Exploring Risk Avoidance Practices Among On-Demand Cybercrime-as-Service Operations

Abstract

Criminologists have recently explored online cybercrime-as-service markets where offenders offer hacking tools and services for a fee. So-called “stresser” or “booter” markets offering distributed reflective denial of service (DRDoS) attacks have been a recent target of international law enforcement action. Few have explored the ways in which these operations continued to function under increased enforcement and sanction. This study attempted to address this gap through a qualitative analysis of online advertisements from 44 booter and stresser operators. The findings revealed operators changed their preferred communications and payment platforms, as well as increased the attack methods available to customers. The implications of this analysis for our understanding of illicit online markets, and the decision-making processes of cybercriminals are discussed in detail.

Keywords

restrictive deterrence cybercrime denial of service attack booter stresser

Get full access to this article

View all access options for this article.

References

Aldridge

Askew

(2017). Delivery dilemmas: How drug cryptomarket users identify and seek to reduce their risk of detection by law enforcement. International Journal on Drug Policy, 41, 101–109.

Aldridge

Décary-Hétu

(2014). Not an’Ebay for Drugs’: the Cryptomarket’ Silk Road’as a paradigm shifting criminal innovation. Social Science Research Network.

Arbor Networks. (2015). Arbor networks 10th annual worldwide infrastructure security report finds 50X increase in DDoS attack size in past decade. Retrieved January 1, 2016, from https://www.businesswire.com/news/home/20150127005290/en/Arbor-Networks-10th-Annual-Worldwide-Infrastructure-Security-Report-Finds-50X-Increase-in-DDoS-Attack-Size-in-Past-Decade

Becker

G. S.

(1968). Crime and punishment: An economic approach. In Fielding

N. G.

Clarke

Witt

(Eds)., The economic dimensions of crime (pp. 13–68). Palgrave Macmillan.

Clarke

R. V.

(1997). Situational crime prevention: Successful case studies (2nd ed.) Harrow and Heston.

Clarke

R. V.

Cornish

D. B.

(1985). Modeling offenders’ decisions: A framework for research and policy. Crime and Justice, 6, 147–185.

Cohen

L. E.

Felson

(1979). Social change and crime rate trends: A routine activity approach. American Sociological Review, 44(4), 588–608.

Collier

Thomas

D. R.

Clayton

Hutchings

(2019, October). Booting the booters: Evaluating the effects of police interventions in the market for denial-of-service attacks [Conference session]. Proceedings of the Internet Measurement Conference, Amsterdam, Netherlands.

Copeland

Wallin

Holt

T. J.

(2020). Assessing the practices and products of Darkweb Firearm vendors. Deviant Behavior, 41(8), 949–968.

10.

Copes

Vieraitis

L. M.

(2009). Bounded rationality of identity thieves: Using offender-based research to inform policy. Criminology & Public Policy, 8(2), 237–262.

11.

Corbin

J. M.

Strauss

(1990). Grounded theory research: Procedures, canons, and evaluative criteria. Qualitative Sociology, 13(1), 3–21.

12.

Corero. (2021). Whitepaper: The need for always-on real-time ddos security. Corero Forrester Webinar 06.24.20. Retrieved March 1, 2022, from https://go.corero.com/wp-always-on-real-time-ddos-security-download

13.

Dupont

Côté

A. M.

Boutin

J. I.

Fernandez

(2017). Darkode: Recruitment patterns and transactional features of “the most dangerous cybercrime forum in the world”. American Behavioral Scientist, 61(11), 1219–1243.

14.

Felson

Clarke

R. V.

(1998). Opportunity makes the thief. Police Research Series, Paper, 98(1–36), 10.

15.

Gibbs

(1975). Crime, punishment, and deterrence. Elsevier.

16.

Holt

T. J.

(2010). Exploring strategies for qualitative criminological and criminal justice inquiry using online data. Journal of Criminal Justice Education, 21(4), 466–487.

17.

Greig

(2021, November 8). DDoS attack cost Bandwidth.com nearly $12 million. ZDNet. Retrieved March 1, 2022, from https://www.zdnet.com/article/ddos-attack-cost-bandwidth-com-nearly-12-million/

18.

Holt

T. J.

(2013). Examining the forces shaping cybercrime markets online. Social Science Computer Review, 31(2), 165–177.

19.

