Tag Archives: defend against ddos

WordPress Site Hacks Continue

WordPress installations sporting known vulnerabilities continue to be compromised by hackers and turned into distributed denial of service (DDoS) launch pads. That warning was sounded last week after IT professional Steven Veldkamp shared an intrusion prevention system (IPS) log with Hacker News , which found that a single 26-second DDoS attack against a site run by Veldkamp was launched from 569 different WordPress blogs. Those blogs appear to have been compromised by attackers, since they comprised everything from a “mercury science and policy” blog at the Massachusetts Institute of Technology (which as of press time remained offline) and a National Endowment for the Arts blog to WordPress sites run by Pennsylvania State University and Stevens Institute of Technology. “The key aspect to note here is the number of compromised WordPress servers,” said Stephen Gates, chief security evangelist at DDoS defense firm Corero Network Security, via email. “It’s a simple mathematical equation — attackers are looking to infect servers sitting in hosting environments with each server easily capable of generating 1 Gbps of attack traffic. It is quite easy to generate extremely high volumes and varieties of attack traffic by compromising just a few WordPress servers.” Once WordPress servers get compromised, attackers can use them for a variety of purposes, such as attacking U.S. financial institutions. “From volumetric attacks that melt down firewalls to the ‘low and slow attacks’ that sneak through firewalls undetected — the list is really endless,” Gates said. WordPress blogs, of course, are easy to provision and host. But that ease of installation — and use — means that such software is often run outside the purview of IT provisioning and oversight. Furthermore, many WordPress administrators fail to keep their software updated or follow security best practices, such as choosing unique usernames and strong passwords for WordPress admin accounts. As a result, numerous WordPress sites sporting known vulnerabilities — or “admin” as the admin account name — remain sitting ducks for automated attacks. Indeed, malware is often used to automatically find and exploit vulnerable WordPress installations. In August, Matthew Bing, an Arbor Security Engineering & Response Team (ASERT) research analyst, noted that the Fort Disco malware — first discovered in April 2013 — was being used to target known vulnerabilities in content management systems, backed by six command-and-control servers that were running a botnet comprised of more than 25,000 Windows PCs. “To date, over 6,000 Joomla, WordPress and Datalife Engine installations have been the victims of password guessing,” he said in a blog post. How widespread is the problem of exploitable WordPress software? According to a study conducted by EnableSecurity CEO Sandro Gauci, the list of the one million most trafficked websites — per the Alexa index — includes 40,000 WordPress sites. But 70% of those sites are running a version of WordPress with known vulnerabilities. Those statistics were relayed last week by WordPress security expert Robert Abela, who studied data that EnableSecurity’s Gauci compiled over a four-day period in the middle of September, immediately following the September 11 release of WordPress 3.6.1, which remains the latest version. In a blog post, Abela reported that of the 42,106 WordPress sites from the Alexa index identified, 19% had already been updated to the new version, while 31% of sites were still running the previous version (3.6). But the remaining 51% of cataloged WordPress sites ran one of 72 other versions, with 2% of all cataloged sites still running version 2.x, which dates from 2007 and earlier. Needless to say, many historical WordPress updates have included patches for exploitable vulnerabilities. For example, the latest version of WordPress — 3.6.1 — patched a known vulnerability in version 3.6 that would have allowed an attacker to remotely execute code. Previous versions of WordPress have also sported a number of known bugs, including version 3.5.1 (8 vulnerabilities), 3.4.2 (12 vulnerabilities) and 3.3.1 (24 vulnerabilities). All of this adds up to numerous WordPress sites that can be relatively easily hacked, based on a review of the top 10 most-seen versions of WordPress seen among the more than 40,000 counted by Gauci. “At least 30,823 WordPress websites out of 42,106 are vulnerable to exploitable vulnerabilities,” said Abela. “This means that 73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools. Considering the number of vulnerable WordPress installations out there, and the popularity of such websites, we are still surprised … most of them haven’t been hacked yet.” Source: http://www.informationweek.com/security/attacks/wordpress-site-hacks-continue/240162060

