Tag Archives: ddos-attacks

Notorious pro-US hacker Jester diverts DoS attack towards Israeli spy service Mossad

A high-profile US hacker has turned an attack on his website into an assault against the Israeli intelligence service. ‘The Jester’ – or th3j35t3r – claims that he diverted an attempt to overload his website to assault Mossad’s online presence. Haaretz reported that Jester’s website – jesterscourt.cc – was the victim of a denial of service (DoS) attack on the night of 1 April. In a tweet, Jester announced that he had diverted the hacker’s attack by simply changing the IP address his website was registered on. When asked why he picked Mossad by one of his 74,400 Twitter followers, Jester replied “Because they can look after themselves perfectly well.” On his blog, Jester claims to have used this technique before. In a post called Offensive Counter Measures – Be Like Water, Jester details the steps he took to divert another DoS attack, which he alleges was carried out by Anonymous, towards websites linked with the Occupy movement. According to Haaratz, Israel’s Information and Communications Technology Authority said Mossad’s website had not seen any irregularities or disruptions of service. At the time of writing, Mossad’s website was working, but IBTimes UK could not confirm whether it had suffered any downtime. However, The Jester’s website was not working. Anti-ISIS, anti-Anonymous Jester is one of the hacking community’s most high-profile members. What is a DoS attack? During a denial of service (DoS) or a distributed denial of service (DoS) attack, hackers attempt to overload a website’s connections by sending in data requests from multiple sources. Most often hackers use a ‘botnet’ – internet-connected PCs that are compromised by malware – to send in the requests to visit the site, without the users’ knowledge. The huge number of requests, which can reach thousands per second, overload the ability of a website’s server to respond, eventually causing an error message to appear instead of the site’s pages. Making a DDoS is relatively simple. Botnets are available to hire on websites not reachable via search engines (deep web) or on encrypted websites (the dark web). Jester’s career as a vigilante hacker appears to have started in 2010, when he claimed to have been involved in an attack on the Wikileaks website. That year, the New York Times reported Jester was a a former military contractor who had worked with US special forces. Since then, Jester has developed a reputation as a pro-US hacker vigilante and cybersecurity expert. Through writing his own blog on cybersecurity, he gives talks on the subject through text chat to keep his identity a secret, and is known for attacking websites linked to Hamas and Islamic State (Isis). Jester has also attacked websites used by the Occupy movement and Anonymous – whom he described as “pathetic terrorist sympathizing buttholes”. He claims to have caused more than 180 websites to go offline since 2010. Jester was listed as one of Time magazine’s “most influential people on the internet” in March 2015. Source: http://www.ibtimes.co.uk/notorious-pro-us-hacker-jester-diverts-dos-attack-towards-israeli-spy-service-mossad-1552895

Link:
Notorious pro-US hacker Jester diverts DoS attack towards Israeli spy service Mossad

