Tag Archives: defend against ddos

Rutgers University Suffers Sixth DDoS Attack This Year

Three cyber-security firms could not handle the attack Rutgers University’s IT department has managed to restore all services after a large-scale DDoS attack kept some of its systems down for four days between December 24 and December 28. This is not the first time Rutgers University has been hit with a DDoS attack, having already reported on a similar incident back at the end of September . Earlier this year, at the end of March and start of May, university staff also suffered four similar attacks, with the longest one lasting for five full days. Sixth time this year, nobody has claimed responsibility yet The first five attacks were claimed by a hacker that went by the name of Exfocus, who admitted in an interview that he was hired via an underground forum to carry out the DDoS bombardment, and later paid in Bitcoin. Unlike in the case of the first five attacks, Exfocus has not come forward to claim responsibility. The Rutgers IT staff said the attack targeted the sakai.rutgers.edu URL, the University’s Sakai portal. Sakai is an open source, self-hosted Java-based course learning environment used primarily by academic institutions. The DDoS attack did not affect student activities since students are away for Christmas break, which started on December 24 and will end on January 5. A $3 million investment in IT security systems did not help at all Last August, Rutgers management spent $3 million / €2.67 million on security measures to bolster their online platform. According to NJ.com, the University hired three cyber-security firms. The unplanned investment was motivated by the March and May attacks. Despite this, the University’s DDoS mitigation provider has failed to live up to its job, both in September and in this most recent four-day-long attack. In his interview, Exfocus said that he controlled a botnet of 85,000 machines, and was able to launch DDoS attacks of around 25 Gbps, which is considered to be of a medium scale. The proper law enforcement agencies have been notified of the attack. Softpedia has reached out to Exfocus on Twitter. We’ll update the article if we uncover any new information. Source: http://news.softpedia.com/news/rutgers-university-suffers-sixth-ddos-attack-this-year-498229.shtml

See more here:
Rutgers University Suffers Sixth DDoS Attack This Year

2016 will see the rise of DDoS-as-a-service

We’ve already seen a big increase in DDoS attacks in the past year and according to the latest predictions these are set to continue and become more sinister in nature as we move into 2016. Security specialist Corero foresees a rise in ‘Dark DDoS’ attacks used as various smokescreens to distract victims while other attacks infiltrate corporate networks to steal sensitive data. Dave Larson, COO at Corero Network Security, says, “The highly sophisticated, adaptive and powerful Dark DDoS attack will grow exponentially next year as criminals build on their previous successes of using DDoS attacks as a distraction technique. The Carphone Warehouse attack in August was interesting because it was one of the first publicly reported cases of Dark DDoS in the public domain. This is a new frontier for DDoS attacks and a growing threat for any Internet-connected business that is housing sensitive data, such as credit card details or other personally identifiable information”. It also predicts a rise in DDoS-as-a-service cyber crime business models, where it’s possible to pay to have victims hit for as little as $6.00 per month. This means less sophisticated cyber crime actors can readily become DDoS adversaries. During October 2015, 10 percent of Corero’s customer base was faced with extortion attempts, which threatened to take down or to continue an attack on their websites unless a ransom demand was paid. If the volume of DDoS attacks continues to grow at the current rate of 32 percent per quarter, according to Corero’s latest Trends and Analysis Report, the volume of Bitcoin ransom demands could triple to 30 percent by the same time next year. Corero also anticipates 2016 will see ISPs come under pressure to provide DDoS mitigation services to their customers. In a survey conducted this autumn, Corero revealed that three quarters of enterprise customers would like their ISP to provide additional security services to eliminate DDoS traffic from entering their networks. “The current status quo allows malicious traffic carrying DDoS threats to flow freely over most provider networks,” says Larson. “As a result, most customers end up paying their provider for bandwidth that delivers potentially dangerous Internet content. But the technology exists for ISPs to turn this problem into a business opportunity. By providing DDoS mitigation tools as a service, deployed at the Internet edge, they can defeat this problem before it enters their customers’ networks”. Source: http://betanews.com/2015/12/28/2016-will-see-the-rise-of-ddos-as-a-service/