Schoolboy arrested over Spamhaus DDoS, world’s biggest cyber attack

In March 2013, a distributed denial of service (DDoS) attack of unprecedented ferocity was launched against the servers of Spamhaus, an international non-profit dedicated to battling spam. A DDoS is an attack wherein the servers of a targeted online service are slowed to a crawl with loads of pointless email or file uploads that clog up their processing ability. The March Spamhaus attack peaked at 300 gigabits per second, Spamhaus CEO Steve Linford told the BBC at the time – the largest ever recorded, with enough force to cause worldwide disruption of the internet. In April, one suspect was arrested in Spain. Now, it’s come to light, another suspect was also secretly arrested in April – this one being a London schoolboy. The 16-year-old was arrested as part of an international dragnet against a suspected organised crime gang, reports the London Evening Standard. Detectives from the National Cyber Crime Unit detained the unnamed teenager at his home in southwest London. The newspaper quotes a briefing document on the British investigation, codenamed Operation Rashlike, about the arrest: The suspect was found with his computer systems open and logged on to various virtual systems and forums. The subject has a significant amount of money flowing through his bank account. Financial investigators are in the process of restraining monies. Officers seized his computers and mobile devices. The boy’s arrest, by detectives from the National Cyber Crime Unit, followed an international police operation against those suspected of carrying out the massive cyber attack, which slowed down the internet worldwide. The briefing document says that the DDoS affected services that included the London Internet Exchange. The boy has been released on bail until later this year, the London Evening Standard reports. The arrest follows close on the heels of two other London-based arrests resulting from international cyber-policing: Last week’s arrest of eight men in connection with a £1.3 million ($2.08 million) bank heist carried out with a remote-control device they had the brass to plug into a Barclays branch computer, and The arrest of 12 men in connection with a scheme to boobytrap computers at Santander, one of the UK’s largest banks, by rigging the same type of remote-control device found in Barclays – devices that enable remote bank robbery. Truly, the UK isn’t fooling around when it comes to cybercrime – a fact it’s making clear with the robust work of the National Cyber Crime Unit, which itself will soon be rolled into the even more cybercrime-comprehensive arms of the National Crime Agency. The National Crime Agency, due to launch 7 October, is going to comprise a number of distinct divisions: Organised Crime, Border Policing, Economic Crime, and the Child Exploitation and Online Protection Centre, on top of also housing the National Cyber Crime Unit. If the recent arrests are any indication, it would seem that the UK’s on the right track with cyber crime. May cyber crooks, both the seasoned and the schoolboys, take heed. Source: http://nakedsecurity.sophos.com/2013/09/27/schoolboy-arrested-over-spamhaus-ddos-worlds-biggest-cyber-attack/

See the article here:
Schoolboy arrested over Spamhaus DDoS, world’s biggest cyber attack

What’s Next for DDoS Attacks?

