Tag Archives: ddos news

DDoS attacks via WordPress now come with encryption

Kaspersky Lab experts have noted an emerging trend – a growth in the number of attacks using encryption. Such attacks are highly effective due to the difficulty in identifying them amongst the overall flow of clean requests. Recently, the company encountered yet more evidence of this trend – an attack exploiting vulnerabilities in WordPress via an encrypted channel. WordPress Pingback attacks have been in use since 2014. They fall under the amplification class of attacks, … More ?

Read the original:
DDoS attacks via WordPress now come with encryption

UK police crack down on people paying for DDoS attacks

It’s all part of ‘Operation Tarpit’, a global crackdown co-ordinated by Europol. Distributed Denial of Service (DDoS) attacks are on the rise, affecting individuals, private businesses and government-funded institutions alike. As part of a large warning to cybercriminals, the UK’s National Crime Agency (NCA) has arrested 12 individuals for using a DDoS-for-hire service called Netspoof. “Operation Vulcanialia” targeted 60 citizens in total, and led to 30 cease and desist notices, and the seizure of equipment from 11 suspects. The NCA says it had two focuses: arresting repeat offenders and educating first-time users about the consequences of cybercrime. The work formed part of Operation Tarpit, a larger effort co-ordinated by Europol. Law enforcement agencies from Australia, Belgium, France, Hungary, Lithuania, the Netherlands, Norway, Portugal, Spain, Sweden, the UK and the US targeted users of DDoS tools together, resulting in 34 arrests and 101 suspects being interviewed and cautioned. The UK’s contribution was spearheaded by intelligence gathered by the West Midlands Regional Cyber Crime Unit, and executed by Regional Organised Crime Units under the watchful eye of the NCA. Some of the arrests were detailed in a press release — all but one was under the age of 30. Netspoof allowed anyone to initiate potentially devastating DDoS attacks from as little as £4. Packages soared to as much as £380, however, depending on the user’s requirements. It meant almost anyone, regardless of their technical background, could take down sites and services by flooding them with huge amounts of data. The trend is representative of the increase in cybercrime and how easy it is for people to wield such powers. DDoS attacks aren’t comparable to hacking, but they’re still a worrisome tactic for businesses. Knocking a service offline can affect a company’s finances and reputation, angering customers in the process. Twelve arrests is by no means insignificant, but it almost certainly represents a small number of DDoS users. Still, it’s a warning shot from the NCA — it’s aware of the problem, and officers are putting more resources into tracking those who both use and facilitate such attacks on the internet. Source: https://www.engadget.com/2016/12/13/uk-national-crime-agency-ddos-arrests/

Can ISPs step up and solve the DDoS problem?

Apply best routing practices liberally. Repeat each morning Solve the DDoS problem? No problem. We’ll just get ISPs to rewrite the internet. In this interview Ian Levy, technical director of GCHQ’s National Cyber Security Centre, says it’s up to ISPs to rewrite internet standards and stamp out DDoS attacks coming from the UK. In particular, they should change the Border Gateway Protocol, which lies at the heart of the routing system, he suggests.…

80 Sony IP camera models come with backdoors

80 different models of Sony IPELA Engine IP Cameras have multiple backdoors that can be misused by attackers to take control of the device, disrupt its functionality, add it to a botnet, and more. Researchers from SEC Consult discovered two application-level backdoor accounts (“primana” and “debug”) with hardcoded passwords, the hashes of which are included in the devices’ firmware. The hashes can be cracked, and through these accounts, attackers can access specific, undocumented CGI functionalities. … More ?

