Tag Archives: defend against ddos

Telegram under 150Gbps DDoS attack

Cross platform messaging app Telegram has been a target of massive distributed denial of service (DDoS) attacks for two days in a row over the weekend with the largest in tune of 150Gbps. The DDoS attacks started on Saturday – September 27 – and according to Telegram the scale of the attack was in tune of tens of Gbps. “A DDoS attack on Telegram in progress, tens of Gigabitsec. Users in some countries may have connection issues. We’re working on it, folks!” tweeted Telegram. Prior to the official confirmation, users started complaining of connectivity issues as well as not being able to send messages successfully. These complaints were picked up by Telegram administrators and upon investigation they zeroed it down to DDoS attack. Telegram soon managed to recover from the attack, but DDoS perpetrators launched another massive attack and this time in tune of of 150Gbps. “Detecting a 150+ Gbit/s DDoS now, an attack three times as large as yesterday’s.” tweeted Telegram. Users are still complaining about connectivity issues and there has been no confirmation from Telegram on whether they have been able to resolve the issue or not. Source: http://www.techienews.co.uk/9718714/telegram-150gbps-ddos-attack/

Continued here:
Telegram under 150Gbps DDoS attack

DDoS Attacks Target Online Gaming Sites, Enterprises

DDoS traffic volume was up overall with a third peaking at over 500Mbps and more than five percent reaching up to 4Gbps, according to NSFOCUS. A continuing trend of distributed denial-of-service (DDoS) attacks that are short in duration and repeated frequently has been revealed by the NSFOCUS 2014 Mid-Year Threat report. In parallel, high-volume and high-rate distributed denial of service (DDoS) attacks were on the upswing in the first half of 2014. DDoS traffic volume was up overall with a third peaking at over 500Mbps and more than five percent reaching up to 4Gbps. In addition, findings showed that over 50 percent DDoS attacks were above 0.2Mpps in the first half of 2014, increasing from around 16 percent. More than 2 percent of DDoS attacks were launched at a rate of over 3.2Mpps, according to the report. “The DDoS attack is a relatively easy attack method to be employed with noticeable effects among other network attacks. When online service is stopped, the impact and damage it causes is very apparent and straightforward,” Xuhua Bao, senior researcher at NSFOCUS, told eWeek. “Attacks with high frequency make it hard for attack’ targets to respond to instantly, increasing the difficulty of the defense level.” The longest single attack lasted nine days and 11 hours, or 228 hours, while the single largest attack in terms of packet-per-second (pps) hit at a volume of 23 million pps. More than 42 percent of attack victims were targeted multiple times while one in every 40 victims was repeatedly hit more than 10 times. The highest frequency of attacks experienced by a single victim was 68 separate DDoS attacks. “Today, DDoS attack methods have become highly instrumental and resourceable. When an attacker plans to launch a DDoS attack on a specific target, there are plenty of DDoS attack tools and resources available online to be purchased and used,” Bao said. “With the rise of hacktavism in recent years, DDoS attacks have become a means of protesting or expressing your own opinion, which is widely used by some hacker groups.” The report revealed HTTP Flood, TCP Flood and DNS Flood were the top three attack types, together making up 84.6 percent of all attacks. DNS Flood attacks held their place as the most popular attack method, accounting for 42 percent of all attacks. While the number of DNS and HTTP Flood attacks decreased, TCP Flood attacks grew substantially. More than 90 percent of attacks detected lasted less than 30 minutes, an ongoing trend the report said indicates that latency-sensitive websites, such as online gaming, e-commerce and hosting service should be prepared to implement security solutions that support rapid response. The survey also indicated an increase in Internet service providers (ISPs), enterprises and online gaming sites as targets. Attacks targeting ISPs increased by 87.2 percent, while attacks on enterprises jumped by 100.5 percent and online gaming by 60 percent. “The online gaming industry has been a target of DDoS attacks and are mainly profit-driven. The nature of online gaming relies greatly on the Internet service and often there is a huge amount of money involved making them extremely sensitive to attacks,” Bao said. “When they are being attacked, there are obvious and direct economic losses, as well as the loss of the resources from players, which leads to malicious competition and extortion.” Source: http://www.eweek.com/small-business/ddos-attacks-target-online-gaming-sites-enterprises.html

