Step right up and get your malware – no skill required, prices start at $20!

By Cameron Abbott and Colette Légeret

It seems that the “service industry” has expanded into cyber-crime without us knowing about it as the Fortinet research team recently discovered. They came across malware-as-a-service schemes available on several Dark Web forums, with one designed as an easy-to-use point of entry for beginner Distributed Denial of Service (DDoS) attackers.

The DDoS kit disguises itself as a legitimate “booter” or “stresser” service and as it is relatively easy to set-up, almost anyone can go into the “DDoS a website for a fee” business. Some of the offerings are incredibly customisable. The research team found one such service that went operational on 17 October 2018 called “Ox-booter” which uses the Bushido botnet for its attacks. Bushido itself is relatively new, having only been identified in September 2018.

Ox-booter allows a DDoS campaign to be set-up, initiated and controlled from a single-user interface offering the wannabe cyber-attacker a variety of options. The service claims to have the ability to push out a 500GB per second attack from about 20,000 bots, but attacks can be set for different levels of intensity and length, with prices ranging between $20 and $150. Surprisingly enough, Ox-booter offers its users 24/7 support and access to all necessary tools to assist with DDoS attacks.

Fortinet tested the service and while they were unable to obtain the high performance advertised, what was generated was more than enough to take down most websites.

There we have it, DDoS attacks are available to purchase, by anyone, and at such low prices –less than a case of beer– it’s no surprise that around 300 attacks have been launched since Ox-booter went live!