An American grand jury indicted a German and a Briton last Thursday, beginning the first American prosecution of hackers for distributed denial-of-service attacks. Axel Gembe and Lee Graham Walker are accused of intentionally damaging a computer system and conspiracy, charges that could lead to fifteen years in prison.
A distributed denial-of-service, or DDoS, attack occurs when a large number of computers simultaneously send massive information requests to another computer, leaving the target unable to handle the onslaught of traffic generated. This is often accomplished by a “botnet,” or series of compromised computers acting like an army of robots locked in on their target.
The men were allegedly hired by Jay R. Echouafni, owner of home satellite dealer Orbit Communications, to take down the Web sites of two competing companies. The attacks were successful. Los Angeles-based WeaKnees was unable to operate for approximately two weeks, while Miami-based Rapid Satellite also suffered damages.
Gembe was apparently hired due to his extensive knowledge of computer viruses. He is thought to have developed several major computer viruses, including Agobot and Phatbot. German authorities also believe he stole the source code for the video game Half Life 2, but prosecutors were unable to press the case due to weak evidence.
Echouafni and his associate Paul Ashley were charged with the conspiracy in 2004. Ashley has already served a two-year prison sentence as part of a plea agreement, but Echouafni continues to evade law enforcement.
What’s unique about the DDoS attacks in this case is the extent of damages actually suffered; the Federal Bureau of Investigation reports that WeaKnees estimates $200,000 in damages, with Rapid Satellite reporting “substantial” losses as well. DDoS attacks have been well known on the Internet for years but have generally been much smaller, resulting from personal vendettas or boring Saturday nights. Extended attacks with a commercial purpose such as those allegedly carried out by Gembe and Walker are considered much rarer.
This case reveals a significant gap between the development of Internet crimes and their prosecution. Botnets have been run on Internet chat servers since at least the early 1990s and similar tactics have been used against various types of Internet servers for over a decade. Nevertheless, the first U.S. indictments of hackers involved in such activity only occurred in October 2008.
In time, officials hope to understand the Internet better, become more adept at fighting cybercrime and close the gap between cybercriminals and cybercops.
– Brian Van Wyk
