The Mirai botnet had a very negative impact on game play for several servers, and I would argue it was the key factor in the demise of at least one of the servers simply because it rendered certain games unplayable.
I remember you had to use NukeNabber to block attacks to TCP port 139 IIRC.
It's not clear what you're talking about when you say "several servers" or "one of the servers". What servers are you referring to?
Granted, I'm also a little surprised that the FBI didn't just twist Google's arm about it, but who knows. Maybe Google did them a solid and doesn't actually charge for the ad space, or maybe the FBI is just trying to play nice since Google has plenty of federal contracts.
Just twist their arm? What does it mean for the FBI to twist Google's arm?
What I was trying to convey was that the FBI could have exerted some kind of pressure to get Google to run the anti-booter ads of their own volition instead of the FBI (presumably) buying the ads like anyone else would buy ads. I have no idea what that kind of pressure would entail cuz I don't work for the feds and couldn't say what their "do this or else" strategies are like, lol.
I think that you are making an assumption about how the FBI operates.
Surely it's obvious that by "pressure" I'm referring to the threat of some sort of nebulous legal-y action if Google didn't comply with [xyz request]. Is that not how law enforcement functions? (I'd be shocked if they were asking very nicely and offering to take Google out to dinner.)
> Broadly speaking, § 1030(a)(5)141 prohibits a variety of acts that result in damage to a computer. Subsection 1030(a)(5) may be used to prosecute many of the activities that are commonly associated with hacking, such as the transmission of viruses or worms and unauthorized access by intruders who delete files or shut off computers.142 The provision may also be used to prosecute the perpetrators of Distributed Denial of Service (DDoS) attacks,143 which occur, for example, when an attacker overwhelms a server’s ability to process legitimate requests by overloading the server with a flood of illegitimate traffic.1
Kicking your friend offline (via DDOS or other) would prevent it from processing legitimate requests and count as a breach of CFAA.
Your friend is not hosting a server and they are not incurring damages due to having trouble connecting to the internet.
The damages from not being able process legitimate requests is like if you DDoS an ecommerce site which means that they are unable to receive orders from legitimate customers which causes them damage.
But they are, right? Whoever is hosting the multiplayer match is running a server. And damages come in the form of being rendered unable to enjoy the video game they paid money for. "Damages" do not have to come in the form of lost customers.
> The CFAA broadly38 defines “computer” as any “electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions,” including “any data storage facility or communications facility directly related to or operating in conjunction with such device . . . .”39 The CFAA excludes only automated typewriters, typesetters, portable hand held calculators, and similar devices from its definition of computer.40 These limited exceptions to the CFAA’s definition of “computer” “show just how general” the statute’s definition of computer is.41 As one court explained, the definition includes any device with an electronic data processor, of which there are numerous examples.42 Thus, under the CFAA, computers include not only laptops and desktops, but also a wide array of computerized devices ranging from cellphones to objects embedded with microchips, such as certain microwave ovens, watches, and televisions. 43
The definition is extremely broad; which means it also includes things like modems and routers.
https://www.fbi.gov/contact-us/field-offices/anchorage/fbi-i...
The FBI would be indicting them, not just warning them -- go to all that trouble of setting up a fake site, and then you just give up actually indicting them for their crime? What's even the point of that? That they didn't know it was a fake site is no defense, the FBI routinely, say, sells people fake bombs and then indicts them.
Besides, if something is illegal and there's a significant portion of offenders who are truly ignorant of its illegality, perhaps a new approach to education is needed, which this tactic also covers.
Maybe other organizations will take notes...
Education
> Big Pipes’ Allison Nixon says she hopes that softer tactics like those can intercept would-be booter service operators early, before they start committing felonies: She’s found that most booter operators start as customers before launching their own service. But for people who aren’t dissuaded by those interventions, she says, Big Pipes and its partners at the FBI will still be watching them.
> “The hope is that this whole show of force will convince some of them to quit and get a real job,” Nixon says. “We want to send a message that there are people tracking you. There are people paying attention to you. We have our eyes on you, we might get you next. And it might not even be on Christmas.”
So the honeypots sound like a sort of catch-and-release strategy to scare kids before they start their own DDoS enterprises.
Don't these botnet services run on compromised computer systems?
For L7 request floods - they spin up a few dozen machines and use open & private proxies to funnel http requests thru. Sometimes those proxies are misconfigured squid, sometimes it's private proxy services, sometimes it's compromised machines converted into proxies (which may be open or require auth / has been sold).
For L3/L4 amplification/reflection they're buying machines where they can spoof and using UDP amplification lists (other people's machines) to reflect off of (and obviously not getting permission to, etc.).
This reminded me of a Wired article[1] from a few weeks back that argued that many of the kids using these services to DDoS their friends/rivals don't realize they're illegal—so federal agencies are taking out keyword ads to warn potential users:
> In fact, he and other members of [cybercrime-busting group] Big Pipes argue that most booter customers seem to believe—or convince themselves—that merely paying to use one of the services to knock out an adversary’s internet connection isn’t against the law, or at least isn’t an enforceable crime. When the UK’s National Crime Agency (NCA) ran a six-month Google advertising campaign in 2018 to intercept people seeking booter services and warn them about their illegality, Clayton’s research group found that attack traffic in the UK remained flat for those six months, while it increased at its usual pace in other countries.
> In the years since, law enforcement agencies seem to have learned from that experiment: The FBI now also buys similar Google advertisements to warn potential booter customers that paying for the services is a crime. The UK’s NCA, meanwhile, has not only launched new advertising campaigns but even run its own fake booter services to identify would-be customers and then send them warnings—sometimes even with in-person visits—about the consequences of paying for criminal DDOS attacks.
[1] https://www.wired.com/story/big-pipes-ddos-for-hire-fbi/ (For the relevant bits, scroll to the "Honeypots, Google Ads, Knock-and-Talks" section)