Operation Payback

About

Operation: Payback Is A Bitch, also known as Operation: Payback, is a series of DDoS attacks organized by users of 4chan’s /b/ (random) board that started on September 17th, 2010 against major entertainment industry websites such as the websites for the Recording Industry Association of America and the Motion Picture Association of America. The attacks began September 19th, 2010, and have continued unabated for over one month.

Beginning on December 7th, 2010, Operation Avenge Assange the DDos assaults led by Anonymous successfully brought down Paypal, Visa and MasterCard’s websites in retaliation against their decision to suspend all transactions with WikiLeaks, reportedly under political pressure from the U.S. State Department. Some of the other targeted sites include Amazon and Swiss Postal Finance.

Origin

The plan for Operation: Payback was initially made by the users of 4chan as a response to the DDoS attacks carried out by Indian company Aiplex Software, who were hired by major media companies to carry out said DDoS attacks against music and movie torrenting sites, such as The Pirate Bay.

After learning of the DDoS on the torrenting sites, 4chan users began planning their own retaliatory attacks on media websites, with the MPAA and Aiplex as their first targets.

General Reaction

After releasing this poster on 4chan and spreading it around the boards, the instigators were able to assemble multiple users bent on taking down the sites, and were able to do so, bringing the website down for over an hour on the first day, with over 22 hours down on the MPAA website and over 24 hours for Aiplex total.

Website

With the creation of the a website for Operation: Payback (now defunct), anons were able to concentrate their efforts on specific targets at specific times, with little need for collaboration over 4chan itself and the ability to strike a wider variety of targets.

Spread/Continued Attacks

After the original attacks against Aiplex and the MPAA, the users decided to continue the Operation, taking down any websites that they disagree with or that have a hand in the attempt to take down The Pirate Bay.

Attacked Websites/Downtime

Throughout the over 1 month of attacks, many websites were brought down. Some, like MPAA were brought down over 20 times in the space of a couple days.

Timeline

September 17th

MPAA was the first website to be attacked,, and had 22 hours of downtime.

International Federation of the Phonographic Industry, the second site to be attacked, had over 14 hours of downtime.

September 18th

Aiplex, the third site to be attacked, was attacked on the 18th and continued through the 20th, with over 25 hours of downtime.

September 19th

The RIAA were attacked starting at midnight on September 19th, being interrupted over 35 times and having an hour and a half of downtime.

September 20th

An attack was scheduled against the British Phonographic Industry but was unsuccessful.

The Operation switches its target back to the MPAA, with much less success.

September 21st

ACS: Law experiences a server shutdown across Europe, as a result of DDoS attacks.

Popularity

Social Networking Advocacy

In light of the recent explosion of interest in counter DDoS attacks, many advocates of targeting companies and organizations that oppose Wikileaks have created social networking pages for their cause. However, these pages were shut down by their respective hosts (such as the Facebook page, though many other iterations of the page have spawned). The Operation: Payback Twitter account was suspended, although there has yet to be official comment on whether or not the suspension was enacted by Twitter itself.

Operation Avenge Assange

Following the whistleblowing organization WikiLeak’s unprecedented expose of sensitive documents containing US diplomatic cables, the US government criticized the WikLeaks founder Julian Assange, and began pressing on the affiliates of WikiLeaks to halt their transacitons with the Swiss-based website. As a result, WikiLeak’s server host Amazon dropped their service, while Mastercard and PayPal ceased all transactions of funds donated by the supporters of WikiLeaks and Julian Assange.

Amazon took down their hosting of the WikiLeaks servers less than a day after being contacted by the office of Senator Joe Lieberman and was then followed by PayPal, Visa, Mastercard and most recently, MasterCard.^[1]^[2] Official statements from these respective companies cite things like ToS violations and pending investigations but the government intervention in all this is somewhat suspect.^[3]^[4]

There is a letter from the US State Department floating around that was sent to Assange on November 27th, which is now making it’s rounds to the organizations still supporting WikiLeaks.^[5]

In retaliation against the US-led counter-measures and support of Mr. Assange, Anonymous contingent launched several waves of DDoS attacks against various companies whom they perceived as “enemies of Julian Assange,” under the catchy-sounding codename Operation: Avenge Assange.

The Next Web Media website reports that Paypal has released funds left over in their Wikileaks account, which was terminated in by the company after an apparent “Terms of Usage Violation” where Wikileaks was said to have been “used for any activities that encourage, promote, facilitate or instruct others to engage in illegal activity.”^[6] The account, however, is still closed.

12/10/2010:

As reported by rawstory.com one Dutch teenager was been arrested with alleged connections to Operation Payback.^[7] The teen could face up to six years in prison for the cyber attacks the Netherlands’ prosecution service said. In apparent retaliation, the Dutch Police Office’s website was consequently attacked and were offline for several hours the morning of December 10, 2010.

Sarah Palin Targeted

ABC News reports that Sarah and Todd Palin’s credit card account have been attacked and “disrupted” by Operation Payback.^[8] Sarahpac.com was also attacked by Operation: Payback. Hints in the DDOS attack lead authorities to suspect affiliation with Wikileaks.^[9]

Protect IP Act

On May 23rd, 2011, an image was posted to Reddit detailing instructions on how to DDoS the United States Chamber of Commerce, a lobbying group that represents businesses and trade associations and has supported the proposed Protect IP bill.^[10]

A CNET article from May 12th, 2011, outlined specific sections of the bill that were controversial:

Sen. Patrick Leahy (D-Vt.) today introduced a revised version of a controversial bill that would give the Department of Justice and individuals new powers to enforce copyright and trademark law against “rogue” and “pirate” Web sites that offer unlicensed copies of protected content or which sell illegal knock-offs of brand-name goods.^[11]

A PDF link to the full proposed bill can be found on Senator Patrick Leahy’s website.^[12]