Lizard Squad's DDoS attack service “Lizard Stresser” runs mostly on thousands of hacked home routers
Lizard Stresser Runs on Hacked Home Routers — The online attack service launched late last year by the same criminals who knocked Sony and Microsoft's gaming networks offline …
Context & Ripple Effects
After crippling Xbox Live and PlayStation Network over Christmas, Lizard Squad converted notoriety into a product: a paid DDoS service with tiers from $6 to $500 that the group itself framed as a marketing scheme for its attacks. The new Krebs reporting explains how a small crew could sustain such capacity — Lizard Stresser is built mostly on thousands of hijacked home routers, so customers rent firepower assembled from other people's devices.
That infrastructure choice cuts both ways: the same consumer-grade footprint makes the service cheap to run and hard to attribute, but it also leaves the operation exposed, as the group's own follow-on breach of customer records would soon show.
First-order effects
- Buyers paying the $6–$500 tiers get attack capacity without owning any hardware, while thousands of households unknowingly lend their routers' bandwidth to each strike they purchase.
- Lizard Squad's cost structure collapses — no server fleet or hosting bills — letting it undercut traditional booter operations that had to rent their own infrastructure.
Second-order effects
- Exposure follows the money: when LizardStresser itself was hacked and customer details dumped publicly, every past buyer's anonymity evaporated, converting a low-risk purchase into a deanonymization risk.
- Router manufacturers and ISPs face pressure to close the default-credential and unpatched-firmware gaps that made this botnet possible, since their installed base is now the ammunition supply for paid attacks.
Third-order effects
- If the pattern holds, consumer routers become the default substrate for DDoS-for-hire, shifting the burden of attack mitigation from the sellers — who own nothing traceable — to device makers, ISPs, and the networks absorbing the traffic.
- Commercializing attacks also creates a criminal audit trail that law enforcement can exploit: payment records and customer lists turn a distributed nuisance into an identifiable buyer market, as the leaked-customer episode demonstrated.
The trend: DDoS-for-hire is consolidating around hijacked consumer routers rather than rented servers, making household devices the raw material of a commercialized attack market.