Botnets Turn to Gambling   3/30/2008 - 665 views,

And we don’t exactly hold up gambling sites as paragons of Internet virtue, either - not that we run from them covering our eyes and crying “unclean, unclean”, but they are at least in the US illegal. Indeed, it is now illegal for US banks and credit card companies to make payment to foreign online gambling sites, as US lawmakers were becoming increasingly concerned that internet gambling could worsen debt, addiction and other social problems. Quite apart from the possibility of attracting all manner of illegal activity, like money laundering. Or tax avoidance. And money there is: in 2001, spending in US land-based casinos alone reached almost US$26 billion.

So news from last week’s e-crime congress in London, bringing to light a case of the bad (a gambling site) being brought to its knees by the worse (a botnet), has us pondering the larger implications. The events reported occurred last year, and center around DDoS attacks taking offline the Internet gambling sites of UK-based Gala Coral.

While the service interruptions were fairly short (a half hour or so), it was the hitherto unreported nature of the attack that is so worrying. The attackers spent months in preparation, opening thousands of accounts with stolen credit cards, and analyzing the browsing and playing habits of typical users. When the DDos was unleashed from these n’er-do-well accounts, traffic patterns mirrored these ‘typical users’ but in such volume and from so many originating hosts that Gala Coral’s servers were swamped.

We do have some sympathy for a legal commercial enterprise trying to go about its business; online gambling remains legal in the UK. With prior DDoS attacks on Gala Coral often preceded by attempts to extort $100,000 or more, we can only surmise that the criminal DDoS attackers prefer sipping aged malt whisky from cut-glass tumblers to guzzling bottles of light beer and munching potato chips.