Sept. 18 marks the one-year anniversary of Izz ad-Din al-Qassam Cyber Fighters’ first announcement about distributed-denial-of-service attacks to be waged against the U.S. financial services industry This self-proclaimed hacktivist group, which U.S. government officials have suggested is being backed by the Iranian government, has for the last 12 months targeted the online banking platforms of nearly every top 100 U.S. banking institution. The group has claimed it’s attacking U.S. banks because of outrage over a YouTube movie trailer deemed offensive to Muslims. The group’s attacks against banks for the last several months have been unsuccessful at taking sites down. And its Phase 4 campaign is in a lull. Still, experts caution banking institutions against letting their guards down. And they warn that the government, media, healthcare and energy sectors could be among the next targets. That’s because banking institutions have enhanced their defenses, so other sectors are easier targets. Some experts, including McAfee Labs and Arbor Networks, expect that al-Qassam could join forces with the Syrian Electronic Army, a collective of attackers that supports Syrian President Bashar al-Assad, to attack a variety of U.S. websites. Experts urge organizations to update their DDoS defenses. Botnet Remains Strong Scott Hammack CEO of DDoS-mitigation provider Prolexic, says that despite the recent lull in al-Qassam’s attacks, there’s no indication that the group’s botnet, known as Brobot, is waning. “We have validated thousands of infected web servers that can potentially participate in future campaigns. We still don’t see the scale of the attacks we saw five months ago, but we are definitely seeing a lot of probing,” he says, which suggests more attacks are on the way. DDoS attacks over the last five months have not been as large, but that should not be misinterpreted to mean Brobot has been retired, Hammack says. “Maybe Iran, with their new leaders, are saying ‘Cool off a little bit.’ But the gun is still loaded. They still have the arsenal at their disposal; they just haven’t fired it in a while.” If al-Qassam were to unite with other cybergroups, such as the Syrian Electronic Army, it could mark a new era of cyberwarfare against the U.S., experts say. “We have to realize this is cyberterrorism,” says Ashley Stephenson, CEO of Corero Network Security. “The disruption, the publicity, the nuisance, the investment these banks have to make … the success of terrorism is not just the act itself, but the amount it costs the victims [for defenses],” he says. Banking institutions and those in other sectors have to continually enhance and update their DDoS defenses, he says, “so that no one needs to panic on the day of an attack” Training Ground al-Qassam’s attacks have served as a training ground for other attackers, says Dan Holden of DDoS-mitigation firm Arbor Networks. “In terms of DDoS in general, we will see more DNS amplification attacks. It’s not that difficult,” he says. A DNS amplification attack relies on a much larger list of DNS servers to amplify the attack. “The attackers are going to have to get better and bigger to take anyone down,” Holden says. That’s because DDoS defenses have improved across the board, although some industries, such as banking, are further along in their mitigation strategies than others, Holden explains. The real question about al-Qassam’s future is not how its attacks might be waged, but rather who will be the target, he says. Holden says he doesn’t see the attacks themselves changing; but the targets will change. “I would be surprised if they continue attacking the banks,” he says. “At this point, what is the point? Something’s got to change.” Cyber-attackers Unite? Because the Syrian Electronic Army and al-Qassam both have waged DDoS attacks to gain attention for their social and political causes, some experts expect them to join forces. While al-Qassam has focused on banks, the SEA’s primary targets have been media and government sites, according to McAfee Labs . Now, DDoS experts, including McAfee Labs, argue both groups have similar interests in taking down U.S. sites, and by joining forces, they could use Brobot for a renewed purpose. One industry expert, who asked not to be named, says the distinction between the SEA and al-Qassam has increasingly blurred. “Isn’t the Syrian Army likely the same guys as al-Qassam? And if you look at the geopolitical stuff, the two align,” this expert says. “They’re holding off attacks because they’re waiting to see what happens with Syria, frankly. And the banks are defending well, so they will move on to a new target. Besides, using the movie as an excuse for attacks is not effective or really being believed anymore.” “The Syrian Electronic Army has said quite clearly that if the U.S. does anything [as far as military strikes] they are coming after us,” Arbor Networks’ Holden says. “And if there is any sympathy for that, it’s a great excuse for QCF [al-Qassam Cyber Fighters] to repurpose and retool their botnet for something else. They could jump onboard there. This is the perfect excuse to change the story about attacking because of the video. This is the perfect cover.” If forces do unite, Holden says other critical infrastructure sectors, beyond banking, will likely be targeted, possibly defense contractors, rather than government itself. “I don’t foresee government being a target, but, instead, a weaker vertical,” Holden says. “If anything government-focused were to be attacked, I would think it would be government contractors that would be somehow associated with Syria.” Holden says e-commerce sites also could be prime targets. “[Those sites] are obviously related to capitalism, like the banks, and the money lost would be huge,” he says. “The impact would be very real, given how much commerce occurs over the Internet.” Media sites could be another target, Holden says. Regulatory Oversight Because of ongoing DDoS threats, more regulatory and legislative oversight related to how critical infrastructure industries address DDoS risks is likely on the way, says Corero’s Stephenson. “The attacks have heightened the need for guidance or legislation, whether that’s from the SEC [Securities and Exchange Commission] or an international agency like the European Commission,” he says. The need for more regulation and cross-industry collaboration has been highlighted by al-Qassam’s attacks, Stephenson adds. DDoS attacks have become a part of everyday business, and all sectors should be sharing threat intelligence, Stephenson says “One of the things I took away from this last year is that the banks really have learned a lot,” he says. “This type of cyberthreat is now business as usual. This is going to be a continuous threat and an ongoing risk of doing business online, and I don’t think we’re going to win here by keeping attack information secret.” The more organizations disclose about the attacks they suffer, the stronger defenses can be built, Stephenson says. “That’s where the vendors come in,” he says. “When they have an attack that is defeated, they can put the information together and pass that on to the authorities. A year ago, that wasn’t happening like it is today,” and there’s always room for improvement. Source: http://www.bankinfosecurity.com/whats-next-for-ddos-attacks-a-6074

