Online Extortion Rears its Head Prior to World Cup

Cloud-based security service Incapsula has fought off what is becoming an increasingly common cyber attack tactic designed to blackmail gaming providers. The 100 gigabits per second (Gbps) distributed denial-of-service (DdoS) attack against an online gambling website client of Incapsula utilized more than five DDoS attack vectors. Vectors used in the attack included an SYN flood, Large SYN flood, NTP amplification, DNS flood, and DNS amplification.

Attack and Smoke Screen

The DNS flood comprised some 75 percent of malicious traffic on the gaming company's traffic, with the large SYN flood responsible for another 20, with the other attacks being used mostly as smoke screens to obscure the source of the malicious traffic and make it harder to detect.

The attackers hid behind spoofed IP addresses, sustaining the attack against the unnamed site for upwards of 24 hours.

DdoS Attacks Increasing in Size and Complexity

The multi-vector DDoS attack was not the first of its kind, but the size of the attack was surprising, as attacks involving more than four vectors are rare and difficult to carry outâ€"as well as defend.

Marc Gaffan, chief business officer and cofounder of Incapsula, told SCMagazine.com in a Tuesday email correspondence that "Multi-vector events are becoming more and more common...with the evolution of DDoS protection services, attackers are also stepping up their game, using larger and more sophisticated DDoS threats that are specifically designed to identify and exploit security flaws in protected Internet infrastructures."

World Cup is Prime Season for DDoS Attack Extortion Attempts

In the days leading up to the World Cup, security concerns are more acute as well, due to recent historical examples such as the conviction by A Dusseldorf, Germany court of a man for extortion from online gambling websites in the run-up to the 2010 Football World Cup in South Africa.

The Frankfurt individual succeeded in blackmailing three online betting sites while attempting to extort from 3 more by threatening DDoS attacks which would have shut the sites down completely during the increased betting (and thus revenue) season that the World Cup brings only once every four years.

The denial-of service threat in the run up to a major sporting event has become increasingly common cyber extortion attempt against betting sites in the last decade, as wagering houses come to rely increasingly on their online sports books for revenue.