lifecycle-of-a-new-relay

timdorr2• 12 years ago

They claim a "0day", which may just be them coopting the term from real hackers, but may also be a legitimate attack that gets around the approval period.

But it appears this is all running from Google's Compute Engine. They can easily shut it down, although they're probably using stolen credit cards, so there's no real traceability there.

spacefight2• 12 years ago

So the question is, why is Google not shutting them down now.

comex• 12 years ago

It's unfortunate that they're attacking Tor, but at least this type of attacks is being demonstrated now by someone presumably only out for lulz, rather than potentially by more malicious entities in the future.

r00fus• 12 years ago

How do you honestly know that? Everything can be pseudonymous or anonymous and behind several layers of indirections. Real names could be used so dox-ing can reveal "something" but in effect could simply be a steganographic ruse.

Given the resources of large intelligence operations funded worldwide, would can you be sure one or more aren't really behind Lizard (or LulzSec or Anonymous even)?

jayrox• 12 years ago

first off, quit calling them hackers. they aren't hackers. they are script kiddies.

wyager• 12 years ago

What makes you say this? Do we know exactly what they've done?

onewaystreet3• 12 years ago

Lizard Squad has access to a large botnet which they used to DDoS Sony and Microsoft and now to create a large number of TOR relays. It's not hacking. It's not even being a script kiddie.

tw044• 12 years ago

I can tell you most of the TOR relays they've got aren't anything more than google cloud instances. So... not really hacking at all.

jacquesm3• 12 years ago

Calling them script kiddies is not productive either. They're hackers by the now commonly accepted definition as used in the media. That ship sailed ages ago, but if you want to bicker about what to call them the correct term is probably something along the lines of cyber criminals.

simias• 12 years ago

I don't usually care for the meaning of "hacker" (tinkerer or pirate) but in this case calling them "hacker", even in the mainstream meaning of the word is giving them too much credit.

They're not hacking anything any more that 4chan users "hack" websites by flooding them, there's no "hack" involved in any meaning of the word. I'm sure they love being called "hackers" by the media.

So yeah, I'm definitely in favor of calling them script kiddies. It's much easier to understand, even for a mainstream audience. And I assume they'd find the attention they're getting less rewarding if they were called script kiddies everywhere...

sjreese• 12 years ago

Sony - had this coming - fake security experts said the NK could do nothing - Now look - Ha! they stole the Admin password Ha! it was "lena" but we will kill their "NK" internet and stop them cold from further take-downs. Ha Ha he he ho ho ho..

deanclatworthy4• 12 years ago

So from what I've read so far they are trying to deanonymize TOR users by having a large number of relays in the network. This isn't an unknown attack vector. But surely the NSA could easily do the same. What's to say that half the relays aren't already NSA owned?

jacquesm3• 12 years ago

You make me wonder if there is yet another way of compromising TOR, to ask each intelligence service to contribute a small fraction of their capacity to TOR so that the vast majority of the nodes is owned by some agency, who then exchange data through some back channel. Harder to detect and with far more resources than any single agency could provide.

Or is the NSA so large that it dwarfs the resources the rest of the world could contribute?

deanclatworthy4• 12 years ago

I don't think its out the realms of possibility for any intelligence agency to set up a LOT of servers at different ISPs with different credit cards and account owners.

onewaystreet3• 12 years ago

Because if you create 3000 TOR relays in an hour it's easy for everyone to notice them and not use them.

deanclatworthy4• 12 years ago

True. But if you do it over a long period... TOR has been around a while now. How can you possibly vet all owners? Surely most relay owners would prefer to remain anonymous.

rohit89• 12 years ago

Does this mean that if agencies from different countries get into an arms-race trying to take control of the network in such a way, it would actually make tor stronger?

bhouston• 12 years ago

But remember that the us, UK, canada, and australia and some other are major cooperators and likely won't compete.

tw044• 12 years ago

PLEASE stop calling them hackers. They're DDoS kiddies who have now switched to spinning up TOR on their botnet. THESE ARE NOT HACKERS.

droopyEyelids2• 12 years ago

At this point Hack is just a marketing/media term and Lisp nerds from MIT no longer have any say in the matter. Let it go.

tw044• 12 years ago

That kind of attitude is why we have people denying global warming. Terms have meaning, allowing idiots to try to muddy the waters hurts all of mankind. It has nothing to do with "Lisp nerds from MIT".

pikzen• 12 years ago

Please understand the problem. Calling them "Hackers", or "Black hats" or whatever fucking term is NOT the issue.

