Hacking group Lizard Squad may have been using “thousands of hacked home Internet routers” to run its LizardStresser service, which helps anyone launch distributed denial of service (DDoS) attacks to knock websites offline.

The group launched LizardStresser at the end of 2014, shortly after its own attacks took down Sony’s PlayStation Network and Microsoft’s Xbox Live online games services over the Christmas period.

LizardStresser would charge all-comers between $6 and $500 to launch their own attacks on websites and internet services, with the high-profile console attacks serving as a “huge marketing scheme” for the group’s commercial ambitions according to one member.

Now online security researcher Brian Krebs claims that LizardStresser was itself running thanks to thousands of internet users failing to change the default passwords on their home broadband routers.

“As it turns out, that service draws on Internet bandwidth from hacked home Internet routers around the globe that are protected by little more than factory-default usernames and passwords,” wrote Krebs in a blog post outlining his findings.

According to Krebs, the malware used by Lizard Squad to build its network of “stresser bots” has been online since early 2014, and can affect commercial routers at universities and companies as well as homes.

“in addition to turning the infected host into attack zombies, the malicious code uses the infected system to scan the Internet for additional devices that also allow access via factory default credentials, such as ‘admin/admin,’ or ‘root/12345’,” wrote Krebs.

“In this way, each infected host is constantly trying to spread the infection to new home routers and other devices accepting incoming connections (via telnet) with default credentials.”

Krebs worked with a group of unnamed – at their request – researchers who he claims are working with law enforcement officials and ISPs to help take infected systems offline, and thus disrupt the LizardStresser botnet.

In the meantime, he advised internet users to always change the default credentials on their home router – including the user name and password – and also to encrypt the connection if they are using a wireless router.

• Man ‘linked to Lizard Squad hack’ arrested over 2013-14 cyber-fraud