See the article here:
DDoS Attacks Target Online Gaming Sites, Enterprises

DDoS Attacks Go Mobile

The cyber security industry has a new front to defend. Hackers are migrating their malicious techniques and technology to mobile platforms and businesses, organizations and users are already feeling the impact. Android: The New DDoS Launchpad A new Android app is causing the mass distribution of a DDoS malware. This DDoS tool uses a Low Orbit Impact Cannon (LOIC) to send TCP/UDP packets to a URL of the hacker’s choosing. Originally, LOIC was an attack that originated from desktops. But a hacker took the open-source LOIC and converted it into an Android app that has sent the security industry reeling. Current mobile infrastructures are vulnerable to hacking and cyber hijacking—the standard security measures of desktop networks and operating systems are rarely seen on mobile devices. The Problem of Super Proxies DDoS attacks sent from mobile devices present a difficult challenge for mitigation; malicious data packets sent from mobile devices travel in “Super Proxies,” or secure servers channeling data from countless other mobile devices. Data traveling in Super Proxies is notoriously difficult to separate and filter. Simply installing a piece of hardware that can stop traffic from specific IPs is not enough; this will cause the server to group bad traffic with that of legitimate users. When users can’t get through to the server, the DDoS hacker has succeeded in ‘denying service.’ Mobile DDoS and Android.DDoS.1.origin The cyber-security community is trying to take lessons from a dangerous mobile DDoS event in 2012. Most substantial DDoS events require a ‘botnet’ or ‘zombie’ army to carry out the attack, and Android.DDoS.1 was no different. It began when a hacker disguised malware in a fake Google Play application. Users downloaded the bogus software onto their devices, giving the hacker remote command of the mobile’s computing power. After amassing a significant botnet army, the hacker sent commands via SMS (didn’t the hacker know about Whatsapp?) to the DDoS viruses. These instructions included the target’s server address and a script to repeat. Once confirmed, the mobile devices also sent out spam text messages to the victim’s contact list, likely to spread the virus. With thousands of these infected mobile devices operating in unison, their requests generated a powerful DDoS force capable of overwhelming even large target servers. One mobile device sending bad requests does little, but an army can do some serious damage. Even experienced users who are wary of the typical trappings of PC-based malware may not be aware of the new dangers on mobile. Expect to see hackers getting more creative as the vulnerabilities in mobile networking are exposed. Handling the New Wave of Mobile DDoS Organizations and businesses trying to stay ahead of the DDoS mobile evolution are entrusting their security measures to experienced third-party protection services, whose robust networks are equipped to handle TCP and UDP attacks, among all other major attack methods in the security landscape. Source: http://www.sitepronews.com/2014/09/25/ddos-attacks-go-mobile/

Continue reading here:
DDoS Attacks Go Mobile

Hackers Target Destiny and Call of Duty Servers with DDoS Attack

This past weekend, several servers for Destiny went down, both on PlayStation and Xbox, following a DDoS attack. Players were booted from the servers in the middle of the game and an error message read “Cattle” on the disconnect screen. The Lizard Squad hacker group claimed responsibility for sporadic DDoS attacks on the Destiny and Call of Duty: Ghost servers. They posted about their endeavors on their Twtiter account, bragging about taking down parts of both servers. Access has since been restored and players can once more return to their games. Understandably, players had been quite upset about their game time being cut short, especially during a weekend, and many have threatened to ask for their money back, thinking that it was a technical issue from Bungie. “Destiny is currently experiencing issues matchmaking and login across all platforms. We are actively investigating this issue,” Bungie wrote on Twitter, although the message was later deleted by the company. The attack comes after another one from August, when the PlayStation Network, Battle.net, and other online games have been targeted. It’s also when the flight carrying John Smedley, the Sony Online Entertainment president, was grounded after the same hackers issued a bomb threat via Twitter. The attacks indicate that the Lizard Squad hasn’t disbanded and ceased its activities, as it was rumored earlier this month. The group’s website continues to be down, however, for unknown reasons. Source: http://news.softpedia.com/news/Hackers-Target-Destiny-and-Call-of-Duty-Servers-with-DDoS-Attack-459494.shtml

