Cyber revenge as hackers hit crime agency website

The NCA website is said to have been targeted in response to the arrests of Lizard Stresser users. Picture: PA

The NCA site was inaccessible yesterday morning and a Twitter account linked to the hacking collective known as Lizard Squad appeared to claim responsibility.

It is thought the website was taken down in a distributed denial of service (DDoS) attack, in which web servers or websites are flooded with massive amounts of data, rendering them inaccessible to visitors.

It came days after the NCA announced six teenagers had been arrested on suspicion of launching attacks using a service created by the group, which previously targeted Xbox and PlayStation networks.

The suspects, who are aged 15-18, were held during an operation targeting alleged users of a tool known as Lizard Stresser.

Yesterday, a Lizard Squad Twitter account posted a message saying: “Stressed out? http://www.nationalcrimeagency.gov.uk/ #offline.”

An NCA spokesman said its website provided an “attractive target”, making attacks “a fact of life”.

He added: “DDoS is a blunt form of attack which takes volume and not skill.

“It isn’t a security breach, and it doesn’t affect our operational capability. At worst, it is a temporary inconvenience to users of our website.

“We have a duty to balance the value of keeping our website accessible with the cost of doing so, especially in the face of a threat which can scale up endlessly.

“The measures we have in place at present mean that our site is generally up and running again within 30 minutes, though occasionally it can take longer. We think that’s proportionate.”

Lizard Stresser is seen as a “DDos for hire” facility which gained notoriety among the hacking community after the group known as Lizard Squad claimed to have knocked Sony PlayStation and Xbox gaming services offline last Christmas.

None of those arrested in the most recent police activity are accused of involvement in those incidents, nor are they believed to be members of Lizard Squad.

The National Crime Agency (NCA) said they were suspected of maliciously deploying Lizard Stresser, having bought it using alternative payment services such as Bitcoin in an attempt to remain anonymous.

Organisations believed to have been targeted by the suspects include a national newspaper, a school, gaming companies and a number of online retailers. They have not been named and it has not been confirmed whether the attempted DDoS attacks were successful.

The arrests were made as part of an operation codenamed Vivarium, co-ordinated by the NCA and involving officers from several police forces.

Those arrested last week were an 18-year-old from Huddersfield, West Yorkshire; an 18-year-old from Manchester; a 16-year-old from Northampton; and a 15-year-old from Stockport.

Two other suspects, both 17, were arrested earlier this year.