Holt

T. J.

Blevins

K. R.

Kuhns

J. B.

(2008). Examining the displacement practices of johns with on-line data. Journal of Criminal Justice, 36(6), 522–528.

20.

Holt

T. J.

Blevins

K. R.

Kuhns

J. B.

(2014). Examining diffusion and arrest avoidance practices among johns. Crime & Delinquency, 60(2), 261–283.

21.

Holt

T. J.

Dupont

(2019). Exploring the factors associated with rejection from a closed cybercrime community. International Journal of Offender Therapy and Comparative Criminology, 63(8), 1127–1147.

22.

Holt

T. J.

Lee

J. R.

(2022a). A crime script analysis of counterfeit identity document procurement online. Deviant Behavior, 43(3), 285–302.

23.

Holt

T. J.

Lee

J. R.

(2022b). A crime script model of Dark web Firearms Purchasing. American Journal of Criminal Justice, 1–21.

24.

Holt

T. J.

Smirnova

Chua

Y. T.

Copes

(2015). Examining the risk reduction strategies of actors in online criminal markets. Global Crime, 16(2), 81–103.

25.

Holt

T. J.

Smirnova

Hutchings

(2016). Examining signals of trust in criminal markets online. Journal of Cybersecurity, 2(2), 137–145.

26.

Hutchings

Clayton

(2016). Exploring the provision of online booter services. Deviant Behavior, 37(10), 1163–1178.

27.

Hutchings

Holt

T. J.

(2015). A crime script analysis of the online stolen data market. British Journal of Criminology, 55(3): 596–614.

28.

Hutchings

Holt

T. J.

(2017). The online stolen data market: disruption and intervention approaches. Global Crime, 18(1), 11–30.

29.

Hyslip

T. S.

Holt

T. J.

(2018). Defining the profile of potential cybercriminals. The Journal of the Homeland Defense & Security Information Analysis Center, 5(2), 25–31.

30.

Hyslip

T. S.

Holt

T. J.

(2019). Assessing the capacity of DRDoS-for-hire services in cybercrime markets. Deviant Behavior, 40(12), 1609–1625.

31.

Jacobs

B. A.

(1996). Crack dealers’ apprehension avoidance techniques: A case of restrictive deterrence. Justice Quarterly, 13(3): 359–381.

32.

Jacobs

B. A.

(2000). Robbing drug dealers: Violence beyond the law. Northeastern University Press

33.

Jacobs

B. A.

(2010). Deterrence and deterrability. Criminology, 48(2), 417–441.

34.

Jacobs

B. A.

Cherbonneau

(2014). Auto theft and restrictive deterrence. Justice Quarterly, 31(2), 344–367.

35.

Jeffrey

(2018, December 20). FBI charges three in connection with DDoS-for-hire website seizures. Techspot. https://www.techspot.com/news/77969-fbi-charges-three-connection-ddos-hire-website-seizures.html

36.

Johnson

B. D.

Dunlap

Tourigny

S. C.

(2000). Crack distribution and abuse in New York. Crime Prevention Studies, 11, 19–58.

37.

Johnson

B. D.

Natarajan

(1995). Strategies to avoid arrest: Crack sellers’ response to intensified policing. American Journal of Police, 14(3–4), 49–69

38.

Karami

McCoy

(2013). Rent to pwn: Analyzing commodity booter DDoS services. Login, 38(6), 20–23.

39.

Karami

Park

McCoy

(2015). Stress testing the booters: Understanding and undermining the business of DDoS services [Conference session]. WWW’ 2016, Proceedings of the 25th International Conference on World Wide Web, Montréal Québec Canada.

40.

Kitchin

H. A.

(2003). The Tri-Council Policy Statement and research in cyberspace: Research ethics, the Internet, and revising a ‘living document’. Journal of Academic Ethics, 1, 397–418.

41.

Knowles

G. J.

(1999). Deception, detection, and evasion: A trade craft analysis of Honolulu, Hawaii’s street crack-cocaine traffickers. Journal of Criminal Justice, 27(5), 443–455.

42.

Krebs

(2015, August 15). Stress-testing the booter services, financially. Krebs on Security. https://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/

43.

Krebs

(2017, April 25). UK man gets two years in jail for running ‘Titanium Stresser’ attack-for-hire service. Krebs on Security. https://krebsonsecurity.com/2017/04/uk-man-gets-two-years-in-jail-for-running-titanium-stresser-attack-for-hire-service/

44.

