Tag Archives: defend against ddos

DDoS attacks are a growing digital threat to freedom of expression in Latin America

The media and Latin American journalists are starting to experience firsthand what until recently seemed to be the exclusive concern of US, European or Asian media outlets: cyberattacks.? This type of online criminal activity, known as Distributed Denial of Service (DDoS), is the other side of technological advances that aim to maximize flow of information online.? Cybercrime legislation is backward and broken in Latin America, where the lack of a culture of information security or economic resources of journalists and media outlets ensures that attacks are successful.? One of the most recent cases occurred in Mexico, where minutes after publishing an investigation about the alleged responsibility of federal police in extrajudicial executions of several young people in Apatzingan, a town in the state of Michoacan, the Aristegui Noticias site was out of services for hours, a victim of a DDoS attack.? The Knight Center for Journalism in the Americas consulted Robert Guerra, an expert on cyber security and Internet freedom, and Luis Horacio Najera, a Mexican journalist and expert in the field, on the consequences of these attacks for media companies.? “The main consequence of a cyber attack in the context of Latin America is the reduction of critical spaces that encourage debate or the exposure of misconduct and abuse of power, like corruption,” Guerra said. Guerra, founder of Privaterra, an organization based in Canada that advises private companies and NGOs on data privacy, believes that “any attack, whether cyber or physical, deteriorates freedom of expression and of the press in the country where it occurs.” In the context of countries like Mexico, where media workers are victims of assassinations, kidnappings and threats, this “silent war” on the Internet is presented as a new alarm when speaking about freedom of expression and of the press. Momentary “blackouts” of online media affect the flow of information, the legitimacy of the company and its journalists, and also cause adverse economics effects for the media companies which base their income in online advertising. “The attacks almost always occur as a result of some publication, that is to say they are more reactive than proactive,” Guerra said of the Latin American case. “The freedom of the press is vulnerable not only when a journalist is killed or a broadcaster is exploited.” In fact, in the 2014 Annual Report of the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights (CIDH), at least four cases of these attacks on media in Mexico were reported. “With the changes in technology and ways of doing journalism, cyber attacks will become more frequent because they attack the legitimacy of the journalist, and also affect the publication of news. Therefore, all attacks and threats should be condemned with the same intensity,” Guerra added. In addition to clear legislation, the region also lacks information on how and where these attacks occur, as well as statistics on their targets and consequences. In 2000, one of the companies specializing in digital security solutions, Arbor Networks, joined Google Ideas (an Internet research and conflict solution implementation think tank) to create a map that tracks digital attacks happening around the world, in real time. The aim was to create a tool for identifying these anonymous attacks: What is the origin of the attack, its target, and the duration and type of attack? It also aimed to analyze trends. Looking at the map, you can see that the peak of the cyber attacks in Latin America happened in December 2014. “It’s very interesting to see that most of the attacks are concentrated in a few countries in the region and that they are the result of specific moments in those countries,” Guerra said. “In the case of Guatemala, a reason for the attacks may be that at that time people were discussing the results of the International Commission Against Impunity in Guatemala. In the case of Peru, the second round of December 2014 regional elections may have influenced events.” What is a DDoS attack? At the technical level, a DDoS attack occurs when millions of simultaneous requests are sent to a single server in order to make it collapse. It is a targeted, deliberate action using hundreds of connected computers to make a simultaneous attack.? In an interview with the Knight Center, Hector Jara, founder and director of Enfinity, a Panamanian cybersecurity and information safety management company, explained the concept with an analogy. “Imagine a highway where a few cars circulating at high speeds and the traffic is fluid. As you add more and more cars, the driving pace slows and traffic is less fluid. If we continue to add cars, you will reach a point where the highway is saturated and cannot meet the demand, and the cars will be stopped. The same thing happens with connections to a website. The number of connections that it can respond to is limited, and if it makes more and more connection, at some point it will be saturated. The more capacity the organization has, this is more difficult to achieve – we think of Google Facebook, among others – but the limit always exists.” Jara also explained how criminal organizations use other types of attacks – for example phishing – through which they infect computers of ordinary users. “These infected computers are known as zombies , and can be controlled and used by these organizations to launch other attacks, such as DDoS. In fact these organizations assemble networks of zombie computers (known as botnets ) that they then ‘rent’ for non-sanctioned purposes”. The cybersecurity expert said that in addition to political purposes and censorship attacks, other attacks are related to digital protest. For example, the term Hacktivism is a new form of protest increasingly being used. One of the latest examples of the use of technology as a means of social protest was during the removal of former President Fernando Lugo of Paraguay when attacks on public bodies were made and one of them closed access to the official website of the Presidency. Asked about possible actions against these attacks, Jara explained that “while we can design a communications architecture in a way that can protect against these attacks – for example there are technological tools such as Web Application Firewalls and services such as CloudFlare , which can mitigate the impact and in some cases completely limit it – by the nature of the attack, if those interested in launching the attack had enough resources and time, it is likely that the would force a site out of operation.” While in the United States DDoS attacks are considered crimes and are punishable under the penal code, this has not been shown to combat the situation. The question is what can legislation achieve regarding this issue. Experts agree that international cooperation is key to fighting cybercrime. In 2014, Mexico hosted the “Workshop on legislation on cybercrime in Latin America”, organized to support Latin American countries in developing legislation on cyber crime, in accordance with international standards proposed in the “Budapest Convention “. During the meeting, possible reforms to criminal law of the participating countries and constitutional reforms in telecommunications were debated. While Argentina, Chile, Colombia, Costa Rica, Mexico, Paraguay and Peru have expressed their interest in joining the treaty, Dominican Republic and Panama have already completed this process. “Most regional legislation concerning information security have been poorly, and in many cases have been motivated by local public security crisis,” said Guerra of Privaterra. “So, from the start, these are deficient laws that in many cases secretly seek to impact civil society through censorship and criminalization of social networking activity.” Guerra also said it is not possible to speak of general solutions in Latin America, but that “each region has its own dynamics, and accordingly, legislation should create or strengthen legal counter methods to give tools for protection to civil society. These tools should be autonomous and independent of government.” Meanwhile, Jara noted that while regulations should establish a legal framework that protects personal information and data, in the case of journalists, these professionals should take measures to protect such data. “Because of the work, they may be a target of criminal organizations and sometimes governments. If they also have blogs or personal pages, they should ensure the safety of them, as a vulnerable site also becomes the focus of attack, ” Jara said. Source: https://knightcenter.utexas.edu/blog/00-16118-ddos-attacks-are-growing-digital-threat-freedom-expression-latin-america

