Intellectual Property Law

Online Casinos Will Experience Cyber-Extortion During SuperBowl Betting

By IBLS Editor

 Online casinos nearing one of their biggest paydays of the year on the eve of SuperBowl XLII must also await anxiously to see whether their site will be one of the many hit by a Distributed Denial of Service attack (DDoS), meant not just to disable, but also reap financial gains for the cyber-criminals who initiate them. The assaults are invariably accompanied by an email note that reads something like, "Your site is under an attack and will be for this entire weekend. You have a flaw in your network that allows this to take place. You can ignore this email and try to keep your site up, which will cost you tens of thousands of dollars in lost wagers and customers, or you can send us $40k by Western Union to make sure that your site experiences no problems." This latter was an actual threat accompanying such an attack. The extortionists will also claim that such a payoff will also provide the website "insurance" for a period of some months against future threats. There may be as many as 10,000 such DDoS incursions a day, globally, according to Bankrate.com.

These criminal hackers typically block access to a website by the DDoS assault which is launched for one reason only -- to extract a ransom. Most online betters are unaware that the global $15-billion-a-year online gambling industry is, according to a recent report, "regularly held for ransom by sophisticated hackers and organized criminals." Amazingly, these attacks not only often have a Mafia connection, but are also colored by political and ideological commitments, and spread out transnationally, according to the British Internet security firm, mi2g Intelligence Unit.

A 2006 study by a researcher at St. Mary's University in Halifax details such "cyber extortion." Criminologist John McMullan says online gambling sites are targeted for "digital shakedowns" at their most profitable times, such as the upcoming Super Bowl and other major sporting events. During the DDoS attacks, unknown criminals launch an assault during the peak betting periods bringing the site offline and sending a message to the owners, which according to McMullan "typically demand $40,000 to $60,000 in ransom in order to release the website so that users can return and keep playing." McMullan claims the hackers are not disorganized kids, but well-disciplined persons who have a business hierarchy that is globally oriented and unseen, where the leaders recruits helpers via email, without ever meeting in person. The study is titled, Cyberextortion at Online Gambling Sites: Criminal Organization and Legal Challenges, and was published in the Gaming Law Review, volume 11, number 6 in 2007, pages 648-665.

Says McMullan of these criminal masterminds, "They recruited different people, like hackers and worm writers, and crackers. There were people who were involved in picking up the money, bankers who were able to move the money around." Recent arrests in Latvia, Russia and Eastern Europe show where some of the perpetrators are located. McMullan warned websites not to get too comfortable in their security systems because the criminals are always updating their methods, as well.

A DDoS attack can be likened to getting ten-thousand fake phone calls to your home during a day. This would keep a person from receiving legitimate calls from friends or making any phone calls out, because every time the the phone is hung up it would ring again. In fact, the phone would eventually be taken off the hook. Likewise, a DDoS attack is the overwhelming of a computer system with so many bogus messages that the equipment essentially freezes up, being overwhelmed by sheer volume. Such actions can be launched by just a single person who knows what he or she is doing, especially if they have access to more than a few computers through previous nefarious activity.

One Internet security expert defines a coordinated DDoS attack in technical terms: "A Distributed Denial of Service (DDoS) attack uses many computers to launch a coordinated DoS attack against one or more targets. Using client/server technology, the perpetrator is able to multiply the effectiveness of the Denial of Service significantly by harnessing the resources of multiple unwitting accomplice computers which serve as attack platforms. Typically a DDoS master program is installed on one computer using a stolen account. The master program, at a designated time, then communicates to any number of "agent" programs, installed on computers anywhere on the Internet. The agents, when they receive the command, initiate the attack. Using client/server technology, the master program can initiate hundreds or even thousands of agent programs within seconds. "

Peder Jungck, Founder and CTO of Cloudshield Technologies has said about these attacks: "Denial of service attacks are very difficult to stop because they can easily overrun an Internet Service Provider's (ISP's) defenses. For example, in one recent incident... an ISP was facing a sustained attack against its DNS services exceeding one million requests per second - that's roughly 100 times the

capacity of typical DNS servers. The ease with which hackers and extortionists can launch such massive assaults is making DoS attacks increasingly popular, particularly those targeting e-commerce sites around peak traffic times like the Super Bowl."

The cyber-criminals are at complete ease in going after online gaming more than any other Internet business because these companies often exist offshore in countries with small infrastructures to help battle such incursions and little police or government support, given the typically smaller regimes they host from. Further, since online betting is officially illegal in the U.S., whereas the gamers are often Americans, it throws an extras wrench into the works. One cannot go to America as a venue for a theft that occurs within another crime, obviously.

For the casino operators who may need the SuperBowl payday badly, the phenomenon presents a classic no-win situation. The owners can ignore the email and place their bets on their server security systems, or bite the bullet and pay the ransom up front. Yet, what often transpires is the owners disregard the notes until they are hit with an avalanche of sudden activity that brings their business to its knees by shutting down all traffic. Then they open up their wallets and pay off the cyber-extortionists so as not to miss out on hundreds of thousands, or even millions in wagers. Online casinos are not a bad target for the cyber-crooks, since the under-protected sites often have to fight for survival on their own terms, and also given the larger gaming houses usually keep from $300-$400 million on hand to cover debts.

Full post as published by IBLS Internet Law Blog on January 22, 2008 (boomark / email).