Two Israeli men, Itay Huri and Yarden Bidani, have been arrested by Israel Police for computer hacking. Following a tip from the FBI, the men were picked up and subsequently released on bail. The hackers earned $600,000 in a massive cybercrime operation.
After the arrest, cybercrime investigator Brian Krebs reported details surrounding the case. Both 18-year-olds are reported to be behind vDOS, a website that sells DDoS attacks to paying customers. According to Krebs, the two were “responsible for a majority of the DDoS attacks clogging up the Internet over the past few years.” Between April and July 2016, “vDOS was responsible for launching more than 277 million seconds of attack time.”
Huri and Bidani “market their service mainly on the site hackforums[dot]net, selling monthly subscriptions using multiple pricing tiers ranging from $20 to $200 per month.” The price tiers depend on the duration and intensity of each attack.
The hackers ended up having their own site hacked, resulting in the arrest. The vDOS hack also leaked the names and information of customers who used the service.
Krebs investigated the leaked vDOS data, drawing conclusions of his own. “Records leaked from vDOS indicate that since July 2014, tens of thousands of paying customers spent a total of more than $618,000 at the service using Bitcoin and PayPal,” he writes. Total income is likely to have been much higher as the site was in operation since 2012. The leaked vDOS data is limiting because the database is missing two years of records.
Huri and Bidani refused to order DDoS attacks on Israeli websites. Krebs speculates that
the two declined these attacks to avoid local detection. Given that vDOS operated on the clearnet, their operation needed heavy protection. Keeping local law enforcement in the dark improved vDOS’s chances of survival.
Krebs wrote that the men were paid through PayPal and in bitcoins. He added that “the proprietors of the attack service worked assiduously to launder payments for the service through a round-robin chain of PayPal accounts.”
Israel Police confirmed the arrest shortly after it occurred. The statement noted cooperation with the FBI. At their lawyer’s request, they were released after agreeing to a supervised house arrest. Internet usage is prohibited for 30 days, along with any form of digital communication. The police statement noted, “Their passports were deposited with the police and they are prohibited from leaving the country or communication with others involved in the case for 30 days.”
The police did not reveal any further details regarding the arrest or investigation, according to The Jewish Press.