Tag Archives: ddos-defense

Expert’s Warning: More Distributed Denial of Service ‘DDoS’ attacks Coming At You

Brace yourself: more distributed denial of service (DDoS) attacks are coming at financial institutions, predicted Scott Hammack, CEO of Hollywood, Fla.-based Prolexic Technologies, a leader in helping big business defend itself against DDoS. “Absolutely, we will see more attacks on banks,” said Hammack in an interview. He traced the current wave of attacks – which have crippled the websites of money center banks including Bank of America and JP Morgan Chase – to probes that began in January. “The attackers did several months of reconnaissance, probing websites for vulnerabilities,” said Hammack. The core DDoS method is to overwhelm a website with a flood of extraneous data. There is so much data coming in that legitimate requests simply cannot be handled. The current attackers, Hammack suggested, come at this with enormous skill, sophistication and funding. He indicated he had no guess about the possible end game or what the objectives of the attackers might be beyond highlighting the vulnerabilities of big banks to attacks. He indicated that the attackers – or people close to them – have frequently posted notices of what institutions they have taken down on Pastebin, a website believed to be frequented by members of the hacker and cyber-criminal community. According to Hammack, the attackers have used the itsoknoproblembro DDoS tool kit and they have come to the battle with deep knowledge of the classic anti DDoS mitigation schemes. Since they know how financial institutions protect themselves at first sight of DDoS, they also know how to maneuver around those protections, said Hammack. Hammack warned: “This is sophisticated in the way Stuxnet was.” Stuxnet’s authorship is unknown, but some have said it was approved by the White House and involved high level cyber security experts from the U.S. and Israel. It specifically targeted Iran’s nuclear program. So far, no credit unions are known to have been targeted in the present wave of DDoS attacks. However, Hammack indicated that in his opinion only the very largest banks are currently prepared to deal with this attack. “A lot of smaller financial institutions have no protection,” he said. “If they get hit they will be out for days.” Source: http://www.cutimes.com/2012/10/01/experts-warning-more-denial-of-service-attacks-com?ref=hp

Link:
Expert’s Warning: More Distributed Denial of Service ‘DDoS’ attacks Coming At You

