Tag Archives: blocking-ddos

Attackers Compromise Vulnerable Web Servers to Power DDoS Assaults

Attackers are exploiting flaws in Linux and Windows software to turn poorly-maintained Web servers into denial-of-service engines. Web servers based on both Linux and Windows are rapidly being targeted by attackers and turned into server-side botnets capable of high-bandwidth denial-of-service attacks, two security firms stated in recently published analyses. On one hand, attackers are targeting unpatched or poorly-maintained Linux systems, exploiting known vulnerabilities and installing bot software to conscript the computers into a server-side botnet, according to an advisory released on Sept. 4 by Prolexic, a subsidiary of content-delivery provider Akamai. Yet, Windows servers are not immune. A recent attack against a client of Website security firm Sucuri used 2,000 servers to send a flood of packets to the victim’s network. Web servers running on Windows 7 and 8 accounted for almost two-thirds of those systems, the company stated in an advisory. In the past, Sucuri had usually seen traffic from botnets created by consumer desktop and laptop systems, CEO and co-founder Tony Perez told eWEEK. “This was different because of the anatomy of the network,” he said. “Normally, we see attacks coming from notebooks and desktops and PCs, but now Web servers are doing the denial-of-service.” By using Web servers, “the attackers have more horse power available to them, allowing them to have more devastating effect on unsuspecting web sites,” Perez said. Server-side botnets used for denial-of-service attacks first came to light in 2012, when the Izz ad-Din al-Qassam Cyber Fighters targeted financial institutions with massive bandwidth and application-layer attacks in alleged retaliation for the posting of videos to YouTube that were offensive to some Muslims. Rather than using botnets consisting of tens of thousands of consumer desktop systems, the attackers used hundreds to thousands of Web servers instead. While some attackers use vulnerabilities to compromise servers, others have significant success just by trying common passwords. The 2,000 servers that attacked Sucuri’s client sent some 5,000 HTTP requests per second, enough to not just overwhelm the victim’s Web server but the victim’s hosting provider as well. The hosting provider, which Perez declined to name, cut off the company for violating its terms of service, according to Perez. The campaign to create Linux-based DDoS botnets is more extensive, according to Prolexic. The attackers behind the denial-of-service botnet use vulnerabilities in popular Linux software, such as Apache Tomcat, Struts and Elasticsearch, the company said. Once a server is compromised, the attackers upload malware, which creates a copy of itself named .IptabLes or .IptabLex. IPTables is a common firewall and routing package included in most versions of the Linux operating system. “The analysis conducted within the lab environment showed that the binary exhibits DDoS functionality,” Prolexic stated in its alert. “Two functions found inside the binary indicate SYN and DNS flood attack payloads. These DDoS attack payloads are initiated once an attacker sends the command to an infected victim machine.” The botnet created by the campaign has been used to target financial institutions, and in one case, created a DDoS that peaked at 119 Gbps. “This bot seems to be in an early development stage and shows several signs of instability. More refined and stable versions could emerge in future attack campaigns.” The attacks appear to come from Internet addresses in Asia, and two hard-coded addresses contained in the malware binary are in China, according to Prolexic. Source: http://www.eweek.com/security/attackers-compromise-vulnerable-web-servers-to-power-ddos-assaults.html

