Tag Archives: ddos-defense

9/11 DDoS Alert for Banks, Agencies

U.S. and Israeli government agencies and banking institutions should be on alert for a potential Sept. 11 wave of distributed-denial-of-service attacks launched by the same groups behind the unsuccessful Operation USA and Operation Israel attacks in May. That warning comes from cybersecurity experts and alerts issued by the Federal Bureau of Investigation and the Financial Services Information Sharing and Analysis Center. While OpUSA and OpIsrael, which were designed to take down websites operated by globally recognized brands and governmental agencies, were not successful, cybersecurity experts say the threat this time is genuine. The groups behind these attacks are now more organized, better equipped and trained, and more determined than they were the first time around, they say. The FBI, however, notes that the attacks are not expected to have a serious or significant impact. “It is thought that due to the fact that hackers will be relying on commercial tools to exploit known vulnerabilities, and not developing custom tools or exploits, that the skill levels are, at best rudimentary, and capable of causing only temporary disruptions of any of the targeted organizations,” the FBI alert states. Attack Alerts On Aug. 5, the FS-ISAC issued a warning to its membership about a new wave of DDoS attacks that could target U.S. banks. David Floreen, senior vice president of the Massachusetts Bankers Association , says the FBI, which issued a separate alert on Aug. 30, and the FS-ISAC asked banking associations to spread the word about the possibility of attacks. “The attacks are expected to occur in two phases,” notes the FBI alert. “Phase I will take place over a period of 10 days and target several commercial and government sites with DDoS attacks. … “Phase II is scheduled to take place on September 11, with a more widespread attack threatened, along with Web defacements.” The FBI recommends organizations: Implement data backup and recovery plans; Outline DDoS mitigation strategies; Scan and monitor e-mail attachments for malicious links or code; and Mirror and maintain images of critical systems files The FBI did not release its alert to the public, an FBI spokeswoman acknowledges. But in an effort to get the word out, the Massachusetts Bankers Association posted the FBI and FS-ISAC warnings on its site, Floreen says. The FS-ISAC alert names top-tier banks that are likely to be targeted during an upcoming attack. The list of potential attack targets includes the same 133 U.S. banking institutions named in the April 24 Anonymous post that appeared on Pastebin during the first OpUSA campaign, says financial fraud expert Al Pascual, an analyst with consultancy Javelin Strategy & Research. The FS-ISAC alert does not reference OpIsrael, but experts say OpUSA and OpIsrael are connected. Planning Attacks Gary Warner, a cyberthreat researcher at the University of Alabama at Birmingham who also works for the anti- phishing and anti- malware firm Malcovery, claims the hacktivist groups’ main focus, for now, is Israel. If attacks against Israeli targets are successful, then U.S. targets will be next, he warns. Since June, two hacktivist groups, AnonGhost and Mauritanian Attacker, have been building plans for OpIsrael Reborn, according to Warner’s research. So far, these groups have not been linked to new attacks planned for a sequel to OpUSA, Warner says. Both groups, however, were involved in OpIsrael and OpUSA, he notes. “As part of our process of watching the phishers who create counterfeit bank websites, we track where many of those criminals hang out and what sorts of things they are discussing,” he says. “We became aware of OpIsrael Reborn while reviewing posts made by criminals who have been phishing U.S. banks and Internet companies.” Announcements for the new campaign began Sept. 2. But more posts were added on Facebook and in underground forums within the last week to recruit additional attackers, he says. “AnonGhost and Mauritanian Attacker have taken the time to build a strong coalition of hackers,” Warner says. “In that June release, there were no dates, no members and no targets announced.” Since that time, attackers have honed their targets, and they claim to have already compromised several government and banking sites in Israel, he says. On Sept. 11, they plan to publish information they’ve compromised from during those attacks, Warner adds. “They claim [on YouTube ] they are going to begin publishing the internal government documents of Israel,” he says. “The video also makes reference to the recent FBI claim that they have dismantled Anonymous.” Attackers are uniting this time out of anger over those claims made by the FBI as well as recent attacks waged against Islamic businesses believed to be backed by an Israeli hacktivist group, Warner explains. So why is this wave of attacks being taken more seriously than the first OpIsrael? The sheer number of attackers, their tools and the way the hacktivist groups have been building momentum through social networking sites such as Facebook has raised serious concern, Warner says. “They’ve been gathering tools since June 9, and training attackers on how do SQL and DDoS attacks,” he says. “It’s a SANS-quality training for hackers, and they’re prepping for wiping Israel off the [online] map.” On Sept. 9, two Israeli government websites were successfully taken offline for a period of time, Warner adds. “We did not see that success in OpIsrael or OpUSA,” he says. “If they pull this thing off against Israel, they will keep hitting others,” he says. No Attack Link to Al-Qassam Experts, including Warner, say Izz ad-Din al-Qassam Cyber Fighters , the self-proclaimed hacktivist group that’s been targeting U.S. banks since September 2012, does not appear to be involved in these most recent campaigns. And although U.S. banking institutions have built up strong online defenses over the last year to mitigate cyber-threats such as DDoS attacks, other sectors are far less prepared, Javelin’s Pascual says. “The lack of success that Izz ad-Din al-Qassam achieved during the fourth round of DDoS attacks was indicative of how well fortified U.S. banks have become,” Pascual says. But Rodney Joffe , senior technologist at DDoS-mitigation provider Neustar, says security professionals should be concerned that other attackers have learned lessons from al-Qassam’s strikes. “I don’t believe there is any connection between OpUSA and AQCF [al-Qassam Cyber Fighters],” he says. “However, the reason I think it is more worrying this time is because, as I have said over and over, the underground learned a lot of groundbreaking lessons from AQCF. … And this time around, they may be more successful.” Source: http://www.bankinfosecurity.com/911-ddos-alert-for-banks-agencies-a-6054

