Category Archives: DDoS Criminals

DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

A group known as New World Hackers says it targeted the websites of Salt Lake City police, Salt Lake International Airport, the Downtown Alliance and First Utah Bank in response to the Feb. 27 officer-involved shooting of teenager Abdullahi Omar Mohamed. The distributed denial of service attacks, first reported Monday by HackRead, appear to have had little impact on the sites’ function. Nick Como, communication and marketing director for the Downtown Alliance, said he heard about the attacks but that the nonprofit’s website analytics were normal. City deputy director of communications Holly Mullen said an attack on the SLCPD site was “unsuccessful.” Airport public relations director Nancy Volmer was unaware of any problems. First Utah Bank CIO Amy Foulks said the bank shut down its website for a few hours Sunday morning after it received an alert, which “allowed ourselves some time to implement a tool that would thwart the denial of service package.” Bank president Brad Baldwin emphasized that the DDoS attacks were not a “hack.” The group did not gain access to the bank’s system or any customer information, he said. A Twitter account associated with the group, @NewWorldHacking, told The Tribune the attacks were in response to the shooting of Mohamed, 17, who was shot and wounded near 250 S. Rio Grande Street after police say he was one of two people attacking a male victim with metal objects. “We want justice for that poor kid who got shot 3 times in the chest for no accurate reason,” it said in a direct message. That the group would target a bank with no apparent role in Mohamed’s shooting is “a mystery to us,” Baldwin said. First Utah reported the attack to authorities, he said. The FBI did not immediately return a request for comment Tuesday. Source: http://www.sltrib.com/news/3665236-155/ddos-attacks-aimed-at-salt-lake

Taken from:
DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Staminus, a California-based internet hosting provider that specializes in helping sites stay online when distributed denial of service (DDoS) attackers try to elbow them off, was itself the target of a cyber broadside last week. At any rate, it started last week, with reports of the company’s site being down as of Thursday. But as of Monday, it was again, or maybe still, sucking wind. Staminus on Friday put out a statement confirming that its network security had been popped and invaded, systems had been “temporarily” taken offline, and customer data had been published online. The company posted a series of updates on Twitter and Facebook while its website was down, explaining that this was a “rare event.” But even while Staminus techs were scrambling to drag the company’s site back online, whoever mugged it was dumping its private data online in what security journalist Brian Krebs called a “classic ‘hacker e-zine’ format” called “F**k ’em all.” Krebs reports that the page included links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The huge data dump included customer names and email addresses, database table structures, routing tables, support tickets, credit card numbers (according to Krebs, at any rate; Ars Technica’s Sean Gallagher didn’t see any when he viewed the dump), and other sensitive data. A Staminus customer who requested anonymity confirmed to Ars that his data was part of the dump. Those behind the dump claimed to have gained control of Staminus’s routers and to have reset them to factory settings. The hacker “e-zine” that contained all the sensitive data began with a note from the attacker titled “TIPS WHEN RUNNING A SECURITY COMPANY.” Then, it went on to list tips for what were supposedly the security holes found during the breach: Use one root password for all the boxes Expose PDU’s [power distribution units in server racks] to WAN with telnet auth Never patch, upgrade or audit the stack Disregard PDO [PHP Data Objects] as inconvenient Hedge entire business on security theatre Store full credit card info in plaintext Write all code with wreckless [sic] abandon On Thursday, Staminus reported that some services were back online or in the process of being brought back and that “We expect full service restoration soon.” Then, another message posted on Friday pointed to the statement from the company’s CEO. That was the last message. What followed was radio silence, unbroken as of Monday evening. Krebs pointed out that the attack isn’t surprising: anti-DDoS providers are a common target for attackers. Source: https://nakedsecurity.sophos.com/2016/03/15/attacker-leaves-security-tips-after-invading-anti-ddos-firm-staminus/

Original post:
Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Anonymous Declares War On Donald Trump