Bank Of America Website Slows After Islamic Hacker Threats

Bank of America’s website experienced periodic outages Tuesday, possibly due to cyber attacks launched in retaliation for “Innocence of Muslims,” the amateurish film whose mocking portrait of the Prophet Muhammad has incited deadly riots throughout the Middle East. The attack was foretold by a Pastebin.com message posted earlier in the day. Allegedly authored by “Cyber fighters of Izz ad-din Al qassam,” a reference to the military wing of Hamas, the posting also declared that the New York Stock Exchange would suffer a similar assault–a threat that has evidently gone unfulfilled. The posting blamed both the United States and the “Zionist Regime” for the offending film and promised continued aggression until the “erasing of that nasty movie,” which YouTube has blocked in volatile regions but which remains freely accessible elsewhere. The initial targets were chosen, the posting declares, because they “are properties of America-Zionist Capitalists.” Bank of America told Reuters that the website had suffered some problems but was available to customers. “We are working to ensure full availability,” Mark Pipitone, a bank spokesman told Reuters. Without specifically commenting about a possible denial-of-service attack, Pipitone said: “I can tell you that we continuously take proactive measures to secure our systems.” The New York Stock Exchange, operated by NYSE Euronext, declined to comment, Reuters reported. Bill Pennington, chief strategy officer at WhiteHat Security, said in an interview that Bank of America’s website problems do not necessarily verify the Pastebin claims. Stating that “it’s reasonable to believe it could be coincidence,” he cited the recent GoDaddy outage, which saw hackers attempt to take responsibility for what was in fact a series of internal technical errors. Nonetheless, he said the incident could have been a denial-of-service attack. “They’re pretty easy,” he stated. “You can rent computing resources from various botnets for almost pennies on the dollar.” Even if one lacks the technical sophistication to launch an attack, simply announcing malicious goals can be enough, he said. Groups such as Anonymous, for example, can take down a site not merely through the efforts of active members and sympathizers but also “a bunch of people watching, generating traffic” while they wait to see what happens. Additional risks, he said, include unaffiliated groups that “hop into” the fray, knowing that scrambling companies will find it “very difficult to pick out” attackers. Pennington cautioned that companies need to be aware that cyber attacks are part of “the landscape we live in today.” He said that many organizations have done their parts, declaring that security concerns–once the purview of “geeks in the IT department”–are now addressed by executives in boardrooms. Each second a site like Bank of America’s is offline, he explained, the company loses money, so “business people are starting to understand … what would actually happen if their site is largely unavailable for three days.” Security-minded companies can thwart DDoS attacks “to some extent,” he said, but “it’s really hard to build an infrastructure” that won’t be overwhelmed by a massive attack. “If a million people log on right now, they’re going to have a problem,” he stated. Efforts to block coordinated DDoS attacks are hampered by the relatively unimposing nature of the devices that hackers sometimes employ. A phone has less computing power than a laptop, for example, but Pennington said “if all it needs to do is make an http request every second, and you have all the phones in the world doing that, it becomes difficult to withstand. There’s only so much you can do.” Indeed, while it is unlikely that an attack could actually harness billions of phones, hackers and malware authors have continually carved out new methods for creating botnets and the brute computing force that comes with them. Even Macs, once all-but-immune to nefarious intruders, can be reduced to “zombie” machines via illicit toolkits that are so cheap as to remove all barriers to entry. Bank of America’s situation still poses more questions than answers, with only the perpetrators and, possibly, the victims fully aware of what transpired. Details should emerge in the coming days, but Pennington said businesses should expect more attacks, no matter the veracity of the Pastebin claims. “It’s probably going to get worse before it gets better,” he said. Source: http://www.informationweek.com/security/attacks/bank-of-america-website-slows-after-isla/240007581?cid=edit_stub_WST