The Anonymous ‘war’ on Donald Trump is a complete disaster

The “total war” that Anonymous declared earlier this month against Donald Trump has quickly devolved into a civil war among hackers fighting within the group and pro-Trump supporters who are trolling them within their chat rooms. In early March, hackers affiliated with Anonymous tried to reboot their Operation Trump campaign by calling for everyone to take down Trump’s websites in a coordinated effort on April 1. Almost immediately, the initiative was criticized by people within Anonymous as irresponsible and “cringeworthy,” but a dedicated group apparently moved on with the plan. It’s April 1: Many of the GOP frontrunner’s sites are still standing, there are now two competing OpTrump chat rooms with totally different missions, and one of them has been flooded with pro-Trump supporters and others leaving trolling comments like “Hitler did nothing wrong.” In short: The so-called war seems to be a complete disaster. ‘A mess is happening’ It’s unclear when the split between Anonymous factions occurred, but it seems to have happened sometime after a hacker named Beemsee, who has been leading the original OpTrump effort, released a new statement claiming that attacking Trump’s websites was all a ruse for publicity around April Fools’ Day. “There is no DDoS,” Beemsee and two other hackers wrote, using the acronym for a distributed denial-of-service attack, a tactic used to overload a website. “It’s only purpose was to gain attention, which this Operation needs. … the point of this Operation is not to attack Donald Trump. Instead, it is going to try to give citizens some insight.” Beemsee and their cohorts say in their statement that people should try and capture “the darker nature of Trump’s supporters” and post it on social media sites with hashtags like #OpTrump and #Trump2016. But a hacker called AnonymousLoyalist disagreed. In a competing statement, the hacker wrote that they moved to a “far more organized channel, which has already seen unsurprisingly large amounts of success.” That channel is #OpTrump2016, but it was unclear exactly what that success boiled down to. When Tech Insider viewed the #OpTrump2016 chat room on Friday, it was an unorganized mess. Most Anonymous chat rooms are moderated in some way, and people usually get kicked out for spamming or posting nonsense. But it appeared to be flooded with trolls intent on calling them children, “social justice warriors,” and, more often than not, homophobic slurs. “A mess is happening,” wrote one user in #OpTrump, expressing a shared frustration among others in Beemsee’s chat room. The ‘war’ goes on It was clear on Friday that at least some of Trump’s websites were indeed under cyberattack. The website CitizensForTrump.com is currently unreachable, and the site for Trump’s hotels brought up an error for a few seconds before pulling up a cached version powered by CloudFlare, a service that protects from attacks like this. Anonymous may be able to bring down some of Trump’s unprotected websites, but it will almost certainly come back online after a few hours or days. And many of his other sites are probably not at risk at all, since Tech Insider previously spoke with CloudFlare CEO Matthew Prince, and he wasn’t particularly worried. “DDoS attacks are not particularly sophisticated cyber attacks,” Prince said. “They are sort of the functional equivalent of a caveman with a club.” A representative for Trump did not immediately respond to a request for comment from Tech Insider, but spokeswoman Hope Hicks previously told Tech Insider: “The government and law-enforcement authorities are seeking the arrest of the people responsible for attempting to illegally hack Mr. Trump’s accounts and telephone information.” Depending on who you believe in Anonymous, the plan is a coordinated DDoS attack or a social-media shaming campaign against Trump’s supporters. But Beemsee left open the possibility of something else, perhaps an actual way to take over one of their targeted websites — which the hacker collective has been scanning for vulnerabilities since the beginning. “This is NOT the last time you hear of this operation,” Beemsee wrote. “We will be watching, and will act when the time is right.” Source: http://www.businessinsider.com/anonymous-war-donald-trump-fail-2016-4

Excerpt from:
The Anonymous ‘war’ on Donald Trump is a complete disaster

University of Georgia hit by DDoS Attack

The University of Georgia was the victim of a cyberattack Sunday night which blocked all Internet access for everyone on campus using the school’s network. The DDoS — distributed denial of service — attack came from outside UGA’s network, and began about 6:10 p.m., according to an email sent Monday by Timothy Chester, UGA’s vice president for information technology. A DDoS attack floods a target’s computer network with traffic, leaving the victim’s use of its websites and computer systems unavailable. During the incident, the university’s entire 20 gigabytes per second of Internet capacity was saturated with outside network traffic, which blocked access campus users.   UGA purchases its Internet connectivity through a nonprofit consortium, called Southern Crossroads, which is operated by Georgia Tech. School officials worked with Southern Crossroads to isolate the attack and began blocking it about 10 p.m., Chester’s message said. The attack ended shortly after that. As of Monday morning, officials had found no evidence that systems or data maintained by UGA had been compromised. Colleges and universities have increasingly been the target of these types of cyberattacks. Last year, Rutgers University students requested tuition refunds after the school experienced its fifth DDoS attack in a year. Arizona State University was also hit by a DDoS attack in April, blocking access to its Internet network a week before final exams. Some campuses are not currently equipped to identify DDoS attacks, and may not have a method for effectively mitigating them, industry experts say. “I personally regret that many of you experienced a disruption as you were preparing homework, getting ready for class or doing other University work and I offer my apologies,” Chester said to the campus community in the message. UGA plans to review the incident with federal, state and local law enforcement, and work with the University System of Georgia on reducing the risks of these types of attacks in the future.   Source: http://www.ajc.com/news/news/local-education/university-of-georgia-hit-by-cyberattack/nqtN9/