Krebs

(2018, December 20). Feds charge three in massive seizure of attack-for-hire services. Krebs on Security. https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/

45.

Krebs

(2019, February 1). 250 Webstresser users to face legal action. Krebs on Security. https://krebsonsecurity.com/2019/02/250-webstresser-users-to-face-legal-action/

46.

Leukfeldt

Kleemans

Stol

(2017). The use of online crime markets by cybercriminal networks: A view from within. American Behavioral Scientist, 61(11), 1387–1402.

47.

Liggett

Lee

J. R.

Roddy

A. L.

Wallin

M. A.

(2020). The dark web as a platform for crime: An exploration of illicit drug, firearm, CSAM, and cybercrime markets. The Palgrave Handbook of International Cybercrime and Cyberdeviance, 91–116.

48.

Lupton

Wilson

May

Warburton

Turnbull

P.J.

(2002). Drug markets in deprived neighbourhoods. Home Office Research Findings No. 167. London, England: Home Office.

49.

McSweeney

Turnbull

P.J.

Hough

(2008). Tackling drug markets & distribution networks in the UK (Vol. 4, No. 11). London, England: UK Drug Policy Commission.

50.

Moeller

Copes

Hochstetler

(2016). Advancing restrictive deterrence: A qualitative meta-synthesis. Journal of Criminal Justice, 46, 82–93.

51.

Moeller

Munksgaard

Demant

(2017). Flow my FE the vendor said: Exploring violent and fraudulent resource exchanges on cryptomarkets for illicit drugs. American Behavioral Scientist, 61(11), 1427–1450.

52.

Newman

(2021, October 17). The true cost of ddos attacks. Infosecurity Magazine. Retrieved March 1, 2022, from https://www.infosecurity-magazine.com/opinions/the-true-cost-of-ddos-attacks/

53.

Rossow

Gortz

(2014). Amplification hell: Revisiting network protocols for DDoS abuse. Proceedings of the 2014 Network and Distributed System Security (NDSS) Symposium, San Diego, CA.

54.

Santanna

J. J.

van Rijswijk-Deij

Hofstede

Sperotto

Wierbosch

M. M.

Granville

L. Z.

Pra

(2015). Booters–An analysis of DDoS-as-a-service attacks. 2015 IFIP/IEEE International Symposium on Integrated Network Management (pp. 243–51). IEEE, Ottawa, CA.

55.

Schwartz

M. J.

(2018). Feds disrupt top stresser/booter services. Bank Info Security. https://www.bankinfosecurity.com/feds-disrupt-top-stresserbooter-services-a-11898

56.

Scott

M. S.

Dedel

(2006). Street prostitution. Problem oriented policing guide series(2). Office of Community Oriented Policing Services, U.S. Department of Justice.

57.

Shover

Honaker

(1992). The socially bounded decision making of persistent property offenders. Howard Journal of Criminal Justice, 31(4), 276–293.

58.

Topalli

Wright

Fornango

(2002). Drug dealers, robbery and retaliation. Vulnerability, deterrence and the contagion of violence. British Journal of Criminology, 42(2), 337–351.

59.

U.S. CERT. (2014). Alert (TA14-017A). UDP-based amplification attacks. Government Report. Retrieved June 2, 2016, from https://www.us-cert.gov/ncas/alerts/TA14-017A

60.

VanNostrand

L. M.

Tewksbury

(1999). The motives and mechanics of operating an illegal drug enterprise. Deviant Behavior, 20(1): 57–83.

61.

Wang

Chang

Chen

Mohaisen

(2018). Delving into internet DDoS attacks by botnets: Characterization and analysis. IEEE/ACM Transactions on Networking, 26(6), 2843–2855.

62.

Wilkinson

Thelwall

(2011). Researching personal information on the public web: Methods and ethics. Social Science Computer Review, 29(4): 387–401.

63.

Wright

R. T.

Decker

S. H.

(1996). Burglars on the job: Streetlife and residential break-ins. University Press of New England.

64.

Yayla

A. S.

Speckhard

(2017, May 9) Telegram: The mighty application that ISIS loves, ICSVE Brief Reports, https://www.icsve.org/telegram-the-mighty-application-that-isis-loves/