Category Archives: DDoS News

Anonymous hacker charged with #opJustina DDoS attacks on hospital

The Anonymous-affiliated hacker who admitted to cyberattacks on two hospitals in the #opJustinaoperation and fled the country while being investigated was indicted last week. Martin Gottesfeld, 32, a biotechnology information technology professional from Somerville, Massachusetts, is being charged with conspiracy to launch cyberattacks against two local hospitals: Boston Children’s Hospital (BCH) and the Wayside Youth and Family Support Network, a mental health facility. Those two hospitals were at the center of a case that attracted masses of media attention: that of Justina Pelletier, the then-15-year-old who was caught in a 16-month custody battle as her parents tried to have her treated for mitochondrial disease at one hospital, while Boston Children’s Hospital treated her in a psychiatric unit as a ward of the state. Gottesfeld’s indictment, handed down on Wednesday, also charges him with intentional damage to a protected computer. Both are felony hacking charges. Gottesfeld admitted to the attacks last month, explaining how he did it and why in an editorial published by the Huffington Post. I had heard many, too many, such horror stories of institutionalized children who were killed or took their own lives in the so-called “troubled teen industry”. I never imagined a renowned hospital would be capable of such brutality and no amount of other good work could justify torturing Justina. The distributed denial of service (DDoS) attack against BCH was planned for maximum financial damage, Gottesfeld said: he knew that the hospital was planning a big fundraising drive and that most donors gave online. In his editorial, he went on to scoff at BCH for making it easy for him to attack it, since the hospital kept its donation page on the same public network as the rest of its systems: Rookie mistake. To take it down, I’d have to knock the whole hospital off the internet. He also claimed that no patients would be harmed: There’s no such thing as an outage-proof network, so hospitals have to be able to function without the internet. It’s required by federal law, and for accreditation. The only effects would be financial and on BCH’s reputation. That’s not how the hospital, or the prosecution, sees it. The indictment states that BCH had to shut down its access to the internet and email servers to protect patient medical records. That meant that physicians outside the hospital couldn’t get at patients’ records. Nor could patients communicate with their doctors. BCH claims that responding to, and mitigating, the damage of the attack cost $300,000, while the disruption in fundraising meant another $300,000 hit, for a total loss of $600,000. Gottesfeld claims that the attack against BCH was a justifiable reaction to the actions of the hospital, which was described as  a “parentectomy”. Gottesfeld’s defence, to blame the hospital for the attack, is all too commonly heard. The blame-the-victim reasoning is often voiced by other cyberattackers, be it from people who guess at weak passwords and use them to waltz into accounts without authorization, or those who launch crippling attacks such as those that Gottesfeld admits to. But just because it’s easy to do doesn’t make those or other cybercrimes OK. They’re illegal, and they can result in jail time, fines or both. Each of the charges Gottesfeld’s facing carry a maximum sentence of five years in jail, along with fines. Gottesfeld has been detained in Rhode Island since he and his wife were plucked off their boat near the coast of Cuba and arrested in Florida. When the indictment was handed down last Wednesday, Gottesfeld was reportedly on day 16 of a hunger strike over the appointment of the office of Carmen Ortiz as his prosecutor. Ortiz was the prosecutor in the cases against both Aaron Swartz and Jonathan James, who both later took their own lives. She has faced sharp criticism over her approach to those cases. In spite of his admission to the DDoS attacks, Gottesfeld is likely to plead not guilty at his arraignment this week before US Magistrate Judge Marianne B. Bowler, his wife told the Washington Times. Source: https://nakedsecurity.sophos.com/2016/10/24/anonymous-hacker-charged-with-opjustina-ddos-attacks-on-hospitals/

