DDOS Attacks: Are The Russians Being Framed?

Surely you've heard of the recent meta-gaming trend in Eve Online where Distributed Denial of Service attacks are hitting websites of various entities. First it was EveNews24.com, then reports of Northern Coalition and Goonswarm teamspeak servers and forums, and lately I heard on Voices from the Void podcast episode 6 that Jason and Erin on Not A Lot of News Newshour suffered a DDOS attack during one of their live broadcasts on Section 8 Radio. Or more accurately, section 8 radio suffered the attack during the show.

One thing that has been consistently reported in these cases is that the originating location for the zombie computers involved in the attacks has been Russia and eastern Europe.

That has struck me as odd. Its easy to track where the attacks are coming from using the IP addresses and there is no reason the zombie computers have to come from a single geographical locale unless its a social group from the areas allowing their computers to be used in a consenting manner (i.e. downloading the DDoS software on purpose).

I wonder how hard it would be for a clever attacker to forge the originating IP addresses through a proxy or five or have his script only launch attacks if the IP address of the infected computer is of a certain locale.

I'm probably over-thinking the issue. I suspect its a higher probablity that it is just a couple idiots with too much time on their hands launching these attacks for shits and giggles rather than a top down concerted effort by the Drone Russian Federation coalition. But we may never know for certain unless someone comes out and claims responsibility.