Read the original post:
University of Georgia hit by DDoS Attack

Change.org Victim of DDoS Attack From China

Change.org, an online petitioning platform, has appear beneath an advancing broadcast abnegation of account (DDoS) advance basic from China afterwards the website hosted a alarm advancement Chinese authorities to absolution artisan Ai Weiwei from custody. The attacks, which started backward Sunday, accept about brought down the site, according to Change.org architect Ben Rattray. DDoS attacks plan by application hundreds or bags of afraid computers to forward cartage to a website, cutting it with abstracts so it becomes aloof to accustomed users. Change.org said the accepted advance originates from an accretion accumulation of computers primarily based in China, and has yet to stop. This is the aboriginal time the website has been hit with a DDoS attack. Change.org has been hosting a online address calling for the absolution of Chinese artisan Ai Weiwei, who is currently beneath arrest. The address has admiring about 100,000 humans from 175 countries, authoritative it one of Change.org’s a lot of acknowledged all-embracing campaigns, Rattray said. “It’s appealing bright the advance is in acknowledgment to the campaign,” he added. “It’s amazing that somebody in China with a high-level of abstruse composure can appulse the adeptness for humans about the apple to organize.” The online alarm coincided with demonstrations beyond the apple this accomplished Sunday, which aswell alleged for the artist’s release. Ai, who is aswell accepted for his activism, has been bedfast as allotment of a Chinese government crackdown on political dissidents in the country. Authorities in the country accept arrested added animal rights activists and clamped down on the advice flow, afterward antecedent online postings that began in February calling for a “Jasmine revolution” adjoin the Chinese government. Change.org is currently blocked in China. Internet censors in the country consistently block sites that are accounted to politically sensitive. Despite the block, the computers complex in the DDoS advance are managing to acquisition a way about the country’s civic Internet firewall, said Rattray. In the past, added sites accept been the victims of cyber attacks advancing from China. This March, blog publishing belvedere WordPress.com aswell reported getting hit with a DDoS attack basic from China. Chinese hackers accept aswell allegedly launched cyber attacks to steal abstracts from adopted activity accompanies, according to aegis bell-ringer McAfee. In 2009, Google was aswell the victim of an advance basic from China that was aimed at accessing the Gmail accounts of animal rights activists The Chinese government has ahead responded to these letters by abstinent it is complex in any cyberattacks, abacus that China has aswell been a victim of hacking attempts. The accurate antecedent of DDoS attacks is generally unclear. Although Change.org has traced the accepted advance to servers in China, it is aswell accessible the computers are beneath the ascendancy of hackers based in addition country. Change.org letters that both the FBI and U.S. State Department are searching into the DDoS attack. “We will not stop or yield down annihilation because of this DDoS attack,” Rattray said. “We accept in the axiological appropriate of the humans to adapt about issues they affliction about it.” Source: http://webtechreview.com/change-org-victim-of-ddos-attack-from-china/

Continue reading here:
Change.org Victim of DDoS Attack From China

Swedish newspaper websites shut down in DDoS attack

The online editions of Sweden’s main newspapers were knocked out for several hours by unidentified hackers at the weekend, police said Sunday as they launched an investigation. The attack was “extremely dangerous and serious,” the head of the Swedish Media Publishers’ Association, Jeanette Gustafsdotter, told Swedish news agency TT. “To threaten access to news coverage is a threat to democracy,” she said. No one has claimed responsibility for the attacks, which either partially or totally shut down the sites of Dagens Nyheter, Svenska Dagbladet, Expressen, Aftonbladet, Dagens Industri, Sydsvenskan and Helsingborgs Dagblad on Saturday evening from about 8:00 pm (1900 GMT) until about 11:00 pm (2200 GMT). Several experts quoted in the media suggested the sites were subjected to distributed denial-of-services (DDoS) attacks, in which hackers hijack multiple computers to send a flood of data to the target, crippling its computer system. Police said in a statement they had launched an investigation, and Swedish intelligence was also being kept abreast of developments. An anonymous threat was issued on a Twitter account shortly before the attack. The account was attributed to J@_notJ. “The following days attacks against the Swedish government and media spreading false propaganda will be targeted,” the first tweet read. An hour later, a second tweet read: “This is what happens when you spread false propaganda. Aftonbladet.se #offline”. Source: https://www.enca.com/technology/swedish-newspaper-websites-shut-down-hacker-attack    