Taken from:
Anonymous hacker charged with #opJustina DDoS attacks on hospital

Media vulnerable to Election Night cyber attack

A hack on the AP and its results tally could have chaos-inducing consequences. Despite spending hundreds of millions of dollars on security upgrades, U.S. media organizations have failed to properly protect their newsrooms from cyberattacks on their websites, communications systems and even editing platforms — opening themselves up to the possibility of a chaos-creating hack around Election Day. In just the past month, BuzzFeed has been vandalized, and both Newsweek and a leading cybersecurity blog were knocked offline after publishing articles that hackers apparently didn’t appreciate. Federal law enforcement is investigating multiple attacks on news organizations, and journalists moderating the presidential debates say they’ve even gotten briefings from the FBI on proper cyber hygiene, prompting them to go back to paper and pens for prep work. “We do a lot of printing out,” said Michele Remillard, an executive producer at C-SPAN, the network home to the backup moderator for all the debates. Journalists are seen as especially vulnerable soft targets for hackers. Their computers contain the kinds of notes, story ideas and high-powered contact lists coveted by foreign intelligence services. They also work in an environment that makes them ripe for attack, thanks to professional demands like the need for a constant online presence and inboxes that pop with emails from sources whom they don’t always know and which frequently contain the kinds of suspicious links and attachments that can expose their wider newsroom networks. Senior U.S. officials, current and former lawmakers and cybersecurity pros told POLITICO the threat against the media is real — and they fret the consequences. Specifically, the security community is worried The Associated Press’ army of reporters could get hacked and the wire service — the newsroom that produces the results data on which the entire media world relies — inadvertently starts releasing manipulated election tallies or that cybercriminals penetrate CNN’s internal networks and change Wolf Blitzer’s teleprompter. “It’s the art of possible is what really scares me,” said Tony Cole, chief technology officer of FireEye, a Silicon Valley-based cybersecurity firm that works with some of the country’s major television and newspaper companies. “Everything is hackable.” “No site is safe,” added Tucker Carlson, editor-in-chief of The Daily Caller. “If the federal government can be hacked, and the intelligence agencies have been hacked, as they’ve been then, can any news site say we have better cybersecurity than the FBI or Google?” The media have long been a spy’s best friend. Intelligence community sources say that foreign and U.S. agents use local newspapers to look for clues about their targets, and that strategy has only grown more sophisticated in an all-online era in which foreign intelligence is reportedly known to hover over a media company’s servers searching for any kind of heads-up on relevant stories inching closer to publication. Reporters on the campaign trail and back in their home bureaus said in interviews that they’ve become increasingly aware of their status as potential hacking victims. The spate of recent attacks — involving their sites and their competitors’ — are more than ample warning of what’s possible. Several journalists said they now use email and other communication with the expectation they’re being watched, and under the assumption that their messages can and will be hacked and shared publicly with the wider world. “We’re a bigger target than the 7-Eleven down the street,” said Mark Leibovich, chief national correspondent for The New York Times Magazine. “Presumably, we have really good, smart IT people who know what they’re doing, who are taking all kinds of precautions, who are acutely in tune with what the risks are and what the threats are.” There is perhaps no greater target in election journalism than the AP, the venerable wire service that will have more than 5,000 reporters, editors and researchers working across the country, tabulating results, calling races and feeding a much wider network of subscribers. Often other news outlets refer to the AP before making calls on races, and AP projections on the East Coast can have effects on West Coast voting, which closes hours later thanks to the time differences. Multiple sources in media, government and the security industry fretted about the effect if the AP were to get hit, and what that would do to their ability to get the news out. The AP will deploy reporters across the country to send up vote tallies, usually by phone, the  wire service  explained to The Washington Post in May. It also has multiple checks and balances in place to monitor for errors. But as with many other news organizations contacted by POLITICO, AP spokesman Paul Colford said the wire service’s policy is to refrain from making public comments about its security measures. “Given the extraordinary interest in the presidential election and thousands of other state and local contests, we would add that AP has been working diligently to ensure that vote counts will be gathered, vetted and delivered to our many customers on Nov. 8,” he said. Federal and state officials stress that even a successful hack on a major news outlet around Election Day would not affect the final results, which typically take weeks to certify. The vote