Inside booters: An analysis on operational databases

Abstract

Abstract-Distributed Denial of Service (DDoS) attacks are an increasing threat on the Internet. One of the reasons is that websites selling attacks for prices starting from $1.00 are becoming popular. These websites, called Booters, facilitate attacks by making transparent the needed infrastructure to perform attacks and by lowering the knowledge to control it. As a consequence, any user on the Internet is able to launch attacks at any time. Although security experts and operators acknowledge the potential of Booters for DDoS attacks, little is known about Booters operational aspects in terms of users, attacks and infrastructure. The existing works that investigate this phenomenon are all restricted to the analysis of a single Booter and therefore provide a narrow overview of the phenomenon. In this paper we extend the existing work by providing an extensive analysis on 15 distinct Booters. We analyze their operational databases containing logs of users, attacks, and the infrastructure used to perform attacks. Among our findings we reveal that (i) some Booters have several database records completely equal, (ii) users that access Booters via proxies and VPNs performed much more attacks than those that accessed using a single IP address, and (iii) the infrastructure used to perform attacks is slightly different from what is known through existing work. The contribution of our work is to bring awareness of Booter characteristics facilitating future works to mitigate this phenomenon.

Booters — An analysis of DDoS-as-a-service attacks

“…Although there is a vast amount of literature on DDoS attacks and mitigation techniques [5], [6], [7], [8], [9], this paper is, to the best of our knowledge, the first to present a structured analysis of several DDoS-as-a-Service providers. Karami et al [10], [3] investigate Booters as well, using a similar approach but focus on a single Booter only.…”

Anomaly detection through information sharing under different topologies

“…As the majority of them stem from booter services [19,20], they are usually shorter than 300 s [21]. After that, the network returns to regular traffic, and the attacker nodes stop adding new packets in the system.…”

Booter list generation: The basis for investigating DDoS‐for‐hire websites

“…The majority of Booter customers are teenagers that attack one another's residential connection to gain advantage in online gaming; and most attacks from Booters typically last up to 5 minutes and send traffic at rates up to 10 Gbps . Some Booter outliers, however, are able to deliver significantly more powerful attacks, eg, 100 Gbps, which can cause serious problems on targets that lack proper defense.…”