When someone has the possibility of doing a Sybil attack, no matter what they did before, you take that shit seriously. As of now, we don't know if the goal is to really test their 0day (which, if it's a Sybil isn't exactly 0day) or just popping up 3360 exit nodes to give "free" bandwidth.

tw044• 12 years ago

Given that they've yet to do anything beyond DDoS attacks that aren't even complex in nature - the odds of them having a 0-day or any attack of any sort is pretty much 0. This is literally one or more teenagers "doing it for the lulz" and the attention.

eropple2• 12 years ago

English is not prescriptive. That will not change no matter how hard you rage.

jnbiche• 12 years ago

The word "prescriptive" generally refers to an approach to language, such as found in grammars, discussed by grammarians, etc. Not to languages themselves, which are neither descriptive nor prescriptive.

a-ghost-fart• 12 years ago

A bunch of children who don't know how to use Tor (take a look at the dox from TheFinest) decide to try and compromise Tor.

Colour me surprised.

Given that a bunch affiliated with the group's names, addresses, numbers and the like have been compromised, this doesn't seem like a very smart plan.

ChristianBundy3• 12 years ago

Link to dox: http://thefinest.com/

Is it just me, or are there huge parallels between gang culture and hacker culture?

yeukhon5• 12 years ago

The thing I fear the most is cyber retaliation. So many of us have accounts on the Internet that matter to us day to day. If they are reading this (I am damn sure they are), and if they don't like you, they will try to take over your accounts and make fun of you. Fear is the most destructive and most effective weapon and such weapon is most terrible when targeting at individuals.

But I still have to drop a line: please arrest these "hackers" / "crackers" / cyber criminals.

pferde• 12 years ago

Oh no, someone might make fun of me. The horror!

balls1872• 12 years ago

Luckily, you're not important enough for people to target.

Luckily, neither am I.

yeukhon5• 12 years ago

Well, you never know. They certainly can target you because you are working for X company and X company sounds awesome enough to exploit and place on the front page.

abritishguy2• 12 years ago

They appear to be using Google Compute instances (based upon the IP addresses) to create TOR relays but since they are not exit nodes I'm not really sure what they are hoping to achieve.

abqio• 12 years ago

They're set up to be exit nodes, they just don't have the exit flag yet.

mperret• 12 years ago

Quite a few seem to have the exit flag now. Only glanced through the first 500 or so, but it looked to be about 50 which had the exit flag

abritishguy2• 12 years ago

And without that flag they might as well not be exit nodes - it takes 88 days to be approved.

dirkk0• 12 years ago

I don't get it.

They attack the PSN and XBox networks. Kim Schmitz gives them 3000 vouchers for Mega to save christmas (what?) and/or the world. Then they claim, he's the reason they stopped the attacks.

And then they target their next victim. My point is: one might not like Kim but he is way too smart to expect such a barter to be successful.

So, given his own background, what makes him this? A stupid hero? Or is there a much smarter option?

scrapcode• 12 years ago

I honestly think he just wanted to play Destiny. That doesn't seems far-fetched to me at all.

chc• 12 years ago

It was a chance to inject Mega's name into a big story. Before, the story was "Hackers steal Christmas." Now, the story is "Mega saves Christmas."