FBI Links Chinese Government to DDoS Attacks on US Websites

The FBI says it has credible evidence to link the Chinese government to attackers who leveraged two Chinese telecom companies and the Baidu search engine to carry out recent distributed denial of service (DDoS) attacks targeting unnamed U.S. websites. The FBI issued a confidential Flash Alert to U.S. companies alleging that the Chinese government sanctioned activities in which Internet traffic was “manipulated to create cyber attacks directed at U.S.-based websites” using man-in-the-middle (MitM) techniques. “Analysis by the U.S. government indicated that Internet traffic which originated outside China, was intercepted and modified to make unsuspecting users send repeated requests to U.S.-based websites,” the Flash Alert reportedly said. “The malicious activity occurred on China’s backbone Internet infrastructure, and temporarily disrupted all operations on the U.S.-based websites.” Analysis of the attacks revealed that malware was injected into the browsers of users when web traffic reached China Unicom or China Telecom networks – both state-owned telecommunications companies – “at the same points in these routes that censor traffic for the Chinese government.” “The location of the [man-in-the-middle] system on backbone networks operating censorship equipment indicates that the [man-in-the-middle] attack could not have occurred without some level of cooperation by the administrators of these systems,” the Alert said. “The malicious Javascript would direct the unsuspecting user’s browsers to make repeated requests to targeted U.S.-based websites.” While the FBI Flash Alert did not specify which company’s websites were attacked, it is likely that the popular web-based software developers collaboration platform GitHub was among those targeted. Researchers from the University of California at Berkeley, the University of Toronto, and Princeton recently published details of a powerful Chinese MitM tool dubbed the “Great Cannon,” which was used in DDoS attacks targeting websites operated by the anti-censorship project GreatFire.org, and later connected to the attacks on GitHub. “Specifically, the Cannon manipulates the traffic of ‘bystander’ systems outside China, silently programming their browsers to create a massive DDoS attack,” the researchers said. “The operational deployment of the Great Cannon represents a significant escalation in state-level information control: the normalization of widespread use of an attack tool to enforce censorship by weaponizing users.” GitHub was likely targeted because GreatFire.org had begun to mirror some content on the platform. The attacks against GreatFire employed the same techniques as those seen in the GitHub attack, which leveraged hijacked Internet traffic. “The web browser’s request for the Baidu javascript is detected by the Chinese passive infrastructure as it enters China. A fake response is sent out from within China instead of the actual Baidu Analytics script. This fake response is a malicious javascript that tells the user’s browser to continuously reload two specific pages on GitHub.com,” analysis of the attack revealed. This analysis aligns with details of the GreatFire.org attacks which was released previously. “Millions of global internet users, visiting thousands of websites hosted inside and outside China, were randomly receiving malicious code which was used to launch cyber-attacks against GreatFire.org’s websites. Baidu’s Analytics code (h.js) was one of the files replaced by malicious code which triggered the attacks,” officials at GreatFire.org said. “Baidu Analytics, akin to Google Analytics, is used by thousands of websites. Any visitor to any website using Baidu Analytics or other Baidu resources would have been exposed to the malicious code.” GreatFire.org said it has conclusive evidence that the Chinese government using the nation’s infrastructure to conduct the attacks, and had previously published a detailed report, which was further backed up by the analysis provided by the university researchers. “We show that, while the attack infrastructure is co-located with the Great Firewall, the attack was carried out by a separate offensive system, with different capabilities and design, that we term the Great Cannon,” the researchers wrote. “The Great Cannon is not simply an extension of the Great Firewall, but a distinct attack tool that hijacks traffic to (or presumably from) individual IP addresses, and can arbitrarily replace unencrypted content as a man-in-the-middle.” Source: http://en.hackdig.com/06/23256.htm