Taken from:
Attackers Compromise Vulnerable Web Servers to Power DDoS Assaults

Application-layer DDoS attacks are becoming increasingly sophisticated

The number of DDoS (distributed denial-of-service) attacks that target weak spots in Web applications in addition to network services has risen during the past year and attackers are using increasingly sophisticated methods to bypass defenses, according to DDoS mitigation experts. Researchers from Incapsula, a company that provides website security and DDoS protection services, recently mitigated a highly adaptive DDoS attack against one of its customers that went on for weeks and combined network-layer with application-layer—Layer 7—attack techniques. The target was a popular trading site that belongs to a prominent player in a highly competitive online industry and it was one of the most complex DDoS attacks Incapsula has ever had to deal with, the company’s researchers said in a blog post. The attack started soon after an ex-partner left the targeted company and the attackers appeared to have intimate knowledge of the weak spots in the target’s infrastructure, suggesting that the two events might be connected, the researchers said. The attack began with volumetric SYN floods designed to consume the target’s bandwidth. It then progressed with HTTP floods against resource intensive pages, against special AJAX objects that supported some of the site’s functions and against Incapsula’s own resources. The attackers then switched to using DDoS bots capable of storing session cookies in an attempt to bypass a mitigation technique that uses cookie tests to determine if requests come from real browsers. The ability to store cookies is usually a feature found in full-fledged browsers, not DDoS tools. As Incapsula kept blocking the different attack methods, the attackers kept adapting and eventually they started flooding the website with requests sent by real browsers running on malware-infected computers. “It looked like an abnormally high spike in human traffic,” the Incapsula researchers said. “Still, even if the volumes and behavioral patterns were all wrong, every test we performed showed that these were real human visitors.” This real-browser attack was being launched from 20,000 computers infected with a variant of the PushDo malware, Incapsula later discovered. However, when the attack first started, the company had to temporarily use a last-resort mitigation technique that involved serving CAPTCHA challenges to users who matched a particular configuration. The company learned that a PushDo variant capable of opening hidden browser instances on infected computers was behind the attack after a bug in the malware caused the rogue browser windows to be displayed on some computers. This led to users noticing Incapsula’s block pages in those browsers and reaching out to the company with questions. “This is the first time we’ve seen this technique used in a DDoS attack,” said Marc Gaffan, co-founder of Incapsula. The challenge with application-layer attacks is to distinguish human traffic from bot traffic, so DDoS mitigation providers often use browser fingerprinting techniques like cookie tests and JavaScript tests to determine if requests actually come from real browsers. Launching DDoS attacks from hidden, but real browser instances running on infected computers makes this type of detection very hard. “We’ve been seeing more and more usage of application-layer attacks during the last year,” Gaffan said, adding that evasion techniques are also adopted rapidly. “There’s an ecosystem behind cybercrime tools and we predict that this method, which is new today, will become mainstream several months down the road,” he said. DDoS experts from Arbor Networks, another DDoS mitigation vendor, agree that there has been a rise in both the number and sophistication of Layer 7 attacks. There have been some papers released this year about advanced Layer 7 attack techniques that can bypass DDoS mitigation capabilities and the bad guys are now catching on to them, said Marc Eisenbarth, manager of research for Arbor’s Security Engineering and Response Team. There’s general chatter among attackers about bypassing detection and they’re doing this by using headless browsers—browser toolkits that don’t have a user interface—or by opening hidden browser instances, Eisenbarth said. In addition, all malware that has man-in-the-browser functionality and is capable of injecting requests into existing browsing sessions can also be used for DDoS, he said. Layer 7 attacks have become more targeted in nature with attackers routinely performing reconnaissance to find the weak spots in the applications they plan to attack. These weak spots can be resource-intensive libraries or scripts that result in a lot of database queries. This behavior was observed during the attacks against U.S. banking websites a year ago when attackers decided to target the log-in services of those websites because they realized they could cause significant problems if users are prevented from logging in, Eisenbarth said. “We continued to see attackers launch those type of attacks and perform reconnaissance to find URLs that, when requested, may result in a lot of resource activity on the back end,” he said. More and more companies are putting together DDoS protection strategies, but they are more focused on network-layer attacks, Gaffan said. They look at things like redundancy or how much traffic their DDoS mitigation solution can take, but they should also consider whether they can resist application-layer attacks because these can be harder to defend against than volumetric attacks, he said. With application-layer attacks there’s an ongoing race between the bad guys coming up with evasion techniques and DDoS mitigation vendors or the targeted companies coming up with remedies until the next round, Gaffan said. Because of that, both companies and DDoS mitigation providers need to have a very dynamic strategy in place, he said. “I think we will continue to see an evolution in the sophistication of application-layer attacks and we will see more and more of them,” Gaffan said. They won’t replace network-layer attacks, but will be used in combination with them, he said. Having Layer 7 visibility is very important and companies should consider technologies that can provide that, Eisenbarth said. In addition to that, they should perform security audits and performance tests for their Web applications to see what kind of damage an attacker could do to them, he said. Source: http://www.pcworld.com/article/2056805/applicationlayer-ddos-attacks-are-becoming-increasingly-sophisticated.html

