Suspect drove around in ‘mobile bunker’ to co-ordinate attacks.
Police in Spain have arrested a 35-year-old Dutchman, believed to be responsible for the DDoS attacks on
Spamhaus
last month.
Although the Dutch public prosecutor has only identified the suspect as ‘SK’, it is almost certain that he is Sven Olaf Kamphuis, spokesman for hosting provider
CyberBunker
. It was the blacklisting of
CyberBunker
‘s IP addresses that triggered the DDoS attacks, and Kamphuis has acted as an unofficial spokesman for the ‘Stophaus’ group behind the attacks – although, somewhat implausably, he denies any direct involvement.
CyberBunker
is named after the disused NATO bunker from the Cold War era in the Netherlands, where it was once (and possibly still is) located.
CyberBunker
promises to host anything ‘except child porn and anything related to terrorism’, thus few will be surprised that it is a popular host for spammers, scammers and malware authors. It has also hosted a
Wikileaks
mirror and the website of torrent index
The Pirate Bay
.
For this latter reason, the provider has gained some popularity among the hacktivist community. This popularity may also have been fuelled by the spin Kamphuis has given to the story, where he tried to portray himself as an online Robin Hood, accusing
Spamhaus
in general and its founder Steve Linford in particular of wanting to control the Internet.
The attack on
Spamhaus
was said to be ‘the biggest DDoS ever’, and although some stories in the media about the iminent collapse of the Internet were somewhat inflated, it certainly was big. It disrupted both the website and the email infrastructure of the blacklist provider, although it didn’t affect the DNS-based list itself. This led to the ironic situation where IP addresses could still be added to the blacklist, but removals could be delayed.
It is uncertain whether the arrest of Kamphuis means the DDoS attacks have now come to an end. Shortly after his arrest, some hacktivists
posted
an ‘official’ press release, in which they threaten more attacks if Kamphuis is not released. They also claim to be responsible for a series of DDoS attacks against Dutch banks and government websites in recent weeks, but this is probably to be taken with a pinch of salt.
More details at the blog of Brian Krebs
here
, with comments from
Spamhaus
‘s Steve Linford
here
. Meanwhile, the
Dynamoo
blog had a look at some of
CyberBunker
‘s IP space and
found
a significant part of it listed for spreading malware and/or spam.
Posted on 29 April 2013 by
Martijn Grooten
Leave a Reply