tallies, after all, will be available on official sites and in many instances on special social media feeds. And if a news site did get defaced with incorrect information, the results would be more like a modern-day version of the famous ‘Dewey Defeats Truman’ headline that President Harry Truman triumphantly held aloft the day after his 1948 reelection. Still, there is a widespread recognition — from the White House down to the local precinct level — that a hack on the media could be damaging given the role it plays in getting election news out to satisfy the country’s insatiable information appetite. Misinformation circulated in the early hours of Nov. 8 about the race’s trajectory, for example, could factor into a voter’s decision to even show up during the election’s final hours, especially in Western states. There’s also concern that false media reports spread via a hacked news account could be a potential spark for violence in an already exceptionally charged atmosphere. On the flip side, there’s a recognition that the media can help build public confidence in the final results, especially following a campaign that’s been engulfed in its closing weeks by Russian-sponsored hacking of the Democratic National Committee, the hacking of Hillary Clinton’s campaign chairman’s personal emails, and Donald Trump’s unfounded charges of vote rigging. “To the degree that foreign hackers could prevent the dissemination of good information around the election, that can be a problem,” said Rep. Adam Schiff, the top Democrat on the House Intelligence Committee. The California congressman said he frets that media outlets, like many other industries, face “massive costs” in protecting themselves against cyberattacks with “no end in sight” to the potential risks. Schiff added that he is especially concerned about smaller news organizations without major IT budgets or the backing of larger parent companies. “They’re much more vulnerable,” he said. Cybersecurity experts say media spending to protect news organizations against cyberattack has grown substantially in the past three years, especially in the wake of North Korea’s attack on Sony Pictures in late 2014. The price tag for vulnerability audits and other techniques varies by the size of the newsroom and the surface area for potential attacks, but multiple sources said quarterly audits can easily cost $50,000 or more. Cyber experts and media officials from newsrooms across the country said they’re prepped to deal with a range of threats to their sites, including the kinds of malware that can infect a computer network and give hackers an entry point to manipulate a home site. They’re also building backup capacity in the event of a DDoS attack, or distributed denial of service, that tries to overwhelm a website or server with fake traffic. News sites, they note, are already prepping for monster traffic around the election, which can surge as much as 30 times compared with other big events this cycle, such as a debate or primary. At the staffing level, newsrooms have also been pushing for better cyber habits by hosting training seminars, requiring employees to take must-pass exams and requiring double-authentication before granting access to a newsroom’s internal filing system and social media accounts. But cyber experts warn that all the preparatory work in the world can matter little for a news organization if it’s facing an attack from a more sophisticated actor. “If all of a sudden your adversary becomes a nation-state, like Sony or the DNC with Russia, you see those kind of procedures aren’t worth a darn,” said Robert Anderson, a former senior FBI cyber official and a managing director at the Navigant consulting firm. The press has indeed been a familiar target for hackers. In 2013, hackers hit the AP’s Twitter account and posted a false report about a bombing at the White House, sending the stock market into a five-minute spiral. In more recent incidents, a USA Today columnist wrote an article in February admitting he was hacked midair while using his commercial flight’s WiFi, and the New York Times reported in August that its Moscow bureau was targeted by what were believed to be Russian hackers. Newsweek blamed hackers for a DDoS attack that took down its site last month soon after it published an article about Trump’s company allegedly violating the U.S. embargo against Cuba through secret business dealings in the 1990s. And BuzzFeed had several articles on its site altered earlier this month after it ran a story identifying a person allegedly involved in the hacking of tech CEOs and celebrities. “I’m sure that lots of newsrooms are having this conversation right now, particularly as we get closer to the election and people have a lot more to lose when things don’t go their way,” said Brian Krebs, the cybersecurity blogger and former Washington Post reporter whose site went down last month after a major DDoS attack that he says was spawned by his reporting about the arrest of two Israeli hackers. With the threat of hackings against the media reaching such a heightened pace, many election observers urged both reporters and the reading public to take a deep breath as the results start coming in. “If Twitter is reporting that Jill Stein wins South Carolina, that should probably give you pause,” said David Becker, executive director of the Center for Election Innovation and Research. Source: http://www.politico.com/story/2016/10/media-vulnerable-to-election-night-cyber-attack-229956