Massive DDoS Attacks of Over 1 Million Queries Per Second Threaten Root Servers That Support The Global Internet

Today, we share a blog post from Looking Glass’ Director of Product Management, Patrick Lynch, as he discusses distributed denial of service (DDoS) attacks on DNS root servers. On Nov 30 and again on Dec. 1, massive DDoS attacks against several Internet based DNS root servers with volumes of over 1 million queries per second threatened the global Internet. There is speculation that the attack was initiated by ISIS (here). Not only is this a risk to the Internet as a whole, but also impacts the Internet Service Providers (ISPs) that are the unfortunate middle link in the attack and whom the majority of Internet access depends on. Although the target was the DNS root servers, the intermediate ISPs probably were more severely impacted by the sudden spike in the traffic load due to the relationship between DNS authoritative and recursive servers. Verisign provided additional information showing why the source IPs were spoofed, and the root servers’ users group also published some information. Arstechnica also has a description of the event. There are a number of actions that are available to an ISP that mitigate both the attacks on the DNS root servers, and on the ISP itself: Ingress filtering by source IP address – Routers can enforce BCP38 that only allows traffic to originate with source IP addresses that are valid for that ISP. This will also prevent source and destination addresses from being the same. If Ingress filtering is not practical, then having a DNS firewall will provide similar capabilities to ingress filtering as well as additional capabilities such as: Only allow queries from allowed IP ranges Rate limit queries by source IP or destination IP to prevent volumetric attacks Rules that prevent DNS responses (as opposed to queries) going to the root servers When an upstream DNS server is busy (as in a DDOS attack), automatically generate a server unavailable error and do not add to the DDOS attack Securing DNS is challenging given the nature of the protocol and the fact that the DNS ports must be left open to ensure continuous delivery of DNS services to Internet attached devices. Source: https://lgscout.com/massive-ddos-attacks-of-over-1-million-queries-per-second-threaten-root-servers-that-support-the-global-internet/

Turkish banks & government sites under ‘intense’ DDoS attacks on Christmas holidays

Turkey is suffering from a wave of cyber-attacks on financial and government websites which intensified over Christmas, resulting in the temporary disruption of credit card transactions. A video released this week and attributed to Anonymous vowed retribution for Ankara’s alleged ties with ISIS. The attacks on Turkish servers have been persistent in recent weeks, but on Christmas day Turkish banks suffered a website outage and reportedly saw sporadic disruption to credit card transactions. Isbank, Garanti and Ziraat Bank were among the targets, local media reported. “It is hard to determine where these attacks are coming from, with detailed work it will be understood whether these attacks are carried out by hackers or by certain groups” said the Minister of Communications Binali Yildrim. The DDoS attacks on Turkey’s “.tr” domain, Yildrim said were “serious” as they include domains of ministries, banks, and the military. The ministry asked Ankara’s Middle East Technical University (ODTU), which operates the “.tr” domain to step up security measures. ODTU’s analysis said that the attacks are coming from “organized sources” outside Turkey. Turkish Telecom, in a statement to Hurriyet daily, said that they are now on “24/7 defense” as they acknowledged facing “thousands of attacks.” Most Turkish institutions use Turk Telekom as their service provider. “The attacks are serious,” a spokesman for internet provider Turk Telekom, Onur Oz, told Reuters. “But the target is not Turk Telekom. Instead, banks and public institutions are under heavy attack.” The banking sector is one of the fastest growing areas of online services in Turkey and equates roughly to 1.5-2 billion transactions daily, according to Hurriyet. More than 85 percent of daily banking transactions in Turkey are carried out on digital platforms. “These attacks began two weeks ago but have intensified over the past two days,” said Burak Atakani, a network specialist from Istanbul Technical University. Some Turkish media outlets have speculated that the cyber-attacks might have been launched by Russia in retaliation to the downing of a Russian bomber by a Turkish fighter jet late in November over Syrian airspace. Meanwhile in a video, released this week allegedly by hacktivist collective Anonymous, hackers promised to take on the Turkish government over its alleged shady deals with Islamic State (IS, formerly ISIS/ISIL) terrorist organization. Anonymous especially threatened to bombard the banking sector. “Turkey is supporting Daesh [the Arabic name for IS] by buying oil from them, and hospitalizing their fighters. We won’t accept that [Recep Tayyip] Erdogan, the leader of Turkey, will help [IS] any longer,” says a video message from the group. “We will continue attacking your internet, your root DNS, your banks and take your government sites down. After the root DNS, we will start to hit your airports, military assets and private state connections. We will destroy your critical banking infrastructure.” Special Cyber government security units within the Information and Communication Technologies Authority (ICTA) and the Telecommunications Directorate (TIB) have been deployed to stop the attacks. “Turkey is not in a position to be powerless in the face of these attacks,” said Customs and Trade Minister, Bulent Tufenkci. “I think that we’ll have necessary response.” Source: https://www.rt.com/news/327119-turkey-banks-cyber-attacks/