More:
What’s Next for DDoS Attacks?

Countering Attacks Hiding In Denial-Of-Service Smokescreens

Denial-of-service attacks have long been considered the blunt wooden club of online hazards, a multi-gigabit stream of shock and awe. Yet, increasingly the noisy attacks are being used to hide more subtle infiltrations of a target’s network. A number of financial institutions, for example, have been targeted by distributed denial-of-service (DDoS) attacks immediately following a wire transfer, according to security firms familiar with the cases. The attacks, generated by computers infected with the DirtJumper DDoS malware, attempt to disrupt any response to the fraudulent transfer of funds, which are usually in the six-figure dollar range, according to a report by Dell Secureworks published in April. “The analogy is signal jamming,” says Kevin Houle, director of threat intelligence for managed security provider Dell Secureworks. “To the extent that you can use the DDoS attack to do cause chaos electronically, to prevent access to particular systems during an attack, the tactic has proven successful.” While DirtJumper has focused on causing chaos immediately following money transfers, the technique could be generalized to other attack scenarios. A variation of the attack has been used by Iranian hacktivists groups to disrupt the online operations of U.S. financial institutions by hiding more subtle application-layer attacks within larger packet floods. And South Korean companies were flooded with data while malware deleted information on organizations’ servers. “Your goal is to sow confusion,” says Vann Abernethy, a senior product manager at NSFOCUS, a DDoS mitigation firm. “A DDoS attack is designed to get your IT department to run around like their hair is on fire.” In addition, noisy DDoS attacks could attract more attackers, says Terrence Gareau, principal security architect for Prolexic, a DDoS mitigation firm. A very public attack could convince other groups to attempt their own operations in the chaos, he says. “If it’s a very public attack, then there is a high probability that other opportunistic attackers could take part as well,” Gareau says. “Opportunistic criminals will say, wow they are under a DDoS attack, so lets look at the network and see what changes have been made.” Companies need to structure their response group to handle a large infrastructure attack, but not be blinded by the influx of alerts to their system. Like magicians, the goal of the attackers is to force the security staff to only pay attention to a distraction to keep them from discovering the actual trick. “You almost have to have a team that deals with the infrastructure attack, and a separate group that goes into hyper-vigilance to find any other attacks coming in,” says NSFOCUS’s Abernethy. A third-party provider, who can use intelligence from attacks on other customers to more quickly identify new attacks, can help eliminate much of the inbound attack traffic, dialing down the volume of alerts that the security team has to process. The level of alerts seen by a security team during a denial-of-service attacks can increase by an order of magnitude. Filtering them out at the edge of the Internet can greatly reduce the impact on a business’s network and employees. “If you don’t have to have all those alerts on your network, you can pay attention to what matters,” Prolexic’s Gareau says. “Using a third part mitigation provider can significantly reduce the noise.” Yet, attacks that use a variety of traffic and techniques in a short time period can cause problems for denial-of-service mitigation firms, says Lance James, head of intelligence for Vigilance, a threat information firm that is now part of Deloitte. “They are not perfect,” James says. “We still see major banks going down. But they do well against long period term DDoS attacks.” While DirtJumper, also known as Drive, is not the only botnet that is used for combined attacks, it a popular one. DirtJumper has a half dozen ways of attacking infrastructure, including flooding Web sites with GET requests and POST requests, targeting infrastructure with two types of IP floods, and using UDP packets to slow down networks. Source: http://www.darkreading.com/threat-intelligence/countering-attacks-hiding-in-denial-of-s/240161237