Notorious hacking team set to launch DDoS attacks on Trump websites on April 1 Donald Trump’s seemingly inevitable rise to power in the United States may be about to hit a fairly major obstacle in the form of an Anonymous cyber-attack. The hacking collective, which has been behind a number of major attacks against individuals or companies it considers to have done wrong to the public, has said it is preparing a DDoS attack against Trump’s campaign website. The “declaration of war” was set out in a video posted to YouTube which says that the attacks, dubbed #OpTrump, will take place on April 1, targeting websites including trump.com, donaldjtrump.com andtrumphotelcollection.com. “Hateful campaign” “Dear Donald Trump, we have been watching you for a long time and what we see is deeply disturbing,” the video says. “Your inconsistent and hateful campaign has not only shocked the United States of America [but] you have shocked the entire planet with your appalling actions and ideas. You say what your audience wants to hear but in reality you don’t stand for anything except for your personal greed and power.” “We need you to shut down his websites, to research and expose what he doesn’t want the public to know. We need to dismantle his campaign and sabotage his brand. We are encouraging every able person with a computer to participate in this operation. This is not a warning, this is a declaration of total war. Donald Trump – it is too late to expect us.” In a separate written message posted online to accompany the video, Anonymous also listed what is claims are personal details belonging to Donald Trump, including his social security number, personal phone number and the contact details of his agent and legal representation. The animosity between Anonymous and Trump dates back to December 2015, when the former officially ‘declared war’ on Trump after a radical speech in which he said Muslims should be banned from entering the United States, which saw a number of Trumps’ websites taken offline. Anonymous has not been shy to wage war on opponents in the past, most famously attacking terrorist group Isis last December following the terrorist attacks in Paris that left 130 people dead. Earlier that month, the group also published the details of a thousand alleged KKK sympathisers as part of its #HoodsOff campaign, which it described as “a form of resistance” against racial violence, following earlier major cyberattacks which included posting several messages on the KKK’s official Twitter feed, and taking control of another account affiliated with the Klan. Source: http://www.techweekeurope.co.uk/security/cyberwar/anonymous-declares-war-donald-trump-187898

View original post here:
Anonymous Declares War On Donald Trump

Health orgs hit with cyberattacks every month

Healthcare organizations “are in the crosshairs” of cyber attackers, suffering one hack per month over the last year, with about half experiencing an incident involving the loss or exposure of patient information and another third unsure whether or not data was exposed, according to a new report. Conducted by the Ponemon Institute for security software company ESET, the report questioned 535 IT security practitioners from a variety of healthcare organizations, including private and public providers as well as government agencies, and found an industry beset by security breaches of all kinds. “With cyber attacks against healthcare organizations growing increasingly frequent and complex, there is more pressure to refine cybersecurity strategies,” the report’s authors wrote. “The State of Cybersecurity in Healthcare Organizations” also found that organizations struggle to deal with a variety of threats, including system failures (79 percent), unsecure medical devices (77 percent), cyberattackers (77 percent), employee-owned mobile devices or BYOD (76 percent), identity thieves (73 percent) and unsecure mobile devices (72 percent). Despite citing unsecure medical devices as a top security threat, only 27 percent of respondents said their organization has guidelines for medical devices as part of its cybersecurity strategy. The most common security incident sited was the exploitation of existing software vulnerabilities greater than three months old, according to 78 percent of respondents. Web-borne malware attacks were named by 75 percent of respondents. Following next were exploits of existing software vulnerability less than three months old (70 percent), spear phishing (69 percent) and lost or stolen devices (61 percent), according to the study. What’s more, participating organizations were only partly effective at preventing attacks. Almost half (49 percent) said their organizations experienced situations when cyberattacks have evaded their intrusion prevention systems (IPS), but many respondents (27 percent) were unsure.  Another 37 percent said their organizations have experienced cyber attacks that evaded their anti-virus (AV) solutions or traditional security controls but 25 percent were unsure. On average, organizations have an APT incident every three months. Only 26 percent of respondents say their organizations have systems and controls in place to detect and stop advanced persistent threats (APTs) and 21 percent are unsure. On average, over a 12-month period, organizations had an APT attack about every 3 months (3.46 APT-related incidents in one year), the survey said. As for the consequences of theses breaches, 63 percent of respondents said the primary consequences of APTs and zero day attacks were IT downtime, followed by the inability to provide services (46 percent), while 44 percent said these incidents resulted in the theft of personal information. In addition, DDoS attacks have cost organizations on average $1.32 million in the past 12 months, the survey said. Healthcare organizations in the report spend an average of $23 million on IT and approximately 12 percent is allocated to information security. “Since an average of $1.3 million is spent annually just to deal with DDoS attacks, the business case can be made to increase technology investments to reduce the frequency of successful attacks,” the report said. Source: http://www.govhealthit.com/news/ponemon-health-orgs-hit-cyberattacks-every-month