View post:
Media vulnerable to Election Night cyber attack

Ubisoft’s Servers Have Been Down For Several Hours, Could Be DDoS

Since early this morning gamers have reported server issues when playing Ubisoft games across all platforms. Ubisoft Support has confirmed the problem, sharing that it is affecting all its services, including its digital shop and official website. Ubisoft has provided the  following updates  regarding the issue: [12:44PM EDT]  We are still looking into this issue. We appreciate your understanding in the meantime.? [1:12PM EDT] Our shop and websites are also affected by this issue. We are still investigating further. Thank you for your patience thus far. Although for some of Ubisoft’s games this is a mere inconvenience, multiplayer-oriented games are currently unplayable. This has resulted in thousands of posts on Twitter directed at Ubisoft, requesting when the problem will be fixed. There is currently no ETA. It is unclear what the root cause of the issue is, although this type of problem usually happens due to DDoS.  Source: http://www.gamerevolution.com/news/ubisofts-servers-have-been-down-for-several-hours-could-be-ddos-37913

Read the original post:
Ubisoft’s Servers Have Been Down For Several Hours, Could Be DDoS

A Decade of DDoS Education: What’s Changed and What’s Stayed the Same

While Distributed Denial of Service (DDoS) attacks have been around for over 20 years, they have only become well-known to the majority of enterprises over the past ten years or so. Ten years ago, many enterprise IT teams only had a vague idea of what a DDoS attack was because they noticed the common symptoms “our website is down,” “the firewall crashed,” “nothing works” etc. The average IT team in 2006 would not have been aware of the techniques DDoS attacks typically used like spoofed addresses or POST floods. In order to provide a true understanding of what DDoS attacks were and how enterprises could defend against them, some basic education had to happen. In 2006 that meant putting it in terms that everyone understood, “what would happen to our meeting if we tried fitting 100 people in this room?” Eventually as education continued and attacks grew in notoriety, the basics of DDoS became common knowledge in the industry. But DDoS in its nature is an evolving threat and as application-layer attacks became predominant more education was needed. Application-layer attacks are not about blocking access to the door of the meeting room anymore, now we had to explain the stealthy nature of low-volume, targeted attacks. “So you’ve let two of us in this meeting room because we appear to be legitimate salespeople, but now we’re going to unplug the projector so you can’t run your meeting properly.” Now ten years later, the majority of enterprise IT teams have a solid understanding of the threat DDoS poses and the basics of defense but even today we still come across people who believe they can protect themselves against DDoS attacks by simply increasing their bandwidth or relying on their firewalls or unified threat management appliances. With the volume of attacks today that is definitely not enough to ensure service and network availability in the face of sustained DDoS attacks. The majority of DDoS education today has shifted from learning about the attack methods themselves to the correct defense techniques and processes. Even with the significant improvements in DDoS education and awareness, a lot of people still have unrealistic expectations that once they install a DDoS mitigation solution their job is done. There is no silver bullet against DDoS attacks. There is no magic box, there is no “set it and forget it” solution. You still have to educate the user. Part of this comes from the misconception that DDoS attacks are launched by untalented kids. While that is true in some cases, many enterprise IT teams are surprised to find themselves often fighting against talented opponents who are often smarter than them, have more time than them and whose effort to start attacks is minuscule compared to their effort in blocking them. Often times, when faced with these advanced adversaries, IT teams are quickly overwhelmed. Even though they have some mitigation tools in place, they may not have the  right  tools. They may not know who to call or recognize the type of attack targeting their systems. In short, they don’t have a technology problem, they have a people and process problem. Think of DDoS defense like a NASCAR race, you have a super-powerful car (your DDoS mitigation solution or service), but if you don’t know how to drive over 70 mph, you’re going to crash and hurt yourself very quickly. And let’s not even mention what happens if you decided to install that cheap transmission because it was half-off. Enterprise IT teams need to focus on building the best car they can, hiring a skilled team that can keep the car in its best possible condition and then hiring the best driver they can afford to drive the car when the time comes. Even if you have the best car in the world, an unskilled maintenance team or driver will lead to a third or fourth place finish at the end of the season. But if you want to win the championship, you need the best car, mechanics and driver you can afford. Moving on from the NASCAR analogy, this means: Understanding the technology that best fits your needs: on-premise, always-on, protection or an on-demand service? Customizing that technology to fit your assets. Is it just your website or the services you provide from it? What about defending your corporate network? Identifying and training a team that is capable of understanding all of the procedures in all possible scenarios that surround a DDoS attack. Continue evolving your mitigation strategy. Keep your technology state-of-the-art and provide continuous training for your team. If you follow these steps you’ll end up in the winner’s circle after mitigating another DDoS attack and not in pit row trying to figure out what went wrong. Source: http://wwpi.com/2016/10/12/a-decade-of-ddos-education-whats-changed-and-whats-stayed-the-same/