See the article here:
9/11 DDoS Alert for Banks, Agencies

Are DDoS Attacks Against Banks Over?

Distributed-denial-of-service attacks against U.S. banks have been dormant for nearly four weeks, leading security experts to question when and if a new phase of attacks might emerge. The hacktivist group Izz ad-Din al-Qassam Cyber Fighters , which since last September has taken credit for the hits against banks, claimed its attacks were in protest of a YouTube movie trailer deemed offensive to Muslims. But some observers have speculated that Iran was backing the DDoS strikes against banks as payback for cyber-espionage attacks, such as Stuxnet, Flame and Duqu, that have over the last three years affected Iranian computer systems. Rodney Joffe, senior technologist for online security provider Neustar Inc., says the current lull could be a sign that the attacks waged by the hacktivist group are over. “It’s a wild conjecture,” Joffe says. “But we may have seen the end of them.” Joffe says indirect activity linked to the al-Qassam Cyber Fighters’ botnet, known as Brobot, has continued. But there have been no direct attacks. And that lack of activity raises questions about whether al-Qassam will wage any more attacks, Joffe says. “The botnet is no bigger than it was,” he says. “We take [compromised] machines down and then new machines keep getting adding. I still have hope that the government will have some impact or effect, but don’t know one way or the other.” The Federal Bureau of Investigation in April warned that Brobot had been modified, “in an attempt to increase the effectiveness with which the [botnet’s] scripts evade detection.” The FBI said the actors behind Brobot were changing their attack methodology to circumvent mitigation efforts put forth by U.S. banking institutions The FBI also noted that as of April 10, 46 U.S. banking institutions had been targeted by more than 200 separate DDoS attacks of “various degrees of impact” since September. Financial fraud expert Avivah Litan , an analyst at Gartner, says intervention from federal authorities may have spurred al-Qassam to halt its attacks. But, like Joffe, she says there is no way to be sure. “I do know the banks were trying to get the White House to do something politically, and that could be what’s happened.” But other experts, such as Mike Smith of Web security provider Akamai Technologies, don’t think there’s been anything going on behind the scenes to keep the attacks from resuming. Different Attack Actors Other experts anticipate that another group could emerge to resume DDoS attacks against banks if Izz ad-Din al-Qassam Cyber Fighters ends its campaigns. “There has been a lull in the al-Qassam-like attacks,” says Scott Hammack , CEO of DDoS-mitigation provider Prolexic. “But I would definitely not misunderstand this lull as being an end to these types of attacks. The attacks will continue; it’s really just a question of when, not if.” The current break comes after a third phase of hacktivist attacks, which kicked off in March. The latest campaign ran eight weeks, the longest-running so far. The break from the third phase of attacks has lasted four weeks so far. By comparison the break between the first campaign , which began Sept. 18, and the second campaign , which kicked off Dec. 10, lasted six weeks. And the break between the second and third campaigns lasted five weeks. Hammack, like Smith, says Brobot, as well as other botnets, continue to grow. In fact, over Memorial Day weekend, Prolexic helped to mitigate a 167-gigabyte DNS-reflection attack, the largest attack recorded to date, Hammack says. “The attack traffic was global and required us to use all four of our cloud-based scrubbing centers,” he says. DNS-reflection was the attack method used in Operation Stophaus , an attack waged in March by The Spamhaus Project, a Geneva-based not-for-profit organization dedicated to fighting Internet spam. And while it’s not an extremely sophisticated type of attack, Hammack says these types of DDoS strikes are only going to become more prevalent. “There are plenty of countries where rogue elements will continue to exist,” he says. “You’re never going to overcome that. I think, if anything, people should be taking advantage of this down time to fortify their infrastructures.” The application-layer attacks al-Qassam Cyber Fighters favored in its last two campaigns have remained inactive, despite that the group appears to continue efforts to grow and strengthen its botnet. “The botnets are out there,” Hanmmack says. “We have between 15,000 and 100,000 compromised web servers out there that we know of. So the artillery is still out there to create these types of attacks. We just haven’t seen any of the web server attacks for the last 30 days.” Why Have Attacks Stopped So why have the hacktivists remained quiet for the last month? On May 6, al-Qassam Cyber Fighters claimed on the open forum Pastebin that its attacks would cease for just a week, out of respect for OperationUSA , a separate hacktivist movement organized by Anonymous that proved unsuccessful Many experts predicted the group’s attacks against banks would resume by May 14. But they didn’t. Some have speculated that international law enforcement could be close to nailing members of the al-Qassam team. But Hammack says drawing conclusions based on the ebbs and flows of DDoS attacks is dangerous because hacktivists attack in waves. “Certain attacks die down after certain periods,” he says. “That doesn’t mean, though, that the attacks are over.” Banking institution leaders say they’ve been advised by groups such as the Financial Services Information Sharing and Analysis Center not to lessen their DDoS mitigation efforts. Litan says banks are heeding that advice. “The banks have more vendors involved now,” she says. “I don’t think they’ll ever pull back. They have put a lot of systems in. They really can’t go back now, and they shouldn’t.” Source: http://www.bankinfosecurity.com/are-ddos-attacks-against-banks-over-a-5801/op-1

