Dutchman arrested in Spain for DDoS attacks on Spamhaus

Posted by   Virus Bulletin on   Apr 29, 2013

Suspect drove around in 'mobile bunker' to co-ordinate attacks.

Police in Spain have arrested a 35-year-old Dutchman, believed to be responsible for the DDoS attacks on Spamhaus last month.

Although the Dutch public prosecutor has only identified the suspect as 'SK', it is almost certain that he is Sven Olaf Kamphuis, spokesman for hosting provider CyberBunker. It was the blacklisting of CyberBunker's IP addresses that triggered the DDoS attacks, and Kamphuis has acted as an unofficial spokesman for the 'Stophaus' group behind the attacks - although, somewhat implausably, he denies any direct involvement.

CyberBunker is named after the disused NATO bunker from the Cold War era in the Netherlands, where it was once (and possibly still is) located. CyberBunker promises to host anything 'except child porn and anything related to terrorism', thus few will be surprised that it is a popular host for spammers, scammers and malware authors. It has also hosted a Wikileaks mirror and the website of torrent index The Pirate Bay.

For this latter reason, the provider has gained some popularity among the hacktivist community. This popularity may also have been fuelled by the spin Kamphuis has given to the story, where he tried to portray himself as an online Robin Hood, accusing Spamhaus in general and its founder Steve Linford in particular of wanting to control the Internet.

The attack on Spamhaus was said to be 'the biggest DDoS ever', and although some stories in the media about the iminent collapse of the Internet were somewhat inflated, it certainly was big. It disrupted both the website and the email infrastructure of the blacklist provider, although it didn't affect the DNS-based list itself. This led to the ironic situation where IP addresses could still be added to the blacklist, but removals could be delayed.

It is uncertain whether the arrest of Kamphuis means the DDoS attacks have now come to an end. Shortly after his arrest, some hacktivists posted an 'official' press release, in which they threaten more attacks if Kamphuis is not released. They also claim to be responsible for a series of DDoS attacks against Dutch banks and government websites in recent weeks, but this is probably to be taken with a pinch of salt.

More details at the blog of Brian Krebs here, with comments from Spamhaus's Steve Linford here. Meanwhile, the Dynamoo blog had a look at some of CyberBunker's IP space and found a significant part of it listed for spreading malware and/or spam.

Posted on 29 April 2013 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

We are more ready for IPv6 email than we may think

Though IPv6 is gradually replacing IPv4 on the Internet's network layer, email is lagging behind, the difficulty in blocking spam sent over IPv6 cited as a reason not to move. But would we really have such a hard time blocking spam sent over IPv6?

Subtle change could see a reduction in installation of malicious Chrome extensions

Google has made a subtle change to its Chrome browser, banning the inline installation of new extensions, thus making it harder for malware authors to trick users into unwittingly installing malicious extensions.

Paper: EternalBlue: a prominent threat actor of 2017–2018

We publish a paper by researchers from Quick Heal Security Labs in India, who study the EternalBlue and DoublePulsar exploits in full detail.

'North Korea' a hot subject among VB2018 talks

Several VB2018 papers deal explicitly or implicitly with threats that have been attributed to North Korean actors.

Expired domain led to SpamCannibal's blacklist eating the whole world

The domain of the little-used SpamCannibal DNS blacklist had expired, resulting in it effectively listing every single IP address.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.