Full Tilt victim of distributed denial of service attacks
Related Articles
Poker forums have been buzzing for the last week or so with threads about the unusual downtime experienced by online poker room Full Tilt Poker. Today, several sources are reporting that the downtime was not the result of an internal issue, but rather the result of external distributed denial of service (DDoS) attacks from unknown groups.
The primary article sourced in most reports comes from shadowserver.org, a volunteer group dedicated to tracking, identifying and solving Internet security issues. Excerpt:
Early yesterday morning I logged online to take a look at the live output of the distributed denial of service (DDoS) attacks that have been coming from HTTP botnets we are monitoring. It only took a moment for this becoming rather interesting. The word “poker” appeared a few times and quickly caught my eye. As it turns out, I was logged in from my hotel room in Las Vegas and had actually just returned from playing poker. The output I was presented with looked something like this (extraneous and other information have been removed/edited):
ddos_command=`flood http`, control_server=`
`, ddos_target=`www.fulltiltpoker.com` ddos_command=`flood http`, control_server=`
`, ddos_target=`www.titanpoker.com` ddos_command=`flood http`, control_server=`
`, ddos_target=`www.cdpoker.com` These are all familiar websites, especially the website for Full Tilt Poker. They are one of the bigger Poker websites on the Internet. Typing all three of these websites into a browser revealed that only one of them, CDPoker, was actually accessible. For the next hour or so that I checked, I could not reach Full Tilt’s website at all and Titan Poker would load sporadically. Further review would later show that CDPoker may have some form of DDoS protection through Prolexic and that Titan Poker was using four different IP addresses. That might explain why CDPoker had no load issues and Titan Poker would periodically load, albeit usually rather slowly. It would appear that Internet poker websites were under attack. As a result we decided to dig a little deeper into the activities of this particular HTTP botnet.
There’s been no official comment from FTP so far, and no word on the motives of the attackers.