Excerpt from:
Hackers Target Destiny and Call of Duty Servers with DDoS Attack

How to Protect Your Blog From an Advanced DDoS Attack Read

Although it’s pretty much unlikely that any high profile hacktivists are going to be targeting your website via a Distributed Denial of Service (DDoS) attack anytime soon, that’s not necessarily grounds for sitting back relaxed and complacent without a backup / protection plan. DDoS attacks are becoming more prevalent and much easier to execute thanks improvement in technology, bandwidth and accessibility to tools and information on how to do it. We continue to see big brands like Sony get brought down momentarily by these attacks, and even the CIA’s website suffered this pain in 2012. It’s a serious threat. For clarification, DDoS attacks happen through an overpowering of numerous computers, usually through the use of bots, that continuously send traffic to an IP address or website. As simple as this might seem, the effects can be brutal to a website. What’s worse is that the typical common security protocols that are set up to defend against hacking and intrusion just don’t work against DDoS attacks and taking matters into your own hands, whether it’s through WordPress security plugins or code tweaks and improvements are not sufficient. Luckily, there are a couple ways to protect a website from DDoS attacks. Using a Cloud Security Provider Using proprietary technologies, a number of web security companies have begun releasing different forms of protection from DDoS. These include the likes of Prolexic, for example, which has a fairly decent track record of mitigating web security threats. However, much of what these products do happens behind the scenes. In the push for full disclosure, more companies and website owners are relying more on cloud security providers, like Incapsula, who not only provide free usage of their CDN but also powerful DDoS protection at fairly reasonable pricing for anyone serious about their website’s security. Where other services just kind of tell us that things are being handled, Incapsula offers some pretty slick monitoring options that take your website security a step further than a service: It’s a tool. Going beyond just DDoS traffic mitigation, Incapsula protects against other forms of attacks and site outages (both malcontent and accidental) while simultaneously offering a speed boost through those same site mitigation channels; along with pretty much guaranteeing 100% up-time for complex applications through load balancing and failover, spread across multiple servers. What’s even better is that they provide visual and trackable insights into the site’s performance and health. Sophisticated web threat protection is becoming more available and affordable and it’s a valid inclusion among tools bloggers and other marketers normally utilize. Self-Protected Domain Infrastructure Bearing in mind that DDoS mitigation is not for the faint of heart or the modest wallet, I know there are some DIY admin types who live for the thrill of getting their hands dirty. Protecting against a DDoS attack on your own is a massive undertaking that’s easy to get wrong, which would leave you just as unprotected as if you had done nothing at all. But, if you’re up for the task and have the skillset required (seriously, be honest with yourself on this one, you or your client’s product is at stake here), the following Cisco reading material will get you moving in the right direction… if you really know what you’re doing: Discuss Options with Your Hosting Service Of the many web hosts online offering bottom dollar deals to get your website up and running , a vast majority of them don’t have the infrastructure set up to properly deflect a DDoS attack. This doesn’t necessarily mean that your cost-effective host, whichever it may be, doesn’t have protection, but that doesn’t mean that they do, either. Simply put, you should be contacting your preferred host(s) directly to determine precisely what they have in place to protect your site/sites from malicious attackers. Additionally, you absolutely need to know what their policy is on how to deal with sites that are suffering attacks that break through or overwhelm their servers. The punishment of a week or two of downtime from your host can be more damaging than the original attack itself since it’s more likely that your account will be blacklisted or suspended rather than the company taking full responsibility. Your best bet for protection via a web host is going with a premium provider like WP Engine who pride themselves on running very secure and well managed hosting environments. The most important thing you should keep in mind is that, for relatively little time invested, you can set a site up to be guarded against incredibly expensive attacks. There’s no reason to find yourself in a situation where you’re looking for protection after a DDoS is launched. The risk for loss of traffic and in some cases, sales, is much too great. Source: http://www.blogherald.com/2014/09/18/protect-blog-advanced-ddos-attack/

