Security reporter hit by 'swatting' attack
A well-respected computer security reporter says he was the target of a con that sent an armed SWAT team to his front door.
"Swatting" is what you do to a fly that's buzzing around your head. But when that fly is respected security reporter Brian Krebs, swatting is what you do to him when you want to scare him and possibly cause him serious physical harm.
As recounted by Ars Technica this morning and later today by Krebs himself, the reporter was at home and cleaning his house when he opened his front door to come face-to-barrel with at least three guns, including a shotgun, handgun, and semiautomatic rifle; numerous police officers; and a half dozen police cars.
The term "swatting" refers to spoofing a 911-emergency call with the end goal of having a Special Weapons and Tactics (SWAT) team dispatched to a specific location under false pretenses. The fear of physical harm is real: SWAT teams, not known for their subtlety, have in the past caused harm to people who panicked when confronted with their crisis-smothering techniques. Its origins lie in the "phreaking" technique of faking a caller ID, although swatting is more sophisticated.
According to his own account, Krebs reacted calmly, allowing the police to handcuff him, and eventually was able to inform them that not only was the situation a hoax, but that he had filed a report with them months earlier explaining that it was likely that he would be the victim of a swatting attempt.
Krebs, a longtime reporter for The Washington Post and author of Krebs On Security, wrote on his blog: "One of the reasons that I opted to file the report was because I knew some of the young hackers who frequented the forum on which this service was advertised had discussed SWATting someone as a way of exacting revenge or merely having fun at the target's expense."
The service he mentions, called "Absoboot," is one of many that will commit DDoS (distributed denial-of-service) attacks against any Web site for the right price. Krebs' site is a frequent victim of DDoS attacks, but this morning Ars Technica was under DDoS attack for several hours.
Krebs summed up succinctly the inherent risks of swatting on his blog:
This type of individual prank puts peoples' lives at risk, wastes huge amounts of taxpayer dollars, and draws otherwise scarce resources away from real emergencies. What's more, there are a lot of folks who will confront armed force with armed force, all with the intention of self-defense.