More:
Bank Of America Website Slows After Islamic Hacker Threats

How cybercriminals and hacktivists use DDoS tools to attack

Network professionals know that distributed denial-of-service attacks are an ever-growing danger. The recent assault on Twitter is just the latest evidence. Using a mushrooming array of advanced tools, including pay-per-use services and mobile devices, attackers are taking down websites, DNS and email servers, often using these tools to destroy a company’s online revenue, customer service and brand reputation. But the technology is only half the story. The thinking that shapes attacks an evolving blend of careful planning, probing and improvisation is often the difference between duds and strikes that leave victims begging for mercy. So who launches DDoS attacks and why? The most common profiles: extortionists, ruthless competitors and “hacktivists,” those attacking not for money, but in the name of social or political protest. The latter gets the most press, thanks to the media-savvy tactics of groups that have punished the likes of Bank of America and the US Chamber of Commerce. However, even though reliable statistics about attacks are hard to find, it’s likely that money, not justice, is the main motive. Regardless of the attacker’s identity or incentive, criminals use common tools and tactics in varying combinations. Many of these tools are cheap or free and easily available. They also require no more specialised skill than typing in the target’s name and hitting “enter.” The low-orbit ion cannon (LOIC), for example, is an open-source DDoS application which floods a server with enough UDP or TCP packets to disrupt service. The LOIC even offers multiple attack vectors. Attackers can send anything from packets with the text of their choice to random HTTP GET requests which imitate legitimate application-layer traffic. The future of malware The means to launch an assault doesn’t stop there though, as there are many other resources for attackers to use. If someone rents a server from a hosting company, but doesn’t secure it, an attacker could obtain administrative rights to the server, load scripts onto it and execute them at will. This is known as accessing a “shell booter.” There are also remote-access Trojans and DDoS bots, both forms of malware that infect PCs and mobile phones, letting criminals control them remotely to execute attacks. A group of such computers is a “botnet” and each computer infected is a “zombie.” Each family of malware has its own destructive capabilities. The most advanced the ones that avoid detection the longest and support the most types of attacks are often sold as software or as a complete pay-by-the-hour service. Attackers can also infect mobile phones to be used as extra resources. It’s the same idea as launching attacks with other people’s computers in a botnet. However, the added benefit is that there are billions of smartphones in use all around the world. And unlike desktop computers and laptops which are shut off for hours each day, mobile phones are always on, connected and able to abet attacks. In the DDoS world, it’s all about how much traffic you can generate, which depends on the number of hosts under your control. Mobile phones are simply too tempting to resist, and a new weapon that network security personnel have to keep an eye out for. However, before going through choosing a weapon and firing, the smartest attackers do their homework first. After all, there’s a ton of public information available about any business, including yours. For instance, a simple DNS look-up can reveal a lot of information about your public-facing assets. Attackers will also check your infrastructure for open ports, protocols, applications and firewalls. By doing recon on your infrastructure and understanding what it’s built to support ecommerce, customer service or public information, let’s say the bad guys will assess what’s at risk and will look for the best ways to exploit these weak spots in your infrastructure. In the ramp-up to an attack, you might notice bursts of heavier traffic in key areas of your network. The attacker is probing, trying to find a way in. While some will simply try to flood you, others will try to find a little crack in your network defenses, some piece of infrastructure too tempting to ignore. If you’re a retailer, for example, and someone succeeds in bringing down your point-of-sale applications, the pain could be acute. For the attacker, it’s well worth the time investment and ensures that your entire organization will take notice of the attack. Know your network and security inside-out Everything’s not all doom and gloom though. While criminals have many tools at their disposal, understanding what’s at risk, and how it will be attacked, allows you to understand how to take the first steps in order to protect it. For starters, make sure your team knows not only your network inside-out but also your security set-up. Conduct a security assessment, either in-house or with third-party experts who can give independent validation. Use these findings to help optimize your systems. It’s also critical to monitor traffic, so you know what’s normal and what’s not. With a clear baseline, you’ll be able to spot and mitigate DDoS attacks faster. Maybe most important of all, devise a DDoS response plan to counteract some of the tactics described here, listing procedures to follow and which team members are responsible for what. And practice executing this plan regularly. If you have to dust it off in the midst of an attack, you’re inviting chaos. Run regular drills including simulated communications with customers, so you can become adept at managing their expectations. At the end of the day, it’s not only attackers whose thinking makes a difference. Companies that invest more brainpower in understanding how DDoS attacks work, to better protect themselves are also more skilled in deploying the technologies designed to keep their online presences safe. For DDoS protection against your e-commerce site click here . Source: http://features.techworld.com/security/3378864/how-cybercriminals-hacktivists-use-ddos-tools-attack/

Read the original:
How cybercriminals and hacktivists use DDoS tools to attack

Anonymous Distributed Denial of Service ‘DDoS’ Attacks Take Down 3 UK Sites

The hacktivist group Anonymous staged a number of DDoS attacks on UK government websites yesterday in an apparent show of support for the controversial WikiLeaks founder Julian Assange, who remains stuck inside his Ecuadorean embassy bolt-hole as he attempts to avoid extradition to Sweden. Anonymous, who have been associated with numerous distributed denial of service attacks in the past, yesterday claimed to have taken down a number of high profile government sites in the UK, including the Justice Department website and “Number 10”, the official website of Britain’s prime minister. In addition, it’s believed that the hacktivist collective was also responsible for taking down the UK’s Department of Work and Pensions website on the same day. The group later claimed through its @AnonIRC Twitter that the attacks were part of “#OpFreeAssange, in reference to the WiliLeaks founder that they have long supported. The Ministry of Justice later confirmed the attack in the following statement: “The Ministry of Justice website was the subject of an online attack last night at around 2000 hours. This is a public information website and no sensitive data is held on it. No other Ministry of Justice systems have been affected. Measures put in place to keep the website running mean that some visitors may be unable to access the site intermittently. We will continue to monitor the situation and will take measures accordingly.” As of this morning, it appears that the Department of Work and Pensions site is now running normally, but the Ministry of Justice said that it’s still experiencing some problems with its website, and that it cannot give a time frame for when the problems might be solved. Number10.gov.uk also remains down, with no word from the government as to when it might be back. Source: http://siliconangle.com/blog/2012/08/21/opfreeassange-anonymous-ddos-attacks-take-down-3-uk-sites/