Link:
Application-layer DDoS attacks are becoming increasingly sophisticated

5 Tips for Fighting DDoS Attacks

It should be the busiest day of the year for your business, but your website has just disappeared off the Internet and orders have dried up. If this happens to you, then you’ve likely just become yet another victim of a distributed denial of service (DDoS) attack. A basic denial of service attack involves bombarding an IP address with large amounts of traffic. If the IP address points to a Web server, then it (or routers upstream of it) may be overwhelmed. Legitimate traffic heading for the Web server will be unable to contact it, and the site becomes unavailable. Service is denied. A distributed denial of service attack is a special type of denial of service attack. The principle is the same, but the malicious traffic is generated from multiple sources — although orchestrated from one central point. The fact that the traffic sources are distributed — often throughout the world — makes a DDoS attack much harder to block than one originating from a single IP address. DDoS Attacks Bigger and Badder DDoS attacks are becoming an increasingly significant problem. According to the latest Quarterly Global DDoS Attack Report commissioned by DDoS mitigation company Prolexic, there’s been a 22 percent increase in the number of DDoS attacks carried out over the last 12 months. The attacks have also lasted longer, up 21 percent from 28.5 hours to 34.5 hours. And attacks have become far more intense, with the average attack bandwidth rising a staggering 691 percent from 6.1Gbps to 48.25Gbps. A March DDoS attack against anti-spam organization Spamhaus may have reached as much as 300Gbps, according to some reports. Studies from Arbor Networks and Akamai Technologies found similar increases in the number and intensity of DDoS attacks. “The barrier to entry of DDoS attacks in terms of cost has largely gone,” says Tim Pat Dufficy, managing director of ServerSpace, a hosting company and Internet service provider (ISP). “That means anyone can launch an attack: organized crime, a group of blackmailers, or just a disgruntled ex-employee or a competitor. And anyone can be the victim. One of our customers is a very small company that does training for people in the construction business, yet they came under attack for two weeks.” It used to be technically difficult to launch a DDoS attack, but now it’s possible to rent a botnet of tens or even hundreds of thousands of infected or “zombie” machines relatively cheaply and use these zombies to launch an attack. And as the Internet develops, home or office computers that have become zombies can make use of increasingly high bandwidth Internet connections. There are also pre-packaged or Web-based DDoS toolkits like Low Orbit Ion Cannon and RussKill that anyone with a minimal amount of know-how can use. So what can you do to protect yourself against DDoS attacks? Identify a DDoS Attack Early If you run your own servers, then you need to be able to identify when you are under attack. That’s because the sooner you can establish that problems with your website are due to a DDoS attack, the sooner you can start to do something about it. To be in a position to do this, it’s a good idea to familiarize yourself with your typical inbound traffic profile; the more you know about what your normal traffic looks like, the easier it is to spot when its profile changes. Most DDoS attacks start as sharp spikes in traffic, and it’s helpful to be able to tell the difference between a sudden surge of legitimate visitors and the start of a DDoS attack. It’s also a good idea to nominate a DDoS leader in your company who is responsible for acting should you come under attack. Overprovision Bandwidth It generally makes sense to have more bandwidth available to your Web server than you ever think you are likely to need. That way, you can accommodate sudden and unexpected surges in traffic that could be a result of an advertising campaign, a special offer or even a mention of your company in the media. Even if you overprovision by 100 percent – or 500 percent – that likely won’t stop a DDoS attack. But it may give you a few extra minutes to act before your resources are overwhelmed. Defend at Network Perimeter (if You Run Your Own Web Server) There are a few technical measures that can be taken to partially mitigate the effect of an attack — especially in the first minutes — and some of these are quite simple. For example, you can: rate limit your router to prevent your Web server being overwhelmed add filters to tell your router to drop packets from obvious sources of attack timeout half-open connections more aggressively drop spoofed or malformed packages set lower SYN, ICMP, and UDP flood drop thresholds But the truth is that while these steps have been effective in the past, DDoS attacks are now usually too large for these measures to have any significant effect. Again, the most you can hope for is that they will buy you a little time as an attack ramps up. Call Your ISP or Hosting Provider The next step is to call your ISP (or hosting provider if you do not host your own web server), tell them you are under attack and ask for help. Keep emergency contacts for your ISP or hosting provider readily available, so you can do this quickly. Depending on the strength of the attack, the ISP or hoster may already have detected it, or they may themselves start to be overwhelmed by the attack. You stand a better chance of withstanding a DDoS attack if your Web server is located in a hosting center than if you run it yourself. That’s because its data center will likely have far higher bandwidth links and higher capacity routers than your company has itself, and its staff will probably have more experience dealing with attacks. Having your Web server located with a hoster will also keep DDoS traffic aimed at your Web server off your corporate LAN, so at least that part of your business — including email and possibly voice over IP services — should operate normally during an attack. If an attack is large enough, the first thing a hosting company or ISP is likely to do is “null route” your traffic — which results in packets destined for your Web server being dropped before they arrive. “It can be very costly for a hosting company to allow a DDoS on to their network because it consumes a lot of bandwidth and can affect other customers, so the first thing we might do is black hole you for a while,” says Liam Enticknap, a network operations engineer at PEER 1 hosting. Tim Pat Dufficy, managing director of ISP and hosting company ServerSpace, agrees. “The first thing we do when we see a customer under attack is log on to our routers and stop the traffic getting on to our network,” he says. “That takes about two minutes to propagate globally using BGP (border gateway protocol) and then traffic falls off.” If that was the end of the story, then the DDoS attack would be successful. To get the website back online, your ISP or hosting company may divert traffic to a “scrubber” where the malicious packets can be removed before the legitimate ones are be sent on to your Web server. “We use our experience, and various tools, to understand how the traffic to your site has changed from what it was receiving before and to identify malicious packets,” explains Enticknap. He says PEER 1 has the capacity to take in, scrub and send on very high levels of traffic — as much as 20Gbps. But with levels of traffic comparable to those experienced by Spamhaus, even this scrubbing effort would likely be overwhelmed. Do have a DDoS plan in place with your ISP or hoster so that it can begin mitigation or divert your traffic to a mitigation specialist with the minimum delay. Call a DDoS Specialist For very large attacks, it’s likely that your best chance of staying online is to use a specialist DDoS mitigation company. These organizations have large scale infrastructure and use a variety of technologies, including data scrubbing, to help keep your website online. You may need to contact a DDoS mitigation company directly, or your hosting company or service provider may have a partnership agreement with one to handle large attacks. “If a customer needs DDoS mitigation then we divert their traffic to (DDoS mitigation company) Black Lotus,” says Dufficy. ”We do this using BGP, so it only takes a few minutes.” Black Lotus’s scrubbing center can handle very high levels of traffic indeed, and sends on the cleaned traffic to its intended destination. This does result in higher latency for website users, but the alternative is that they can’t access the site at all. DDoS mitigation services are not free, so it’s up to you whether you want to pay to stay online or take the hit and wait for the DDoS attack to subside before continuing to do business. Subscribing to a DDoS mitigation service on an ongoing basis may cost a few hundred dollars a month. If you wait until you need one, however, expect to pay much more for the service and wait longer before it starts to work. DDoS mitigation specialists include: Arbor Networks Black Lotus DOSarrest Prolexic VeriSign Source: http://www.esecurityplanet.com/network-security/5-tips-for-fighting-ddos-attacks.html

