Mafiaboy and the 2000 DDoS Attacks That Took Down Yahoo and Amazon

On 7 February 2000, Yahoo, then the most visited site on the internet, became unreachable for around three hours. Over the following days, other household names went the same way: Buy.com, eBay, CNN, Amazon, ZDNet, E*Trade and Dell. The dot-com boom was at its peak, and the attacks demonstrated that the biggest names on the web could be knocked offline from afar. The person behind them turned out to be a 15-year-old in Montreal.

What a DDoS attack is

A denial of service attack tries to make a service unavailable by overwhelming it. A distributed denial of service attack, or DDoS, does this from many machines at once, so that the traffic is hard to block by banning a single address. The victim's servers or network links run out of capacity, and real visitors cannot get through.

The idea of flooding a server was not new. What changed in the late 1990s was the ability to coordinate large numbers of compromised computers. In August 1999, a tool called Trinoo was used to attack a system at the University of Minnesota, and similar tools such as Tribe Flood Network and Stacheldraht followed. They worked by installing small programs, often called agents, on hacked machines, and then commanding all of them from one control point.

The February 2000 attacks

The attacker, who used the online name Mafiaboy, compromised computers at several universities and other networks, then used them to send huge volumes of traffic at his targets. Yahoo went down first. In the following days, a string of other sites reported problems. Because many of these sites were central to the commercial web, the outage drew the attention of the press, investors and the White House.

US President Bill Clinton convened a meeting on internet security in mid-February with technology executives and security experts. Financial estimates of the damage were large, with a figure of over a billion dollars sometimes quoted, but such numbers are hard to verify and should be read as rough guesses.

How he was caught

The investigators were helped by the attacker's own vanity. He boasted about the attacks in internet chat rooms, and he was heard by people who then contacted the authorities. The FBI and the Royal Canadian Mounted Police worked together, using chat logs and records of connections. In April 2000, Canadian police arrested a teenager in Montreal. His name was later made public as Michael Calce.

Because he was a minor, the case went through the youth justice system. In 2001 Calce pleaded guilty to a number of charges, and he was sentenced to eight months in open custody, a year of probation, and restricted use of the internet, along with a small fine. He later became a security consultant and author, and has spoken publicly about the episode.

Why it was a turning point

The attacks showed several things at once.

• Size no longer protected a site. The largest sites in the world had no particular immunity.
• Cheap tools could do large damage. A teenager with downloaded tools had caused disruption on a national scale.
• The weak points were the other machines. The attacks only worked because many ordinary computers at universities and elsewhere had not been secured and were used as relays.

The incident brought attention to techniques for filtering traffic close to its source, and spurred the growth of companies that sell DDoS protection by absorbing attack traffic on large networks.

The aftermath for the targets

For the companies hit, the outages were an embarrassment as much as an expense. Online retail was new, and trust was fragile. Executives who had spent years telling customers that the web was reliable now had to explain why it had not been. Several of them began to invest in extra capacity and in specialist help, and some of the first commercial DDoS mitigation services date to this period. The incident also exposed how little coordination existed between internet providers on handling attack traffic. Providers had to phone each other to ask for filters, which is slow when an attack is already under way.

DDoS today

DDoS attacks have grown enormously since 2000, driven by networks of compromised devices, called botnets, which now include home routers and cameras. Attackers can also rent attack capacity from criminal services, which has made the technique accessible to people with little skill. Some attacks target a site's bandwidth, others its processing, for example by requesting expensive pages again and again. Small sites are frequent victims, sometimes as part of extortion attempts.

Common types

Type	What it exhausts
Volumetric flood	Network bandwidth
Protocol attack	Connection tables and server resources
Application-layer attack	Web server or database capacity

The lesson for site owners today

You cannot stop an attacker from sending traffic, but you can decide where it lands. A site that sits directly on a single server has nothing between it and a flood. A site behind a large content delivery network spreads the load across a global network and filters bad traffic before it reaches the origin.

1. Put a CDN with DDoS filtering in front of your site.
2. Cache as much of your content as possible, so that the origin does less work.
3. Hide your origin server's address, and restrict access to it.
4. Have a plan for who to contact and what to do if the site goes down.

For a wider baseline of measures, see the security page.

Adding a layer in front

Cloudflare CDN is available on sites hosted with Zebra Hosting. You can read how it works on our CDN page, and the security page describes how it fits into the bigger picture.