31-12-2010, 01:29 AM
FBI Raids Texas Server Farm for Clues to Anonymous Group, Operation Payback
Share
By: Fahmida Y. Rashid
2010-12-30
Federal agents seized two hard drives from a server in a Texas company believed to have been used to launch the DDoS attack against PayPal as part of a pro-WikiLeaks protest.
#ArticleWidgets { font-family: Arial,Verdana,Helvetica,sans-serif; font-size: 11px; text-decoration: none; margin-bottom: 0px; }#ArticleWidgets { color: rgb(0, 51, 153); text-decoration: none; line-height: 16px; }#ArticleWidgets.a, articlewidgets.a:hover { color: rgb(0, 51, 153); text-decoration: underline; line-height: 16px; }#position { padding: 5px 0px 5px 5px; }#spacer { height: 5px; line-height: 5px; }.add2head_new { font-size: 11px; font-weight: bold; width: 200px; margin-left: 8px; margin-right: 8px; display: block; float: right; }.ArticleWidgetsHeadline { font-size: 11px; font-weight: bold; }
The FBI raided a Dallas-based server farm and seized servers used in the distributed denial-of-service attack against PayPal earlier this month, according to an affidavit obtained by the Smoking Gun Web site.
Federal agents are looking for clues as to the identity of the hackers who orchestrated the DDOS attack on PayPal, according to the affidavit. It is unclear whether the raids were successful in that regard.
The FBI began their investigation shortly after the Anonymous group of Internet activists launched DDoS attacks against PayPal and other financial and technical service companies for cutting off support to the WikiLeaks site after it published thousands of secret U.S. state department cables.
The PayPal blog was offline for a few hours as part of the DDoS campaign the Anonymous group called "Operation Payback." Volunteers were encouraged to download a point-and-click DDoS tool to attack PayPal and other targets, including Visa, MasterCard, Bank of America (earlier this week), and a Swiss bank who froze WikiLeaks founder Julian Assange's accounts.
FBI investigators believe that some volunteers used botnets of compromised machines to launch a more potent assault, according to the affidavit.
"Vigilante DDoS, a bunch of kids getting together and running a software," is not a particularly powerful attack because there is not enough volume, Jason Hoffman, of Joyent, told eWEEK. Attackers would have needed five to fifteen million people all on high broadband connections to "be effective," he said.
PayPal provided FBI agents with eight IP addresses of servers that were used to run IRC chat servers associated with planning the Operation Payback attacks, according to the affidavit. Investigators believed the same systems were used as command and control hubs for botnets used during the DDOS attacks.
According to the affidavit, "multiple, severe DDos attacks" had been launched against PayPal, which amount to felony violations of a federal law covering the "unauthorized and knowing transmission of code or commands resulting in intentional damage to a protected computer system."
One IP address was traced to Host Europe, a Germany-based Internet service provider. The server in question turned out to belong to a man from Herrlisheim, France, but that the root-level access to the machine appeared to be from a remote user with administrator access, said the affidavit. The log files indicate the commands to execute the attack came from this remote address, which led investigators to hosting firm Tailor Made Services in Dallas, Texas.
Investigators believe the command to launch the attack was made on Tailor Made Services systems and relayed to this server in Germany to hide its origin.
A pair of log entries on the compromised Host Europe machine contained the same message: "Good_night,_paypal_Sweet_dreams_from_AnonOPs." according to a sworn statement from FBI agent Allyn Lynd.
Agents raided Tailor Made Services on Dec. 16 after getting a search warrant based on the affidavit. Agents copied two hard drives from the targeted server during this raid, according to Smoking Gun. There is currently no information available about what was found on the drives.
Another IP address associated with the attacks was traced to a Canadian ISP in British Columbia, which was actually a virtual server physically hosted at California-based "co-location" firm, Hurricane Electric. There is no information as to whether the company had been raided by agents at this time.
Share
By: Fahmida Y. Rashid
2010-12-30
Federal agents seized two hard drives from a server in a Texas company believed to have been used to launch the DDoS attack against PayPal as part of a pro-WikiLeaks protest.