Follow this link:
5 Tips for Fighting DDoS Attacks

Details of the complexity of a Distributed Denial of Service (DDoS) Attacks

DDoS‘s popularity as an attack method can be explained by how important availability is to most organizations’ ability to function. Availability is as critical to an organization today as electricity. If an organization is taken offline, it can lose the ability to generate revenue from its customers, or the ability to access cloud-based data and applications. And, if publicized, the downtime can damage its reputation and brand. Arbor Networks’ data, gathered from more than 240 service provider deployments, shows that, without question, DDoS attacks are getting bigger. Much bigger. Consider the statistics: The average attack in September was 1.67 Gbps, a 72-percent growth from September 2011. The number of mid-range attacks, ranging 2-10 Gbps, also has increased, up 14.35% so far in 2012. Very large attacks, 10 Gbps+, were up 90 percent during 2011. The largest attack this year measured 100.84 Gbps. Hackers seek out pain points for an organization, like maintaining availability, and look to exploit weaknesses in infrastructure and existing security defenses. From that perspective, DDoS is a great tool. There are three main categories of DDoS attack: Volumetric attacks These attacks attempt to consume the bandwidth either within the target network/service, or between the target network/service and the rest of the internet. These attacks are simply about causing congestion. Volumetric attacks first emerged in 2001 when Microsoft, eBay and Yahoo were taken offline by what back then was considered large attacks in the 300 Mbps range – a relatively low volume attack. With DDoS attacks now exceeding 100 Gbps, internet service providers are faced with new challenges of how to protect their networks and infrastructure. TCP state-exhaustion attacks These attacks attempt to consume the connection state tables that are present in many infrastructure components, such as load balancers, firewalls and the application servers themselves. Even high-capacity devices capable of maintaining state on millions of connections can be taken down by these attacks. Application layer attacks In 2010, there was a dramatic shift in DDoS, from primarily large volumetric attacks to smaller, harder-to-detect application-layer attacks that target some aspect of an application or service at Layer 7. These are the most sophisticated, stealthy attacks, as they can be very effective with as few as one attacking machine generating a low traffic rate (this makes these attacks very difficult to proactively detect and mitigate). ** Each of these attack types present unique challenges to network operators. The easiest attacks to mitigate are volumetric, which can be effectively mitigated by cloud-based managed security services. Attacks targeting existing infrastructure, and those that are “low-and-slow” targeting applications, are the most difficult to identify and mitigate. What makes DDoS such an effective weapon in recent years is the increasing complexity of attacks, the blending of attack types, targets and techniques. Take, for example, the recent attacks on financial institutions in the United States. These attacks used a combination of attack tools with vectors mixing application-layer attacks on HTTP, HTTPS and DNS with volumetric attack traffic on a variety of protocols including TCP, UDP, ICMP and others. The other unique characteristic of these attacks was the targeting of multiple companies in the same vertical at very high bandwidth. Compromised PHP web application servers were used as bots in the attacks. Additionally, many WordPress sites, often using the out-of-date TimThumb plug-in, were compromised around the same time. Joomla and other PHP-based applications were also leveraged. The attackers uploaded PHP WebShells to unmaintained servers and then used those shells to further deploy attack tools. The attackers connected to the tools either directly or through intermediate servers/proxies/scripts, and therefore the concept of command-and-control did not apply in the usual manner. This complex, rapidly evolving attack vector requires purpose-built tools, both on-premise and cloud-based, to provide comprehensive protection against both large attacks and those that target the application layer. And until we see pervasive deployment of best practices defenses, we can expect to see DDoS in the headlines for years to come. Winston Churchill offered some great advice that IT security professionals should keep top of mind as they adapt their defense to the threat landscape, “Success is not final, failure is not fatal: It is the courage to continue that counts.” Source: http://www.scmagazine.com/its-the-complexity-not-the-size-that-makes-ddos-effective/article/273775/

