Tag Archives: ddos news

For recent big data software vulnerabilities, botnets and coin mining are just the beginning

The phrase “with great power comes great responsibility” was excellent advice when Ben Parker said it to his nephew Peter, aka Spiderman. It is even more applicable to any organization using open source software to manage their big data analysis. This is especially true since, in 2018, significant vulnerabilities were identified and disclosed for both Hadoop and Spark, allowing unauthenticated remote code execution via their REST APIs. Many enterprises have adopted big data processing components … More ? The post For recent big data software vulnerabilities, botnets and coin mining are just the beginning appeared first on Help Net Security .

View the original here:
For recent big data software vulnerabilities, botnets and coin mining are just the beginning

Cequence Security announces application security platform to stop bot attacks

Cequence Security released Cequence ASP, an application security platform that provides a scalable defense against the growing number of bot attacks affecting today’s hyper-connected organizations. These financially-motivated attacks target externally-facing web and mobile apps, as well as API services that provide connections to other applications across their digital ecosystem. Attack objectives can include account takeover, content scraping, distributed denial of service, and much more. “From a bad actor’s perspective, geo-distributed bot attacks are relatively easy … More ? The post Cequence Security announces application security platform to stop bot attacks appeared first on Help Net Security .

View article:
Cequence Security announces application security platform to stop bot attacks

‘DerpTroll’ derps into plea deal, admits DDoS attacks on EA, Steam, Sony game servers

Austin Thompson, 23, cops to $95,000 worth of damage The man accused over DDoS-bombing several online games hosts in 2013 and 2014 has entered a guilty plea under a deal with US authorities.…

More:
‘DerpTroll’ derps into plea deal, admits DDoS attacks on EA, Steam, Sony game servers

NTT Security adds botnet infrastructure detection to Managed Security Services

NTT Security has developed a new network analytics technology to detect and defend NTT Group’s Managed Security Services (MSS) customers from attacks launched on botnet infrastructures. The new network flow data analysis uses machine learning and scalable streaming analytics – developed in partnership with NTT Group companies – and pulls data from NTT’s global network infrastructure, which provides visibility into the world’s internet traffic. The enhancement will enable NTT Security to find attacks on customers’ … More ? The post NTT Security adds botnet infrastructure detection to Managed Security Services appeared first on Help Net Security .

Week in review: Top cyber attack sources, serverless botnets, CFO as best cybersecurity friend

Here’s an overview of some of last week’s most interesting news and articles: Repairnator bot finds software bugs, successfully submits patches Can a bot create valid, high-quality fixes for software bugs more rapidly than a human can, and get them accepted by human developers and permanently merged in the code base? How to make the CFO your best cybersecurity friend Good cybersecurity is extremely expensive, and bad cybersecurity is, well… even more expensive. It’s very … More ? The post Week in review: Top cyber attack sources, serverless botnets, CFO as best cybersecurity friend appeared first on Help Net Security .

See the article here:
Week in review: Top cyber attack sources, serverless botnets, CFO as best cybersecurity friend

Over third of large Dutch firms hit by cyberattack in 2016 – CBS

Large companies are hit by cyberattacks at an above average rate, according to the Cybersecurity Monitor of Dutch statistics bureau CBS for 2018. Among companies of 250+ employees, 39 percent were hit at least once by a cyberattack in 2016, such as a hack or DDoS attack. By contrast, around 9 percent of small companies (2-10 employees) were confronted with such an ICT incident. Of the larger companies, 23 percent suffered from failure of business processes due to the outside cyberattacks. This compares to 6 percent for the smaller companies. Of all ICT incidents, failures were most common, for all sizes, though again, the larger companies were more affected (55%) than the smaller ones (21%). The incidents led to costs for both groups of companies. Chance of incident bigger at large company CBS noted that ICT incidents can arise from both from an outside attack and from an internal cause, such as incorrectly installed software or hardware or from the unintentional disclosure of data by an employee. The fact that larger companies suffer more from ICT incidents can be related to the fact that more people work with computers; this increases the chance of incidents. In addition, larger companies often have a more complex ICT infrastructure, which can cause more problems. The number of ICT incidents also varies per industry. For example, small businesses in the ICT sector (12%) and industry (10%) often suffer from ICT incidents due to external attacks. Small companies in the hospitality sector (6%) and health and welfare care (5%) were less often confronted with cyberattacks. Internal cause more common at smaller companies Compared to larger companies, ICT incidents at small companies more often have an internal cause: 2 out 3, compared to 2 out of 5 for larger companies. ICT incidents at small companies in health and welfare care most often had an internal cause (84%). In the ICT sector, this share was 60 percent. About 7 percent of companies with an ICT incident report them to one or more authorities, including police, the Dutch Data Protection Authority AP, a security team or their bank. The largest companies report ICT incidents much more often (41%) than the smallest companies (6%). Large companies report these ICT incidents most frequently to the AP, complying with law. After that, most reports are made to the police. The smallest companies report incidents most often to their bank. Smaller: less safe Small businesses are less often confronted with ICT incidents and, in comparison with large companies, take fewer security measures. Around 60 percent of small companies take three or more measures. This goes to 98 percent for larger companies. Source: https://www.telecompaper.com/news/over-third-39-of-large-dutch-firms-hit-by-cyberattack-in-2016-cbs–1265851

