Online gaming sites attacked by botnets
Distributed denial of service attacks (DDoS) wreaked havoc at online gaming sites earlier this week. Full Tilt Poker, Titan Poker, Virgin Games and Party Poker were among the sites attacked by a web-based botnet, according to the Shadowserver Foundation, a watchdog group of security professionals that gathers, tracks, and reports on malware, botnet activity, and electronic fraud. Some e-commerce sites were also attacked.
The full impact of these attacks is not immediately clear. Full Tilt Poker's Web site was inaccessible for parts of Sunday and Monday. And Full Tilt had to "pause" the final table of the FTOPS VII Main Event for a brief period with just three players remaining when its client lost connectivity with the FUll Tilt servers.
The botnet DDoS attacks are the likely culprit for Full Tilt's client problem during the tournament "if their site is part of the server farm that runs fulltiltpoker.com," said Andre M. DiMino, director of the Shadowserver Foundation.
"A botnet is a network of compromised computers that act as drones under the common control central server," DiMino says.
"Traditionally, the way they're formed is through viruses that infect machines that are then recruited to join the botnet," DiMino added. "The way the malware compromises the computers is it points it to the server that is the control point."
"The operator of the (Web) botnet, through the command server, then issues instructions to compromised machines that form the botnet," DiMino said.
"Usually the infected machine's owner doesn't know his machine is compromised," DiMino added.In the case of Full Tilt Poker, "each of the compromised machines were instructed to send simultaneous requests to Full Tilt Poker site, which was too much for the servers to bear." DiMino explained. "(The requests) overloaded the bandwidth and took the server(s) offline."
The fact that the DDoS attacks were web based made it more difficult to repel, DiMino said. Traditionally, DDoS attacks are controlled by Internet Relay Chat (IRC), which is fairly easy to block, DiMino added. But Web botnets are "more resilient and difficult" to stop.
The botnets caused Titan poker pages to load intermittently. Casino City has sent requests for information to other targeted sites to determine the impact of the attacks.
The Shadow Foundation traced the initial attacks to a server hosted by Layered Technologies. That server has been shut down, but the botnet has moved to a new host and IP address.
"DDos attacks are always going to be out there," DiMino says. "In the past, they were used to show the might of the botnet. But the real purpose for botnets now is fraud and identity theft."