Anonymous Claims Responsibility For 40 Gbps DDoS Attack on Turkish Servers

The online hacktivist Anonymous has claimed the responsibility for a massive 40Gbps DDoS attack on Turkish DNS Servers under NIC.tr — The reason behind the attack is that Turkey is allegedly supporting and aiding the Daesh or ISIS/ISIL terrorist group. In a video uploaded by Anonymous, the hacktivists said that their attack on Turkish servers was part of their ongoing operation #OpISIS. According to the video message, “We won’t accept that Erdogan, the leader of Turkey, will help ISIS any longer. The news media has already stated that Turkey’s Internet has been the victim of massive DDOS attacks . This lead Turkey to shut down it’s internet borders and deny anybody outside the country to access Turkish websites.” The hacktivists also warned the government that if Turkey didn’t stop aiding Daesh or ISIS the attacks will continue and target airports, banks, government and military servers. “If you don’t stop supporting ISIS, we will continue attacking your internet, your root DNS, your banks and take your government sites down. After the root DNS we will start to hit your airports, military assets and private state connections. We will destroy your critical banking infrastructure. Stop this insanity now Turkey. Your fate is in your own hands,” said Anonymous. The cyber attack on Turkish root DNS servers took place last week which forced 40,000 .tr domains to go offline. Though the targeted domains were back online they same day however the accesses to those sites was kept limited. The state of Turkey has been accused of aiding and buying oil from the Daesh terrorist group. Some also accuse Turkey of being a safe passage for the groups recruitment in Syria. Source: https://www.hackread.com/anonymous-40-gbps-ddos-attack-on-turkish-servers/