More here:
Over third of large Dutch firms hit by cyberattack in 2016 – CBS

The FBI Is Investigating More Cyberattacks in a California Congressional Race

The hacks — first reported by Rolling Stone — targeted a Democratic candidate in one of the country’s most competitive primary races WASHINGTON — The FBI has opened an investigation into cyberattacks that targeted a Democratic candidate in a highly competitive congressional primary in southern California. As Rolling Stone first reported in September, Democrat Bryan Caforio was the victim of what cybersecurity experts believe were distributed denial of service, or DDoS, attacks. The hacks crashed his campaign website on four separate occasions over a five-week span, including several hours before the biggest debate of the primary race and a week before the election itself, according to emails and other forensic data reviewed by Rolling Stone. They were the first reported instances of DDoS attacks on a congressional candidate in 2018. Caforio was running in the 25th congressional district represented by Republican Rep. Steve Knight, a vulnerable incumbent and a top target of the Democratic Party. Caforio ultimately finished third in the June primary, failing to move on to the general election by several thousand votes. “I’m glad the FBI has now launched an investigation into the hack,” Caforio tells Rolling Stone in a statement. “These attacks put our democracy at risk, and they’ll keep happening until we take them seriously and start to punish those responsible.” It was unclear from the campaign’s data who launched the attacks. But in early October, a few weeks after Rolling Stone’s report, Caforio says an FBI special agent based in southern California contacted one of his former campaign staffers about the DDoS attacks. The FBI has since spoken with several people who worked on the campaign, requested forensic data in connection with the attacks and tasked several specialists with investigating what happened, according to a source close to the campaign. According to the source, the FBI has expressed interest in several details of the DDoS attacks. The bureau asked about data showing that servers run by Amazon Web Services, the tech arm of the online retail giant, appear to have been used to carry out the attacks. The FBI employees also seemed to focus on the last of the four attacks on Caforio’s website, the one that came a week before the primary election. An FBI spokeswoman declined to comment for this story. A DDoS attack occurs when a flood of online traffic coming from multiple sources intentionally overwhelms a website and cripples it. The cybersecurity company Cloudflare compares DDoS to “a traffic jam clogging up a highway, preventing regular traffic from arriving at its desired destination.” Such attacks are becoming more common in American elections and civic life, according to experts who monitor and study cyberattacks. “DDoS attacks are being used to silence political speech and voters’ access to the information they need,” George Conard, a product manager at Jigsaw, a Google spin-off organization, wrote in May. “Political parties, campaigns and organizations are a growing target.” Matthew Prince, the CEO of Cloudflare, told Rolling Stone last month that his company had noticed an increase in such attacks after 2016 and the successful Russian operations on U.S. soil. “Our thesis is that, prior to 2016, U.S.-style democracy was seen as the shining city on the hill. The same things you could do to undermine a developing democracy wouldn’t work here,” Prince says. “But after 2016, the bloom’s off the rose.” The FBI has since created a foreign influence task force to combat future efforts to interfere and disrupt U.S. elections. Southern California, in particular, has seen multiple cyberattacks on Democratic congressional candidates during the 2018 midterms. Rolling Stone reported that Hans Keirstead, a Democratic candidate who had challenged Rep. Dana Rohrabacher (R-CA), widely seen as the most pro-Russia and pro-Putin member of Congress, had been the victim of multiple hacking efforts, including a successful spear-phishing attempt on his private email account that resembled the 2016 hack of John Podesta, Hillary Clinton’s campaign chairman. Hackers also reportedly broke into the campaign computer of Dave Min, another Democratic challenger in a different southern California district, prompting the FBI to open an investigation. On Friday, the nation’s four top law enforcement and national security agencies — the FBI, Justice Department, Department of Homeland Security and the Office of the Director of National Intelligence — released a joint statement saying there were “ongoing campaigns by Russia, China and other foreign actors, including Iran” that include interference in the 2018 and 2020 elections. Cybersecurity experts and political consultants say there are many reports of hacking attempts on 2018 campaigns that have not been publicized. But the proximity of the attacks is significant because Democrats have a greater chance of taking back the House of Representatives if they can flip multiple seats in Southern California. Source: https://www.rollingstone.com/politics/politics-news/california-congressional-race-hack-745519/