Read the original:
Anonymous Distributed Denial of Service ‘DDoS’ Attacks Take Down 3 UK Sites

Russia Today hit by Distributed Denial of Service ‘DDoS’ attack as anti-Wikileaks group claims responsibility

The website of the Kremlin-funded news network Russia Today has been hit with a denial-of-service attack that some have linked with the station’s support for Wikileaks founder Julian Assange, and others with the impending Pussy Riot verdict. The English-language Russia Today (RT) tweeted on Friday morning that its hosting provider had confirmed RT.com was “under DDoS attack”. An anti-Wikileaks group subsequently claimed responsibility, but there is as yet no proof of this connection. It is notable that Friday is the day when a Russian court will decide the fate of three members of the punk protest band Pussy Riot, which has been very critical of Vladimir Putin. RT’s tweet came through at 8:12am. Around 20 minutes later, Antileaks tweeted that it was responsible for the DDoS, and attached a hashtag supporting Pussy Riot. The Wikileaks account then went on to condemn the attack, suggesting that it was connected with RT’s support of Assange, rather than the punk band. Assange, who faces extradition from the UK to Sweden to face questioning over sexual assault allegations, had a chat show on RT, with one of his guests having been Ecuadorian president Rafael Correa. Correa granted Assange diplomatic asylum on Thursday. However, that move has so far had a limited effect, since the UK does not recognise that type of asylum and Assange cannot get safe passage to an airport. RT is a strong supporter of Assange, but it is also a supporter of the Russian leader. Many free-speech advocates are incensed at the likelihood of the Pussy Riot members facing jail time for playing an anti-Putin song in a church. Summary: The Kremlin-funded channel, which featured Julian Assange as a talk-show host, says it has come under denial-of-service attack. Antileaks says it’s responsible, but the timing could more to do with the Pussy Riot verdict than Wikileaks. For fast DDoS protection against your e-commerce website click here . Source: http://www.zdnet.com/russia-today-hit-by-ddos-as-anti-wikileaks-group-claims-responsibility-7000002794/

Excerpt from:
Russia Today hit by Distributed Denial of Service ‘DDoS’ attack as anti-Wikileaks group claims responsibility

Bambuser Distributed Denial of Service ‘DDoS’ attack may be connected with Assange embassy stream

Bambuser came under a distributed denial-of-service attack on Thursday morning, possibly in connection with a user’s coverage of the Ecuadorian embassy where Wikileaks founder Julian Assange is holed up. The connection is not certain, but Bambuser’s Swedish proprietors say they had received threatening tweets just prior to the attack. Bambuser chief Jonas Vig told ZDNet that the DDoS took the service down for “almost an hour” and made it “hard to reach for another hour”. Bambuser lets people stream live video from their smartphones to the web. It has become very popular with activists and protestors, from the Occupy movement to Russia and Syria. The service has come under attack before, with the attacks generally coinciding with marches and protests that are being covered on Bambuser. The stream that appears to have solicited the DDoS is that of ‘citizen journalist’ James Albury, who has stationed himself outside the Ecuadorian embassy in London. Julian Assange has been inside the embassy since June, and the Ecuadorian government is set to announce its decision regarding his asylum bid later on Thursday. A diplomatic row erupted overnight, after Ecuador accused UK authorities of preparing to storm the embassy. Assange is wanted for questioning in Sweden over sexual coercion and rape allegations, and the UK wants to extradite him there under a European Arrest Warrant. Vig explained that the tweets Bambuser had received were not of the ‘tango down’ variety, but they did indicate that “it was someone aiming the attack directly at some specific users of ours”. “We still don’t want to speculate who was behind it, but there’s some indication it was directly aimed at blocking the streams from the embassy,” he added. “It was quite a serious attack,” Vig said. “We consider all DDoSes as serious.” A new anti-Wikileaks hacker, or group of hackers, called Antileaks has suggested on Twitter that he, she or they might be responsible for the DDoS. For fast DDoS protection against your e-commerce website click here . Source:

