The operation, a DDoS attack on a range of major corporations, “none other then the ones who ultimately rule: the high revenue making companies of the world,” was announced via Pastebin on 11 April. While maintaining its insistence that it is not Anonymous, TheWikiBoat also hopes that “this operation [will] make a difference.”
But this attack is different in another way. Most attacks are either breaches or DDoS; and Imperva has stated that DDoS attacks often follow failed hack attacks. In this instance it is both. TheWikiBoat has named the targets, has named the date, and has also stated that it will hack the sites after they have been “downed (DDoS'd) for at least 2 hours. This phase is all about leaking highly classified data from the targets.”
A large number of different targets has been announced (according to Fox Business, “46 major companies around the world... including Bank of America, Apple, and Wal-Mart”). “It’s not uncommon for hacking groups to announce their targets,” said André Stewart, president international at Corero Network Security, “particularly when they are ahead of a distributed denial of service attack. This enables them to ‘recruit’ as many like-minded individuals who support the ideology of the hacktivist group, to join in on the attack. However, the majority of DDoS attacks are often carried out using an army of automated computers, called Botnets, which can be controlled by a single user.”
TheWikiBoat has been attempting to build a LOIC botnet between the time of its announcement in April and the date of the planned attack, 25 May. What we won’t know until tomorrow is whether they have succeeded. An army of LOIC attackers is difficult to defend; but it will all depend on whether that army has been recruited. One problem for TheWikiBoat is structural. It’s in it for the lulz. But where is the lulz for its LOIC army? Where is the lulz in just allowing your computer to be used by someone else for their lulz?
It is quite possible, then, that OpNewSon will simply fail. We will know by tomorrow. In the meantime, as Stewart says, “any organization who is a target would be unwise to dismiss the threat. With prior knowledge of an impending attack, they have the opportunity to pro-actively put in place additional security measures, to ensure that they remain secure.”