Visit link:
Details of the complexity of a Distributed Denial of Service (DDoS) Attacks

To the Rescue: A Fully Managed Distributed Denial of Service (DDoS) Protection Solution

With its hosting DNA, DOSarrest understands the challenges of dealing with a distribute denial of service (DDoS) attack in a data center. We know, for example, that for every minute your website is reeling from a DDoS attack, thousands – or even hundreds of thousands-of dollars can be lost in the form of missed sales and credibility with your customers. In addition to lost revenue, you risk future losses due to the negative impact to your search engine optimization (SEO) ranking caused by a prolonged outage – a penalty from which it can take months to recover. To help avoid these problems, DOSarrest designed a cloud-based mitigation service that provides carrier-grade service and leaves your Web infrastructure intact. Because we created a multilayered defense system in each of its geo-distributed mitigation centers, we can handle the large Layer 2 and Layer 3 attacks all the way to the most sophisticated application layer incursions with relative ease. Expecting the Unexpected Given the relatively low barrier of entry for the committed attacker, a DDoS attack can be launched at anytime for a variety of reasons, unbeknownst to the victim. Because of this uncertainty, we had to design a mitigation service that could be implemented within minutes. By using a distributed architecture, we can provide both DDoS protection and added website performance for our customers. But this distribution presented some challenges we had to overcome. Given that we broadcast our customers’ content from several locations between Europe and North America, we needed to know how each location was performing. Ensuring Total Stability and Performance To solve this problem we developed – and are now in the process of rolling out – DOSarrest External Monitoring Service (DEMS) , a completely separate website monitoring service designed to ensure the highest degree of stability and performance for all the geographic regions from which we broadcast. Even some of the world’s largest content-delivery networks don’t supply this information to their customers. With DEMS , we can provide the first fully managed DDoS protection service, backed by a team of engineers on duty 24/7/365 in our Security Operations Center, which is capable of detecting and thwarting an oncoming attack before it has any effect. Our philosophy is to resolve issues that may arise on the first call or e-mail from our customers. There are no auto-replies here, as an experienced engineer responds to every inquiry, normally within 10 minutes. Jag Bains, CTO at DOSarrest Internet Security . To read more about the InformationWeek DDoS Special Report, download it here: http://www.informationweek.com/gogreen/121112fs

More here:
To the Rescue: A Fully Managed Distributed Denial of Service (DDoS) Protection Solution