View the original here:
Bambuser Distributed Denial of Service ‘DDoS’ attack may be connected with Assange embassy stream

Indicted College Student Speaks Up About Her Case for involvement of distributed denial-of-service (DDoS) attacks

A college student arrested last year for alleged involvement in distributed denial-of-service (DDoS) attacks waged by Anonymous appeared publicly here Saturday on a panel discussing the hacktivist collective and online civil liberties. Mercedes Haefer, an undergraduate student at the University of Nevada Las Vegas who was indicted in July 2011 with 13 others for alleged conspiracy to commit DDoS attacks against PayPal’s website, spoke out briefly about her case in the panel session entitled “Anonymous and the Online Fight for Justice.” “I am charged with conspiracy to DDoS,” Haefer said during the panel discussion, noting that she found the charges “amusing.” She would not comment on the specific circumstances that led to her arrest. Anonymous talk at Def Con focused more on online civil liberties and activism, and came amid the backdrop of a screening of “We Are Legion” documentary held at the famed hacker conference. It was a far cry from last year’s Def Con, where some members donned their signature Guy Fawkes masks, while others shouted down speakers during a question-and-answer session on a panel about building a “better” Anonymous. Legal experts on Saturday’s panel pointed to a disparity in sentencing for physical activism versus hacktivism. Marcia Hoffman, a senior staff attorney at the Electronic Frontier Foundation, says the penalty for online civil disobedience is severe. “I’m not talking spending the night in jail. Federal hacking law [prescribes] up to 10 years in prison: That’s an incredibly harsh penalty,” Hoffman says. “It’s disconcerting that young people flexing their political muscle get 10 years in prison for [a] first-time offense.” Whether DDoS should be considered a legitimate form of protest was also debated. “Under certain circumstances, DDoS is protected political speech and should be afforded First Amendment rights,” said criminal defense attorney Jay Leiderman, who is representing Christopher Doyon, an alleged member of Anonymous who goes by the handle “Commander X.” Leiderman said an interview today that Commander X’s case and the PayPal case are classic examples of how some DDoS attacks should be treated as free speech. In the former, Commander X and others camped out for months in front of the Santa Cruz, Calif., courthouse protesting a crackdown on homeless people sleeping in the streets. “In the wake of more arrests, he and a small number of people allegedly DDoS’ed the County of Santa Cruz, slowing its server for 18 minutes,” he says. “That use of DDoS is a classic form of political speech, where the government is ignoring you and [you] get their attention in a nonharmful and noninvasive way with something to let them know you are out there.” Josh Corman, who has been researching Anonymous and, along with Brian Martin writing a series on “Building A Better Anonymous,” says the DDoS-as-free-speech argument made by the panel was interesting. Corman says he sees the disparity in a $250 fine for physical civil disobedience and a 10-year prison sentence for the digital equivalent. “I can see a reasonable argument that this is a legitimate form of free speech … I can see the disparity in the law there. Maybe they have a case there, but I’ll let people smarter than me decide,” Corman says. “[But] then I realize what a massive distraction that [argument] was.” The free speech DDoS argument distracts from the more malicious activity some members of Anonymous have conducted, he says. “And all of that drowns out the potentially noble” activity, he says. The bottom line is that DDoS doesn’t really accomplish what the hacktivists want it to, anyway, he says. “It doesn’t have any lasting damage at all. It’s a tool of fear” and is noisy, but hasn’t effected the type of change in the targeted organizations that the hacktivists had intended, Corman says. Sony, for example, suffered “orders of magnitude more” in financial losses from the massive earthquake in Japan than from the more than 21 DDoS attacks waged against it, he says. Meanwhile, Haefer offered a little insight into how Anonymous operates: In response to a question about how an Anonymous plan to out Mexican government officials with ties to drug cartels didn’t materialize, she said sometimes the intentions are there, but action may not be “feasible at that time.” “A lot of times where people start up an op with the intention of trying to do something, and someone will jump the gun and say, ‘We’re going to [f’ing] do it,’ and sometimes it’s not always possible with the people we have around and their lives” and other commitments, she said. At A Crossroads Corman says a small group of Anonymous members should define what free speech online means, and a find a better way to protest than DDoS attacks, he says. “I can envision truly noble online activism as transformative as a civil rights movement,” he says. Corman and others at an earlier panel at Def Con urged the security community to be aware and speak out about privacy and freedom concerns at the upcoming World Conference on International Telecommunications (WCIT-12) meeting. Experts say the meeting could result in the potential restructuring and governance of the Internet that could ultimately hamper user access and freedoms. The security community could be doing more to carry the torch here as a more formal means for Internet activism, he says. “The original Def Con crowd could be a force of organized chaos that keeps the peace actively or passively,” Corman says. And Anonymous, meantime, is at a crossroads, according to Corman. “Several [of them] are ready to engage on what a better Anonymous might look like,” he says. For fast DDoS protection against your website click here to view DOSarrest services. http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240004684/indicted-college-student-speaks-up-about-her-case-anonymous.html