View the original here:
The FBI Is Investigating More Cyberattacks in a California Congressional Race

Serverless botnets could soon become reality

We have been accustomed to think about botnets as a network of compromised machines – personal devices, IoT devices, servers – waiting for their masters’ orders to begin their attack, but Protego researchers say that many compromised machines are definitely not a requirement: botnets can quite as easily be comprised of serverless functions. They created one on the Google Cloud Functions platform as a proof of concept and have calculated that the losses experienced by … More ? The post Serverless botnets could soon become reality appeared first on Help Net Security .

Read the original post:
Serverless botnets could soon become reality

The Haunting Horror Story Of Cybercrime

As the old saying goes, “darkness falls across the land, the midnight hour is close at hand.” Halloween is upon the scene and frightening things are unforeseen. Imagine watching a chilling movie depicting a zombie apocalypse or a deadly virus spreading fast across a metropolis, infecting everything in its wake. Sounds like a monstrous scenario? Sounds analogous to a cyber-attack? You could be onto something. Strap yourself in. It’s going to be a bumpy ride. According to recent F5 Labs threat analysis, the top application breaches haunting companies right now with rapidly mutating sophistication include payment card theft via web injection (70%), website hacking (26%), and app database hacking (4%). Frighteningly, further analysis shows that 13% of all web application breaches in 2017 and Q1 2018 were access related. This bloodcurdling discovery can be dissected as follows: credentials stolen via compromised email (34.29%), access control misconfiguration (22.86%); credential stuffing from stolen passwords (8.57%), brute force attacks to crack passwords (5.71%), and social engineering theft (2.76). The eerie evidence also shows that applications and identities are the initial targets in 86% of breaches. Businesses worldwide now face a sense of creeping dread and imminent disruption. Nowadays, they are more prone than ever to terrors such as malware hijacking browsers to sniff or intercept application authentication credentials. Then there are the strains of malware that target financial logins to menace both browser and mobile clients. There’s no way around it. Getting your cybersecurity posture right is the only way to stay safe. Get it wrong, however, and you’ll get the fright of your life in the shape of EU’s General Data Protection Regulation (GDPR) enforcement. There is definitively nowhere to hide this Halloween if you’re breached or fall short of tightening compliance expectations. Yet, if scary movies have taught us anything about horror stories, it is to never to scream and run away. As this ghoulish season can overshadow any organisation, it’s imperative that preventative measures are in place to protect vital assets. Yes, the findings from F5 Labs may paint a bleak picture but there are plenty of preventative measures you can take to improve your security posture and safeguard your employees’ applications and sensitive data: Understand your threat environment and prioritise defences against grave risk concerns. Know which applications are important and minimise your attack surface. Remember, an app’s surface is broadening all the time, encompassing multiple tiers and the ever-increasing use of application programming interfaces (APIs) to share data with third parties. Use data to drive your risk strategy and identify what attackers would typically target. Beware that any part of an application service visible on the Internet will be probed by fiendish hackers for possible exploitation. Configure your network systems properly or suffer the consequences of applications leaking internal and infrastructure information, including server names, private network addresses, email addresses, and even usernames. This is all valuable ammunition for a horrible hacker to carry out an attack. Be aware of common threats including DDoS attacks, ransomware, malware, phishing, and botnets. Ensure your IT response strategies are built to adapt and update in line with new vulnerabilities and threats will invariably improve survival rates. Implement a strong set of easily manageable and powerful security solutions such as an advanced web application firewall (AWAF). This type of technology is extremely scalable and can protect against the latest wave of attacks using behavioural analytics, proactive bot defence, and application-layer encryption of sensitive data like personal credentials. Ensure the company enforces a proactive culture of security and educates employees on policy, device management, as well as safe internet and cloud usage. When travelling on business, ensure staff never conduct financial transactions requiring a debit or credit card when using public or free Wi-Fi services. Never assume mobiles and laptop devices are safe, even at the local coffee bar. Change your passwords regularly (i.e. every month). This is especially important after travel. Devices may have been compromised during transit. Always perform regular data backups on approved devices and/or secure cloud platforms to ensure sensitive information is not lost or stolen and can be quickly recovered in the event of an attack. Remember, careless employees who feel they are unaccountable for the loss of work devices can damage business reputations. The grim reality Remember this is the time of year when “creatures crawl in search of blood to terrorize the neighbourhood”. Whether you’re expecting a trick or treat this Halloween, neglecting cybersecurity is certain to have ghastly consequences. The business world is littered with victims of cybercrime, so don’t get consigned to the grievous graveyard of cyber fraud. Know what makes your apps vulnerable and how they can be attacked. Makes sure you put the right solutions in place to lower your risk. Now is the time to stop being haunted by cybercriminals draining the lifeblood out of your business. Source: https://www.informationsecuritybuzz.com/articles/the-haunting-horror-story-of-cybercrime/