Threat of the Week: DDoS For Hire on the Rise

Just when you thought you could tune out the fears about DDoS (distributed denial of service) attacks, listen up: the risks for you suddenly are much graver, and it may be the time when defensive action on your part has become necessary. Yes, the fear-mongering over the May 7th DDoS blitzkrieg – which turned out to be a non-event – has prompted many credit union executives to turn off the DDoS discussion. That’s a mistake, however. “Three years ago I would have called DDoS a nuisance. Now it is a threat to many more businesses,” said Vann Abernethy, an executive with security firm NSFOCUS. A big change that is occurring, sources insist to Credit Union Times , is that for-rent DDoS networks – often costing spare change – are proliferating and they have plenty of firepower to take down most credit unions’ online presences. The scariest part: absolutely no technical skills are required to deploy what is being called DDoS as a service. All that’s needed is digital money – PayPal or BitCoin and there even are some providers that take MasterCard and Visa. Barry Shteiman, senior security strategist at Imperva, named names of sites that he said offer what seems to be DDoS for hire: SSH Booter, Empire Stresser, Quantum Stresser, Asylum Stresser, Titanium Stresser, Illuminati Stresser, Legion Stresser, Agony Stresser. The list is not complete. “There are dozens of companies selling DDoS as a service now,” said Sean Bodmer, chief researcher, Counter-Exploitation Intelligence, for CounterTack. Note: Almost all such sites claim to offer, not rogue DDoS for hire, but “stress testing” so that an organization – a credit union for instance – can check its DDoS defenses. Just one problem: sources insisted that the majority of stress-testing sites they are familiar with do no verification that the person buying the “stress test” has any affiliation whatsoever with the target. What’s fueled the rise in DDoS as a service? For one, the intense publicity for DDoS has just about everybody aware of the attack format. For two, “As email spam has become more and more a solved problem it has forced criminals with botnets to find other uses for them. DDoS lets them monetize their botnets,” said Matthew Prince, CEO of CloudFlare, a DDoS mitigation company. DDoS as a service prices are also tumbling. Hemant Jain, vice president of engineering for security company Fortinet, said that he has found providers who are selling an hour of DDoS for $5, a 24-hour day of it for $40 and a week for $260. Can’t these DDoS as service provider be shut down by law enforcement? It’s not that easy. Commented Carl Herberger, vice president of security solutions at mitigation provider Radware, “It’s important to note that ‘DDos for Hire’ websites move around in terms of their technical underpinning. They don’t stay in one area or one location for too long. It’s almost like a game of “Whack-a-Mole” – just when you think you’ve identified the location of the website, it’s already moved.” Added Chris Ensey, COO of security company Dunbar Digital Army, “These (DDoS as a service) sites are being resold like white-labeled products now. Most of the sellers are just affiliates who leverage another botnet or platform” – that is, they have none of their own infrastructure and, poof, they can be here today and back tomorrow under a new flag. That’s the problem: it is very hard to pinpoint the location of a DDoS command and control center and when it’s found, said sources, it generally is in a country with little or no law enforcement reciprocity with the United States. The bottom line for credit unions: “They have to take DDoS seriously. There is no turning this back,” said Shteiman. The good news: the attack throughputs via DDoS for hire are tiny fractions of what al Qassam is throwing at money center banks – 1% or 2% of the volume in many cases. But that is plenty to knock out a credit union that lacks defenses. As for what defenses are needed to thwart for hire DDoS, experts indicated that in most cases low-cost mitigation, within the budget of just about every credit union, ought to suffice. Talk with mitigation companies, also ask Web hosts what protections they have on hand or can line up, Small expenditures ought to bring peace of mind – at least that’s what the experts are saying today Source: http://www.cutimes.com/2013/05/28/threat-of-the-week-ddos-for-hire-on-the-rise?ref=hp

