Author Archives: Enurrendy

Hackers Use Thousands Of Infected Android Devices In DDoS Attacks

Hundreds of thousands of home routers, IP cameras and other internet-of-things devices have been infected with malware over the past year and have been used to launch some of the largest distributed denial-of-service (DDoS) attacks ever recorded. Attackers are now doing the same with Android devices, with the help of malicious applications hosted on Google Play and other third-party app stores. A joint investigation by the security teams from Akamai, Cloudflare, Flashpoint, Google, RiskIQ and Team Cymru has led to the discovery of a large botnet made up of over 100,000 Android devices located in more than 100 countries. The investigation was launched in response to large DDoS attacks that have hit several content providers and content delivery networks over the past few weeks. The goal behind DDoS attacks is to flood servers with bogus traffic in order to use up their available internet bandwidth or their CPU and RAM resources so they can no longer serve requests from legitimate users. Servers are typically configured to handle a certain number of concurrent connections based on the estimated number of visitors that they’re expected to receive. Load balancers, firewalls and other anti-DDoS technologies are used to limit the negative impact of any sudden traffic spikes, but with enough firepower, attackers can disrupt even the most well-protected networks. This particular Android botnet, which has been dubbed WireX, was used to send tens of thousands of HTTP requests that were meant to resemble those coming from legitimate browsers. The researchers were able to establish a pattern to the User-Agent string reported by the rogue clients and traced them back to malicious Android applications. Some of the applications were available in third-party app stores that came pre-installed on devices, but around 300 of them were hosted on Google Play. “Many of the identified applications fell into the categories of media/video players, ringtones or tools such as storage managers and app stores with additional hidden features that were not readily apparent to the end users that were infected,” the researchers said in a report. Most of the rogue applications requested device administrator permissions during installation, which allowed them to launch a background service and participate in DDoS attacks even when the applications themselves were not actively used or when the devices were locked. Google has removed the malicious applications from Google Play and started to remotely remove them from affected devices as well. Furthermore, the Play Protect feature which runs locally on Android devices prevents these apps from being reinstalled, the researchers said. Some antivirus products detect the malicious applications as an “Android Clicker” Trojan which might suggest that the botnet’s original purpose was click fraud, a method of earning revenue from fraudulent clicks on advertisements. However, by the time it was discovered, the botnet had clearly been repurposed for DDoS and was receiving attack instructions from command-and-control servers hosted under the same domain name. This is not the first Android-based DDoS botnet ever found, but it is certainly the largest. At the peak of the attacks, the researchers observed malicious traffic coming from over 120,000 unique IP addresses per hour. Last year, security firm Imperva uncovered a similar botnet that was used to launch DDoS attacks from around 27,000 infected Android devices. While Google is making significant efforts to keep malware off Google Play and constantly scans the apps hosted on its platform, this is not the first time when malicious applications have made it past its defenses. Just last week, the company removed applications that were using an advertising toolkit with spying capabilities and in May the company removed around 40 apps that included click fraud functionality. Source: https://www.forbes.com/sites/lconstantin/2017/08/28/hackers-use-thousands-of-infected-android-devices-in-ddos-attacks/#67c498825228

See the article here:
Hackers Use Thousands Of Infected Android Devices In DDoS Attacks

Tech firms band together to take down Android DDoS botnet

An ad-hoc alliance of tech firms has managed to seriously cripple an Android-based botnet that was being actively used to DDoS multiple content providers. The botnet, dubbed WireX by the researchers, consisted of Android devices with malicious apps installed. In fact, in the wake of the discovery, Google has pulled some 300 such apps from Google Play, began removing them remotely from affected users’ devices, and blocked them from being installed. The malicious apps The … More ?