Continue Reading:
80 Sony IP camera models come with backdoors

Cybercriminals use DDoS as smokescreen for other attacks on business

Distributed Denial of Service (DDoS) attacks are sometimes used by cybercriminals to distract businesses while hackers sneak in through the back door, a survey from Kaspersky Lab and B2B International suggests. Over half of businesses questioned (56%) are confident that DDoS has been used as a smokescreen for other kinds of cybercrime, and of those business respondents, a large majority (87%) reported that they had also been the victim of a targeted attack. The Kaspersky Lab IT Security Risks 2016 study showed that when businesses have suffered from cybercrime, DDoS has often been part of the attack tactics (29%). For example, a worrying quarter (26%) of businesses that have suffered data loss as a result of a targeted attack, named DDoS as one of the contributing vectors. Overall, 56% of business representatives surveyed believed that the DDoS attacks their companies had experienced were a smokescreen or decoy for other criminal activities. Kirill Ilganaev, Head of Kaspersky DDoS Protection, explained why DDoS attacks may appeal to cybercriminals as part of their tactics. He said, “DDoS prevents a company from carrying on its normal activities by putting either public or internal services on hold. This is obviously a real problem to businesses and it is often ‘all hands on deck’ in the IT team, to try and fix the problem quickly, so the business can carry on as before. DDoS can therefore be used not only as an easy way to stop the activity of a company, but also as a decoy to distract IT staff from another intrusion taking place through other channels.” The study found that when DDoS attacks have been used by cybercriminals as a smokescreen, businesses also faced threats such as losses and exploits through mobile devices (81%), the actions of other organizations (78%), phishing scams (75%) and even the malicious activity of internal staff (75%). The majority (87%) were also victims of targeted attacks. Ilganaev continued, “The research shows us that DDoS attacks are often aligned with other threats. Businesses therefore need to be aware of the full threat landscape, and prepared to deal with multiple types of criminal activity at any one time. Failure to do this could increase the collateral damage, on top of already significant losses caused by downtime and the resulting impact on reputation. Businesses need to use a reliable DDoS protection service to reduce the risk of DDoS and help staff concentrate their efforts on protecting the business from any threats that can be hidden as a result.” Source: http://www.networksasia.net/article/cybercriminals-use-ddos-smokescreen-other-attacks-business.1480989900

See original article:
Cybercriminals use DDoS as smokescreen for other attacks on business

Warcraft, Overwatch Down? Blizzard DDoS Attacks Affect Gaming Service

Miscreants have struck Blizzard servers again with multiple waves of DDoS attacks over the last 12 hours. Warcraft and Overwatch, two massively popular games, have been facing latency, login and disconnection issues even while Blizzard has been working on fixing the problem. The company first acknowledged the problem in a tweet Sunday evening. Since then, Blizzard claimed to have regained control over matters at its end, only to announce twice the DDoS attacks had restarted. Its last update, at 11:42 p.m. EST Sunday, came three hours after the last wave of DDoS attacks. On Twitter, a group calling itself Phantom Squad claimed responsibility for the attack Blizzard also provided a link to a support page on its website that may help some users troubleshoot their connection problems. As always, social media was abuzz with users venting their frustration at the gaming servers being affected. This is at least the fifth such instance in the last few months. The company also has a scheduled maintenance coming up Tuesday. Source: http://www.ibtimes.com/warcraft-overwatch-down-blizzard-ddos-attacks-affect-gaming-service-2454782

View the original here:
Warcraft, Overwatch Down? Blizzard DDoS Attacks Affect Gaming Service