See the article here:
FBI Links Chinese Government to DDoS Attacks on US Websites

Cost to launch DDoS attack from botnets for hire

Could you pass up a $40,000 return on a $20 investment? Odds are you couldn’t if you enjoy wreaking havoc on a business. New research released today by Incapsula shows distributed denial of service (DDoS) assaults continue to be expensive nuisances for online businesses — and that the attacks can be launched from botnets-for-hire for around $38 a month. A DDoS attack costs a business $40,000 per hour in terms of lost business opportunities, loss of consumer trust, data theft, intellectual property loss and more, Incapsula estimates. When you consider top attacks last for days and that half of all targets are repeatedly hit, it’s easy to see how quickly costs escalate. A Lot for a Little “What is most disconcerting is that many of these smaller assaults are launched from botnets-for-hire for just tens of dollars a month. This disproportion between attack cost and damage potential is the driving force behind DDoS intrusions for extortion and vandalism purposes,” the security firm noted in its 2015 DDoS Threat Landscape Report (registration required). Last year Incapsula reported a 240 percent increase in DDoS activity. This year, although DDoS activity is still rising, Incapsula highlighted shifts in the methods, length and types of attacks. Incapsula defines an attack as a persistent DDoS event against the same target (IP address or domain). It is preceded by a quiet (attack free) period of at least 10 minutes and succeeded by another such period of the same duration or longer. The study differentiates between network layer and application layer attacks. These definitions refer to the Open Systems Interconnection model (OSI Model), which conceptualizes the process of data transmission by segmenting packets into seven layers. Network layer attacks target the network and transport layers (OSI layers 3 and 4), while application layer attacks target OSI layer 7. The analysis is based on data from 1,572 network layer and 2,714 application layer DDoS attacks on websites using Imperva Incapsula services from March 1 through May 7. “Assaults against network infrastructures continue to grow in size and duration. Those aimed at applications are both long in duration and likely to be repetitive. The upshot for organizations of all sizes is that simply weathering the storm is no longer a viable strategy — the impact will be big, durable and likely recurring,” the report notes. On That Depressing Note Here are a few of the report’s key findings: Once a target, always a target: 20 percent of websites are attacked more than five times DDoS attacks can last a long time: While 71 percent of all network layer attacks last under three hours, more than 20 percent last more than five days Some attacks are exceptionally long: The longest attack was 64 days DDoS for hire is more readily available than ever: Botnet-for-hire fingerprints are on roughly 40 percent of all attacks Five countries create most DDoS botnet traffic : 56 percent of DDoS bot traffic emerged from China, Vietnam, US, Brazil and Thailand What’s a Botnet-for-Hire? Opportunistic cybercriminals have the botnet-for-hire business model, a subscription scheme that provides each user with limited access to the botnet resources (usually for a cumulative duration of no more than 60 minutes per month). “During these short periods, individuals with little or no DDoS skill are able to execute assaults using one of the few available scripts (which are reminiscent of our definition of attack vectors),” the report notes. The average cost to rent-a-botnet for an hour each month through a DDoS subscription package is around $38, with fees as low as $19.99. The takeaway: It costs very little to bring down a website. “Perhaps putting a price tag on the damage caused by such services will bring more public attention to their activity, and to the danger posed by the shady economy behind DDoS attacks,” the report notes. Source: http://www.cmswire.com/information-management/you-can-bring-down-a-website-for-38/

