Dutchman arrested in Spain for DDoS attacks on Spamhaus

Posted by   Virus Bulletin on   Apr 29, 2013

Suspect drove around in 'mobile bunker' to co-ordinate attacks.

Police in Spain have arrested a 35-year-old Dutchman, believed to be responsible for the DDoS attacks on Spamhaus last month.

Although the Dutch public prosecutor has only identified the suspect as 'SK', it is almost certain that he is Sven Olaf Kamphuis, spokesman for hosting provider CyberBunker. It was the blacklisting of CyberBunker's IP addresses that triggered the DDoS attacks, and Kamphuis has acted as an unofficial spokesman for the 'Stophaus' group behind the attacks - although, somewhat implausably, he denies any direct involvement.

CyberBunker is named after the disused NATO bunker from the Cold War era in the Netherlands, where it was once (and possibly still is) located. CyberBunker promises to host anything 'except child porn and anything related to terrorism', thus few will be surprised that it is a popular host for spammers, scammers and malware authors. It has also hosted a Wikileaks mirror and the website of torrent index The Pirate Bay.

For this latter reason, the provider has gained some popularity among the hacktivist community. This popularity may also have been fuelled by the spin Kamphuis has given to the story, where he tried to portray himself as an online Robin Hood, accusing Spamhaus in general and its founder Steve Linford in particular of wanting to control the Internet.

The attack on Spamhaus was said to be 'the biggest DDoS ever', and although some stories in the media about the iminent collapse of the Internet were somewhat inflated, it certainly was big. It disrupted both the website and the email infrastructure of the blacklist provider, although it didn't affect the DNS-based list itself. This led to the ironic situation where IP addresses could still be added to the blacklist, but removals could be delayed.

It is uncertain whether the arrest of Kamphuis means the DDoS attacks have now come to an end. Shortly after his arrest, some hacktivists posted an 'official' press release, in which they threaten more attacks if Kamphuis is not released. They also claim to be responsible for a series of DDoS attacks against Dutch banks and government websites in recent weeks, but this is probably to be taken with a pinch of salt.

More details at the blog of Brian Krebs here, with comments from Spamhaus's Steve Linford here. Meanwhile, the Dynamoo blog had a look at some of CyberBunker's IP space and found a significant part of it listed for spreading malware and/or spam.

Posted on 29 April 2013 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2018 paper: The dark side of WebAssembly

Today, we publish the VB2018 paper by Symantec researchers Aishwarya Lonkar and Siddhesh Chandrayan on the security risks that come with WebAssembly.

The Virus Bulletin conference returns home: VB2019 to take place in London

In 2019, the Virus Bulletin conference is set to return home, with VB2019 taking place in London, UK.

Guest blog: The case for increasing transparency in cybersecurity

In a guest blog post, Kaspersky Lab's Anton Shingarev considers the case for increasing transparency in cybersecurity.

VB2018 preview: Workshops

Workshops make their VB Conference debut during VB2018, giving delegates the opportunity to learn the basics of kernel-level malware analysis, Android reverse-engineering and artificial intelligence.

New article: Through the looking glass: webcam interception and protection in kernel mode

Today we publish a short article by Ronen Slavin and Michael Maltsev, researchers at Reason Software Company, who dive into the video capturing internals on Windows, and explain how this can be used by a malicious actor to steal images recorded by a…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.