Feeds

Feds raid server farms in bid to root out PayPal DDoS perps

On the trail of Anonymous

Beginner's guide to SSL certificates

Federal investigators have seized servers allegedly abused to launch a denial of service attack against PayPal earlier this month.

An affidavit obtained by the Smoking Gun contains testimony by federal agents convinced that systems at Texan hosting firm Tailor Made Services are likely to contain clues in the hunt for hacktivists who launched an attack against PayPal in response to its decision to freeze an account used by WikiLeaks. The suspension of the account followed the release of US diplomatic cables by the whistle blowing site.

Volunteers were encouraged by members of the loosely bound Anonymous collective to download a tool to pepper the websites of financial firms who had turned their back on WikiLeaks - including MasterCard, Visa and Swiss bank PostFinance as well as PayPal - with junk traffic.

FBI investigators are proceeding on the assumption that some used botnets of compromised machines in order to launch a more potent distributed denial of service attack against PayPal, knocking its corporate blog offline for at least several hours.

PayPal supplied FBI agents with eight IP addresses of systems used to run IRC chat servers associated with planning the so-called Operation Avenge Assange attacks. Investigators reckon the same systems were also used as command and control hubs for botnets used the DDoS assault against PayPal et al.

The Texan systems were traced back via a compromised machine at Host Europe, Germany. Investors alleged that the command to launch an attack against PayApl was made via systems hosted by Tailor Made Services in Texas and relayed via the servers at Host Europe in a bid to disguise its origin. A pair of log entries on the compromised Host Europe machine contained the same message: "Good_night,_paypal_Sweet_dreams_from_AnonOPs." according to a sworn statement from FBI agent Allyn Lynd.

The affidavit was used to obtained a search warrant used on a raid on Tailor Made Services on 16 December. Agents copied two hard drives from the targeted server during this raid. A second IP address associated with the pro-WikiLeaks attacks was traced to a virtual server physically hosted by Hurricane Electric in California.

It's unclear whether or not a suspect has been identified through the FBI's investigation thus far. ®

Remote control for virtualized desktops

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
Turnbull should spare us all airline-magazine-grade cloud hype
Box-hugger is not a dirty word, Minister. Box-huggers make the cloud WORK
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
Do you spend ages wasting time because of a bulging rack?
No more cloud-latency tea breaks for you, users! Get a load of THIS
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.