More:
Anonymous Claims Responsibility For 40 Gbps DDoS Attack on Turkish Servers

Xbox Live Suffers DDoS Disruption, Playstation Network May Be Next

A DDoS attack initiated by grey-hat hacker group Phantom Squad may have taken Microsoft’s Xbox Live online network offline for at least 3 hours today. If the hacker group’s threats are to believed, Sony’s PlayStation Network (PSN) may be next. Gamers, look away. This is going to make for painful reading. For the second time in two years, a hacker group may be disrupting two of the most popular gaming networks in the console gaming world, Xbox Live and the PlayStation Network. Hacked reported on the DDoS threats made by Phantom Squad a few days ago, after a series of tweets posted by the hacker group that also took credit for knocking Reddit offline recently. In a case of history repeating itself, the group is doing what infamous hacking group Lizard Squad did last year in December, disrupting gamers’ plans of going online with their consoles by taking down Xbox Live and PSN for several days last year. While the new group Phantom Squad threatened to take down the gaming networks during Christmas, Xbox Live suffered an outage in certain parts around the world for a few years today. To nobody’s surprise, Phantom Squad took credit for the outage. An update posted today on Xbox’s status website read: Hey Xbox members, are you having trouble purchasing or managing your subscriptions for Xbox Live? Are you also having an issue with signing into Xbox Live? We are aware of these issues and are working to get it fixed ASAP! Thank you for being patient while we work. We’ll post another update when more information becomes available. The message made no reference to any disruptions or DDoS attacks targeting the network although Microsoft nor Sony seldom acknowledge such attacks, even if they were bearing the brunt of such attacks. For now, Xbox Live Status shows all services are up and running and it is likely that Microsoft has found an IP range or two to block the DDoS requests flooding the servers, a common defense strategy against such attacks. Meanwhile, Phantom Squad has claimed that it will DDoS both gaming networks this Christmas Day. So we are going to DDoS Xbox&PSN on Christmas Day We Dont Joke We Are Always Watching Christmas Day PSN&Xbox This Is Not A Bluff #Phantom — PhantomSquad (@PhantomLair) December 18, 2015 The hacking group claims that the disruptions are to bring attention to the lack of cybersecurity in the gaming networks but gamers will argue the group is doing it simply to annoy a large population of console gamers looking to wind down and play games during the holidays. Hacked has previously reported on several disruptive malicious hackers, including those from Lizard Squad who have been arrested not long after their antics from Christmas last year. One of the suspects was arrested in the UK in January this year while another was apprehended as a part of a wider operation in March 2015. Hacked will keep you updated on this story as it unfolds in the week leading to Christmas. Source: https://hacked.com/xbox-live-suffers-ddos-disruption-playstation-network-may-next/

Read this article:
Xbox Live Suffers DDoS Disruption, Playstation Network May Be Next

Hacker squad plans DDoS attacks on PlayStation Network, Xbox Live this Christmas

Hacker group Phantom Squad plans to shut down Xbox Live and PlayStation Network on Christmas. Forget the Grinch, there’s someone else who wants to steal Christmas. Phantom Squad, an online hacker group, has threatened to shut down Xbox Live and the PlayStation Network this Christmas by unleashing a series of DDoS (distributed denial of service) attacks — coordinated barrages of falsified incoming server traffic that causes the system to crash. DATA BREACHES AND CYBERATTACKS IN 2015 “We are going to shut down Xbox Live and PSN this year on Christmas,” the hackers tweeted. “And we are going to keep them down for one week straight. #DramaAlert.” We are going to shut down Xbox live and PSN this year on christmas. And we are going to keep them down for one week straight #DramaAlert — Phantom Squad (@PhantomSqaud) December 9, 2015 This could cause a big problem, because a lot of people are expecting to receive new gaming consoles on Dec. 25. If Phantom Squad is successful, this would be the second year in a row that these gaming networks go offline. Last year, the infamous hacker group Lizard Squad took credit for shutting down Xbox Live and PSN for two days. The group demanded more retweets and Twitter followers in exchange for restoring the servers. Phantom Squad, which said it has no relation to Lizard Squad, claims they’ve previously performed smaller outages on the gaming community servers, as well as other website such as Reddit. The group also explained in a tweet why it is that they perform these attacks. “I get asked a lot on why we do this? Why do we take down PSN and Xbox Live?” the tweet reads. “Because cyber security does not exist.” Sony and Microsoft have both received a series of attacks over the past year, but it’s still unknown what tactics they’ve developed to try and avoid these issues. Kim Dotcom, the infamous Internet entrepreneur behind Megeupload, has warned Sony and Microsoft that the attack could be avoided if they update their servers. “Warning @Sony & @Microsoft. You had 1 year to upgrade your networks. If Lizard Squad takes down PSN & XBOX this Xmas, we’ll be pissed! RT!,” Dotcom tweeted. Dotcom, who is also a gamer, helped stop last year’s attack by promising the hackers 3,000 accounts on his encrypted upload service Mega. While Sony and Microsoft work on strengthening their servers, people who bought a console as a gift this Christmas can unbox it, plug it in, and download all the updates as soon as they buy it. This process will let them at least play games offline on Christmas. Otherwise, if the hackers release a DDoS attack, the console will be useless without being powered on and updated. Source: http://www.nydailynews.com/news/national/hackers-plan-ddos-attack-psn-xbox-live-christmas-article-1.2467876