View original post here:
Indicted College Student Speaks Up About Her Case for involvement of distributed denial-of-service (DDoS) attacks

Super-Charged Distributed Denial of Service ‘DDoS’ attack Spike In 2012

This year has seen distributed denial of service (DDoS) attackers increase the power of DDsS attacks massively, according to figures exclusively shown to TechWeekEurope. DDoS attacks see servers overwhelmed with traffic, causing a target’s website to go down. All kinds of organisations use DDoS attacks, from hacktivists like Anonymous to private companies wanting to stymie competition, and figures have shown they are upping their efforts. The average size of an attack went up 27 percent in 2012, hitting 1.56Gbps in June, compared to 1.23Gbps in 2011, second quarter data from anti-DDoS vendor Arbor Networks showed. June’s average attack speed was 82 percent up on the same month in 2011. There was also a return to growth in super-powered hits, with a 105 percent rise in the proportion of DDoS attacks measuring in at over 10Gbps. Between 2011 and 2010 that proportion was down 34 percent. Multi-vector DDoS attacks Arbor told TechWeekEurope that attackers were increasingly combining big volumetric attacks with stealthy application-level attacks, which are harder to identify due to a lower level of traffic. “We are still seeing a lot of the more stealthy application layer attacks going on out there, although now they are quite often accompanied by a volumetric attack. Attackers have learned that by generating application and volumetric attacks (multi-vector ) at the same time they can take sites and services down, and keep them down, for longer periods,” said Darren Anstee, solutions architect at Arbor. “Using multiple vectors makes it more difficult for operational security teams to figure out exactly what is going on, as different parts of the attack can impact different areas of infrastructure. Application layer attacks target the application servers, state-exhaustion attacks target firewalls, load balancers etc.” Despite the rise in DDoS power, the highest powered attacks have hit something of a plateau. The biggest monitored attack so far this year came in at 100.84Gbps, lasting 20 minutes, where 2011’s record of 101.394Gbps has not yet been surpassed in 2012. “It does appear that on the Gigabit per second side of things, right at the top end, attacks sizes may have plateaued. Why? It could be that 100Gbps of attack traffic is ‘all’ that is required to take down anything that has been targeted thus far, or, we could have reached some kind of limitation in some of the tools,” Anstee said. For the first time, the port used for Xbox Live connections (port 3074) showed up on Arbor’s findings, taking up 0.76 percent of attacks. Port 80, used by the HTTP protocol, is the prime target for DDoSers, with 29 percent of strikes hitting it in Q2. “There are unfortunately quite a lot of attacks between on-line gamers (this is multiplayer online gaming, rather than gambling). These attacks are used either to give one player an advantage over another, or avenge a defeat,” Anstee added. Botnets are a major part of the problem, as TechWeekEurope’s recent investigation into the underground DDoS market found. Law enforcement and industry firms continue to work with one another on knocking down botnets, as seen in last week’s effort to kill off super-spammer Grum. But most believe arrests are needed to truly counter the rise of malicious networks. For fast DDoS protection click here . Source: http://www.techweekeurope.co.uk/news/ddos-attacks-power2012-86926