Visit link:
A Decade of DDoS Education: What’s Changed and What’s Stayed the Same

Justice Charges Hackers From Lizard Squad, PoodleCorp

Two teenagers face charges from the U.S. Justice Department for allegedly being members of well-known hacking groups Lizard Squad and PoodleCorp. On Thursday (Oct. 6), Krebs on Security reported that the pair have been charged with credit card theft and operating services that enabled paying customers to launch cyberattacks with the intention of knocking websites offline. The two 19-year-olds, Zachary Buchta and Bradley Jan Willem van Rooy, are believed to have conspired to cause damage to protected computers. “The charges are the result of an international investigation into the computer hacking groups ‘Lizard Squad’ and ‘PoodleCorp,’ according to a criminal complaint and affidavit filed in U.S. District Court in Chicago,” a statement from the U.S. Attorney’s Office for the Northern District of Illinois said. “Buchta and van Rooy allegedly conspired with others to launch destructive cyberattacks around the world and trafficked payment accounts that had been stolen from unsuspecting victims in Illinois and elsewhere,” it continued. Last year, the U.K.’s National Crime Agency (NCA) arrested six teenagers for allegedly attempting to access a tool used by the Lizard Squad hacker group. Just days after those arrests were made, the NCA itself was taken down by a targeted cyberattack. The NCA’s website was down for more than an hour and was the target of a distributed denial-of-service (DDoS) attack. In DDoS attacks, hackers bombard a targeted website with an overflow of data, eventually causing the entire network to crash. Lizard Squad took to Twitter shortly after the attack to take credit for the site shutdown. The group also gained press last year for supposedly launching a new business venture that allows anyone to join its security-breaching ways for a low cost of $6 a month. The subscription service known as LizardStresser allows subscribers to obtain a distributed denial-of-service attack tool. “This booter is famous for taking down some of the world’s largest gaming networks, such as Xbox Live, Playstation Network, Jagex, BattleNet, League of Legends and many more!” the LizardStresser homepage boasted at the time. “With this stresser, you wield the power to launch some of the world’s largest denial-of-service attacks.” Source: http://www.pymnts.com/news/security-and-risk/2016/hackers-from-lizard-squad-poodlecorp-arrested/

Visit link:
Justice Charges Hackers From Lizard Squad, PoodleCorp

53% of DDoS attacks result in additional compromise

DDoS attack volume has remained consistently high and these attacks cause real damage to organizations, according to Neustar. The global response also affirms the prevalent use of DDoS attacks to distract as “smokescreens” in concert with other malicious activities that result in additional compromise, such as viruses and ransomware. “Distributed denial-of-service attacks are no longer isolated events limited to large, highly visible, targets. Sophisticated attacks hit companies of all sizes, in all industries,” said Rob … More ?