#ArticleWidgets { font-family: Arial,Verdana,Helvetica,sans-serif; font-size: 11px; text-decoration: none; margin-bottom: 0px; }#ArticleWidgets { color: rgb(0, 51, 153); text-decoration: none; line-height: 16px; }#ArticleWidgets.a, articlewidgets.a:hover { color: rgb(0, 51, 153); text-decoration: underline; line-height: 16px; }#position { padding: 5px 0px 5px 5px; }#spacer { height: 5px; line-height: 5px; }.add2head_new { font-size: 11px; font-weight: bold; width: 200px; margin-left: 8px; margin-right: 8px; display: block; float: right; }.ArticleWidgetsHeadline { font-size: 11px; font-weight: bold; }
The FBI raided a Dallas-based server farm and seized servers used in the distributed denial-of-service attack against PayPal earlier this month, according to an affidavit obtained by the Smoking Gun Web site.
Federal agents are looking for clues as to the identity of the hackers who orchestrated the DDOS attack on PayPal, according to the affidavit. It is unclear whether the raids were successful in that regard.
The FBI began their investigation shortly after the Anonymous group of Internet activists launched DDoS attacks against PayPal and other financial and technical service companies for cutting off support to the WikiLeaks site after it published thousands of secret U.S. state department cables.
The PayPal blog was offline for a few hours as part of the DDoS campaign the Anonymous group called "Operation Payback." Volunteers were encouraged to download a point-and-click DDoS tool to attack PayPal and other targets, including Visa, MasterCard, Bank of America (earlier this week), and a Swiss bank who froze WikiLeaks founder Julian Assange's accounts.
FBI investigators believe that some volunteers used botnets of compromised machines to launch a more potent assault, according to the affidavit.
"Vigilante DDoS, a bunch of kids getting together and running a software," is not a particularly powerful attack because there is not enough volume, Jason Hoffman, of Joyent, told eWEEK. Attackers would have needed five to fifteen million people all on high broadband connections to "be effective," he said.
PayPal provided FBI agents with eight IP addresses of servers that were used to run IRC chat servers associated with planning the Operation Payback attacks, according to the affidavit. Investigators believed the same systems were used as command and control hubs for botnets used during the DDOS attacks.
According to the affidavit, "multiple, severe DDos attacks" had been launched against PayPal, which amount to felony violations of a federal law covering the "unauthorized and knowing transmission of code or commands resulting in intentional damage to a protected computer system."
One IP address was traced to Host Europe, a Germany-based Internet service provider. The server in question turned out to belong to a man from Herrlisheim, France, but that the root-level access to the machine appeared to be from a remote user with administrator access, said the affidavit. The log files indicate the commands to execute the attack came from this remote address, which led investigators to hosting firm Tailor Made Services in Dallas, Texas.
Investigators believe the command to launch the attack was made on Tailor Made Services systems and relayed to this server in Germany to hide its origin.
A pair of log entries on the compromised Host Europe machine contained the same message: "Good_night,_paypal_Sweet_dreams_from_AnonOPs." according to a sworn statement from FBI agent Allyn Lynd.
Agents raided Tailor Made Services on Dec. 16 after getting a search warrant based on the affidavit. Agents copied two hard drives from the targeted server during this raid, according to Smoking Gun. There is currently no information available about what was found on the drives.
Another IP address associated with the attacks was traced to a Canadian ISP in British Columbia, which was actually a virtual server physically hosted at California-based "co-location" firm, Hurricane Electric. There is no information as to whether the company had been raided by agents at this time.
"The philosophers have only interpreted the world, in various ways. The point, however, is to change it." Karl Marx
"He would, wouldn't he?" Mandy Rice-Davies. When asked in court whether she knew that Lord Astor had denied having sex with her.
“I think it would be a good idea” Ghandi, when asked about Western Civilisation.
"He would, wouldn't he?" Mandy Rice-Davies. When asked in court whether she knew that Lord Astor had denied having sex with her.
“I think it would be a good idea” Ghandi, when asked about Western Civilisation.