View the original here:
Threat of the Week: DDoS For Hire on the Rise

DDoS Attacks – Understanding the Dangers

If you’re a small business owner, or if you own Web space for any reason, one of the new threats that have no doubt begun to appear on your horizon is the potential of being attacked online. Fortunately for the hackers, not a lot of people understand what online attacks really are, how they pull them off, or how to effectively protect from it. Most computer repair experts agree it is hard to guarantee 100 percent security, but you can take the necessary precautions to minimize damages if your security is ever compromised. Taking precautions starts by understanding the dangers: One of the most common types of attack that takes place these days is a DDOS, or Distributed Denial of Service attack. This type of attack is particularly effective because it doesn’t require an intimate knowledge of your security to be deployed. It just takes brute force. Prior to the scheduled attack, the hacker will create a swarm of “zombie” computers — computers infected by the hacker’s software. This software allows the hacker to use the processing power of thousands of computers belonging to other people to bring down your server. When the attack commences, the hacker tells the zombie computers to simultaneously and continually load information from your Web server. If the attack is powerful enough, your server will stop serving. It will become unreachable so even legitimate visitors can’t access the site. While this intense strain is taking over your server, the hacker can try to slip into the back door unnoticed. This is where a lot of the actual financial loss associated with DDOS attacks come from. Scared yet? Don’t be…too scared. Most DDOS attacks happen to high-profile sites that make a lot of money online and that have a lot to lose from even a temporary outage. But there’s still a chance it could happen to you for reasons beyond your control. So how do you protect against such a large-scale attack? The easiest way is to talk to your in-house IT Department and have them work through the nine steps that help defend against a DDOS attack. No IT onsite? Then call your trusted IT or computer repair professionals and tell them you want to prepare for a DDOS attack. They can best help you and recommend plans to upgrade your servers or to install special software that can determine legitimate traffic from DDOS attacks. They might also want to talk with you about the current security software you’re using. An off-the-shelf program probably won’t defend very well against this new type of attack, so talk with your IT professional about the options available to you. As always, the best defense is vigilance. As you’re managing your website, be sure to note any suspicious traffic, educate your staff on safe practices and call your computer repair professionals as soon as you note suspicious activity. Most likely it won’t be anything, but it never hurts to ask. For protection against your eCommerce site click here . Source: http://www.sitepronews.com/2013/05/22/ddos-attacks-understanding-the-dangers/