View original post here:
How to Protect Your Blog From an Advanced DDoS Attack Read

The Escapist #GamerGate Forums Brought Down In DDoS Attack

Earlier this week, Milo Yiannopoulos of Breitbart London published an article containing emails between a group of video game journalists, all members of an email list called GameJournoPros. The Breitbart piece suggested collusion between these journalists to provide a specific spin on news during the early days of the Zoe Quinn scandal, which has now blossomed into the broader #GamerGate movement, and to clamp down on discussion of the topic across sites and forums. Yiannopolous also published the full exchange of emails, which provided a more nuanced look at the situation. In the emails various game writers discuss the Quinn scandal and how to approach it. Some suggest sending a note of solidarity, while others push back against this idea, citing the need for professional distance between journalists and their subjects. All told, it appears to be a largely civil conversation between professionals. But two moments in the thread ought to raise eyebrows. In one, writer Ryan Smith asks questions about where other writers and publications draw the line on writing about the private lives of subjects. He is quickly shouted down. More important is an exchange between Polygon writer Ben Kuchera and The Escapist’s Editor-in-Chief Greg Tito. Kuchera urges Tito to shut down The Escapist forum where the discussion of Quinn was occurring, but Tito refuses, arguing that a place for discussion is a healthy thing. “The conversation may be distasteful to some of us,” Tito writes in response to Kuchera and others, “but I don’t know if the answer is to delete the thread. The Escapist is not giving harassment a home, but allowing civil discussion on a matter that people are emotional about.” Since these emails took place, #GamerGate has been born and even the release of Bungie’s popular video game Destiny hasn’t dampened the voices on both sides. However, it appears that many forums where discussion of #GamerGate has been occurring have been clamping down. Both reddit and 4chan have been banning users and shutting down forums related to the topic. One of the only places outside of Twitter where any discussion has been occurring has been at The Escapist. This morning The Escapist came under a DDoS (denial of service) attack, according to the co-founder and GM of the site Alexander Macris. “A DDOS attack is currently underway against @TheEscapistMag. The attackers are specifically targeting the GamerGate forum thread,” Macris tweeted this morning. After a brief interlude the attacks began again, and eventually the publication was forced to take down the forums temporarily. The attack consists of “a large number of IP addresses targeted the GamerGate thread for reload many times per second.” At this point there is no information of the perpetrator of the attack though The Escapist is working to find out. The timing of the attack, following the revelations in the GameJournoPros emails, does raise questions. We will continue to follow this story and update as more information comes to light. If anyone has information about the attacks please don’t hesitate to reach out. Source: http://www.forbes.com/sites/erikkain/2014/09/20/the-escapist-forums-brought-down-in-ddos-attack/

Continued here:
The Escapist #GamerGate Forums Brought Down In DDoS Attack

Japanese Teen Sent to Prosecutors over DDoS Attack

Japanese police sent papers on a 16-year-old boy to public prosecutors Thursday over a suspected distributed denial of service (DDoS) attack on an online game company. It was the first criminal accusation by police in the country against a DDoS attack, which entails saturating a particular server or computer with large amounts of data, according to Tokyo’s Metropolitan Police Department. The high school student in the southwestern city of Kumamoto has admitted the charges, sources familiar with police investigations said. He told investigators that he was frustrated after the game company froze his game account and that he had a lot of fun to make numerous attacks, according to the sources. He is suspected of carrying out similar attacks on two other companies as well, the sources said. Source: http://jen.jiji.com/jc/i?g=eco&k=2014091800573