4 sectors vulnerable to IoT attacks in 2017

2017 is set to feature new attacks on internet infrastructure and advancements in Internet of Things security One of 2016’s key events in the tech world was the massive distributed denial of service (DDoS) attack in October that brought many of the internet’s most heavily trafficked sites to their knees. There were two main takeaways from the event. Firstly, DNS infrastructure is highly vulnerable. And secondly, the growing proliferation of cheap, connected Internet of Things (IoT) devices – webcams, Wi-Fi speakers, wearables etc. – is making it far easier for cybercriminals to launch massive DDoS attacks. Why? Because many of these devices are shipped with default usernames and passwords, which are never changed by the enduser, and so are easily taken over. Earlier in October, the Mirai botnet malware was made public, and it evidently played a role in the attack. In 2017 businesses are sure to suffer more DDoS attacks and internet shutdowns powered by cheap, insecure IoT devices. But while these attacks could become more common, they’re also likely to become less lethal as backbone providers harden their defenses and device manufacturers adopt identity-based security to close vulnerabilities. However, the sheer number of cheap AND insecure IoT devices deployed globally will ensure DDoS attacks continue sporadically through 2017. Catastrophic DDoS attacks might dominate tech media coverage, but the failure of IoT device, service and infrastructure to adopt and scale robust security and privacy tactics will play out in several ways. Here are four sectors that will face the brunt of this as digital transformation takes hold in 2017. 1. Healthcare In 2017, the distinction between in-home and clinical healthcare devices will continue to erode. To date, smart wearables and exercise devices like Fitbits and Apple Watches have been perceived as a means to track exercise in order to further fitness goals – distinct from clinical medical devices like heart monitors, blood pressure cuffs or insulin pumps. At the same time, it’s become common for patients with high blood pressure to monitor their levels at home by capturing them on a mobile app on their phone – exactly how fitness trackers work. The wealth of data available to clinicians flowing from such devices is leading to expectations that individuals can and perhaps should play much more active roles in preventative care. But the ease with which personal health data can now be gathered and shared will increase pressure on healthcare IT decision-makers to turn to identity management and authentication as the technology most effective for achieving security objectives. The proliferation of digital systems and devices in healthcare settings creates more vulnerabilities where personal data can get exposed or stolen. By adding contextual authentication and authorisation through strong digital identity, hacking these systems becomes more difficult. For example, adding presence, geo-location and or persistent authentication. 2. Financial services In 2017, commercial banks and investment houses will continue the race to avoid having their business models disrupted by fintech innovation such as Bitcoin and emerging artificial intelligence technologies. Banks are already co-opting these disruptive technologies and incorporating them into their own IT mix. Somewhat ironically, having established relationships with their customers, many legacy banks could be very well positioned to not just weather the digital transformation storm, but emerge even more stable and profitable in the years ahead. This is especially true for those that embrace omnichannel techniques and technologies to create seamless experiences that delight customers across devices. Banks in 2017 will work on allaying customer privacy concerns as they cope with regulations regarding data protection and sharing. There will be a continued effort to eliminate internal data silos that create impersonal customer experiences across channels, and fragmented systems that can’t support digital customer demands and business requirements. 3. Retail The race toward omnichannel will accelerate in 2017 as many retailers and B2C organisations find themselves doing more business via mobile than they’re doing on the conventional laptop and online channel. Delivering convenience and seamless experiences will depend heavily on providing customers with experiences that are not just secure but also personalised to their needs and tastes. In order to do this, they must securely connect the digital identities of people, devices and things. This requires solving complex identity challenges and creating solutions that enhance and improve customer experiences and at the same time maximise revenue opportunities. 4. Communications and media AT&T’s proposed acquisition of Time Warner at the end of 2016 highlights exactly how vulnerable legacy media and telecommunications firms perceive themselves to be to disruptive forces like cord cutting. ‘Digital pipe’ companies feel like they need to lock in content providers in order to lock in audiences and preserve value. However, regulators may frown on such industry consolidation, and independent players like Netflix and semi-independent players like Hulu and independent cable TV producers continue to find ways to directly insert successful content into the entertainment bloodstream. Here again, making content easily accessible through the full array of channels is key to locking in loyalty and preserving lifetime value (LTV). Source: http://www.information-age.com/protect-internet-unsecured-everything-123463392/

Read this article:
4 sectors vulnerable to IoT attacks in 2017

World’s Biggest Mirai Botnet Is Being Rented Out For DDoS Attacks

Forbes’ Thomas Fox-Brewster recently reported on a DDoS-for-hire tool. For $7500, anyone who wanted to cause a little online mayhem could rent an army of 100,000 bots. Its controllers boasted that the Mirai-based botnet could unleash attacks of 1 Terabit per second or more. Now there’s a new DDoS service that’s powered by four times as many bots. 400,000 of anything sounds like a lot, but how big is that in botnet terms? A security researcher who goes by the handle MalwareTech told Bleeping Computer’s Catalin Cimpanu that this new Mirai botnet is larger than all other the Mirai botnets combined . It’s being actively promoted on the Dark Web, and its handlers are even willing to give free demonstrations of its considerable capabilities to potential customers. You don’t have to rent all 400,000 bots if you don’t want to. A customer can specify how many bots they want to rent for an attack, the duration of the attack, and the length of the “cool-down period” they’re willing to accept so the bots don’t get overtaxed. Prices are adjusted accordingly, a Bitcoin payment is made, and customers are given an Onion URL to access the botnet’s controls so they can launch their attack. Access to a service like this doesn’t come cheap. Cimpanu was quoted $3,000 to $4,000 to utilize 50,000 bots for a two-week attack with 1-hour bursts and a 5-10 minute cool-down. Apart from the massive number of bots this Mirai botnet has at its disposal, Cimpanu notes something else that differentiates it from the others. This botnet has the ability to circumvent certain DDoS mitigation techniques. Its creators have given it the ability to broadcast fake IP addresses, which makes the attacks much more difficult to disrupt. It also has one prominent attack under its belt already: the one last month that targeted a mobile telecom provider’s network in Liberia. Though reports after the fact showed that the whole country was not ever knocked completely offline, this botnet definitely seems to have the capacity to make that happen. Aimed at the right servers, a fraction of its 400,000 bots can cause widespread disruptions. Just look at what a single gamer with money to burn and an axe to grind with the Playstation Network did to Internet users all over the east coast this month. Source: http://www.forbes.com/sites/leemathews/2016/11/29/worlds-biggest-mirai-botnet-is-being-rented-out-for-ddos-attacks/#5a31b930465a