Paypal turns blind eye to payments totaling $35,000 for on-demand DDoS

It seems as though just about anyone with Internet access can set up a profitable online enterprise these days — including a criminal one. And for one Illinois teen, YouTube and PayPal have been all too happy to help him make a fast (albeit illegal) buck. Brian Krebs has been sleuthing once again, and his target this time was a “stress testing” service called Asylum Stresser . Stress testing, of course, is the thin veil that skiddies (script kiddies) like to drape over a for-hire DDoS attack setup. According to Krebs and his cohorts, Asylum looks like it’s been built using fairly run-of-the-mill cybercrime kitware that’s promoted in underground forum sites. Its servers are based in Romania, and appear to be nestled safely in a data center that is nothing if not criminal-friendly. Nothing shocking so far, right? Anyone who has a few extra bucks (or BitCoins) to white label someone else’s criminal back-end can do this stuff. But here’s the twist: the kid Krebs believes is running Asylum Stesser is accepting PayPal payments and advertising on YouTube. Recently, Asylum’s user database was leaked to the web and it revealed that more than $35,000 had been sent to one chandlerdowns1995(at)gmail.com. Downs also appears to have hired an eager infomercial actor over on Fiverr. While the promo spot is good for a chuckle, it’s hard to believe that YouTube will jump all over a 30 second fan-made video for copyright infringement, but has somehow allowed an ad for an illegal DDoS service to be viewed more than 42,000 times. Downs maintains that it’s not his fault if people use the service to launch illegal attacks. Asylum Stresser was launched so that law-abiding folk can make sure their websites are resilient. Maybe that’s why PayPal and YouTube have been fine with ignoring what’s gone on to this point. Former U.S. Justice Department attorney Mark Rasch, however, feels differently. He told Krebs that if Downs triggers an attack after being paid to do so, he is “criminally and civilly liable.” Downs didn’t exactly made it difficult for Krebs to connect the dots here. Let’s see if PayPal and YouTube get their heads out of the sand now and do something before an Illinois court orders them to. For protection against your eCommerce site click here . Source: http://www.geek.com/news/paypal-turns-blind-eye-to-payments-totaling-35000-for-on-demand-ddos-1554902/

See the original post:
Paypal turns blind eye to payments totaling $35,000 for on-demand DDoS

Government Takes Precautions Over Expected ‘OpUSA’ Cyber Attack

RHONDA SCHWARTZ, PIERRE THOMAS and LEE FERRAN report: The Department of Homeland Security and the FBI are cautioning American government and financial institutions that they could be targets of a wave of cyber attacks Tuesday from Anonymous-linked hacktivists in the Middle East and North Africa. “The attacks will likely result in limited disruptions and mostly consistent of nuisance-level attacks against publicly accessible web pages and possibly data exploitation,” says an unclassified memo from the Department of Homeland Security, first obtained by the cyber security blog KrebsOnSecurity.com. In another memo, this one from the FBI’s Cyber Division and obtained by ABC News, 140 banks are listed as potential targets for the potential cyber attack campaign known as “OpUSA.” Threats against the targets were originally made weeks ago and posted publicly online in a rambling missive that also denounced American “war crimes” in Iraq, Afghanistan and Pakistan. Both U.S. government and industry analyses of the OpUSA threats have connected them to OpIsrael, a widespread but reportedly largely ineffective cyber attack targeting Israeli government and private websites last November. As in that attack, OpUSA hackers are expected to use distributed denial of service (DDoS) attacks to flood target websites with illegitimate traffic, potentially knocking them offline, a Department of Homeland Security official said. One industry analysis says that due to the “hive mindset” of groups like Anonymous, the attack’s effectiveness could be contingent on its popularity and perceived success. “Similarly, if the central actors appear to be largely failing in their efforts, other Anonymous actors may decide not to join in this operation,” the analysis says. Cyber security expert Mikko Hypponen of F-Secure told ABC News he expects that “something’s going to happen,” but likely not more than some websites being defaced or briefly knocked offline by the DDoS attacks. If it proves correct, Hypponen’s prediction would be a far cry from OpUSA’s original promise to wipe the U.S. “off the cyber map.” For protection against your eCommerce site click here . Source: http://abcnews.go.com/blogs/headlines/2013/05/government-takes-precautions-over-expected-opusa-cyber-attack/