Also, he probably wanted to play some video games and it's not like Mega vouchers cost him all that much, particularly considering this is basically an advertising expense.

higherpurpose2• 12 years ago

New headline: Mega Helps Destroy Tor Network

Seriously, he just ended up passing the hot potato to someone else. That someone else is now Tor. I think I would've preferred to let Microsoft deal with the DDoS (they have the means).

Giving in to criminals's demands really ends up making things worse in the long term, whether it's bank robbers, CryptoLocker creators or the owners of botnets that can DDOS sites.

mrmondo2• 12 years ago

I agree, he's very keen to clean his name and promote a shining knight image.

CyberDildonics• 12 years ago

Not only that but he could gather information on the use of those accounts. If they are ever used recklessly then he potentially has information about the group, giving him leverage with authorities. A very crafty play indeed.

chokolad• 12 years ago

Then they claim, he's the reason they stopped the attacks.

Attacks have not been stopped though. PSN is still down (or was this morning) and Xbox Live is still under DDOS, it's just being able to mitigate it better than yesterday.

rcamera2• 12 years ago

Tor Devs haven't made any announcement yet, there is, however, a discussion about it on the mailing list:

https://lists.torproject.org/pipermail/tor-talk/2014-Decembe...

If you use Tor, I would follow the suggestion by another member of the mailing list [1], simply add to your torrc file:

  ExcludeNodes US
  StrictNodes 1

That will disallow using any US nodes, which works since all of LizardNSA's nodes are currently in the US.

[1] https://lists.torproject.org/pipermail/tor-talk/2014-Decembe...

joliv• 12 years ago

Supposed response from "lizards@riseup.net":

Why? I assure you, our exits are just fine. What's with people responding so negatively to us donating 360Gbit/s of exit BW?

EDIT: From @lizardmafia:

To clarify, we are no longer attacking PSN or Xbox. We are testing our new Tor 0day.
Only hackers, miscreants and pedophiles use Tor.

rcamera2• 12 years ago

There is a clear explanation in the same thread as to why LizardNSA's actions of adding bandwidth to the network isn't good, and in fact, potentially dangerous (not very dangerous at this moment of writing):

https://lists.torproject.org/pipermail/tor-talk/2014-Decembe...

linuxydave• 12 years ago

"Only hackers, miscreants and pedophiles use Tor."

Oh please. They're trying to take the moral high ground to justify their behaviour.

EliRivers• 12 years ago

Only hackers, miscreants and pedophiles use Tor.

Amateurs.

The kind of person whose sense of moral outrage gets activated by such nonsense bullshit doesn't know what the word "miscreant" means, and by not mentioning "terrorists" they're just confusing their target audience. If you don't say "terrorist", how are we supposed to know you're the good guys?

RayJoha2• 12 years ago

"> Only hackers, miscreants and pedophiles use Tor." you must be a full blown moron. Tor is used by journalists, bloggers, gov employees, chinese dissidents and all sorts of ppl in peril. go shoot yourself

lbenes• 12 years ago

UPDATE: "But even though they are running thousands of new relays, their relays currently make up less than 1% of the Tor network by capacity. We are working now to remove these relays from the network before they become a threat, and we don't expect any anonymity or performance effects based on what we've seen so far." So hopefully this gets nipped in the trollish bud before anonymity is affected."

http://gizmodo.com/hackers-who-shut-down-psn-and-xbox-live-n...

mrobot• 12 years ago

What was the maximum capacity over the entire attack?

Even if you held majority for just an hour, it seems you could still build a useful database of identities and their usage. I was trying to imagine how much just an hour Tor snapshot might be worth to somebody.

Maybe? Or no?

jwcrux• 12 years ago

I'd be curious if this would be considered against the google compute engine ToS.