View post:
World’s Biggest Mirai Botnet Is Being Rented Out For DDoS Attacks

Protecting smart hospitals: A few recommendations

The European Union Agency for Network and Information Security (ENISA) has released a new report to help IT and security officers of healthcare organizations implement IoT devices securely and protect smart hospitals from a variety of threats. We all know that attacks against hospitals are increasing, but according to security experts, ransomware and DDoS attacks are just the start. The report, compiled with the help of infosec officers from several European hospitals and consultants and … More ?

Read the article:
Protecting smart hospitals: A few recommendations

Three ways to prevent a DDoS disaster this Black Friday

Black Friday will be a big day for retailers — and hopefully for all the right reasons. Some of the biggest shopping days of the year are upon us. But while retailers are focused on ensuring that they cope with huge peaks in online and in-store sales, are they as prepared as they need to be to defend against major distributed denial of service (DDoS) attacks? Avoiding a cyber-crime catastrophe Black Friday is here (along with the increasingly popular Cyber Monday). As ever, crowds of shoppers will flock to retailers’ stores and websites in search of rock-bottom prices. And this will mean a huge increase in sales for both physical and online stores. Black Friday may be a sales bonanza but it’s also a period of high vulnerability that criminals could exploit to maximise the threat to a retailer’s business. With Christmas sales accounting for a sizeable chunk of most retailers’ annual revenues, from a criminal’s perspective, there could hardly be a better time to launch a cyber attack. What’s more, with systems already creaking under the load of peak volumes, it might not take much of a straw to break the camel’s back. The last thing a retailer wants is for their business to spectacularly and very visibly come to a sudden halt because they can’t defend against and mitigate a major distributed denial of service (DDoS) attack. Retailers face a growing threat Talk of cyber attacks are more than mere scaremongering – the threat is very real. For example, in September, the release of the Mirai code — a piece of malware that infects IoT devices enabling them to be used for DDoS attacks — opened a Pandora’s box of opportunities for ruthless cyber entrepreneurs who want to disrupt their target markets and exploit the vulnerabilities and weaknesses of companies who honestly serve their customers. This code gives criminals the ability to orchestrate legions of unsecured Internet of Things (IoT) devices to act as unwitting participants in targeted DDoS attacks. These objects could be anything from domestic hubs and routers, to printers and digital video recorders — as long as they’re connected to the internet. The latest large DDoS attacks have used botnets just like this — proving that the bad guys are multiplying and, perhaps, gearing up for bigger things. Prevention is better than the cure There are no easy answers to the question of how to secure IoT smart devices — especially at the ‘budget conscious’ end of the market. That’s why we expect that these DDoS attacks will continue to proliferate, meaning that targeted DDoS attacks of increasing scale and frequency will almost certainly occur as a result. So how can retailers defend themselves against the threat of an attack on Black Friday? Organisations have to use a combination of measures to safeguard against even the most determined DDoS attack. These include: Limiting the impact of an attack by absorbing DDoS traffic targeted at the application layer, deflecting all DDoS traffic targeted at the network layer and authenticating valid traffic at the network edge. Choosing an ISP that connects directly to large carriers and other networks, as well as internet exchanges — allowing traffic to pass efficiently. Employing the services of a network-based DDoS provider — with a demonstrable track record of mitigating DDoS attacks and sinking significant data floods. This will safeguard specific IP address ranges that organisations want to protect. Black Friday will be a big day for retailers — and hopefully for all the right reasons. But in an increasingly digital world, consideration needs to be given to the IT infrastructure that underpins today’s retail business and the security strategy that protects it. Source: http://www.itproportal.com/features/three-ways-to-prevent-a-ddos-disaster-this-black-friday/

View original post here:
Three ways to prevent a DDoS disaster this Black Friday