Continued here:
Government Takes Precautions Over Expected ‘OpUSA’ Cyber Attack

May 7th 2013: Mark Your Calendar (or Not) for OpUSA DDoS Attacks

CUNA made headlines with its warning about a planned May 7th DDoS – Distributed Denial of Service – attack that, said the trade group, was sufficiently worrisome that credit unions had to take steps to be ready. CUNA attributed the source of word of the threat to “chatter” that has been detec What chatter? That turns out to be comments not from the al Qassam Cyber Fighters – the group that has claimed the prior DDoS attacks that have knocked big U.S. banks and several credit unions offline in the past year. Sources pointed instead to OpUSA, a shadowy hacktivist group that is affiliated with Anonymous. OpUSA has claimed al-Qassam will be involved in the May 7 attacks, but al Qassam – a group often said to be allied with the Iranian government – has been less committal in its remarks. As for what OpUSA has planned for May 7, the group has offered its commentary on Pastebin, the website of choice for DDoS-related announcements. (Warning: there is substantial off color language here,) Aside from anti-Israel and anti-Obama commentary, there are no real details of what is planned for May 7. Anonymous, the supposed manpower behind OpUSA, is a group that has had successful takedowns of public websites – recently the Spanish parliament’s website became a victim. It has documented computer skills at very high levels. But the exact relationship between OpUSA and Anonymous is not presently known. So, what should a credit union do in the run up to May 7? Experts consulted by Credit Union Times indicated that at this late date, not much could in fact be done to ward off an unknown attacker unleashing an unknown attack vector in a little over a week. Were budgets unlimited, much could be done, said the experts, but with a typical credit union’s constrained IT budget, many will decide their best course of action is to wait this one out and see exactly what damage transpires on May 7. In the vast majority of cases, DDoS also has not been associated with data breaches. It has been an outage, plain and simple, noted one expert who indicated it was not that different from going down in an electrical storm. “Many – most – will decide to take this route,” he said. For protection against your eCommerce site c lick here . Source: http://www.cutimes.com/2013/04/29/may-7-mark-your-calendar-or-not-for-credit-union-d?ref=hp

Continue Reading:
May 7th 2013: Mark Your Calendar (or Not) for OpUSA DDoS Attacks

DDoS Attack Strikes Take EU Banks Offline

Distributed-denial-of-service attacks against banking institutions are becoming a global concern, and experts say many organizations outside the U.S. financial-services sector are ill-equipped to defend themselves. DDoS strikes have taken down online-banking sites in Northern Europe in recent days and weeks, several security experts say. Scott Hammack , CEO of DDoS-mitigation provider Prolexic, says institutions in the Netherlands appear to be among the most recently targeted, but banking institutions throughout Europe have been hit within the last several months. Energy companies also have fallen victim, he says. But experts say the attacks being waged against European banks are not linked to Izz ad-Din al-Qassam Cyber Fighters , the hacktivist group that since September has been striking leading U.S. banks. And some experts believe fraud is the motive behind the attacks waged in Europe. Northern European Targets Hammack would not name which European organizations had been targeted. Carl Herberger of online-security firm Radware, which specializes in DDoS mitigation, says six Northern European banking institutions have been targeted in the last two to three weeks, and attacks continue. “From our perspective, based on the traffic we see, it’s only been about a half-dozen hit, and it’s been mostly banks and e-commerce sites,” he says. “They’re all located in continental Northern Europe – the EU epicenter or power areas in the EU.” Herberger also would not provide names of the targeted banks. But ING confirms in a statement that was available on its website April 19 that its online- and mobile-banking platforms had earlier been inaccessible because of a DDoS attack. In a separate statement issued April 5 by the Dutch Banking Association , ING’s outages also were mentioned. “All this was the result of a very wide range of Internet traffic on the websites of banks, called a DDoS attack, where both Dutch and foreign banks [were] affected by the encounter,” the banking association states. ENISA , the European Network and Information Security Agency, on March 13 issued a warning to European business about the increasing risk of cyber-attacks, but spokesman Ulf Bergstrom says few banks and Internet service providers have adequately heeded the warning. ENISA has longstanding standards that address DDoS risks, Bergstrom notes. But most organizations have failed to make online protections a priority, he contends. “The ISPs are either unaware of these standards that have existed for 13 years, or they do not deem they can muster the costs to apply them,” he says. “Banks also do not always go for the best solutions, but cheaper security solutions. It depends if it’s easier to pay off one person who is hit by cyberfraud.” A Different Kind of Attack Herberger and others say the attacks in Europe are different than the DDoS campaigns waged against U.S. banks. “The attacks are not of the same signatures as Operation Ababil,” he notes, referring to the campaigns being waged by Izz ad-Din al-Qassam Cyber Fighters against U.S. banking institutions. “The attacks don’t match the current attack profiles we see from Operation Ababil,” he adds. “They are less sophisticated, less pervasive and less aggressive. Nevertheless, for institutions that have endured attacks of this nature, they have been trying.” Other experts also say the botnet used by Izz ad-Din al-Qassam Cyber Fighters has not been linked to attacks in Europe. And the motives for the attacks in Europe could be more about fraud than hacktivism, they add. John Walker , chairman of ISACA’s Security Advisory Group in London who in September said European banks were not prepared to defend themselves against DDoS, says the attacks being waged now likely have a monetary motivation. “I know in two cases extortion was involved,” he says. Herberger says the attack patterns in Europe are still being analyzed at Radware, but that it does seem the attacks in Europe are being waged for more than annoyance. “The attacks seem to be directed against integrity-based interests,” he says. “There’s no evidence yet that there has been a data loss; but once you violate integrity systems, you can get anything you want.” But the greater worry, Herberger says, is the apathy among European banks when it comes to addressing DDoS risks. “Around the world, everyone has viewed this as an ‘Ugly American’ problem,” he says. “But these attacks are hitting more than banks, and it’s been more than one country.” For protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/ddos-strikes-take-eu-banks-offline-a-5701/p-2