If so, it'd be simple for Google to wipe them. Otherwise, I have no doubt the tor directory authorities will be keeping an eye on these for malicious activity and will mark them as Bad Relays if any is detected.

yedpodtrzitko• 12 years ago

This isn't Fox News, can we call the things correctly, thus "crackers" in this case, pls?

sanswork5• 12 years ago

The crackers instead of hackers war was lost 15 years ago.

mbel• 12 years ago

I guess it can be won back if you convince people that calling programmers hackers and hackers crackers is hip now. Once we achieve that we can focus or more serious issues like naming Linux GNU/Linux :)

cbd1984• 12 years ago

Yeah, like how 'gay' can mean 'stupid' in some contexts and moaning about it is pointless.

Karunamon3• 12 years ago

So we just stop all use of correct language because of defeatism? Nonsense.

s_q_b2• 12 years ago

They're trying a correlation attack on the network. Create enough entries and exits, then matching traffic by time, size, and shape.

gburt• 12 years ago

Do you know this? It seems obvious to me, but calling it a "0day" suggests that maybe the attack is (at least marginally) more sophisticated than the obvious correlation attack. Not to mention, as far as I can see, we have no idea.

s_q_b2• 12 years ago

To date, no one to date has presented a reliable, scalable, consistent passive correlation algorithm.

mattdeboard2• 12 years ago

This group has been DDOSing game networks for quite awhile now, a year at least? Are they just super skilled at covering their tracks, are they not being investigated, is federal law enforcement not good at tracking this down yet, or what? I don't understand how a major crime spree is being conducted in public and gleefully boasted about for this long.

AlyssaRowan4• 12 years ago

Would it be unreasonable to draw parallels to Lulzsec?

mattdeboard2• 12 years ago

I forgot who these guys were, but yeah I reckon.

IIRC LizardSquad did allegedly "disband" awhile back, I think when some heat got applied to them, but I don't know. They were repeatedly DDOSing the servers of a game I play so I started following their exploits. I do hope law enforcement catches up with these guys sooner rather than later.

tanglesome• 12 years ago

What a great bunch of guys! And, oh by the by, PSN is still down and Xbox Live is still having trouble.

linksbro2• 12 years ago

Seems like it's coming to an end? https://twitter.com/CthulhuSec/status/548612570102640640

linksbro2• 12 years ago

Their exits seem to be gone, too: https://globe.torproject.org/#/search/query=LizardNSA&filter...

alexggordon2• 12 years ago

I'm always a little bit fascinated by these sorts of attacks.

On one hand, I guess I understand (yet don't condone) the motivation for the 'vigilante' justice they're trying to do. On the other, I really don't understand what benefit you can get from attacking Xbox, then Sony, and finally Tor.

When I think of the people doing this, I tend to think of them as understanding the importance of Tor and the benefit of anonymity it brings. However, here are people doing a DDOS attack (obviously illegal) trying to bring down the biggest illegal goods marketplace on the internet.

Maybe I'm alone in this, but outside of attention, I really don't understand any logical reason for this happening, and that really makes me dismiss any message they may have. I can comprehend being motivated by anger or some event, or just being a douchey company, but I just really don't understand what anyone besides the US Government would gain by attacking Tor.

mrmondo2• 12 years ago

I personally think they're trying to get attention for themselves to build reputation and perhaps land some sort of job / payout.

yeukhon5• 12 years ago

Well based on what they did, they obviously can't advertise their work. They also won't have any interest in working for SV companies. The only kind of job they are after is in the black market (organized crime and intelligence).

growupkids• 12 years ago

Or they're just sociopathic and sadistic and actually enjoy what they are doing. Wouldn't be the first time a DDOS was done just for the lulz.

reledi• 12 years ago

That seems to be part of their motivation. From a recent interview published at http://www.dailydot.com/technology/lizard-squad-hackers

“Microsoft and Sony are fucking retarded, literally monkeys behind computers,” Omari said. “They would have better luck if they actually hired someone who knew what they were doing. Like, if they went around prisons and hired people who were convicted for stuff like this, they would have a better chance at preventing attacks.”

