Israeli authorities arrest suspects behind DDOs service vDOS
Two people suspected of being behind the vDOS company were arrested in Israel before the weekend. Via vDOS they offered so-called booter services, with which customers could make a website inaccessible via a DDO attack for a fee.
The two 18-year-old men, Itay Huri and Yarden Bidani, are said to have earned about $618,000 from their activities since 2014, security researcher Brian Krebs wrote in two messages. The suspects were arrested as part of an FBI investigation. They are also said to be responsible for about 150,000 DDoS attacks on various websites.
Shortly before the arrest, Krebs had published a notice about the vDOS service based on information released during a major hack of the company. From this he could conclude that the two men were behind vDOS. The data also shows that the service was responsible for about 277 million seconds of attack time between April and July 2016, Krebs said. That would be nearly nine ‘ddos years’ of attacks carried out in four months. The researcher concludes from this that the two carried out a very large number of attacks at the same time on a daily basis.
On the vDOS site, customers could choose different subscription plans for between twenty and two hundred dollars per month. The price determines the number of seconds that a ddos attack lasts. Krebs suspects the service has brought in more money than his current estimate, as the site has been up and running since September 2012. However, data for that period is missing.
The suspects were not careful in concealing their involvement in vDOS. For example, one of them was called AppleJ4ck on his Facebook page by his hacker nickname, and the page was used to discuss ddos activities. In addition, another suspicious received text messages from the site’s support system on his personal phone. That same number was specified with the domain used to maintain the site. The two suspects also described an investigation into DDOs attacks, in which one of the two used his real name and the other an email address assigned to one of the vDOS admins.
The suspects were released on bail, but were placed under house arrest for ten days without a passport. In addition, they have no access to the internet or other means of communication for 30 days. On the day of the arrest, security company BackConnect was hit by a 200Gbit/s DDO attack, which came from vDOS. The company was only able to counter this attack by hijacking part of the vDOS address space via a bgp hijack. The day after the arrest, Krebs’ site was also the target of a ddos up to 140Gbit/s.