More:
Health orgs hit with cyberattacks every month

Cyber-crooks now prefer ransomware to botnets. Yep, firms are paying up

CryptoWall most prevalent nasty – survey File-encrypting ransomware has eclipsed botnets to become the main threat to enterprises, according to Trend Micro.…

Continued here:
Cyber-crooks now prefer ransomware to botnets. Yep, firms are paying up

Repeat DDoS and web application attacks become the norm

Akamai Technologies has shared the latest DDoS and web application attacks numbers in its Q4 2015 State of the Internet report. DDoS attack activity at a glance During Q4, repeat DDoS attacks were the norm, with an average of 24 attacks per targeted customer in Q4. Three targets were subject to more than 100 attacks each and one customer suffered 188 attacks – an average of more than two per day. During Q4, Akamai mitigated … More ?

Visit site:
Repeat DDoS and web application attacks become the norm

DDoS attacks up 149 percent as brassy booter kids make bank

Akamai report finds surge in weighty packets. The number of distributed denial of service attacks rose 149 percent in dying months of 2015 according to Akamai’s networking wonks.…

Continue Reading:
DDoS attacks up 149 percent as brassy booter kids make bank

Palo Alto reveals critical bugs and March 16th patch deadline

Researcher who found the flaws will reveal crim-friendly details in three weeks Palo Alto Networks has revealed four new nasties, one of which can allow remote code execution and DDOS attacks on its boxen, and given users until March 16th to patch them.…

Originally posted here:
Palo Alto reveals critical bugs and March 16th patch deadline

Does the Internet of Things need an indie security assessor?

Some in the IEEE reckon it’d be a good idea, before your toaster burns more than bread The Internet toaster that’s browning your crumpets, talking to its home servers, and participating in a ransomware-distributing botnet should get the kind of cyber-safety testing that it gets for physical safety.…

See the article here:
Does the Internet of Things need an indie security assessor?

How Norway’s biggest news site protects itself from DDoS attacks

Every day hackers attack Norway´s largest news site, VG.  But not without risk. VG has both helped the police put hackers behind bars and alerted mothers about what their adventurous sons are up to. VG.no is one of the most successful news sites in the world. Every week 4 million Norwegians – out of a population of 5 million – visit the site for the latest news. But that also makes VG.no a target for hackers. “Whenever there is a new security hole discovered, someone want to try it on VG,” says Audun Ytterdal, head of IT operations in VG. During the Schibsted Tech Polska Winter Event 2016 he presented “War stories from the ops trenches”, describing how the media house protects itself from a continuous flow of DDoS attacks. Under attack every day VG is well prepared for hacker attacks – and is able to deal with lots of traffic without going down. According to Ytterdal the site can handle up to 30 GB per second. “Usually we see around 10.000 http-hits per second. But during the attacks we can experience up to 100.000 http-hits per second,” he explains. Called the hacker´s mum In the presentation he explains some of the technical measures taken to secure the news site from attack. But he also tells entertaining stories about how the IT staff used their technical skills to identify the hackers. And not always the hackers have everything planned out! Take for instance the young hacker who managed to take over the front page of the business site E24.no with photos of himself in a balaclava taken in his mum´s bathroom. However smart he had been breaking into the site, he had forgotten to remove the location info added to the image file when he took the photo with his mobile phone. “So we could see where he lived – and we called his mum informing her that her son was up to activities she may not approve of,”  laughs Audun Ytterdal. Sent hackers to jail In another case the hackers bragged about their achievement on Twitter. That gave the IT operations department the opportunity to contact them directly.  After a while they also managed to identify two of the hackers. When one of them posted a photo from a town in Southern Norway, VG was able to locate the exact house it had been taken from with use of Google Street View. The information was given to the police – and the two hackers later had to serve time in jail. Entertaining error page For a news room all alarms go off when the main site is down.  And Audun Ytterdal believes it will be very hard to avoid never being shut down. So what to do when it happens? Of course identify and fix the problem. But VG also decided to give people a good laugh by designing an entertaining error page. The error page is a fun version of the normal front page of the site. “The last time we used this we had people tweeting that they would rather see the error page of VG than any other news site,” smiles Ytterdal. Source: http://www.schibsted.pl/2016/02/how-norways-biggest-news-site-protects-itself-from-ddos-attacks/

View the original here:
How Norway’s biggest news site protects itself from DDoS attacks