Has a BOT Network Compromised Your Systems?

BOT networks have surprisingly penetrated many corporate networks around the world. Yet many of the information technology and security operations teams often have difficulty identifying their activity and eliminating them from the network. The term botnet is derived from the combination of the words robot and network. A cybercriminal creates a network of these robots connected together for the purposes of coordinating some large-scale activity, most often to function as a cyberattack tool for cybercriminals. These activities often include the propagation of attacker malware tools, economic gain, or perhaps targeting a debilitating attack upon one or more websites on the internet, effectively harming revenue and reputation for enterprise organizations and online e-tailers. The larger the botnet, the more effective it can be in achieving the desired goal. Botnets spread via malware, often distributed through malicious email, and may also be self-propagating so that they move laterally from your laptop to other workstations and network devices within the network. Alternately, they can infect your laptop when you visit a compromised website, setting in motion a series of malicious events that result in a compromised system (drive-by download) and automatically installing the botnet software unbeknownst to the owner of that system. Very typically, due to a lack of effective cyber defense for both detection and remediation, cybercriminals find undefended internet of things (IoT) devices to be ideal hosts to harbor and hide their botnet malware. These IoT hosts can include the new generation of IoT enabled devices such as smart refrigerators, security cameras, digital video records, network connected access management systems, thermostats, and much more. Enterprise security departments are often surprised to find that their access management systems and security cameras are completely compromised by such botnets. The most common indicator is users complaining that computer programs are running much more slowly. This is an often key warning sign that hidden botnets or other malware are using your computing resources. More subtly, you may notice that your cooling fans are running when you are not actively using your computers or servers. This may be symptomatic of the considerable computational overhead created by botnets heating up the processor boards. Finally, on your Windows endpoint platforms, failure to shut down properly, or at all, or failure to download updates are other key indicators, any of which by themselves may not confirm the presence of a botnet, but together raise the suspicions to a high level. Some of your employees might also see unknown posts placed on their Facebook accounts. This might also be directly related to botnet activity. Cybercriminals can use social media accounts to easily disseminate malicious content. Conceptually, this social media botnet attack is very different than infecting your computer. By infecting your social media account, the botnet can propagate more rapidly across your entire social media account and never has to physically sit on your laptop or other home computers. Botnets usually work through automation set up, of course, by cybercriminals you don’t know. Key symptoms are almost always technology related – not related to insider activity or insider malicious threats. Beyond the symptoms already mentioned above, there are also technical indicators, such as strange processes running under windows, but these are very hard to detect. As quickly as cyber defense automation and tools evolve, so do the tactics, techniques, and procedures of the botnet cyberthieves. Most botnets don’t damage the host computers – most of what they do is degrade your performance and effectively “steal” your computer resources. More dangerous is the damage the cyberattackers can cause by using the botnet to maliciously target other websites. For example, when they launch a denial of service (DDOS) attack. Several best practices can help cut down or eliminate botnet infections and the secondary attacks that may be launched once an attacker has access to your networks through a botnet. These include: Utilize software that filters or cuts down on suspicious email attachments and don’t click on any links which are suspicious; Make sure your operating systems have all patches and updates installed; Keep your antivirus protection up to date – these often have the signatures of known and recent botnet malware components; and Encrypt your data end-to-end (at rest, in use, and in transit) so that an attacker in your network will be unable to make use of it. Source: https://securityboulevard.com/2018/10/has-a-bot-network-compromised-your-systems/

Original post:
Has a BOT Network Compromised Your Systems?