See no evil, hear no evil? Dissecting the impact of online hacker forums

• Main Authors: YUE, Wei T., WANG, Qiu-Hong, HUI, Kai‐Lung
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2019
• Subjects: Hacker forum; distributed denial of service attack; backscatter data; dual use; panel regression; content analysis; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/4377; https://ink.library.smu.edu.sg/context/sis_research/article/5380/viewcontent/hacker_forum_sv.pdf; https://ink.library.smu.edu.sg/context/sis_research/article/5380/filename/0/type/additional/viewcontent/04_13042_RA_YueWangHuiAppendices.pdf
• Institution: Singapore Management University

Online hacker forums offer a prominent avenue for sharing hacking knowledge. Using a field dataset culled from multiple sources, we find that online discussion of distributed denial of service (DDOS) attacks in hackforums.net decreases the number of DDOS-attack victims. A 1% increase in discussion decreases DDOS attacks by 0.032% to 0.122%. This means that two DDOS-attack posts per day could reduce the number of victims by 700 to 2,600 per day. We find that discussion topics with similar keywords can variously increase or decrease DDOS attacks, meaning we cannot ascertain the impact of the discussion just by the post nature. Mentioning botnets, especially new botnets, increases the attacks, but the follow-up discussion decreases the attacks. Our results suggest that online-hacker-forum discussion may exhibit the dual-use characteristic. That is, it can be used for both good and bad purposes. We draw related managerial implications.