Monthly Archives: January 2008

DDoS Company – Prolexic Bought for USD10.5 Million

Publicly listed firm IPVG Corp. (IPVG) has announced the acquisition of Prolexic Technologies Inc. (Prolexic), a United States-based managed security service provider of distributed denial of service (DDOS) mitigation solutions, the company said.

IPVG has initiated a stock purchase agreement with stockholders of Prolexic for the purchase of 100 percent of the company’s capital stock, IPVG said in a disclosure.

IPVG CEO Enrique Gonzalez said the acquisition is part of the company’s entry into the global communications market.

“With Prolexic, we are positioned to become the leading DDOS mitigation provider in the world with operations in the US, Latin America, Europe and Asia,” Gonzalez said, noting the continued demand for Internet security solutions for the enterprise market.

IPVG is investing a total of $ 10.5 million for this acquisition.

DDOS attacks involve flooding target web servers to slow down or even deny legitimate traffic. This type of attack is often used to target systems of banks, credit card payment gateways, among others. Prolexic has recently seen more sophisticated ways of how DDOS is being used to target popular websites or online services using hijacked computer systems or peer-to-peer networks.

IP-Converge Data Center Inc., the data center subsidiary of IPVG, has reportedly prevented DDOS attacks within its customer networks.

Russian army shows the new face of DDoS attacks

In late April, a Russian-speaking blogger upset with recent events in Estonia posted a series of dispatches calling on like-minded people to attack government servers in that country.

…VolchenoK’s dispatch was echoed in posts on other Russian-speaking websites and helped set the groundwork for more than a week of distributed denial of service (DDoS) attacks, which sometimes brought official Estonian websites to their knees.

The assault on the Estonian sites was motivated by the government’s removal of a Soviet-era memorial from the center of that country’s capital.

…The attacks should serve as a wake-up call for US government officials about the potency of several new DDoS tools adopted by cyber criminals, says Arbor Networks senior security engineer Jose Nazario.

…The Estonia attacks are a graphic example of the damage that disaffected groups can cause when they vent their rage on internet targets, he says. Combined with a separate round of attacks on sites belonging to both pro-Russian and anti-Russian groups over the last three months, they raise the possibility that attacks based on political, ethnic or cultural differences may be on the rise.

…Posts like the one left by VolchenoK included a do-it-yourself script users could run to turn their computers into individual launch pads for the attacks. They also included instructions on when participants should start and stop them to ensure the incursions caused as much damage as possible.

…They also employed protocols such as ICMP and TCP SYN, which have been used for so long that they are no longer effective against many hardened targets.

…Over the past several months, Nazario has documented attacks on sites belonging to groups on both sides of the Russian establishment. Targets include the Party of Regions, a pro-Russian party led by Ukrainian Prime Minister Viktor Yanukovych; the site of Gary Kasparov, the Russian chess grandmaster turned critic of Russian President Vladimir Putin; and namarsh.ru, another dissident site.

…It doesn’t rely on the more primitive IRC protocol, doesn’t scan for new hosts to infect and is cloaked in a rootkit, making it hard for users or security researchers to detect.

…More than three dozen servers have been detected as command and control centers for BlackEnergy, and because the tool is available for $40 the number could grow, Nazario says. HTML-based bots like BlackEnergy are harder for security professionals to detect and stop because the data they generate looks similar to web traffic.

…So Nazario is working with the computer emergency response teams of various governments to snuff out the command and control servers that act as the hubs for these networks. Among the techniques for stopping them are the blacklisting of domain names and internet protocol addresses and the sharing of signature files that can be used by Snort and other intrusion detection systems to pinpoint the servers.

Full Article Here