Evolving Distributed Denial of Service ‘DDoS’ Attacks Force Defenders to Adapt

Distributed denial-of-service attacks get bigger and combine application-layer exploits requiring defenders to be more agile. n the past, attackers using distributed denial-of-service (DDoS) attacks to take down Web sites or network servers typically adopted one of two tactics: Flooding the site with a deluge of data or overwhelming an application server with seemingly valid requests. Companies concerned about denial-of-service attacks have generally focused more on mitigating data floods, also known as volumetric or infrastructure attacks. Yet, increasingly attackers are using a hybrid approach, using multiple vectors to attack. The attacks that hit financial firms in September and October, for example, often used a massive flood of data packets that would overwhelm a victim’s network connection, while a much smaller subset of traffic would target vulnerable applications functions, consuming server resources. “It is almost like sending a whole squadron of tanks and then have an assault team that can go in and be mores stealthy in taking out their targets,” says Carlos Morales, vice president of global sales engineering and operations for network protection firm Arbor Networks. “It broke the model that people had for stopping these things.” The one-two punch is potent. Many financial firms thought they had the defenses in place to defeat such attacks but had problems staying accessible during the onslaught. Companies prepared to handle application-layer attacks or smaller volumetric attacks could not handle the 20Gbps or more that saturated their Internet connection. Even a gateway that can keep up with 10Gbps connection speed cannot deal with twice as much–or more–traffic sent to the same server. A recent report from network-security firm Prolexic found that the average attack bandwidth had increased to nearly 5Gbps, with 20Gbps attacks quite common. In a year, the average volume of attacks had doubled, the firm found. “The late Senator Ted Stevens got mocked for saying that the Internet is a ‘series of tubes,’” says Matthew Prince, CEO of Cloudflare, a content-delivery and network-security firm. “But the Internet is a series of tubes, and you can only fit so much through it.” Companies must start creating a multi-layered approach to stopping distributed denial-of-service attacks, according to mitigation experts. The greatest amount of attack volume should be stopped inside a provider’s network, away from the company’s links to the Internet. Trying to over-provision your network for the worst case scenario will likely not work and will be very expensive to boot. “Even if you are a large bank in the U.S., you are doing less than 10Gbps of traffic across all the properties of your network combined,” says Cloudflare’s Prince. “If you have to over-provision that by 10x, that is wasting a lot of resources.” By using a service provider to filter out most of the spurious traffic at the edge of the Internet, companies can pay attention to the data that actually enters their network. Collecting information on the traffic can help a company to better develop defenses for future attacks as well, even if a company does not have the resources to identify attacks in real time. Yet, faster detection and more agile response can mean the difference between successful defenses and downtime. “Seeing an impact and understanding that there is an attack happening is not necessarily going to happen at the same time,” says Neal Quinn, chief operating officer for attack-mitigation service Prolexic. For many companies, the threat of attacks is not over, but rather, just beginning. The most recent attacks did not start with the financial industry; other industries have been hit by similar attacks for almost the last year. Companies should not expect it to end there either. The holiday season tends to be a popular time for attackers to attempt to extort money from retailers by threatening denial-of-service attacks. “It is traditionally a very busy time of year for these attacks,” Prolexic’s Quinn says. “If anything, organizations should make themselves more aware of how well they can handle these attacks.” Source: http://www.darkreading.com/security-services/167801101/security/perimeter-security/240142616/evolving-ddos-attacks-force-defenders-to-adapt.html

The New Wave of Distributed Denial of Service ‘DDoS’ attacks: How to Prepare and Respond

What will you do if your organization is the next target of a distributed denial of service attack? Hacktivists recently launched DDoS attacks that caused online outages at several major U.S. banks. Each institution was warned in advance; none were able to prevent disruptions. And while banks are the current targets, any organization could be next. Join this panel for expert insight on: Why these recent DDoS attacks elude traditional defenses; New security solutions to help detect and respond to DDoS attacks; How to respond if you are attacked – from ramping up fraud prevention in other channels to what to tell customers about the attacks. Background Beginning in mid-September, hacktivists initiated a series of sophisticated DDoS attacks against major U.S. banks, including Bank of America, Chase and Wells Fargo. The attackers claim to be waging a cyber war against top-tier banking institutions because of outrage over a YouTube movie trailer believed by the hacktivists to be anti-Islam. In each instance, the group has given at least 24 hours notice before launching the DDoS attacks. But no institution so far has successfully avoided online outages resulting from the attacks. These incidents send two clear messages to security leaders: The sophistication and strength of the DDoS attacks are greater than organizations have seen before. One industry expert measured the DDoS traffic flow at one institution to be 65 gigabytes per second – roughly 65 times heavier than previous DDoS attacks. Any organization is susceptible. Banks are today’s DDoS target, but tomorrow it could be a government agency, merchant or healthcare entity that offends a hacktivist group with the resources to launch an attack. If banks, with their mature security programs and state-of-the-art defenses, cannot ward off these attacks, then what other organization can? In this panel webinar, industry leaders with expertise in DDoS defense will present the unique qualities of these latest attacks, why no organization should feel immune, then discuss successful solutions that can empower organizations to detect, prevent and respond to attacks. Leading the discussion is Matthew Speare, SVP of IT at M&T Bancorp. He will set the stage by discussing how his institution responded to the attacks against other banks, including preparation, security controls and customer communication strategies. Speare then will be joined by thought-leaders from Akamai, Fortinet and Neustar, who will discuss a range of DDoS-related topics, including: Sophistication of Attacks – In the past, DDoS meant brute-force network attacks. Now, experts say, they are not only stronger, but also morphing into application layer attack, which makes them harder to detect and block. What have we learned from these attacks, and which new solutions are best for identifying and rerouting the DDoS traffic? A Cover for Fraud? – Sometimes DDoS attacks are meant as a distraction – to keep security personnel focused online while the fraudsters turn to other channels, such as the call center, to commit fraud. What are the account anomalies you need to be equipped to detect? Incident Response – Not only does your organization need to be prepared to respond internally to DDoS attacks, but you also need to know how to communicate externally to customers. What’s your message, and how can you take this opportunity to better explain your security posture? Source: http://www.bankinfosecurity.com/webinars/new-wave-ddos-attacks-how-to-prepare-respond-w-308

Read the article:
The New Wave of Distributed Denial of Service ‘DDoS’ attacks: How to Prepare and Respond

Distributed Denial of Service ‘DDoS’ crooks: Do you want us to blitz those phone lines too TDoS?