Link:
Hacker squad plans DDoS attacks on PlayStation Network, Xbox Live this Christmas

Boston internet service disrupted briefly by DDoS attack

Internet service in Boston was disrupted on Tuesday in what is being called a “minor act of cybervandalism,” according to the Boston Herald . The outage, affecting city agencies and the police and fire departments, was “short, but widespread,” said Mayor Martin J. Walsh. A distributed denial of service (DDoS) attack that caused computers worldwide to redirect network traffic to City Hall computers is cited as the method by which web connections were shuttered. While Jascha Franklin-Hodge, the city’s CIO, dismissed the attack as “a minor act of cybervandalism,” the incident is another example of an attack method becoming increasingly common and illustrates the vulnerabilities enterprises face on a daily basis. Experts explained that as the attack harvests no data, it might have been retribution or an attacker’s attempt to gain notoriety. Franklin-Hodge said his team was able to restore service within 20 minutes. Source: http://www.scmagazine.com/boston-officials-call-ddos-attack-on-internet-service-a-minor-act/article/460203/

Excerpt from:
Boston internet service disrupted briefly by DDoS attack

Moonfruit takes down thousands of sites after a DDoS attack

Moonfruit, a free website builder, has taken thousands of business and personal websites offline following a distributed denial of service (DDoS) attack. The company’s users are disappointed by the slow pace at which it has communicated the problem, and the way it’s being handled. The company said it had been threatened with a cyber-attack and had decided to make its customers’ websites unavailable for “up to 12 hours” to make infrastructure changes. In a statement on the Moonfruit website it was said that the company was actually attacked by a hacker group called the Armada Collective, which DDoSed the site for about 45 mintes. One business owner told the BBC it was “very bad timing”. Film-maker Reece de Ville said: “They have been slow to communicate via their website what is going on.” “I’m going to have hundreds of people finding my site today but not being able to access it. I could be losing out on a lot of money from potential clients, and they may not come back if they think the company has gone. It’s incredibly bad timing, especially for businesses selling Christmas cards and gifts on their website.” In an email to its customers, the company apologised for giving them “short notice” that their websites would be offline. “We have been working with law enforcement agencies regarding this matter and have spared no time or expense in ensuring we complete the work as quickly as possible,” the company’s director, Matt Casey, said in the official statement. Industry reaction Ron Symons, regional director at cyber security specialist A10 Networks said: “Moonfruit has responded in the best possible way to this threat by taking its services offline. As the attack it suffered last week shows, distributed denial of service (DDoS) is extremely difficult to prevent. More worryingly, DDoS attacks frequently act as smokescreens hiding more invasive attacks as hackers exploit unguarded system backdoors to steal sensitive data. “By making this bold decision to pre-empt another incident, Moonfruit stands a much better chance of protecting its clients’ private data. The shutdown may be inconvenient now, but by ensuring its infrastructure is equipped to deal with today’s increasingly powerful cyber attacks Moonfruit is acting in the best interests of those using its services.” SEE ALSO: Throwback Thursday: Why Apple is called Apple Dave Larson, Chief Operating Officer at Corero Network Security said: “Unfortunately, the sheer size and scale of hosting or data center operator network infrastructures and their massive customer base presents an incredibly attractive attack surface due to the multiple entry points and significant aggregate bandwidth that acts as a conduit for a damaging and disruptive DDoS attack. “As enterprises of all sizes increasingly rely on hosted critical infrastructure or services, they are placing themselves at even greater risk from these devastating DDoS attacks – even as an indirect target.” Source: http://www.itproportal.com/2015/12/14/moonfruit-takes-down-thousands-of-sites-after-a-ddos-attack/#ixzz3uLEOSJCP

