Russian held over botnet attack on Amazon.com
A Russian man believed to have launched denial-of-service attacks against Amazon.com has been arrested in Cyprus, where he faces extradition to the US.
Dmitry Olegovich Zubakha was detained on an international warrant on Wednesday, the US Department of Justice said. He has been charged with crimes relating to allegations he launched two botnet-based distributed denial-of-service (DDoS) attempts against the online retailer in 2008.
"Orders from Amazon.com customers dropped significantly, as legitimate customers were unable to access the website and complete their e-commerce transactions during the pendency of the attack," read an indictment unsealed in district court in western Washington on Thursday.
The Moscow resident is also thought to have tried to use the botnet to overwhelm systems at Priceline.com and eBay, and to have made hacking attempts using 15 or more unauthorised devices.
Zubakha is believed to have used the hacker names 'Eraflame', 'Dima-k17' and 'DDService'. According to prosecutors, he launched the first DDoS against Amazon with a co-conspirator, Sergey Viktorovich Logashov, at 10.23am PST on 6 June, 2008. The company managed to mitigate the attack at 2.55pm.
The botnet involved requested "large and resource-intensive web pages" on a magnitude of between 600 and 1,000 percent of normal traffic levels, according to the indictment. Amazon's servers were overwhelmed, prosecutors said.
A second, more prolonged attack was made against Amazon on 9 June at 10.06am. It continued for days, until Amazon managed to rectify the situation on 12 June.
During the attempt on Priceline.com, Logashov called the market comparison company to offer his services as an IT consultant, according to the indictment. The Moscow resident is thought to go by the hacker handle 'Jjoker'.
Zubakha is also charged with possessing credit card track data — the information on the magnetic strip — for more than 28,000 accounts. The data covers card numbers for Boeing Employees Credit Union (BECU) accounts.
"This defendant could not hide in cyberspace, and I congratulate the international law enforcement agencies who tracked him down and made this arrest," US attorney Jenny Durkan said in a statement.
The charges faced by Zubakha carry potential penalties of up to 10 years in prison and a $250,000 (£160,000) fine.