Continued here:
Countering Attacks Hiding In Denial-Of-Service Smokescreens

SatoshiDice hit by DDoS attack, but bets continue

Bitcoin gambling site SatoshiDice has recovered after being felled for several days by a DDoS attack. The site went down several days ago, and was inaccessible from the Internet. Erik Voorhees, who created the site and sold it for $11.5 million in July, no longer runs the site, but naturally still has insights into how it operates. DDoS attacks happen a lot to bitcoin gambling sites, he said. “They largely wasted their money,” he said of the attackers, pointing out that the website isn’t needed for the placing of bets. It simply provides information about bet statistics, and bitcoin addresses to send to. These addresses are constant, available outside of the main site, and can easily be retained by regular gamblers even when the site goes down, meaning that bets can still be processed. “They’d have to launch an attack against the whole bitcoin network,” Voorhees said. There is a back-end computer processing the bets, but this isn’t the same computer that hosts the website. Attackers could potentially disrupt betting if they were able to find that machine, but Voorhees points out that it could easily be moved. The attack didn’t seem to affect the site’s popularity in the long term. SatoshiDice vanity addresses made up eight of the most popular bitcoin addresses used on the network overnight. Source: http://www.coindesk.com/satoshidice-hit-by-ddos-attack-but-bets-continue/

Visit site:
SatoshiDice hit by DDoS attack, but bets continue

Police nab alleged DDoS extortion gang at Heathrow Airport

Two Polish men were arrested at Heathrow Airport earlier this week in connection with an alleged DDoS extortion attack on a Manchester-based business, news sources have reported. Details are light but it is known that a website connected to the business was brought down during the attack, which happened at an unspecified time before the 7 August arrests. “This investigation centres on an allegation that the on-line company was blackmailed,” said Detective Inspector Chris Mossop, of Greater Manchester Police’s Serious Crime Division “As part of this blackmail attempt, one of the company’s websites was made temporarily unavailable by the offenders,” he added. “Denial of service attacks have become increasingly common offences in recent years and can have a devastating effect on the victim’s on-line business or presence.” The investigation continued in several countries, including the UK, the US and Poland, police said. Although such cases rarely come to light, cyber-extortion has flourished in the last decade. In almost every case, DDoS is the weapon of choice. These days, small and medium-size businesses are the usual target because they are far less likely to have DDoS mitigation in place to defend themselves. The other less common technique involves attackers stealing data and threatening to release it unless a ransom is paid. An example of this type of attack came to light last year when a Belgian bank was blackmailed by hackers. Last December, hackers tried to extort $4,000 AUS (£2,600) from a medical centre in Australia after breaching its network and encrypting its customer database. A recent survey suggested that one in five UK businesses had been affected by DDoS attacks during 2012. Source: http://news.techworld.com/security/3463285/police-nab-alleged-ddos-extortion-gang-at-heathrow-airport/

Read the article:
Police nab alleged DDoS extortion gang at Heathrow Airport

Analysis: Who’s Really Behind DDoS?