Read the original:
DDoS Attack Strikes Take EU Banks Offline

Amex Website Victim of DDoS Attack

Cyber attacks have become an alarming problem in recent months. Threats from China have been the main concern in America, but now a new type of hacker has surfaced. A group of Islamic internet hackers launched a distributed denial of service attack on the American Express website, temporarily shutting down the site for a few hours. As expected, this did not go over well with American Express cardholders. In a DDOS attack, site visitors are infected with a Trojan virus that redirects them to a site of the creator’s choice. Once a certain number of people visit that target site, the original site shuts down. The hackers were able to make this work successfully, but American Express’s security team quickly corrected the problem. Nevertheless, it shows how vulnerable American business is right now to Internet hackers. The hackers claimed that much of their motivation came from the YouTube video, Innocence of Muslims. Since its publication, that video has enraged the Islamic community and fueled their hatred of Americans. The cyber hackers vowed to continue their efforts until it was removed from the internet. The original video was in English, but there are now versions in Arabic, French, Spanish and other languages. It has been blocked in Indonesia, Saudi Arabia, Egypt and other Muslim states. The video was actually removed once before because of a slew of hate mail going towards the original uploader. It was re-posted shortly thereafter and has since received close to two million views. American Express is now taking extra precautions to ensure that similar events do not happen in the future. Source: http://www.lowcards.com/amex-website-hacked-islamic-attackers-11690