View article:
53% of DDoS attacks result in additional compromise

Expect ‘Flood’ of DDoS Attacks After Source Code Release

The source code behind the massive distributed denial of service attack against security researcher Brian Krebs’s website has been released online. In a blog post over the weekend, Krebs wrote that the so-called Mirai source code’s release pretty much guarantees that “the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders, and other easily hackable devices.”  Krebs knows all too well what Mirai is capable of. Last month, the “Internet of Things” botnet launched a “historically large” 620Gbps DDoS attack against his well-known and respected site KrebsOnSecurity, inundating it with so much spam traffic that DDoS protection provider Akamai dropped the site to protect other subscribers. The Mirai source code leak came to light on Friday via the Hackforums community, Krebs said. A user with the alias “anna-senpai” posted the code there for anyone to use, likely to avoid getting caught. “It’s an open question why anna-senpai released the source code for Mirai, but it’s unlikely to have been an altruistic gesture: Miscreants who develop malicious software often dump their source code publicly when law enforcement investigators and security firms start sniffing around a little too close to home,” Krebs wrote. “Publishing the code online for all to see and download ensures that the code’s original authors aren’t the only ones found possessing it if and when the authorities come knocking with search warrants.” The malware spreads by “continuously scanning the Internet for [vulnerable] IoT systems” that are using default or hard-coded usernames and passwords. Vulnerable devices are then turned into bots, which together can be used to launch DDoS attacks designed to send so much traffic to a website that it’s knocked offline. “My guess is that (if it’s not already happening) there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth,” Krebs wrote. “On the bright side, if that happens it may help to lessen the number of vulnerable systems.” Source: http://www.pcmag.com/news/348404/expect-flood-of-ddos-attacks-after-source-code-release

See the article here:
Expect ‘Flood’ of DDoS Attacks After Source Code Release

Source code unleashed for junk-blasting Internet of Things botnet

Hackforums leak Malicious code used to press-gang IoT connected devices into a botnet was leaked online over the weekend.…