Now that Izz ad-Din al-Qassam Cyber Fighters has launched its fourth phase of distributed-denial-of-service attacks against U.S. banks, many observers are continuing to ask: Who’s behind this group, and what are the real motives? Is al-Qassam really an independent hacktivist group, as it claims? Does it have connections to a nation-state, such as Iran? Or does it have ties to organized crime? And is there a possibility that it has leased out its botnet to multiple groups? In this analysis, Information Security Media Group weighs the evidence. al-Qassam has been waging DDoS attacks against leading U.S. banking institutions and a handful of smaller ones since last September. The attacks, designed to disrupt online banking service, have, so far, proven to be more of a nuisance than a malicious threat. But the launch of this new phase, which was announced July 23, raises new questions about just who is behind Izz ad-Din al-Qassam The Group’s Message Since the beginning, al-Qassam has positioned itself as a group of hacktivists – independent attackers who are waging online war against U.S. banking institutions to make a social statement. The group claims the catalyst for the attacks is a movie trailer on YouTube that it deems offensive to Muslims. And because YouTube has not removed links to this trailer, as al-Qassam has asked, al-Qassam is focusing its attack energies on America’s core – it’s financial foundation. In an Oct. 23 post on the open forum Pastebin, al-Qassam restated its purpose, and noted that the attacks are not being waged to perpetrate fraud . “We have already stressed that the attacks launch only to prevent banking services temporarily throughout the day and there is no stealing or handling of money in our agenda,” the group states. “So if others have done such actions, we don’t assume any responsibility for it. Every day we are giving a compulsive break to all employees of one of the banks and its customers.” The post also takes issue with statements made in October by U.S. Defense Secretary Leon Panetta, who during a speech about cybersecurity noted that industries touching critical infrastructure were at risk. “Mr. Panetta has noted in his remarks to the potential cyberthreats such as attacking on power and water infrastructures, running off trains from the tracks and etc.,” the post states. “In our opinion, Panetta’s remarks are for distracting the public opinion and in support of the owners of the banks’ capital. … This is capitalism’s usual trick.” Then, in November, an alleged member of al-Qassam told ABC News that its attacks were not backed by anyone, nor were they connected to the August 2012 attack on Aramco, a Saudi oil firm, which involved the deletion of data from tens of thousands of computers. “No government or organization is supporting us, and we do not wait for any support as well,” the self-proclaimed al-Qassam member wrote in an e-mail, ABC News reported. “Do you think that the massive protests in the world are done with support? [In] the same manner [that] millions of Muslims in the world protested, hackers are also part of this protest” But many experts have questioned the protest motive and have expressed doubt that al-Qassam is what it says it is. Experts’ Views Financial fraud analyst Avivah Litan has repeatedly argued these attacks are actually being backed by a nation-state, namely Iran, not independent hacktivists. Others, such as Bill Wansley of the consultancy Booz Allen Hamilton, have shared similar opinions. “There are indications that it’s an Iranian group,” Wansley told BankInfoSecurity in late September 2012. “There are a lot of indicators it’s from that region of the world. But these hacktivist groups, frankly, can operate from a number of different locations and give the impression of being from one time zone when they’re really not. So it’s not conclusive. But there certainly have been some indicators, such as the use of Arabic names, Iranian names and the time zone [and the time of day when the first attacks struck] that would indicate something from that part of the world.” An unnamed source within the U.S. government quoted in the New York Times in May suggested Iran is backing attacks against the U.S. in retaliation for economic sanctions the U.S. has imposed on Iran. Many security experts, however, have been reluctant to attribute these attacks to any one type of actor. That’s because any attribution could only be based on circumstantial evidence in the online world, says Alan Brill, cybercrime investigator and senior managing director at investigations and risk-consulting firm Kroll. “You can’t accept crowd opinion for verified fact,” he says. “I think it’s still very difficult to attribute things like this, simply because the Internet was never designed to make that easy.” Although Brill admits he has not carefully reviewed the evidence linked to these attacks, he says attributing these types of attacks is challenged by attackers’ abilities to mask their points of origination with throw-away IP addresses and anonymous networks. “Unlike other forms of evidence, such as a fingerprint at a crime scene, which does not change, this stuff is just so fluid,” he says. “It’s very difficult to put all of the pieces together. And in the