Read the article:
Japanese Teen Sent to Prosecutors over DDoS Attack

DDoS Attack on RT News Website

The RT news website has undergone the most powerful Distributed Denial of Service (DDoS) attack in its history, the press service of the channel reported Wednesday. “Thanks to the website’s reliable technical protection, RT.com was unavailable just for a few minutes,” the statement reads. According to the channel’s press service, RT.com has been repeatedly subjected to DDoS-attacks. One of the most powerful hacker attacks occurred on February 18, 2013. The website was unavailable for about 6 hours. In 2012 the channel’s English and Spanish websites also came under attack. The attack was claimed by anti-WikiLeaks hacker group AntiLeaks. A DDoS-attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. The RT network’s first channel was launched in December 2005 and now consists of three global news channels broadcasting in English, Spanish and Arabic. RT has 22 bureaus in 19 countries and territories. RT reaches over 644 million people in more than 100 countries. Source: http://en.ria.ru/society/20140918/193035597/Hackers-Attack-RT-News-Website.html

View original post here:
DDoS Attack on RT News Website

DDoS Attack on Russia Today News Website

Read the original:
DDoS Attack on Russia Today News Website

SNMP-Based DDoS Attack Spoofs Google Public DNS Server

The SANS Internet Storm Center this afternoon reported SNMP scans spoofed from Google’s public recursive DNS server seeking to overwhelm vulnerable routers and other devices that support the protocol with DDoS traffic. “The traffic is spoofed, and claims to come from Google’s DNS server. The attack is however not an attack against Google. It is likely an attack against misconfigured gateways,” said Johannes Ullrich, dean of research of the SANS Technology Institute and head of the Internet Storm Center. Ullrich said the ISC is still investigating the scale of the possible attacks, but said the few packets that have been submitted target default passwords used by SNMP. “The attack uses the default ‘read/write’ community string of ‘private.’ SNMP uses this string as a password, and ‘private’ is a common default,” Ullrich said. “For read-only access, the common default is ‘public.’” Ullrich explained that the attack tries to change configuration variables in the affected device, the TTL or Time To Live variable to 1 which he said prevents any future traffic leaving the gateway, and it also sets the Forwarding variable to 2, which shuts it off. “If this works, it would amount to a [DDoS] against the network used by the vulnerable router,” Ullrich said. Large-scale DDoS attacks rely on amplification or reflection techniques to amp up the amount of traffic directed at a target. DNS reflection attacks are a time-tested means of taking down networks with hackers taking advantage of the millions of open DNS resolvers on the Internet to get up to 100 to 1 amplification rates for every byte sent out. Earlier this year, home routers were targeted in DNS-based amplification attacks; more than five million were used during February alone as the starting point for DDoS attacks. Also earlier this year, hackers found a soft spot in Network Time Protocol (NTP) servers that synch time for servers across the Internet. NTP-based DDoS attacks, some reaching 400 Gbps, were keeping critical services offline. However, a concerted patching effort has kept these attacks at bay and in June, NSFocus reported that of the 430,000 vulnerable NTP servers found in February, all but 17,000 had been patched. Experts, however, warned that SNMP-based DDoS attacks could be the next major area of concern. Matthew Prince, CEO of CloudFlare, said in February that SNMP attacks could dwarf DNS and NTP. “If you think NTP is bad, just wait for what’s next. SNMP has a theoretical 650x amplification factor,” Prince said. “We’ve already begun to see evidence attackers have begun to experiment with using it as a DDoS vector. Buckle up.” SANS’ Ullrich, meanwhile, said he’s continuing to research this attack, and admins should be on the lookout for packets from the source IP 8.8.8.8, which is Google’s DNS server, with a target UDP port of 161. “Just like other UDP based protocols (DNS and NTP), SNMP has some queries that lead to large responses and it can be used as an amplifier that way,” Ullrich said. Source: http://threatpost.com/snmp-based-ddos-attack-spoofs-google-public-dns-server

Continue reading here:
SNMP-Based DDoS Attack Spoofs Google Public DNS Server