This idea – that DDoS attacks are now so easy to mount and within the reach of individuals, including those without significant technical resources or skills – has been amply demonstrated both within the hacktivism sphere and, recently, by the attack on Mumsnet.
Notoriously, the Anonymous movement employed a very crude tool – the Low Orbit Ion Cannon (LOIC) – to mount its attacks against the likes of Sony and PayPal. Followers were encouraged to download the code and run it from their own PCs. Many, swept up by the passion of the moment, did just that, only to find that a lack of any attempt on the part of the software to obfuscate their IP addresses resulted in them being easily identifiable by the authorities. A number of them ended up serving jail time.
“DDoS attacks are easy to put together, and there are a number of DDoS for hire services (also called ‘stressers’),” explains Conway. LOIC was indeed described as a network stressing tool, and was allegedly written for testing purposes (although the veracity of this claim has been impossible to establish). More recently, and less ambiguously, we've seen the arrival of the Lizard Stresser. This was released and used by the Lizard Squad, a hacking group that seems to have styled itself on the now-defunct (and mostly convicted) Lulz Security.
The Lizard Stresser first appeared in December 2014, when it was used by the Lizard Squad to disrupt the Sony PlayStation and Microsoft Xbox gaming networks. Soon after, it was set up as an online service that allowed people to pay to have sites attacked for up to eight hours at a time. The Lizard Squad site was itself hacked in early January 2015 and quickly disappeared.
Recently, the UK's National Crime Agency (NCA) made six arrests connected with the use of the Lizard Stresser tool against gaming sites, a school, a national newspaper and retailers.9 The NCA also interviewed 50 other people whose details were found on the Lizard Squad site. Shortly after the arrests, the NCA's website was taken offline for about an hour by a DDoS attack, and the Lizard Squad tweeted an image carrying the legend ‘Stressed out’ and the NCA logo. The NCA described the attack as a “temporary inconvenience”.