More:
Swedish newspaper websites shut down in DDoS attack

Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks can have an amplification factor of 26.5 An independent security researcher that goes by the name of MalwareTech has discovered a way in which he could abuse the ZeroAccess malware’s botnet to launch reflection DDoS attacks with an above-average amplification factor. ZeroAccess is a trojan that infects Windows computers and then starts communication with a C&C (command and control), which in turn tells the trojan to download various types of other, more dangerous malware, usually clickfraud bots or Bitcoin mining software, operating hidden from the user’s view. The ZeroAccess botnet appeared in 2011, and because of an effective rootkit component and P2P-like structure, it even managed to survive a takedown attempt orchestrated by Microsoft in December 2013. ZeroAccess botnet used for amplifying DDoS attacks MalwareTech discovered that ZeroAccess allowed its bots to relay messages from one to another, some acting like smaller servers (supernodes) while the rest were just end-points (workers). To relay orders from the C&C server to supernodes and workers, ZeroAccess used simple UDP packets. Because of its complex mesh structure, when a UDP packet arrived at a supernode, the bot would add more information to the packet, containing various details about the network’s structure. The supernode would add 408 bytes on top of the original 16, for a total of 242 bytes. Since UDP packets can have their destination address spoofed, an attacker that managed to map ZeroAccess’ bot network would be able to send UDP packets to its bots, some of which would then amplify the traffic by 26.5, sending it back to the spoofed destination (the victim’s IP). This scenario is your typical reflection DDoS attack , carrying a 26.5 amplification factor, which is more than double the typical 2-10 amplification factor seen in other types of reflection DDoS attacks. DDoS attacks worked even if bots were behind NATs Theoretically, this wouldn’t have been a problem, since most bots infect users that are sitting behind NATs (Network Address Translation), software programs that translate public IPs to private IP addresses, in order to maximize IPv4 address space usage. That meant that a vast majority of the ZeroAccess botnet wouldn’t have been accessible to a person carrying DDoS attacks via this technique. Unfortunately, MalwareTech found a way around this issue as well, allowing him to involve ZeroAccess supernode bots into DDoS attacks even if sitting behind a router. All of this is only theoretical since the researcher did not want to commit a crime just to test out his theory. Source: http://news.softpedia.com/news/malware-botnet-can-be-abused-to-launch-ddos-attacks-501869.shtml

See the original post:
Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

A group known as New World Hackers says it targeted the websites of Salt Lake City police, Salt Lake International Airport, the Downtown Alliance and First Utah Bank in response to the Feb. 27 officer-involved shooting of teenager Abdullahi Omar Mohamed. The distributed denial of service attacks, first reported Monday by HackRead, appear to have had little impact on the sites’ function. Nick Como, communication and marketing director for the Downtown Alliance, said he heard about the attacks but that the nonprofit’s website analytics were normal. City deputy director of communications Holly Mullen said an attack on the SLCPD site was “unsuccessful.” Airport public relations director Nancy Volmer was unaware of any problems. First Utah Bank CIO Amy Foulks said the bank shut down its website for a few hours Sunday morning after it received an alert, which “allowed ourselves some time to implement a tool that would thwart the denial of service package.” Bank president Brad Baldwin emphasized that the DDoS attacks were not a “hack.” The group did not gain access to the bank’s system or any customer information, he said. A Twitter account associated with the group, @NewWorldHacking, told The Tribune the attacks were in response to the shooting of Mohamed, 17, who was shot and wounded near 250 S. Rio Grande Street after police say he was one of two people attacking a male victim with metal objects. “We want justice for that poor kid who got shot 3 times in the chest for no accurate reason,” it said in a direct message. That the group would target a bank with no apparent role in Mohamed’s shooting is “a mystery to us,” Baldwin said. First Utah reported the attack to authorities, he said. The FBI did not immediately return a request for comment Tuesday. Source: http://www.sltrib.com/news/3665236-155/ddos-attacks-aimed-at-salt-lake

Taken from:
DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Event ticket seller Ticketmaster experiences the traffic equivalent of a huge DDoS attack every time a major gig or show goes on sale, necessitating a steady migration to the cloud. That’s according to Simon Tarry, director of engineering strategy at the firm, speaking to V3 ahead of the V3 Cloud and Infrastructure Live event on 20 and 21 April 2015. “Ticketmaster’s been handling web traffic for almost two decades now, so we’ve built up our own infrastructure, and part of the problem with that, as a US company, is we’ve grown through acquisition and bought up a lot of ticketing businesses round the world – as well as all the infrastructure that comes with it,” Tarry explained. With ticketing platforms scaling, and a growing audience increasingly consisting not just of fans “but automated bots as well”, Tarry said Ticketmaster’s existing infrastructure was reaching critical mass. Ticketmaster currently handles around 1,300 users per second at peak times. “We basically suffer huge DDoS attacks from a large on-sale, so we try to separate our human traffic from bot traffic,” Tarry told V3 . Having already been using a private cloud for the past three years, Ticketmaster is now going through a “strategic push” to AWS. “We’re assessing at the moment that kind of journey – how to move what we have into an AWS architecture. So a lot of planning and training is going on right now,” Tarry said. The initial migration to private cloud was an e-commerce stack for a one-off event. “We tried that first, as a short project, as it was limited in scope to a certain degree,” said Tarry. “But we made a lot of assumptions about the infrastructure that weren’t true,” he added. “So we had to challenge a lot of our thinking about the infrastructure and how it would perform. The key criteria for us is to handle a very large on-sale on any platform.” Keeping the lights on and maintaining the ability to cope with a punishing level of traffic was achieved by “strong tooling”, said Tarry, including load testing products from SOASTA. Mechanisms to interrogate the traffic in order to block out traffic Ticketmaster doesn’t want also help in this. “Part of our DevOps culture is a kind of ‘swat team’ of guys who play ‘hunt the bottleneck’, spending time diagnosing, testing, and finding the next problem,” Tarry said. “Ultimately, when we’re cloud based we want that capacity on-tap – it’s not something you can just do,” he said. “You need to configure your systems to use that capability.” Source: http://www.v3.co.uk/v3-uk/news/2451092/ticketmaster-turns-to-the-cloud-to-handle-ddos-level-traffic-during-big-event-launches