Continue Reading:
Cost to launch DDoS attack from botnets for hire

DDoS Attacks Continue To Plague Darknet Markets

The last week brought confirmation that the Agora online marketplace’s recent downtime has been due to a DDoS attack. It joins the long list of darknet services that have been hit by these recent attacks, which now appear to have mostly been based on the darknet markets being held for ransom by attackers. A string of articles on Deep Dot Web recently revealed the source of the issues. The truth was discovered when a market admin’s account was hacked by TheRealDeal, another marketplace, and the admin’s communication were revealed. It was back at the beginning of May when Mr Nice Guy was hit with DDoS attacks. The offenders demanded 8 bitcoins to be paid within an hour to end the assault; however, the admin had another plan in mind. He wanted to negotiate, and he was willing to pay. He offered the attackers $200 a day or $6000 a month to launch DDoS attacks against rival markets including Agora, Nucleus, BlackBank and AlphaBay. The last week brought confirmation that the Agora online marketplace’s recent downtime has been due to a DDoS attack. It joins the long list of darknet services that have been hit by these recent attacks, which now appear to have mostly been based on the darknet markets being held for ransom by attackers. A string of articles on Deep Dot Web recently revealed the source of the issues. The truth was discovered when a market admin’s account was hacked by TheRealDeal, another marketplace, and the admin’s communication were revealed. It was back at the beginning of May when Mr Nice Guy was hit with DDoS attacks. The offenders demanded 8 bitcoins to be paid within an hour to end the assault; however, the admin had another plan in mind. He wanted to negotiate, and he was willing to pay. He offered the attackers $200 a day or $6000 a month to launch DDoS attacks against rival markets including Agora, Nucleus, BlackBank and AlphaBay. The reputation of Mr Nice Guy has surely been greatly damaged by these events. While there is a great deal of competition between darknet markets for the multitude of customers that seek to buy and sell on the Deep Web, in the past similar attacks have been met with collaboration. The darknet markets, though they compete with each other for business recognize the necessity for cooperation, as it only takes a few markets to go down for the integrity of all markets to be questioned. Nowhere was this more evident than when the Evolution marketplace exit scammed, leaving with over $12 million dollars in bitcoin. The aftermath revealed a dark spell of the darknet markets as they all suffered a reduction in customers. In an interview with Deep Dot Web, the man behind Mr Nice Guy spoke about his remorse for what he had done. He said that it would be up to the Deep Web community whether they wished to trust him again. However, he did say that he had learned that the way to attract customers was increasing security as well as providing extra services; he stated that his is the only major marketplace offered in more than one language. While the DDoS attacks are still occurring to an extent, the loss of their contractor has reduced the efforts of the offenders somewhat, and most of the darknet markets have come back online. Yet this saga has definitely shown the weaknesses that exist in the system, and how one stray admin can do an awful lot of damage to the entire network. Source: http://darkwebnews.com/news/ddos-attacks-continue-to-plague-darknet-markets/