“If I was working [at Microsoft or Sony] and had a big enough budget, I could totally stop these attacks,” Cleary claimed. “I’d buy more bandwidth, some specific equipment, and configure it correctly. It’s just about programming skill. With an attack of this scale, it could go up to the millions. But that’s really no problem for Sony and Microsoft.”

"If I get caught, then I get caught. Maybe I'll end up serving time, or maybe I'll end up helping companies, help them get better I guess."

r109• 12 years ago

Because sometimes desk jockeys within the IT world put on their blue collar, settle for a mediocre salary, grow 4-6 pant sizes, and think "this is good enough"

Up until new blood walks up, points out a flaw, and fucks shit up because the "senior" desk jockey can barely squirm out of his $1000 computer chair to reach his keyboard.

That's just my take on it, if Lizard Squad states that it has taken them minimal effort to setup these attacks; then what's stopping a larger organization from doing such things?

Yhippa• 12 years ago

Apparently Kim Dotcom gave them 3,000 MegaUpload accounts to stop. After that they claim to have halted the attacks. They have somewhat of an incentive now to DDoS internet services and wait to see if someone will give them goodies in exchange to stop this.

https://twitter.com/KimDotcom/status/548305704776241152

sangel10• 12 years ago

according to this article they sold off the accounts and then continued the attacks.

http://www.dailydot.com/technology/lizard-squad-hackers/

jedberg• 12 years ago

I really don't understand any logical reason for this happening,

Maybe it is the federal government trying to bolster their case for stronger control of the internet with a false flag operation.

For the record I'm not a conspiracy nut, but at the same time, given what we know about our government now and in the past, I can't completely dismiss the possibility.

vladimirv• 12 years ago

Knowing the people behind the attacks personally, I can ensure you this isn't the case. They're simply kids with too much free time and a yearning for attention.

If you're curious about validating this first hand, some of the members are active over at digitalgangster.com to give you an idea of the level of sophistication.

sporkenfang• 12 years ago

anyone besides the US government

How about China, the EU, and ISIS/ISIL (if they even have any technology whatsoever)?

lectrick• 12 years ago

The Internet was designed to withstand a nuclear attack and due to people intent on centralizing services, we have services taken down by nerds. I hope Tor ends up being resilient because it's also used by folks in oppressed countries.

lizards• 12 years ago

I like lizards in general, but I am not too pleased about lizards that are hacking. It is, quite frankly, a disgrace.

Please be aware that the lizard community as a whole is appalled by these circumstances.

I hope that this whole bag of shenanigans does not prejudice your fine selves against lizards - whether they be lizards of the past, present, or future.

Thank you for your time.

angersock• 12 years ago

Do they run SUSE? This is important.

ChristianBundy3• 12 years ago

UDPATE: Lizard Squad is currently being interviewed on BBC Live 5 right now: http://www.bbc.co.uk/radio/player/bbc_radio_five_live

feld• 12 years ago

requires flash :( darn, wanted to listen in but I'm sure it will be done before I can get flash installed

lotsofmangos• 12 years ago

That was surreal. Felt like characters from Nathan Barley had walked into an early William Gibson novel.

deanclatworthy4• 12 years ago

I didn't catch the interview, did they mask the voices? Presumably the filter they would use could be undone fairly easily, in the same way that the "swirl" filter paedophiles were using got them caught [1].

The way in which these people are acting right now is just asking for a mistake. I would guess they have made some huge opsec mistakes already. There's a supposed dox on them already (find it yourself on Twitter).

[1] http://thelede.blogs.nytimes.com/2007/10/08/interpol-untwirl...

polack• 12 years ago

For those who missed it: https://www.youtube.com/watch?v=FNZg5NaPe0k

hwach• 12 years ago

Wold at arms

LISPmasta• 12 years ago

Yeah I'm sure some rando bitch named Kate from gizmodo knows about DDoS. Any fucking moron can read twitter, thanks for "writing" an article about __nothing__. Seriously this site has zero standards compared to how it used to be.

Hackers Who Shut Down PSN and Xbox Live Now Attacking Tor

Related Stories