Cybercrooks are now offering to launch cyberattacks against telecom services, with prices starting at just $20 a day. Distributed denial of attacks against websites or web services have been going on for many years. Attacks that swamped telecoms services are a much more recent innovation, first starting around 2010. While DDoS attacks on websites are typically launched from botnets (networks of compromised Windows PCs under the control of hackers), attacks on telecom lines are launched using attack scripts on compromised Asterisk (software PBX) server. Default credentials are one of the main security weaknesses used by hackers to initially gain access to a VoIP/PBX systems prior to launching voice mail phishing scams or running SIP-based flooding attacks, say researchers. Telecoms-focused denial of service attacks are motivated by the same sorts of motives as a DDoS on a website. “Typical motives can be anything from revenge, extortion, political/ideological, and distraction from a larger set of financial crimes,” a blog post by Curt Wilson of DDoS mitigation experts Arbor Networks explains. Many of the cybercrime techniques first seen while crooks blitzed websites with junk traffic are being reapplied in the arena of flooding phone lines as a prelude to secondary crimes, according to Arbor. “Just as we’ve seen the Dirt Jumper bot used to create distractions – by launching DDoS attacks upon financial institutions and financial infrastructure at the same time that fraud is taking place (with the Zeus Trojan, or other banking malware or other attack technique) – DDoS aimed at telecommunications is being used to create distractions that allow other crimes to go unnoticed for a longer period.” Arbor details an array of services offered by hackers, some of which offer to flood telephones (both mobile and fixed line) for $20 per day. The more cost-conscious would-be crooks can shop around for a service that offers to blitz lines for $5 an hour, the price offered in another ad spotted by the ASERT security research team. As well as blitzing phone lines, other attacks against a targeted organisation’s VoIP system or SIP controllers are possible. Poorly configured VoIP systems can be brought down even by something as simple as a port scan, Wilson notes. “In such cases, an attacker could bring down an organisations’ phone system quickly if they were able to reach the controller. The benefits of proactive security testing can help identify such brittle systems ahead of time, before an attacker might latch onto the vulnerability. “Any system is subject to availability attacks at any point where an application layer or other processor-intensive operation exists as well as the networks that supply these systems via link saturation and state-table exhaustion. Telecommunications systems are no exception to this principle, as we have seen. Clearly, there is money to be made in the underground economy or these services would not be advertised,” Wilson concludes. For fast protection against your e-commerce website click here . Source: http://www.theregister.co.uk/2012/08/02/telecoms_ddos/

Visit link:
Distributed Denial of Service ‘DDoS’ crooks: Do you want us to blitz those phone lines too TDoS?

Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging

Distributed denial-of-service (DDoS) have matured with hackers blending different attack techniques and becoming more damaging, observers note. They add that defenses need to evolve to complement infrastructure security that has already been commoditized.” DDoS attacks, where multiple compromised systems usually infected with a Trojan virus, are used to target a single system have been getting more “sophisticated” over the years, Vic Mankotia, security vice president of CA Technologies Asia-Pacific and Japan, noted. Today, there are DDoS attacks coming from automated systems, payloads delivered from USB sticks and protocols such as Bluetooth and magnetic strips of cards, he observed. In the past, DDoS attacks primarily targeted networks using low-level protocol or volumetric attacks, Eric Chan, regional technical director of Fortinet Southeast Asia and Hong Kong, remarked. However, hackers today use a combination of volumetric and application-layer attacking techniques, he noted. An application-layer DDoS targets the application service by using legitimate requests to overload the server, and rather than flood a network with traffic or session, they target specific applications and slowly exhaust resources at the application layer, Chan explained. They can be very “effective” at low traffic rates, which makes them harder to detect, he added. The Sony Playstation breach for example, had been a result of application-layer DDoS attacks, able to camouflage a data breach of over 77 million customer records, he cited. Evolved with IT trends, hackers intent On a basic level, denial-of-service (DoS) has evolved from “taking a pair of wire cutters outside the organization and snipping those wires” 20 years ago, to becoming distributed DoS where “hundreds and thousands of” traffic making computers into botnets to shut down systems, Andrew Valentine, managing principal of investigative response at Verizon observed. Strong connectivity, data centers and cloud, have given mobility center-stage, paved way for the Bring Your Own Device (BYOD) trend making the security parameters “disappear”, Mankotia explained. While mobile devices may not store the target information, but they do allow the DDoS attackers access to the information they seek, he noted. Laptops and devices also have a lot more computing power compared to those in the past, Claudio Scarabello, global security product manager of Verizon added. As such, hardware have a lot more power to flood systems, and can be much more “damaging”, he warned. Another way it has evolved is through the intent, Valentine added. In the past, DDoS had stemmed from “bragging rights”–showing off one’s ability to hack into the server, as well as financial intents, he explained. Today, it is used for political intents, commonly known as hacktivism, and DDoS and data breaches have become “synonymous”, he added, citing the Verizon 2012 data breach investigation report which found a rise in hacktivism against large organizations. “As such, DDoS today is associated with political intent, and making a statement, and not about script kiddies showing off anymore,” he said. Security system with visibility, multi-layered defense needed What is needed is a different type of security to complement the infrastructure security that has already been commoditized–a security system which enables the knowledge of where and who is sharing the data, Mankotia pointed out. DDoS attacks are heavily customized with a signature to get specific information, and security has to evolve as all information is not equal, and all identities, access and system must be in one ecosystem, where content-aware identity and access management are applied and advanced authentication is at its core, he explained. As botnets can send huge amounts of legitimate connections and requests from each compromised machine, and determining whether such connections are valid or not will be crucial, enterprises will need security solutions with “sufficient visibility and context”, Chan added. “These systems should have sufficient visibility and context to detect a wide range of attack types without slowing the flow, and processing of legitimate traffic, and is then able to conduct mitigation in the most effective manner,” he said. Above of, a multi-layer defense strategy is also essential, and the defense strategy must cover both network-layer and application-layer attacks, Chan surmised. In need of protection click here DDoS protection . Source: http://www.zdnetasia.com/ddos-becoming-more-sophisticated-damaging-62305134.htm

Continued here:
Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging

North Korea ships malware-infected games to South Korean users, uses them to launch DDoS attacks

According to an independent report published in Korea’s JoongAng Daily, Seoul’s Metropolitan Police Agency has intercepted a cyber attack plot orchestrated by North Korea’s Reconnaissance General Bureau, which successfully shipped malware-infected games to South Korean users which were later on used to launch a DDoS attack against the web site of Incheon Airport. More details: According to the police, the South Korean man, identified by the surname Jo, traveled to Shenyang, northeastern China, starting in September 2009 and met agents of an alleged North Korean trading company. He allegedly asked them to develop game software to be used in the South. Jo purchased dozens of computer game software for tens of millions of won, which was a third the cost of the same kind of software in the South. The games were infected with malignant viruses, of which Jo knew, an official at the police agency said. Jo sold the games to South Korean operators of online games. When people played the games, the viruses used their computers as zombies, through which the cyberattack was launched. This is the second attempt by North Korea in recent months to engage in electronic warfare with South Korea, following the use of GPS jammers causing difficulties in air and marine traffic controls. What’s particularly interesting about North Korea’s infection vector in this campaign, is that it’s not a novel approach to spread malware. Instead, it relies on a chain of trust, from the unknown origin of the produced games, to the sellers claims that they are malware-free, and ultimately targets bargain hunters. In the past, software piracy has proven to be a key driving force behind the growth of malware campaigns internationally. Distribution of malware-infected games greatly reminds me of a case which happened in Eastern Europe in the 90s where a malware coder participating in a popular IT magazine’s coding contest, on purposely backdoored his game, which ended being shipped to thousands of subscribers on a magazine-branded CD. Although a good example of a flawed QA (Quality Assurance) on behalf of the magazine, South Korean authorities claim that the person who purchased the games actually knew that they were infected with malware, hence the lower price for purchasing them. Just how big of a cyber threat is North Korea? It’s an emerging market player, having actively invested in the concept over the years, that’s for sure. In my recent conversation with cyber warfare expert Jeffrey Carr, he pointed out that he doubts Russia or China will knowingly supply the irrational North Korea with cyber warfare ‘know how’. However, Russia or China’s chain of command doesn’t need to know that this outsourcing will ever take place, as North Korea could easily outsource to sophisticated cybercriminals doing it for the money, not for the fame. Summary: Seoul’s Metropolitan Police Agency has intercepted a cyber attack plot orchestrated by North Korea’s Reconnaissance General Bureau, which successfully shipped malware-infected games to South Korean users. Source: http://www.zdnet.com/blog/security/north-korea-ships-malware-infected-games-to-south-korean-users-uses-them-to-launch-ddos-attacks/12383

See more here:
North Korea ships malware-infected games to South Korean users, uses them to launch DDoS attacks