More here:
Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Brief Downtime Disrupts Bitcoin Exchange Trading

Another day in the Bitcoin world and another crisis has been averted, even though plenty of users were worried when several exchanges experienced the same issue at the same time. Incapsula, the DDoS protection provider for several major Bitcoin exchanges, was experiencing some issues earlier today. As a result, trading was temporarily unavailable, although the issue was rectified rather quickly. However, this “centralized” form of protection is an annoyance for a decentralized ecosystem. While it is of the utmost important for Bitcoin exchanges to have some form of DDoS protection, it is not helpful if all of these platforms use one and the same provider. Bitcoin and digital currency are all about decentralization, yet companies seem to be using one centralized security solution. Granted, Incapsula is one of the market leaders when it comes to DDoS and platform protection services. It only makes sense when companies such as BTCC , Bitstamp , BitFinex , Vaultoro , and others have taken a liking to this company. Not that there is anything wrong with that, as long as there is no outage as Incapsula itself. There is no mention on the Incapsula Twitter account as to what went wrong exactly, or how the matter was resolved in the end. Whichever way the company handled this issue, the issue was sorted in a matter of minutes, which is commendable. Nor do any of the affected Bitcoin exchanges posted any messages on social media either, which is quite disconcerting. Security is the top priority for any Bitcoin exchange platform, as most companies act as a custodian while watching over customer funds. DDoS attacks, hacking attempts, and database breaches need to be avoided at all costs.Incapsula is a well-respected company capable of delivering such a service. But at the same time, this situation begs the question if there are no other companies who can provide this service as well. Granted, security is an innovative business in the online world right now, and there are hundreds of companies in existence who want to be market leaders. Incapsula has secured their spot already– for now – but other players need to emerge and collaborate with Bitcoin platforms to create more decentralization in the security department. Source: http://themerkle.com/news/brief-incapsula-downtime-disrupts-bitcoin-exchange-trading/

Read the article:
Brief Downtime Disrupts Bitcoin Exchange Trading

Customers of large NZ website company Zeald have been hit by DDoS attack

Customers of a large New Zealand website design company have had their websites shut down due to a cyber attack believed to target one or more of the company’s customers. Customers of Zeald were informed on Thursday that some clients had experienced outages with their websites in recent weeks. The company, formed in 2001, with thousands of customers in New Zealand and Australia, has told clients the outages were caused by Distributed Denial of Service (DDoS) attacks. These attacks attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. They present a major challenge to making sure people can publish and access important information. “Simply put, a DDoS attack simulates millions of computers trying to access a website at the same time. This puts tremendous stress on the online infrastructure, and can make access to a website difficult, or impossible,” the company said in its email. “We believe these attacks are targeted at one of our customers,” it said. It said the attacks were difficult to resolve and were a rapidly expanding class of security attack. They did not involve ‘hacking’ and did not lead to the loss of confidential information, but they made it impossible to access a site. “They can be created by attackers with limited technical skill but options for dealing with them are extremely limited”. “Working with our upstream providers, we have been able to stop these attacks temporarily by blocking international traffic. Unfortunately, these attacks keep resuming and are no longer isolated to international traffic alone. These attacks are also causing major issues for our upstream providers as well as the other websites and services that they provide,” it said. “If you have experienced any kind of extortion attempt or communication threatening an attack like this please let us know. Any feedback regarding recent threats will be treated in the strictest confidence. If we know the target of the attack there are measures we can put in place to eliminate the problem”. Source: http://www.stuff.co.nz/technology/77539929/customers-of-large-nz-website-company-zeald-have-been-hit-by-cyber-attack

Excerpt from:
Customers of large NZ website company Zeald have been hit by DDoS attack