Law enforcement authorities told Protx that it was the victim of Russian organized crime, Alculumbre says, but criminal extortion is not the only motivation for such attacks. In April, Australian anti-spyware vendor PC Tools became a target of spyware companies that didn't want users interested in PC Tools' spyware-cleansing software to reach the actual PC Tools Web site.
Customers whose PCs had already been infected by spyware were greeted with fake pop-up windows and shopping carts when they tried to purchase the company's Spyware Doctor product, says Simon Clausen, PC Tools' CEO. Instead of buying his company's anti-spyware software, they were tricked into purchasing useless products that left their computers infected, he said.
Even links that appeared to be from legitimate Web sites like Google or Download.com were modified on fake pages displayed to users, Clausen said. "Any link that said Spyware Doctor would be redirected to the attackers' sites."
Clausen estimates that as much as 15 percent of his company's business was lost, representing hundreds of thousands of dollars in missed sales. But the real cost was in lost productivity for his software development team, which was forced to spend hundreds of hours changing PC Tools' products and Web site in an effort to stay one step ahead of the attackers, he said. "We probably had a dozen people involved pretty heavily in it for about a month or two."
By the time PC Tools developed a way of handling the attack, the company had taken major hits in employee time and in lost business opportunities because of product delays, he said.
Online Cat and Mouse
By scrambling its IT staff and prohibiting traffic from zombie servers (at one point, Protx.com simply blocked all traffic originating from the Western United States) that company managed to survive the first wave of the attack against it.
But the 13-person company's biggest cost involved preparing for the next assaults, consisting of thousands of server requests, which came in January and April of 2005.
The April attack, which lasted for more than five days, was the most severe, as Protx and the attackers engaged in a kind of online cat and mouse: Just as Alculumbre's technicians found one way to block the flood of unwanted server messages, the attackers would switch to another tack. At one point, the cybercrooks used a new exploit of Microsoft's Microsoft Internet Information Services server that caused the Protx Web site to crash whenever certain types of secure messages got through. Protx responded by installing an SSL accelerator and analyzing the messages before letting them through.
On the final day of the April assault, the attackers hit Protx with everything they had. At the peak of the assault, the company's servers were processing 800 megabits of traffic per second, the equivalent of more than 530 T1 lines firing at full capacity.
Protx's administrators spent some long, tense hours over that weekend, scrambling with technicians from the company's Internet service provider to keep the company's Web and transaction processing server online. "It's like being in a war," said Alculumbre. "My three guys were working with three other technicians in extremely tight hosting facilities, trying to put all this bloody machinery in and wire it up... it looked like Spaghetti Junction. How they ever knew what they were doing was beyond me."