Extortion racket cripples gambling sites

Criminals have used distributed denial of service (DDoS) attacks to bring down six online businesses, demanding £50,000 from each to stop targeting their websites.

Police are investigating the incidents and the companies, predominantly gambling sites, are currently upgrading their IT defences.

Gambling websites are targeted because of the time-specific nature of their service.

If shoppers cannot buy a CD online they can go to a shop later, but if gamblers cannot place their bets immediately they are likely to go to a competitor.

It is also very easy for such sites to quantify their losses.

"This sort of thing has been done before in the Far East," said Professor Neil Barrett, technology director at security firm Information Risk Management.

"In the past such attacks have been launched from compromised servers, but it could be that more home PCs are now being targeted for use in DDoS attacks because they are more vulnerable."

The identity of the criminals has not been confirmed, but a range of betting sites in the US were brought down in September by the Russian Mafia.

In those cases £24,000 was demanded in exchange for the companies being left alone for a year.

"In a lot of cases the attacks have taken out well-configured firewalls," said Ian Morris, founder of Equip, who has been working with some of the affected sites.

"Most people in positions of authority believe that, because they've got firewalls, they are protected - bullet-proof if you like. These attacks have shown that this is not the case."

The National High Tech Crime Unit has warned businesses not to give in to extortion and to contact the police immediately if demands are made.

The unit pointed out that making a payment is no guarantee that the attacks will stop.