Visit site:
DDoS Attacks Continue To Plague Darknet Markets

DDoS attack on DigitalOcean for Alleged on-campus rape

Denial of service attack staged against DigitalOcean, which hosts video stemming from Columbia University student’s protest about alleged on-campus rape The service provider hosting the latest visual art project by Columbia University graduate Emma Sulkowicz has confirmed the site was temporarily disabled by a sophisticated cyberattack after the film which she warns “may resemble rape” was published online last week. Sulkowicz graduated from Columbia in May after completing a year-long performance art project in which she carried a dorm room mattress everywhere she went on campus to protest about the school’s refusal to expel the man she accuses of raping her. The website hosting Sulkowicz’s video, titled Ceci N’est Pas Un Viol, French for This Is Not a Rape, was hit by a denial of service (DoS) attack, in which hackers attempt to force a targeted website offline, according to Keith Anderson, platform support lead at DigitalOcean, where Sulkowicz site is hosted. “We can confirm that there was a denial of service attack on Thursday,” Anderson said. “On Friday there was also a spike in outbound bandwidth coming from the website, likely due to a sudden increase in traffic and unrelated to the attack, so we worked with their web team to resolve the issue and their site is back up and running.” Sulkowicz told the Guardian that she has no doubt the cyberattack was deliberate. But she said she was prepared for it. Her accusation that a classmate raped her was met with a backlash, counter-accusations and trolling. In the video Sulkowicz and an unidentified man engage in a sexual encounter that appears to begin consensually before turning violent. During the act the man slaps her multiple times, ignores her protests and and continues to have violent sex. Sulkowicz and her mattress became a powerful symbol of the movement to reform campus responses to sexual violence after vowing to carry it around campus as her visual arts senior thesis. The video is the artist’s first major work since the conclusion in May of her performance art piece Mattress Performance: Carry That Weight. Sulkowicz accuses Paul Nungesser of raping her in August 2012 at the start of their sophomore year. Columbia investigated the incident and later cleared Nungesser of all responsibility during a campus tribunal. Nungesser has maintained that the encounter was consensual and has since filed a lawsuit against the university, its president and an art professor alleging that the school enabled a harassment campaign. Sulkowicz called the experience of making the video “terrifying” and “traumatizing” but said she was determined to make it because she believed so strongly in its importance. “I was in a very scared, emotional state for days,” Sulkowicz told the Guardian. Sulkowicz said she conceptualized the project in December and pitched it to artist Ted Lawson, whom she met through performance artist Marina Abramovi?. While collaborating on a separate project with Lawson, Sulkowicz said she suggested the video and asked him to direct it. In an interview with ArtNet News, Lawson said: “It was a super risky piece and I thought very courageous, so of course I agreed.” They filmed the video in one of the university’s dorm rooms over spring break, Sulkowicz said. The male actor remains anonymous and his face is blurred in the video. The timestamps on the videos are blurred. Though Sulkowicz said her friends and family have been very supportive in private, she said it can hurt when they don’t support her publicly online. “The trolls don’t upset me as much as when my friends don’t support it,” she said. “I expect the trolls but to see my friends not support it [vocally] is upsetting.” Sulkowicz has said the encounter with Nungesser began consensually but then turned violent. The video echeos her account of that night in August 2012. Though Sulkowicz says it is not a re-enactment, she does appear in the video. Introductory text for the video contains a trigger warning: “The following text contains allusions to rape.” In complementary text published with the video Sulkowicz writes: “Ceci N’est Pas Un Viol is not about one night in August, 2012. It’s about your decisions, starting now. It’s only a re-enactment if you disregard my words. It’s about you, not him.” She characterized reaction to her latest piece as “somber”. Asked what that meant, she said: “With this piece there’s really nothing to rally behind. It’s really more of a quiet, reflective type of support.” Sulkowicz said she was working on a new art piece that she expects to publish soon. She would not give any hints about the theme of the new project. “It’s a different piece,” she said, “but I have only one body and one history to work with.” Source: http://www.theguardian.com/us-news/2015/jun/09/emma-sulkowiczs-this-is-not-a-site-taken-down-by-cyberattack

Taken from:
DDoS attack on DigitalOcean for Alleged on-campus rape

China Overtakes US as Top Source of Distributed Denial of Service Attacks

More Distributed Denial of Service (DDoS) attacks originated in China than in any other country, followed by Germany and the United States, according to the Q1 2015 State of the Internet – Security Report by cloud services provider Akamai. China is responsible for 23.45% of the world’s DDoS attacks , malicious attempts to make servers unavailable to users by interrupting the services of a host connected to the Internet, while 17.39% came from Germany and 12.18% from the US. The number of Chinese DDoS has risen 66% in attack source IPs compared with the US, although researchers say it could be attributed to the increase in redirected traffic from Asia. The United States was the origin of 32% of DDoS attacks in Q4 2014, with China at 18%. The percentage drop does not indicate a decline in attacks from these countries, but rather a change in proportions as the number of total DDoS attacks worldwide soars. DDoS attacks have increased 117% quarter-over-quarter and 35% quarter-on-quarter. The quarter set a record for the number of DDoS attacks observed over the Prolexic network, while the attack duration is now 43% longer than in Q1 2014, according to the report. The US was the top source country of attacking IPs, at 52%, followed by China at 11% and Brazil at 6%, among source countries for web application attacks. US-based websites were the most targeted for web application attacks in Q1 2015, receiving 82% of attacks , while no other country was targeted for more than 2% of attacks. Retail, media/entertainment and hotel/travel were the most targeted industries for web application attacks in Q1 2015. This stems from previous attacks on the financial service sector, which hardened its security policy significantly. Meanwhile, retail and media attacks and breaches of 2014 signaled that these industries were softer targets, leading attackers to probe them for vulnerabilities. Source: http://www.hotforsecurity.com/blog/china-overtakes-us-as-top-source-of-distributed-denial-of-service-attacks-11929.html

