page_title: The Spamhaus Project
section_title: CyberBunker dispute and DDoS attack
hierarchical_section_title: The Spamhaus Project / Conflicts / CyberBunker dispute and DDoS attack
caption_attribution_description: English: English Translation and re-mix of Matthäus Wander's work. Puplished with the same license as the original.
context_page_description: The Spamhaus Project is an international organisation, based in both London and Geneva, founded in 1998 by Steve Linford to track email spammers and spam-related activity. The name spamhaus, a pseudo-German expression, was coined by Linford to refer to an Internet service provider, or other firm, which spams or knowingly provides service to spammers.
context_section_description: In March 2013, CyberBunker, an internet provider named after its former headquarters in a surplus NATO bunker in the Netherlands that "offers anonymous hosting of anything except child porn and anything related to terrorism" was added to the Spamhaus blacklist used by email providers to weed out spam. Shortly afterwards, beginning on March 18, Spamhaus was the target of a distributed denial of service (DDoS) attack exploiting a long-known vulnerability in the Domain Name System (DNS) which permits origination of massive quantities of messages at devices owned by others using IP address spoofing. Devices exploited in the attack may be as simple as a cable converter box connected to the internet. The attack was of a previously unreported scale (peaking at 300 Gbit/s; an average large-scale attack might reach 50 Gbit/s, and the largest previous publicly reported attack was 100 Gbit/s) was launched against Spamhaus's DNS servers; as of 27 March 2013 the effects of the attack had lasted for over a week. Steve Linford, chief executive for Spamhaus, said that they had withstood the attack, using the assistance of other internet companies such as Google to absorb the excess traffic. Linford also claimed that the attack was being investigated by five different national cyber-police-forces around the world, who had chosen to remain anonymous to avoid similar attacks on their own infrastructure. Spamhaus also hired Cloudflare, a DDoS mitigation company, to assist them by distributing their internet services across Cloudflare's worldwide network, after which the focus of the attack was redirected to the companies that provide Cloudflare's network connections.
  Spamhaus alleged that CyberBunker, in cooperation with "criminal gangs" from Eastern Europe and Russia, was behind the attack; CyberBunker did not respond to the BBC's request for comment on the allegation; however, Sven Olaf Kamphuis, the owner of CyberBunker, posted to his Facebook account on 23 March "Yo anons, we could use a little help in shutting down illegal slander and blackmail censorship project 'spamhaus.org,' which thinks it can dictate its views on what should and should not be on the Internet." According to The New York Times Kamphuis also claimed to be the spokesman of the attackers, and said in a message "We are aware that this is one of the largest DDoS attacks the world had publicly seen", and that CyberBunker was retaliating against Spamhaus for "abusing their influence". The NYT added that security researcher Dan Kaminsky said "You can’t stop a DNS flood ... The only way to deal with this problem is to find the people doing it and arrest them".
  The attack was attributed by network engineers to an anonymous group unhappy with Spamhaus, later identified by the victims of the attack as Stophaus, a loosely organized group of "bulletproof spam and malware hosters".
  On 26 April 2013, the owner of CyberBunker, Sven Olaf Kamphuis, was arrested in Spain for his part in the attack on Spamhaus. He has since been released pending trial.
  The British National Cyber Crime Unit revealed that a London schoolboy had been secretly arrested as part of a suspected organised crime gang responsible for the DDoS attacks.  A briefing document giving details of the schoolboy’s alleged involvement states: "The suspect was found with his computer systems open and logged on to various virtual systems and forums. The subject has a significant amount of money flowing through his bank account. Financial investigators are in the process of restraining monies."
caption: Diagram showing the role of open resolvers, improperly configured servers vulnerable to IP address spoofing[45][46]
exif: {}