Visit site:
Moonfruit takes down thousands of sites after a DDoS attack

Cyber criminals not to blame for all DDoS attacks, study shows

There is a real concern that many companies are being affected by the DDoS attacks commissioned by competitors, according to Kaspersky Lab Distributed denial of service (DDoS) attacks are associated with criminal activity, but not all those behind DDoS attacks are cyber criminals, research has revealed. Nearly half of more than 5,500 companies polled in 26 countries claimed to know the identity and motivation behind recent DDoS attacks, and 12% named competitors as the most likely culprits. This suspicion increases in the business services industry, with 38% of respondents in this sector believing their competitors were behind a DDoS attack, according to a survey by Kaspersky Lab and B2B International. However, 18% attributed recent DDoS attacks to criminals seeking to disrupt or distract while another attack took place; 17% to criminals seeking to disrupt their services for a ransom; 11% to political activists; and 5% to state-sponsored activities. The most popular motivation for the attacks is believed to be a ransom, cited by 27% of respondents in the manufacturing and telecoms sectors. “DDoS attacks are no longer just about cyber criminals seeking to halt a company’s operations,” said Evgeny Vigovsky, head of DDoS protection at Kaspersky Lab. “Businesses are becoming suspicious of each other, and there is a real concern that many companies – including small and medium ones – are being affected by the underhanded tactics of their competitors, which are commissioning DDoS attacks directly against them, damaging their operations and reputation,” he said. In the light of this trend, Vigovsky said all businesses should remain vigilant and fully understand the repercussions of a DDoS attack in terms of the potential financial and reputational damage. “It is wise not to pay a ransom, or to fall victim to cyber criminals or competitors. Ensure that you have the appropriate security measures in place to help manage the increased risk posed to your business from DDoS attacks,” he said. Looking ahead to 2016, security firms expect to see an increase in the tactic of using DDoS attacks to distract companies from other, more damaging malicious activity on their networks, such as data theft. The use of DDoS, or the threat of DDoS attacks, as a way of extorting money is also expected to continue and increase in the coming year. According to the study, 20% of companies with 50 employees or more reported that they have been the victim of at least one DDoS attack, with companies in the telecoms, financial services and IT sectors the most likely to be targeted. The study also revealed that 50% of DDoS attacks led to a noticeable disruption of services; 26% led to the loss of sensitive data; 24% led to services being completely unavailable; and 74% led to a noticeable disruption of service, which coincided with a different type of security incident, such as a malware attack, network intrusion or other type of attack. According to Kaspersky Lab, the average cost for recovering from a DDoS attack for companies of more than 1,500 employees is $417,000, and $53,000 for small and medium businesses (SMBs). Yet 56% of those polled thought that spending money to prevent or mitigate DDoS attacks in future would be worth the investment, 53% said their organisation knew how to mitigate or prevent DDoS attacks, and only 52% felt well-informed about DDoS attacks. Despite the cost and complexity of dealing with DDoS attacks, the Kaspersky Lab research said the average financial damage of a DDoS attack is significant, especially for SMBs, and is definitely higher than the cost of a service designed to reduce the effect of such attacks. “DDoS prevention is almost always a third-party service, and outsourcing this trouble to experts not only reduces the damage but also frees up IT personnel to deal with a probable complementary attack on a company infrastructure, which will have much worse consequences,” the report said. Source: http://www.computerweekly.com/news/4500260544/Cyber-criminals-not-to-blame-for-all-DDoS-attacks-study-shows

Taken from:
Cyber criminals not to blame for all DDoS attacks, study shows