By Brian Cullingworth (InfoPowa News)
Eastern European and Brazilian criminals involved
April 15, 2004
The online gaming industry is fighting back against "denial of service" attacks by extortionists. Criminal attempts to extract "protection money" have had an effect on online casinos and poker rooms.
The big sports books were targets of blackmailers in 2004. This year many online casinos, poker rooms and even some gambling portals reportedly had success in averting similarly vigorous assaults, experiencing only intermittent interruption of their activities.
An even greater number of gaming websites have elected not to be identified after their encounters with the digital crooks.
Online gamblers may have experienced short interruptions of service. This does not appear to have turned the gamers against their casinos. Since the extortionists try to attack where they can at any opportune moment, gamblers could feel the ripples anywhere in the online gaming community, although maybe not very often.
Online gamblers can rest assured that their personal information is not at risk. The extortionists don't try to break into the records of secure casinos or steal any information. They threaten instead to drown the targeted website with huge amounts of data arriving in countless small packets. This would cause the website to stall and stop working.
The modus operandi of the masterminds behind the extortion is based on using thousands of separate computers to transmit data to the victim website.
The extortionists reportedly demand payment before they launch an attack - pay up and we'll leave you alone. We understand most of the attacks emanate from Brazil and Eastern Europe.
Many online casinos are reticent about any such crooked approaches that may have been directed at them. Even so it is evident that the criminals are now targeting the entire online gambling industry after years of concentrating on the sports books. There have been reported demands of up to $50,000 in protection money.
In the sports book sector, BetWWTS reportedly paid $30,000 to extortionists before deciding to resist further blackmail. Other online establishments are adopting a similarly tough approach to this criminal activity. Rather than pay the crooks, a few poker rooms and casinos recently went offline. Among them were Cryptologic's InterCasino, InterCasinoPoker, Harrods Casino, VIP Casino and InterBingo.
In another recent turn of events, Major Wager, The Prescription and Sports 911 fell victim to recent attacks but were back online in quick time after calling in the technical, telecommunications and ISP boffins. The assaults on these three appear to have been launched from Calgary in Canada. The RCMP and Interpol are undertaking intensive investigations. What they already know is that the extortionists tried to hit a large number of online sports books, poker rooms and casinos, among them the substantial Canbet organization.
In an authoritative three-part series, Interactive Gaming News reported that Paddy Power, Blue Square, Coral and companies of that ilk had been targets.
Ross Ivers, director of finance at Blue Square, said the attacks were a level removed from mere "hacking." There had been no attempts to steal confidential information. The criminals used a blocking tactic which, said Ross, was not unlike forcing 400 gamblers into a betting shop so that no other gamblers could get in.
Criminal actions of this type seem to build up during high-action periods such as March Madness when the volume of betting increases significantly. In response, the majority of operators aim to counter the attacks by installing enhanced technical and other safeguards.
BetonUSA, for instance, is likely to accept bets amounting to $30 million during the March Madness period. With the fervor it inspires, this key period on the sports calendar is estimated to bring in $80 million in bets from recreational gamblers. It was during March Madness that UKBetting, by its own admission, was forced offline for several hours, not once but twice.
By and large, the bigger operators won't be bullied into paying off the crooks.
Yet the criminal organizations behind the blackmail could cost millions of dollars, euros or pounds to companies which are not adequately protected.
Extortionists brought a major online bookmaking company to a halt as the climax of the Cheltenham Festival was approaching. Other online gambling sites suffered disruption caused by dozens of attacks timed to coincide with highlight races during the festival. Gamblers couldn't place their bets. The cost in lost revenue may amount to millions.
It's thought that the extortionists on this occasion were elements of the Russian underworld. They demanded blackmail of up to 10,000 British pounds as a fee for not crashing a targeted website.
Politicians in Britain are pressing for an urgent crackdown on digital crime of this nature. One security guru observes that it is nothing more than traditional extortion dressed up in modern guise.
William Hill, one of the companies singled out for recent assaults, says it fended off resolute attempts to shut it down. Company spokesman David Hood stated that an attempted attack on the William Hill website lasted for 24 hours. The attack failed. It also pointed the way to special security measures, such as restricting online access to the site from certain regions of the world.
Booth said the company ran at 50 percent capacity during the attack. The demand for blackmail payment arrived only after the assault had ended. The company made it clear that it wasn't paying money to any crook. Since then there have been no further attacks.
V.O. Group, a company based in Malta, operates MVPsportsbook.com and other gambling sites. Its chief technology officer, Matthew Wilson, says they are still getting blackmail demands even though they paid money to extortionists after a series of negotiations in 2003. This time round, the company has strengthened its defenses. It won't be paying the crooks again.
Much more recently there have been reports that Casino Euro was under attack. This casino told its affiliates about the assaults and said it would be going temporarily offline as a result.