Read the article:
Tech firms band together to take down Android DDoS botnet

3 Ways to Defeat DDoS Attacks

In 2012, a number of DDoS attacks hit Bank of America, JPMorgan Chase, Wells Fargo, U.S. Bank and PNC Bank. These attacks have since spread across most industries from government agencies to local schools and are showing an almost yearly evolution, with the most recent focus being the Internet of Things (IoT). In 2016, compromised cameras, printers, DVRs and other IoT appliances were used in a large attack on Dyn that took down major websites including Amazon, Twitter, Netflix, Etsy and Spotify. Inside Distributed Denial-of-Service Threats Although these large attacks dominate the headlines, they’re not what most enterprises will deal with day to day. The most common attacks are in the range of 20 to 30 Gbps or less, while larger attacks have been reported at 1.2 tbps. Creating DDoS Defense Security technology is becoming more sophisticated, but so are hackers, which means attacks can be much more difficult to mitigate now than in the past. Enterprises must be knowledgeable and prepared with mitigation techniques as the attacks continue to evolve. DDoS mitigation comes in three models: Scrubbing Centers The most common DDoS mitigation option for enterprises is to buy access to a scrubbing center service. During an attack, traffic is redirected to the security provider’s network, where the bad traffic is “scrubbed out” and only good traffic is returned to the customer. This option is good for multi-ISP environments and can be used to counter both volumetric and application-based attacks. For added protection, some providers can actually place a device in your data center, but this is not as cost-effective as the cloud-based option. ISP- Clean Pipes Approach With the rise of DDoS attacks, many ISPs have started their own scrubbing centers internally, and for a premium will monitor and mitigate attacks on their customers’ websites. In this scenario, ISPs operate as a one-stop-shop for bandwidth, hosting and DDoS mitigation. But some ISPs are more experienced at this than others, so customers must be sure to thoroughly test and research the quality of the service offered by their ISPs. Content Delivery Network Approach The distributed nature of content delivery networks (CDNs) means that websites live globally on multiple servers versus one origin server, making them difficult to take down. Large CDNs may have over 100,000 servers distributing or caching web content all over the world. However, CDN-based mitigation is really only a good option for enterprises that require core CDN functionality, as porting content to a CDN can be a time-intensive project. Source: https://www.forbes.com/sites/gartnergroup/2017/08/28/3-ways-to-defeat-ddos-attacks/#dda62aada78f

See the original article here:
3 Ways to Defeat DDoS Attacks

Week in review: Android Oreo security, hacking robots, DDoS attacks on the rise

Here’s an overview of some of last week’s most interesting news, podcasts and articles: Judge limits DOJ’s search of anti-Trump website data On Thursday, District of Columbia Superior Court Judge Robert Morin ruled that DreamHost must comply with the narrowed warrant, but has further limited the government’s access to the asked-for data, in order to limit exposure of sensitive user information. Review: Securing the Internet of Things The authors do a good job explaining the … More ?

Read more here:
Week in review: Android Oreo security, hacking robots, DDoS attacks on the rise

DreamHost, web hosting company, blames powerful DDoS attack for online outages

DreamHost, one of the world’s largest web hosting companies, said a distributed denial-of-service (DDoS) caused significant outages Thursday affecting customers of its web and email services. The Los Angeles-based hosting provider said that “internet vigilantes” conducted an attack against part of its online infrastructure resulting in connectivity issues affecting several aspects of its operations, ranging from its online customer support features to the hosting service used by over 1.5 million websites. The attack targeted DreamHost’s Domain Name Servers (DNS) – digital directories that allow internet users to access specific websites without remembering their lengthy, numeric IP addresses – and was remedied about four hours after first being detected, according to the company. DDoS attacks involve knocking websites offline by overloading their servers with illegitimate traffic and effectively rendering them inaccessible. Low-level attacks are capable of briefly disabling websites lacking DDoS protection, but wide-scale attacks like the one conducted last year against Dyn, an American DNS provider, caused unprecedented outages affecting some of the world’s most popular websites, including Amazon and Netflix. DreamHost customers, including the Cambridge Seventh-day Adventist Church in England and the Tale of Two Wastelands video gaming project, were among those who said their websites were unavailable Thursday due to the powerful DDoS attack. The DDoS attack was confirmed by DreamHost as two of the company’s customers made headlines in their own right over their unrelated efforts to survive scrutiny: DisruptJ20, an anti-Trump protest site, and The Daily Stormer, a white supremacist website that remerged online this week with the help of DreamHost after being all but driven off the internet. A federal judge earlier Thursday ordered DreamHost to provide information sought by federal prosectors investigating the riots that erupted in Washington, D.C. during President Trump’s inauguration Jan. 20. The Daily Stormer, meanwhile, relaunched on a DreamHost website Thursday after previously being banned from the internet’s biggest domain registrars and hosting providers, including GoDaddy, Google and Cloudflare. The Daily Stormer had quietly registered the new domain using an automated signup form and was subsequently booted several hours later, , DreamHot said Thursday evening. “Unfortunately, determined internet vigilantes weren’t willing to wait for us to take that action,” DreamHost said in a statement to Ars Technica. “They instead launched a DDoS attack against all of DreamHost this morning. We were ultimately able to declaw that attack, but the end result was that most of our customers experienced intermittent connectivity issues to their sites today.” Source: http://www.washingtontimes.com/news/2017/aug/24/dreamhost-web-hosting-company-blames-powerful-ddos/

View the original here:
DreamHost, web hosting company, blames powerful DDoS attack for online outages

DreamHost smashed in DDoS attack: Who’s to blame? Take a guess…

Is it the alt-right or anti-fascists? Most likely the latter Web hosting biz DreamHost has been largely crippled today by a distributed denial of service attack, bringing down most of its services.…

Read the original:
DreamHost smashed in DDoS attack: Who’s to blame? Take a guess…