Read the original:
Amex Website Victim of DDoS Attack

Top Banks Offer New DDoS Attack Details

Increasingly, U.S. banking institutions are reluctant to acknowledge – much less discuss – the ongoing distributed-denial-of-service attacks against their online services. Perhaps that’s because they’re concerned that consumers will panic or that revealing too much about the attacks could give hacktivists information they could use to enhance their DDoS abilities. But in recent regulatory statements, the nation’s largest banks are candid about DDoS attacks and their impact. In their annual 10-K earnings reports, filed with the Securities and Exchange Commission, seven of the nation’s top 10 financial services institutions provide new details about the DDoS attacks they suffered in 2012. In its report, Citigroup even acknowledges that DDoS attacks have led to unspecified losses. Citigroup , which filed its 10-K report March 1, notes: “In 2012, Citi and other U.S. financial institutions experienced distributed-denial-of-service attacks which were intended to disrupt consumer online banking services. While Citi’s monitoring and protection services were able to detect and respond to these incidents before they became significant, they still resulted in certain limited losses in some instances as well as increases in expenditures to monitor against the threat of similar future cyber-incidents.” The bank also points out that these attacks are being waged by powerful adversaries. “Citi’s computer systems, software and networks are subject to ongoing cyber-incidents, such as unauthorized access; loss or destruction of data (including confidential client information); account takeovers; unavailability of service; computer viruses or other malicious code; cyber-attacks; and other events,” Citi states. “Additional challenges are posed by external extremist parties, including foreign state actors, in some circumstances as a means to promote political ends.” When contacted by BankInfoSecurity , Citi and other institutions did not comment further about DDoS attacks or the information in the 10-K reports. These banks, as well as other U.S. financial institutions, are now in the midst of the third wave of DDoS attacks attributed to the hacktivist group Izz ad-Din al-Qassam Cyber Fighters – a group that has claimed since September that its attacks are being waged to protest a YouTube movie trailer deemed offensive to Muslims. ‘Technically Sophisticated’ In their 10-K reports, Citi, as well as JPMorgan Chase & Co. , Bank of America , Goldman Sachs Group , U.S. Bancorp , HSBC North America and Capital One acknowledge suffering from increased cyber-activity, with some specifically calling out DDoS as an emerging and ongoing threat. HSBC North America, in its 10-K report filed March 4, notes the global impact of DDoS on its customer base. “During 2012, HSBC was subjected to several ‘denial of service’ attacks on our external facing websites across Latin America, Asia and North America,” the bank states. “One of these attacks affected several geographical regions for a number of hours; there was limited effect from the other attacks with services maintained. We did not experience any loss of data as a result of these attacks.” And U.S. Bank, in its 10-K filed Jan. 15, describes DDoS attacks as “technically sophisticated and well-resourced.” “The company and several other financial institutions in the United States have recently experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods,” U.S. Bank reports. “These ‘denial-of-service’ attacks have not breached the company’s data security systems, but require substantial resources to defend and may affect customer satisfaction and behavior.” U.S. Bank reports no specific losses attributed to DDoS, but it states: “Attack attempts on the company’s computer systems are increasing, and the company continues to develop and enhance its controls and processes to protect against these attempts.” Other DDoS Comments Here is what the other institutions reported about DDoS attacks suffered in 2012: Chase: “The firm and several other U.S. financial institutions continue to experience significant distributed denial-of-service attacks from technically sophisticated and well-resourced third parties which are intended to disrupt consumer online banking services. The firm has also experienced other attempts to breach the security of the firm’s systems and data. These cyber-attacks have not, to date, resulted in any material disruption of the firm’s operations, material harm to the firm’s customers, and have not had a material adverse effect on the firm’s results of operations.” BofA: “Our websites have been subject to a series of distributed denial of service cybersecurity incidents. Although these incidents have not had a material impact on Bank of America, nor have they resulted in unauthorized access to our or our customers’ confidential, proprietary or other information, because of our prominence, we believe that such incidents may continue. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that we will not suffer such losses in the future.” CapOne: “Capital One and other U.S. financial services providers were targeted recently on several occasions with distributed denial-of-service attacks from sophisticated third parties. On at least one occasion, these attacks successfully disrupted consumer online banking services for a period of time. If these attacks are successful, or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services online. In addition, a breach or attack affecting one of our third-party service providers or partners could impact us through no fault of our own. Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently and often are not fully recognized or understood until after they have been launched, we and our third-party service providers and partners may be unable to anticipate certain attack methods in order to implement effective preventative measures. Should a cyber-attack against us succeed on any material scale, market perception of the effectiveness of our security measures could be harmed, and we could face the aforementioned risks. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.” No Mentions of Attacks Among the top 10, the only institutions that do not specifically reference DDoS in their 10-K reports are Morgan Stanley, Bank of NY Mellon and Wells Fargo , a bank that has recently suffered significant online outages. Wells Fargo spokeswoman Sara Hawkins tells BankInfoSecurity that the bank’s online and mobile-banking channels were inaccessible for portions of the day on April 4, when it saw “an unusually high volume of website and mobile traffic … which we believe is a denial of service attack.” Reporting Protocol Doug Johnson , who oversees risk management policy for the American Bankers Association, says banking institutions are required to report all suspicious cyber-activity either through their filings with the SEC or in the Suspicious Activity Reports to the Financial Crimes Enforcement Network , a bureau of the U.S. Department of the Treasury. All financial institutions, regardless of size, must report SARs to FinCEN, an agency that collects, analyzes and shares financial intelligence. However, only companies with more than $10 million in assets are required to file reports with the SEC. Banking institutions are required to report cyber-attacks in their SEC filings, Johnson says. “Online banking platforms, obviously, are extremely important to banking retail consumers, and so that would be one of those systems which would be very important to report on a suspicious activity report,” Johnson says. “One thing that is also very important to do is to go and have that conversation with your primary federal regulator, at the field level, to find out what you would do, as an institution, for generalized security breach reporting.” Breach reporting requirements vary from state to state, Johnson adds. For protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/top-banks-offer-new-ddos-details-a-5667/p-3

See more here:
Top Banks Offer New DDoS Attack Details