Visit link:
Super-Charged Distributed Denial of Service ‘DDoS’ attack Spike In 2012

Five Ways to Protect Against Distributed Denial of Service ‘DDoS’ attacks

Distributed denial of service (DDoS) attacks are able to take out an entire site in a matter of minutes. Firewalls and traditional tools like intrusion detection and prevention systems cannot always mitigate the security risks associated with these threats. New techniques and technologies in DDoS attacks can be more aggressive than their DoS predecessors and require a different kind of approach to network security. This slideshow features some of the tricks and tools, identified by Jim MacLeod, product manager at WildPackets, that can be employed to hinder the flow of a DDoS attack. 1. Understanding a DDoS attack The goal of any DDoS attack is to overwhelm a service to the point where it no longer works. While DDoS has historically been just an annoyance, there is usually a financial impact, such as lost sales or a spike in bandwidth costs. Cloud-hosted services, which charge by usage, are especially financially vulnerable to an onslaught of traffic. DDoS attacks use large numbers of computers simultaneously targeting a single service. The attack often comes from botnets, which are composed of PCs infected by a virus. Recently, DDoS has been used by political protesters, who crowdsource attackers through downloadable software. Older DoS attacks like SYN floods used limited numbers of attackers, so it was possible to use automatic per-client rate-limiting, or to block the IPs. Modern DDoS techniques try to avoid large amounts of traffic per attacker, and rely purely on large numbers. 2. Prepare in advance Many sites may think they’re too small to attract attention. However, DDoS isn’t a hard attack to perform. Ironically, DDoS is even available as a service. If your site is big enough to attract any business, it’s big enough to attract a potential attacker. Reducing the cost of an attack starts with early detection. There are simple techniques you can use to alert yourself to an attack. Run a script on your server that sends a message periodically with the recent traffic count: You’ll get a warning either if the count jumps significantly, or the message doesn’t arrive. Additionally, use a remote monitoring program that periodically checks the service’s availability. A large DDoS attack may block your management access if the site is remote. Try to make sure there’s a cost-effective out-of-band management solution. 3. Identify the attack fingerprint Once you detect a DDoS attack, the first step is to identify its unique characteristics. Despite the availability of cleverer techniques, DDoS usually relies on brute force – which means that the traffic from all of the attackers will have unique similarities. Because large numbers of attackers will be involved, scattered across the Internet, blocking the IP addresses will be nearly impossible. Instead, do a quick packet capture of the attack. Finding examples will be relatively easy, since most of the traffic will be DDoS traffic. Commonalities can often be found in the URI, user agent, or referrer. What you’re looking for is a pattern that you can block with your firewall, router ACL, IDS, etc. It will often be an ASCII or hex pattern at an offset. Become familiar with the capabilities of your equipment, and try some tests in preparation. 4. Block the rogue packets Once you have identified the attack fingerprint, it is time to set up a block within your firewall or router to drop the majority of packets. However, a high-bandwidth attack may simply exhaust your WAN link: You’ll have a clean LAN, but your service will still be unreachable. Contact your carrier now to figure out how to work with them during a DDoS attack, in case they need to do the blocking for you. Some service providers offer “clean pipe” hosting with automatic DDoS squelching. There are also companies who offer products and services to detect and prevent DDoS. Depending on the specifics of your service, it may make financial sense to pay for one of these solutions. Don’t forget the option of simply hosting the service somewhere large enough to absorb the attack – but remember that DDoS against sites that charge by bandwidth can result in unexpectedly high bills. 5. Surviving and cleaning up During and after a DDoS attack, ask for help. Your regional CSIRT (Computer Security Incident Response Team) should be alerted, as they have expertise and contacts that can not only help you during the attack, but also start the process of figuring out who did it and how. A global list is available here: http://www.cert.org/csirts/national/contact.html As cyber crimes get more sophisticated, businesses must be able to constantly adapt to these new security threats. While there are no methods or tools that can completely prevent DDoS attacks from happening, having a security “insurance policy” in place is the first step in ensuring that you are completely prepared. The ability to quickly suspend this new level of attack is tantamount to protecting company data as well as your business as a whole. Click here for DDoS protection. Source: http://www.itbusinessedge.com/slideshows/show.aspx?c=96534

