Gaming DDoS: forget cyber-jihadis, they’re just trolls

Jane McCallion Read more August 26, 2014

Three of the largest online gaming networks – Xbox Live, Battle.net and PlayStation Network (PSN) – were hit by massive DDoS attacks over the bank holiday weekend.

Gaming DDoS: forget cyber-jihadis, they're just trolls

Several million users were affected by the distributed-denial-of-service (DDoS) attack on the three services, which was claimed by a group called Lizard Squad – that raised eyebrows by saying the attacks were in support of the Islamic State.

While the attacks over the weekend garnered the most attention, Lizard Squad has been attacking a variety of online gaming services over the past week.

On 19 August, the group ran DDoS attacks against on venerable online multiplayer games Runescape and League of Legends. Two days later, they moved onto another online multiplayer, Guild Wars, and Eve Online, before heading for the servers of Sony, Microsoft and Blizzard, which owns Battle.net.

Cyber-jihadis, anti-capitalists, or trolls?

The tone of the group’s Twitter feed had been lighthearted and mocking until Sunday, when things took a turn for the slightly more sinister.

Lizard Squad tweeted it had “planted the ISIS flag on Sony’s servers” accompanied with a picture of a man holding the Islamic State (IS) flag, before claiming there was a bomb aboard the flight of Sony Online Entertainment president John Smedley and posting a video of the collapse of the World Trade Center towers.

Today we planted the ISIS flag on @Sony‘s servers #ISIS #jihad pic.twitter.com/zvqXb2f5XI

— Lizard Squad (@LizardSquad) August 24, 2014

The group then repeatedly referred to gamers and the law enforcement as “kuffar” – a derogatory term for non-Muslims – and inviting the FBI to “come to the Caliphate and arrest us”.

This was taken as confirmation by some – including International Business Times and Metro – that Sony and Microsoft had fallen victim to “cyber-jihadis”.

However, while there are hacking collectives motivated by political Islam, Lizard Squad only claimed to be part of IS for less than a day, and the collective had previously made anti-capitalist statements.

Million dollar companies shouldn’t be affected by us. End the greed.

— Lizard Squad (@LizardSquad) August 19, 2014

Why do we do it? Multi-million dollar companies aren’t spending your money to ensure your game has good service. DDoS is so old it’s funny

— Lizard Squad (@LizardSquad) August 21, 2014

For the most part, the group has been trolling Twitch users playing the games that are under attack, including getting people to put a shoe on their head and post clips of Karma Chameleon in order to end the DDoS attacks.

Indeed, Channel 4 reports confusion in the collective’s IRC chat around the jihadi language, with one user replying it was “a troll” and “the media fell for it”.

Skinks or dragons?

While Lizard Squad has managed to do a wreak plenty of damage, it’s not necessarily a large team pulling the strings.

“It only takes one group with enough compromised machines to have the power to knock people offline for many hours,” according to Chris Boyd, a malware intelligence analyst at security firm Malwarebytes, who specialises in videogames.

“Videogame network DDoS services have been around for many years and continue to refine themselves, and there’s plenty of people out there who – for example – will rent botnets to DDoS rival gamers out of sessions to ensure they win the game,” Boyd added.