The bulk of the evidence disclosed by a number of global law enforcement
agencies on the trail of the extortionists indicates that they operate from Brazil and Eastern Europe, mainly Russia.
Barret Lyon, DigiDefense International's chief technology officer, says at least five organizations are currently engaged in this racket. DigiDefense is a network security company. Its services are being bought by many gambling houses. To shield its clients, it diverts and filters Internet traffic from their sites to its own system, which is the digital equivalent of a fortress bristling with defenses.
DigiDefense pulls out all the stops to protect its premises and its staff at its San Jose headquarters. There are guards armed with shotguns on every floor of the building. Bodyguards accompany everyone who travels for the company.
Lyon says the attempted extortion goes beyond being just a digital threat. "It's terrorism. There are some extraordinarily vicious emails."
The British online betting exchange Sporting Options was reported to have been affected by a denial of service coinciding with the Grand National, Britain's premier race for betting, and the Arsenal-Manchester United semi-final in the FA Cup. Sporting Options felt the effects of a sustained attack aimed at online bookies, with more than 15,000 punters being affected.
Police said the casino received a threat that its site would be knocked down unless a payment of 40,000 Euros was made through Western Union.
A customer service representative at Sporting Options says they ignored the threat. The British National Hi-Tech Crime Unit is investigating this attempt at extortion. Sporting Options has given its members an assurance that their confidential information was not compromised. The attack was vicious but the site's integrity remained intact.
Normal activity on the site resumed following the application of corrective security measures by Sporting Options and its Internet service provider.
Large online bookmakers including Totalbet have endured the same types of assaults.
Computer crime syndicates in Eastern Europe have extorted payments from 10 percent to 15 percent of the companies that have received warnings from them, according to DK Matai, the executive chairman of M12G, a security firm.
USA Today reports that the majority of gangs email their demands to intended victims in the build-up period of top sports fixtures including March Madness, the Grand National or the Superbowl.
The current wisdom is that the most effective way to stop the modern, high-tech blackmailers in their tracks is to refuse their demands for protection money and to ward off their attacks with trained personnel and new technology which has emerged to meet this type of threat.
A selection of defensive products is now available from a range of extremely capable technical organizations. They can be an invaluable additions to the anti-crime weaponry of any online website. Behind the scenes, the leading software suppliers are also participating in the campaign against the criminals.
Meanwhile the electronic and digital crime teams of national and global law enforcement are receiving bigger budgets and making a concerted effort to root out the infection at its source. Being a Web extortionist is becoming more and more difficult.
Internet crime is not restricted to Internet gambling. A report from McAfee Security highlights the growing menace of viruses and DDoS attacks among small businesses in Europe, where recent invasions of this type have forced 22 percent of small businesses to interrupt their online activity at various times while they go through the disinfection process. McAfee indicates that in excess of 14 million such businesses with fewer than 20 staff have suffered to some degree recently.
McAfee's report is in line with survey findings by the National Hi-Tech Crime Unit in Britain, which estimates that computer and Internet crime inflicted a cost of hundreds of millions of pounds on UK companies in 2003.
McAfee further projects that every attack against an online casino costs the owner more than $6,000 in lost revenue and security expenses. Among the thousands of online casinos in Western Europe, the cumulative yearly cost of these crimes amounts to more than $20 billion.
France and Italy were the most severely affected, with attacks locking down 50 percent and 30 percent of small business respectively. In Spain, 20 percent of small businesses that responded to the survey reported irrecoverable file losses or damage resulting from malicious digital invasions.
McAfee technology consultant Jack Clark warns that matters are worsening. The first three months of 2004 spawned more viruses than the entire previous year.
It's tough enough already for online casinos to make a go of it in their highly competitive zone of the online world. In addition they have to deal with Web fraud artists who distribute questionable emails or set up fake casinos with the aim of luring members of the public into submitting their banking information or passwords. On top of this comes the new scourge of blackmailers who threaten to paralyze websites with a flood of data and deny service by shutting down the site unless the owners pay "protection money."
It's disturbing that most European companies don't keep their anti-virus software up to date even though the cyber attacks are increasing in number and ferocity. McAfee reports that 60 percent of British businesses, for example, are wide open to these attacks.
Clark warns that online businesses as whole are guilty of "a lack of awareness."
Online gambling businesses should closely heed this advice:
Speak to technical and gambling software experts. Get their advice on the newest developments in screening and defensive measures.
Resist the demands of extortionists. Paying up now may look like an easier way out, but they'll know who to target the next time.
Tell your customers what's happening. Many of them may otherwise believe their system is experiencing problems.
Notify the authorities immediately if you receive a threat or an attack. Besides helping the cops to catch the crooks, your information can help the good guys to identify criminal trends and patterns of behavior.