Waring: Hackers can break into your Cisco TelePresence sessions, One of the Methods through Distributed Denial of Service ‘DDoS’ attack

If you rely on Cisco TelePresence products for sensive business communications, you might want to stop what you are doing and pay attention to a new warning that hackers can exploit security flaws to execute arbitrary code, cause a denial-of-service condition, or inject malicious commands. Cisco released four separate security advisories today to warn of the risks and urge TelePresence users to deploy patches, especially in sensitive business environments. If you think this might just be a theoretical threat, take a look at what HD Moore (of Metasploit fame) demonstrated for the New York Times earlier this year. The skinny from Cisco: Advisory #1: Cisco TelePresence Recording Server contains the following vulnerabilities: Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability Cisco TelePresence Web Interface Command Injection Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability Exploitation of the Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability may allow a remote, unauthenticated attacker to create a denial of service condition, preventing the product from responding to new connection requests and potentially causing some services and processes to crash. Exploitation of the Cisco TelePresence Web Interface Command Injection may allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with elevated privileges. Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability may allow allow an unauthenticated, adjacent attacker to execute arbitrary code with elevated privileges. Advisory #2: Cisco TelePresence Multipoint Switch contains the following vulnerabilities: Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability Exploitation of the Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability may allow an unauthenticated, remote attacker to create a denial of service (DoS) condition, causing the product to become unresponsive to new connection requests and potentially leading to termination services and processes. Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability may allow an unauthenticated, adjacent attacker to execute arbitrary code with elevated privileges. Advisory #3: Cisco TelePresence Manager contains the following vulnerabilities: Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability Exploitation of the Cisco TelePresence Malformed IP Packets Denial of Service Vulnerability may allow an unauthenticated, remote attacker to create a denial of service (DoS) condition, causing the product to become unresponsive to new connection requests and potentially leading to termination services and processes. Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability may allow an unauthenticated, adjacent attacker to execute arbitrary code with elevated privileges. Advisory #4: Cisco TelePresence Endpoint devices contain the following vulnerabilities: Cisco TelePresence API Remote Command Execution Vulnerability Cisco TelePresence Remote Command Execution Vulnerability Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability Exploitation of the API Remote Command Execution vulnerability could allow an unauthenticated, adjacent attacker to inject commands into API requests. The injected commands will be executed by the underlying operating system in an elevated context. Exploitation of the Remote Command Execution vulnerability could allow an authenticated, remote attacker to inject commands into requests made to the Administrative Web interface. The injected commands will be executed by the underlying operating system in an elevated context. Exploitation of the Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability may allow an unauthenticated, adjacent attacker to execute arbitrary code with elevated privileges. Summary: Major security holes in the Cisco TelePresence product line could allow attackers to execute arbitrary code, cause a denial-of-service condition, or inject commands. Source: http://www.zdnet.com/hackers-can-break-into-your-cisco-telepresence-sessions-7000000825/

More:
Waring: Hackers can break into your Cisco TelePresence sessions, One of the Methods through Distributed Denial of Service ‘DDoS’ attack