More:
China Overtakes US as Top Source of Distributed Denial of Service Attacks

How Visual Basic Broke Modern Python: Welcome to the World of High Orbit Ion Cannon

In 2012, Anonymous introduced HOIC (high orbit ion cannon) as a replacement to LOIC (low orbit ion cannon). Unlike its predecessors, that were built upon C#, and later java. This new DDoS player was built upon the unsuspecting language of Visual Basic. Taught in high school classrooms, Visual Basic was largely seen by the programming community as a means for kids and young programmers to get their feet wet in the experience of programming. Considered by many programmers as grossly inefficient and a memory hog; Visual Basic was an unsuspected carrier for what would become one of the most powerful means of DDoS. One of the popular notions of HOIC has been its ability to randomize variables such as: user agent, referrer and URI, during an attack. In the same manner, an attack tool known as HULK (developed by: Barry Shteiman, 2012), written in Python, was developed in recent history. Within a controlled environment we tested these DDoS tools to judge their effectiveness and total output. In controlled trials the DDoS output of LOIC (Visual Basic on Windows) outperforms the DDoS output HULK (Python on Linux) by +40%. Figure 1: HOIC Test in Stable Windows Environment Figure 2: HULK Test While many of us in the Internet security industry ridicule and downplay the “kiddie hacker;” it is clear that it sometimes only takes a kiddie to build an empire. Lessons in open source economics teach us that in an open access environment, it takes only a small few to bring about radical change and innovation. Today HOIC has become one of the primary tools of groups such as anonymous. From this lesson, we can expect that challenges and sudden changes, will not come from those paid hundreds of thousands a year; but from those small few kiddies, whom are politically motivated and are paid nothing. Source: http://www.dosarrest.com/ddos-blog/how-visual-basic-broke-modern-python-welcome-to-the-world-of-high-orbit-ion-cannon/

Continued here:
How Visual Basic Broke Modern Python: Welcome to the World of High Orbit Ion Cannon

DDoS Attack Update: Idaho Teen Faces Felony Charges After Unleashing a DDoS Attack on School District

In May 15, KTVB reported that a student recently launched a cyber-attack on one of Idaho’s largest school districts. The attack, which was identified as a Distributed Denial of Service (DDoS), practically rendered the entire district’s internet unable to function. The attack was so powerful that it caused internet problems for the affected school district for weeks without ceasing. A lot of Idaho students working on achievement tests lost all their data, and some even had to retake the exam multiple times because of the gravity of the attack. Even the administrative network itself, which, unfortunately, included the teachers’ payroll data was compromised. A DDoS attack occurs when multiple systems compromised by a Trojan are used by a host, or in this case, a channel, to target a single host simultaneously causing a denial of service. In simple terms, the attack floods a single network with immeasurable internet traffic until it simply stops dead on its tracks. Most of these attacks exploit problems within the victim computer’s TCP/IP system. Because a DDoS attack comes from hundreds, possibly even thousands of sources at once, it is practically impossible for any program on earth to track down the actual source of the problem. To make matters worse, a DDoS attack makes it impossible to identify actual, legitimate traffic, because everything gets lost in a haze of incoming data. Despite the overwhelming odds, the authorities managed to trace the attacker’s IP address back to the high school student. Today, he faces the possibility of expulsion, as well as 180 days in a juvenile detention center. Authorities say that he might even be facing serious federal charges. Moreover, the culprit’s parents will also be expected to pay any losses that the school district has incurred due to the attacks. A representative for the West Ada School District said that there might be other students within the area who know how to carry out this cyber-attack. Nevertheless, the spokesperson reassured everyone that further attacks will be dealt with more readily. The district also sent a message to parents of students enrolled in their schools, urging them to help keep their children from committing cyber attacks. Source: http://www.chinatopix.com/articles/51791/20150527/idaho-teen-felony-charges-ddos-attack.htm

