Prosecuting DDoS Attacks?

dptalia writes "We all have heard of major DDoS attacks taking down countries, companies, and organizations. But how many of them are ever prosecuted? And how many prosecutions are even successful? I've done some research and it appears the answer is very few (Well duh!). And those that are successfully prosecuted tend to have teenagers as the instigators. Does this mean DDoS is a fairly safe crime to conduct? Are the repercussions nonexistent? Does anyone have some knowledge an insight into this that I don't have? How would you go about prosecuting a DDoS attacker? What's your experience with getting the responsible parties to justice?"

Re:Don't do if you don't want a other Terry Childs

[tsm_sf]

One of those "the authorities won't become interested until you take matters into your own hands" situations. And the reason is that, as a law-abiding (ok, more or less) citizen, you're much easier to prosecute.

What's needed is for one of these new "cyber" security agencies (and I hope this isn't offensive, but they really need to be led by combat veterans with modern prostheses) to be tasked with hunting botnets and taking them over. Displaying a "this computer secured by the U.S. Gub'mint" message is probably the only guaranteed method of getting a user to wipe their machine.

Re:Illegal; but....

[LostCluster]

A DDoS requires many hosts in different places... and that role is usually played by a botnet of unwitting users. If users cared more about their bandwidth consumption, or were responsible for the damage they caused by their insensitivity to the Internet community, then botnets would be a whole lot harder to assemble. I'm sick of the 3am calls from the girl who only calls when her computer won't work for her....

Re:It depends on the scale of your operation

[rainer_d]

Well, not from what I know.
http://magbiz.net/news-en/unknown-person-extorts-shut-down-of-an-erotic-portal/?lang=en [magbiz.net]

Re:Illegal; but....

[Nemyst]

Even teenagers rarely get caught. I know someone whose server has been flooded multiple times over by one of those punks you speak of. He knows the name, address, school, he called the police, FBI, police in the server's country... And nothing. The police don't give a damn about it, despite the entire thing costing him money every month (it's a large dedicated server that's getting taken down). The FBI didn't hear "child porn" or "terrorism" so they also don't give a damn. Basically, he's entirely stuck alone if he can't reach the guy's parents or if they don't do anything.

It's incredible that such a thing is running rampant, though, seeing how it can cost people money and business. I can understand the trouble when facing a "professional" hacker who's so well hidden it'd take weeks to track him back, but when all the data is already tracked down, complete with evidence? The police probably prefer eating donuts all day long for all I can tell (sorry to all police officers who dislike donuts or who would actually do something in such a situation).

Re:Ask slashdot

[Anonymous Coward]

Ok, this is the sucker: http://slashdot.org/ [slashdot.org]

Re:Dear China...

[icebraining]

It depends - one of the most effective ways to kill a small site is to perform a "bandwidth rape" until they cross their monthly limit. A couple dozen people running simple wget loop requesting a large image/video continually can waste hundreds of gigabytes per day.

i got dossed ONCE

[chronoss2010]

and i\\when server went down it cost me 150$ i contacted the isp ISP said to email UUNET UUNET told me to CONTACT the iSP after 3 more times at his shit i sent an email to all involved and said "OK if your not willing or able to stop this i will and do not give me any legal repercussion on how i permanently end the problem" I then made apiece a software that targeted the PERSON in Argentina doing it and 75% of the isps in that country. then handed this software to 150 other hackers i knew around the world a week later i asked all to stop i got email from the arse doing this whom apologized that was the last dos i ever had to deal with and its why you never fuck with a hacker site P.S. i never caved and ever started doing what many did post 9/11 and called themselves "security sites either" most of those were shit heads anyhow. BTW before i did it i informed all the top pirates and said your email host thinks its a joke to attack my site , they weren't happy but i said he needs to learn something. its one reason its kinda good to gt in with hackers at least even if your not to serious , just be nice to them and they'll be nice to you. i used ot have some good chats with some pretty high up webmasters of yahoo and other major sites. AND no i've never used this power to extort or force any actions to anyone.Might be one reason ive been running this org for 16 years with no IT arrests in the membership

Re:Not true - you still need sufficient horsepower

[mikael_j]

In a way I think "properly configured" includes "not running on a 512/128 kbps DSL line", "not running the latest whizbang blogging platform webapp on a 133 MHz Pentium with 64 megs of RAM" and "not trying to server up funny cyborg pet videos on said 512/128 kbps DSL line".

There seem to be three common scenarios when sites get slashdotted:

1. "Junk lovers" who take pride in running their home server on some ancient piece of junk they got for free ten years ago, generally have blog posts about how they managed to speed up SpamAssassin so it now only takes ten minutes to process each incoming message, completely oblivious to why it is not advisable to run modern resource-intensive software on ancient hardware.
2. And then the guys who have shared hosting which they're constantly pushing to its limits even without getting slashdotted ("I have n gigs of transfer per month and I'm only using 96% of that on an average month, why would I upgrade?"), also known as cheapskates.
3. Extremely resource-intensive server-side processing, I'm not talking about people who run Wordpress on a 486, I'm talking about those "Look at the neat stuff we did" sites that run on some lab server that is unable to handle the load of hundreds of /. users trying it out at the same time.