Taken from:
Source code unleashed for junk-blasting Internet of Things botnet

Why a massive DDoS attack on a blogger has internet experts worried

Someone on the internet seems very angry with cybersecurity blogger Brian Krebs. On 20 September, Krebs’ website was hit with what experts say is the biggest Distributed Denial of Service (DDoS) attack in public internet history, knocking it offline for days with a furious 600 to 700 Gbps (Gigabits per second) traffic surge. DDoS attacks are a simple way of overloading a network router or server with so much traffic that it stops responding to legitimate requests. According to Akamai (which had the unenviable job of attempting to protect his site last week), the attack was twice the size of any DDoS event the firm had ever seen before, easily big enough to disrupt thousands of websites let alone one. So why did someone expend time and money to attack a lone blogger in such a dramatic way? Krebs has his own theories, and the attack follows Krebs breaking a story about the hacking and subsequent takedown of kingpin DDoS site vDOS, but in truth nobody knows for certain and probably never will. DDoS attacks, large and small, have become a routine fact of internet life. Many attacks are quietly damped down by specialist firms who protect websites and internet services. But the latest attack has experts worried all the same. Stop what you’re doing DDoS attacks first emerged as an issue on the public internet in the late 1990s, and since then have been getting larger, more complex and more targeted. Early motivations tended towards spiteful mischief. A good example is the year 2000 attacks on websites including Yahoo, CNN and Amazon by ‘MafiaBoy’, who later turned out to be 15-year old Canadian youth Michael Calce. Within weeks, he was arrested. Things stepped up a level in 2008 when hacktivist group Anonymous started an infamous series of DDoS attacks with one aimed at websites belonging to the Church of Scientology. By then, professional cybercriminals were offering DDoS-for-hire ‘booter’ and ‘stresser’ services that could be rented out to unscrupulous organizations to attack rivals. Built from armies of ordinary PCs and servers that had quietly been turned into botnet ‘zombies’ using malware, attacks suddenly got larger. This culminated in 2013 with a massive DDoS attack on a British spam-fighting organization called Spamhaus that was measured at a then eye-popping 300Gbps. These days, DDoS is now often used in extortion attacks where cybercriminals threaten organizations with crippling attacks on their websites unless a ransom is paid. Many are inclined to pay up. The Krebs effect The discouraging aspect of the Krebs attack is that internet firms may have thought they were finally getting on top of DDoS at last using techniques that identify rogue traffic and more quickly cut off the botnets that fuel their packet storms. The apparent ease with which the latest massive attack was summoned suggests otherwise. In 2015, Naked Security alumnus and blogger Graham Cluley suffered a smaller DDoS attack on his site so Krebs is not alone. Weeks earlier, community site Mumsnet experienced a DDoS attack designed to distract security engineers as part of a cyberattack on the firm’s user database. At the weekend, Google stepped in and opened its Project Shield umbrella over Krebs’ beleaguered site. Project Shield is a free service launched earlier in 2016 by Google, specifically to protect small websites such as Krebs’ from being silenced by DDoS attackers. For now it looks like Google’s vast resources were enough to ward off the unprecedented attack, but it’s little comfort to know that nothing short of the internet’s biggest player was the shield that one simple news site needed. With criminals apparently able to call up so much horsepower, the wizards of DDoS defence might yet have to rethink their plans – and fast. Source: https://nakedsecurity.sophos.com/2016/09/29/why-a-massive-ddos-attack-on-a-blogger-has-internet-experts-worried/

View post:
Why a massive DDoS attack on a blogger has internet experts worried

Web Host Hit by DDoS of Over 1Tbps

A French web hoster is claiming his firm has been hit by the biggest DDoS attack ever seen, powered by an IoT botnet with an estimated capacity of 1.5Tbps. Octave Klaba, the founder and CTO of OVH, took to Twitter late last week to reveal his firm was under attack from a stream of DDoS blitzes creeping towards and eventually past the 1Tbps mark. He claimed the botnet in question was initially comprised of around 145,000 internet-connected cameras and digital video recorders with an estimated 1-30Mbps capacity each – that’s a potential 1.5Tbps in total. In further updates this week Klaba said the botnet had increased by first another 6857 devices and then 15,654 more. The news follows reports last week that Akamai was forced to withdraw its  pro bono  DDoS protection of the KrebsOnSecurity site after it was allegedly hit by an attack measuring 665Gbps, then the largest on record. Dave Larson, CTO and COO at Corero Network Security, claimed the recent attacks are beginning to change the way IT security professionals view DDoS. “The internet is a powerful tool, and must be viewed with security and protection first and foremost,” he added. “Motivations for attacks, and the tools and devices used to execute the attacks, are readily available to just about anyone; combining this with almost complete anonymity creates a recipe to break the Internet.” Roland Dobbins, principal engineer at Arbor Networks, argued that IoT botnets are increasingly favored by hackers because they frequently ship with insecure defaults, are often connected to high speed internet and are rarely patched to fix bugs. “Embedded IoT devices are often low-interaction – end-users don’t spend much time directly interfacing with them, and so aren’t given any clues that they’re being exploited by threat actors to launch attacks,” he told  Infosecurity . “Organizations can defend against DDoS attacks by implementing best current practices for DDoS defense, including hardening their network infrastructure; ensuring they’ve complete visibility into all traffic from their networks; having sufficient DDoS mitigation capacity and capabilities either on premise or via cloud-based DDoS mitigation services or both; and by having a DDoS defense plan which is kept updated and is rehearsed on a regular basis.” Source: http://www.infosecurity-magazine.com/news/web-host-hit-by-ddos-of-over-1tbps/

More:
Web Host Hit by DDoS of Over 1Tbps