90% of Companies Get Attacked with Three-Year-Old Vulnerabilities

A Fortinet report released this week highlights the importance of keeping secure systems up to date, or at least a few cycles off the main release, albeit this is not recommended, but better than leaving systems unpatched for years. According to the Fortinet Q2 2017 Global Threat Landscape, 90% of organizations the company protects have experienced cyber-attacks during which intruders tried to exploit vulnerabilities that were three years or older. In addition, 60% of organizations were attacked with exploits ten years or older. Organizations that did a relatively good job at keeping systems patched would have been able to block the attacks. Nonetheless, it is always recommended that companies keep systems up to date at all times. This has been shown in the past year. First last year with a Joomla flaw that saw exploit attempts days after being disclosed, then again at the start of January when attackers started scanning for a recently disclosed WordPress flaw hours after the official announcement. The focus on older exploits is simple to explain. Not all hackers are on the same skill level of nation-state cyber-espionage units, and most rely on open-sourced exploits. The older the vulnerability, the better the chances of finding a working exploit on one of the many exploit-sharing sites currently available online. Weekend warriors Furthermore, the Fortinet includes an interesting chart that shows attackers launching attacks mostly over the weekend. There are a few simple explanations for these. First, there are no SIRT (Security Incident Response Team) responders at most businesses over the weekend. Second, most hackers have jobs as well, and the weekend is when most are free for “side activities.” Number of DDoS attacks grew after Mirai source code release Also this week, Akamai released the State of the Internet/Security Report for Q2 2017. The report contains statistics on a wide variety of web attacks that took place via the company’s infrastructure in April, May, and June. The report’s main finding is the rise in the number of DDoS attacks during the first half of 2017 after DDoS attacks went down during the second half of 2016. According to Akamai, the release of the Mirai DDoS malware source code in September 2016 helped breathe new life into a declining DDoS booter market. Since then, a large number of different botnets built on the Mirai source code have been spotted, many of which were offered as DDoS-for-hire services. In a separate research presented at the USENIX security conference last week, researchers from Cisco, Akamai, Google, and three US universities revealed that despite having a reputation of being able to take down some of the largest online companies around, most Mirai botnets were mainly used to target online gaming servers. Besides Mirai, another very active strain of DDoS-capable malware was the PBos trojan, also targeting Linux-based devices. Some of these attacks even reached the massive size of 75 Gbps. Source: https://www.bleepingcomputer.com/news/security/90-percent-of-companies-get-attacked-with-three-year-old-vulnerabilities/

See the original article here:
90% of Companies Get Attacked with Three-Year-Old Vulnerabilities

DDoS attacks down in second quarter

Attacks designed to overwhelm servers with internet traffic — known as distributed denial of service (DDoS) attacks — were less frequent this spring than last, according to Akamai’s second quarter report. Akamai is a major seller of services to fight DDoS attacks. According to the company’s report, attacks declined by 18 percent between the beginning of April and end of June from the same period last year. DDoS attacks use hacked computers and internet-connected devices to send abnormal levels of traffic to a target, forcing it to slow or crash. A DDoS attack knocked out a critical internet switchboard known as Dyn, a domain name system provider, in October that rendered Twitter, Netflix and The New York Times unreachable. In May, the FCC reported a DDoS attack slammed its commenting system, though critics have questioned whether this was an attack or just a flood of commenters weighing in on the contentious issue of net neutrality. The report notes that while attacks are down year over year, attacks jumped 28 percent from the first quarter. But, it cautions quarterly data may not be the best measure of trends. It explains many attacks are tied to yearly events: “For most organizations, security events aren’t seasonal, they happen year round, without the ability to anticipate attacks. Unless you’re the security team for a merchant, in which case you need to plan for Black Friday and Cyber Monday, since they are likely to be the high water marks for attack traffic for the year.” While attacks rose from the beginning of the year, attack severity declined. “[F]or the first time in many years” Akamai observed no attacks exceeding 100 gigabits per second. The report speculates one potential cause of lower severity attacks might be international success taking the networks of hijacked computers, known as botnets, offline. Gaming companies were the victim in around 80 percent of attacks observed by Akamai in the second quarter, with one customer seeing more than 550 attacks. At the USENIX conference this year, Akamai researchers, teaming with other industry players and academics, presented research that the Dyn attack was actually intended as an attack on one of Dyn’s clients — the gaming platform PlayStation. According to that presentation, Dyn crashed as it handled requests headed to PlayStation. Source: http://thehill.com/policy/cybersecurity/347496-ddos-attacks-down-in-second-quarter

View the original here:
DDoS attacks down in second quarter

Here we go again: DDoS attacks on the rise!

Newly released data shows that DDoS and web application attacks are on the rise once again, according to Akamai’s Second Quarter, 2017 State of the Internet / Security Report. Contributing to this rise was the PBot DDoS malware which re-emerged as the foundation for the strongest DDoS attacks seen by Akamai this quarter. In the case of PBot, malicious actors used decades-old PHP code to generate the largest DDoS attack observed by Akamai in the … More ?

See the original article here:
Here we go again: DDoS attacks on the rise!