For a few days in 2017, visitors to the websites for the city of Akron, Ohio, and its police department received error messages instead of the municipal webpages. A hacker had overwhelmed the sites with traffic.
City officials spent about four days in a game of whack-a-mole with the hacker, restoring the sites only to have them attacked again. In this type of attack, known as distributed denial of service (DDoS), bots or other computers overwhelm a single website with traffic until the site shuts down from lack of bandwidth. In addition to denying the public access to the websites, other city services were limited by the outage. After the initial four-day attack, hacking attempts directed at local and state government continued off and on for months.
The city quickly notified the FBI, which opened an investigation.
“When you have a persistent attacker going after a single site, the organizations have to spend a lot of time and effort handling it. There are also often effects on other systems besides the website,” said the special agent who investigated the case out of the FBI’s Cleveland Field Office.
This hacker was a “hacktivist” who liked to brag about his work, helping investigators quickly find him. James Robinson, then 32, posted screenshots of the sites he’d taken down and of the tools he had used. When questioned by investigators, Robinson admitted to these attacks and to several previous DDOS attacks on more prominent websites, such as the National Institutes of Health, the Department of Defense, and the Department of the Treasury.
Robinson told investigators he had grudges against the city’s police department. He was also involved in a hacking group and participated in hacks directed by that group.
“He was very vocal about what he was doing. He wanted to bring attention to his opinions,” the agent said of the hacktivist.
With the availability of “stressor” sites online that will cheaply conduct a DDOS attack on your behalf, Robinson didn’t require any special technical skills to take down these sites. He was adept at using these tools.
“When you have a persistent attacker going after a single site, the organizations have to spend a lot of time and effort handling it.”
Special agent, FBI Cleveland
Robinson pleaded guilty to damaging protected computers and was sentenced in October to six years in prison.
The FBI case agent stressed the importance of organizations protecting their websites and other online infrastructure as much as possible. Quickly notifying authorities of an intrusion or attack is also critical.
“The Internet is based on trust, and it’s like a network of roads. When you’re driving, you trust other drivers will stop at stop signs. Occasionally, a driver doesn’t stop, and someone gets hurt,” the agent said. “When someone acts maliciously on the Internet, bad things happen, and there are real-world impacts. That’s why we have to pursue these types of cases.”
Resources
Akron Man Sentenced to Six Years in Prison for Launching Denial of Service Attacks That Shut Down Websites for the City of Akron and the Akron Police Department
source Department of Justice