Original post:
DDoS Attack Update: Idaho Teen Faces Felony Charges After Unleashing a DDoS Attack on School District

South Africa a target for DDoS

South Africa is the most targeted country in Africa when it comes to distributed denial-of-service (DDOS) attacks. This was revealed by Vernon Fryer, chief technology security officer at Vodacom, in a keynote address during ITWeb Security Summit 2015, in Midrand, this morning. In computing, a DDOS attack is an attempt to make a machine or network resource unavailable to its intended users. Such an attack generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. Fryer was speaking with reference to statistics from the Vodacom Cyber Intelligence Centre, which the company established eight years ago to analyse the threat landscape on the African continent. He revealed over the past 18 months, there has been a marked increase in DDOS attacks on the continent, with a typical attack averaging 9Gbps. “There has been about a 150% increase in the number of DDOS [attacks] in the last 18 months in Africa,” he said. In terms of the number of attacks, Kenya, Uganda, Algeria, Nigeria and Tanzania respectively come after SA, said Fryer, pointing to the analysis done by the Vodacom Cyber Intelligence Centre last Thursday. According to Fryer, the majority of in-bound traffic to SA emanated mainly from China, Germany, Brazil, Vietnam, Russia, Cyprus, Turkey, Switzerland, Canada and the US. However, he noted, it was surprising Switzerland and Canada were featuring on the list this year, something never witnessed previously. Another unexpected trend showed traffic coming from Swaziland, he added, pointing out the growing number of Chinese communities in the country could be a reason for this spike. Describing some of the attack vectors cyber criminals were making use of in the region, Fryer pointed to scareware, ransomware, fake anti-virus, as well as TDSS Rootkit, among others. The trending malware included KINS Trojan, Skypot, VirRansom, SpyEye Trojan and the Chameleon Botnet. With regard to ransomware attacks in Africa, Tanzania is the most attacked on the African continent, Fryer said. He also noted the trending hacker groups in Africa include Anonymous, also known as the Lizard Squad, the Syrian Electronic Army, as well as the Yemen Cyber Army. Faced with the rise in the level and sophistication of attacks, Fryer said organisations need to constantly monitor the behaviour of their firewalls. Typically, he said, organisations take about five years without monitoring their firewall. “We need to understand if our firewalls are capable of handling today’s threats. Thus, the performance of firewalls needs to be constantly monitored,” he concluded. Source: http://www.itweb.co.za/index.php?option=com_content&view=article&id=143446:SA-a-target-for-DDOS&catid=234

Taken from:
South Africa a target for DDoS

Teen hires attacker to DDoS his school district

A high school boy might have to face state and federal charges for allegedly hiring a third party and launching a DDoS attack against the West Ada school district, Idaho, US. A 17-year old high school student (the name cannot be disclosed because of him being a minor) might be accused of launching a distributed denial of service (DDoS) attack after hiring a third party. The attack crippled operations at more than 50 schools of the district for a week previously this month. DDoS is a type of attack in which the servers of a particular online service are slowed to such an extent that their processing ability gets clogged up. According to KTVB report , the West Ada students suffered assorted misery due to the attack such as they lost their data on the Idaho Standard Achievement tests. Some of the students also had taken the tests multiple times. The attack lasted around a week and during this phase the online classes and textbooks could not be accessed. Moreover, the faculty and staff also experienced problems in accessing business and administrative systems such as payroll. The IP address from where the attack was launched was finally traced by the school district’s IT staff, which led them to the high schooler. The boy has been suspended from Eagle High but school administration suggested that he should be expelled. According to the Sheriff’s Office, the seventeen year old will most likely be charged with computer crime felony, which can send him to a juvenile detention facility for up to 180 days as the teenager paid someone to overwhelm the system with traffic from multiple sources. Additionally, the boy’s family will also be held responsible for a financial restitution for covering the losses since operations at around 50 schools got disrupted due to the attack. This is not the first time when a teenager attacked an educational institution. In April 12, 2015, Domanik Green, a 14-year-old student studying at Florida’s Paul R. Smith Middle School managed to bypass the school’s computer security network using just his computer skills and gained access to the server that contained FCAT (Florida Comprehensive Assessment Test) data. Source: https://www.hackread.com/teen-ddos-attack-school-district/

View the original here:
Teen hires attacker to DDoS his school district