case of state actors, you’re not going to get a lot beyond circumstantial evidence.” Reviewing Patterns But what can the industry glean from the most recent attacks? Many experts say the more they learn about al-Qassam, the more confused they are. The group’s Pastebin announcements, attack schedules and breaks between attack campaigns have been inconsistent. Just as soon as the industry thinks it’s outlined a pattern, the pattern changes, as shown again in this fourth wave of attacks. Here, Information Security Media Group spells out some important factors. Are They Really Hacktivists? Support for the notion that al-Qassam is a hacktivist group stems from the fact that it claims itself to be one – and so far, no financial fraud or other type of data compromise has been linked to an al-Qassam attack. Banking regulators have warned of the potential for DDoS to be used as a mode of distraction for fraud to be perpetrated in the background But so far, no account compromises have been associated with al-Qassam attacks. The group claims it’s waging its attacks for social reasons – outrage over a YouTube video deemed offensive to Muslims. That purpose would suggest this is just a group of hacktivists out for attention. Is a Nation-State Involved? But none of the industry experts interviewed for this analysis believes that is truly the motive. Hacktivists typically want attention. “There’s usually some bragging about what was accomplished,” Wansley said last year. “That’s the typical pattern of some of the hacktivist groups.” While al-Qassam bragged on Pastebin in the early weeks of its attacks, the bragging has waned over time. Hacktivists also often name their targets in advance. Al-Qassam did this early on, but as the attacks became less effective, that stopped. During the second and third campaigns, al-Qassam took credit after the attacks. Now, most of that post-attack bragging has stopped as well. And experts note that these DDoS strikes have been hitting U.S. banking institutions for nearly a year; a hacktivist group would need substantial funding to run an attack campaign that long. That’s why many believe al-Qassam is actually a front for a nation-state, a criminal network – or even a mix of both. “In this case, there’s a group that has an Arabic name that has never been associated with cyber-activity at all,” Wansley noted. “[The name has] been associated with Hamas. And for them to, all of the sudden, become a hacktivist group is just really interesting. We’ve never seen that before. That doesn’t mean they’re not doing it, but it could also mean they’re being used as a cover for some other country or organization to do something.” The timing of this fourth phase further supports the notion that al-Qassam is actually a nation-state actor, Gartner’s Litan contends. The Iranian presidential election, as well as elections for regional posts, occurred June 14. Litan says the attacks were expected to lapse during the election, assuming that the Iranian government is actually funding the attacks. “We all knew they’d be back after the election,” she says. “Really, this is just business as expected.” Based on information she’s gathered from law enforcement and some of the attacked banks, Litan concludes: “We know it’s Iran because the attacks have been traced back to them, through the files, through the servers.” Is There a Criminal Connection? But could there be a criminal element involved? Many experts say a connection to organized crime is possible, because the attackers waging these long-term, extensive DDoS strikes are likely getting funding from a nefarious source. But are there clues al-Qassam is waging its attacks for a criminal purpose? Brobot, al-Qassam’s botnet, keeps growing, experts say. While the attacks waged by Brobot have been unsuccessful at causing any significant online outages during the third and fourth phases, al-Qassam has continued to increase the botnet’s size. Why? Some argue the purpose is to rent out Brobot for a profit – perhaps to cybercrime rings. And attacks linked to Brobot this campaign may support the notion that Brobot is now being used by more than just al-Qassam. During the afternoon hours of July 30, Brobot was used to attack merchant sites, seemingly as a coding test for the attacks that kicked off July 31, says Mike Smith of the cybersecurity firm Akamai, which has been tracking and mitigating DDoS activity linked to al-Qassam. The only commonality among the July 30 targets: They all have the word “Da Vinci” in their website URLs, Smith and others confirmed. “There was no connection to banking at all,” Smith says. Source: http://www.govinfosecurity.com/analysis-whos-really-behind-ddos-a-5966

View article:
Analysis: Who’s Really Behind DDoS?

DDoS is Back; 3 Banks Attacked

A week after the self-proclaimed hacktivist group Izz ad-Din al-Qassam Cyber Fighters announced plans to launch a fourth phase of attacks against U.S. banks it’s still not clear whether the group has resumed its distributed-denial-of-service activity. DDoS attacks appear to have targeted three banks July 24 through July 27, according to Keynote, an online and mobile cloud testing and traffic monitoring provider, and other sources. But security vendors that track attacks linked to al-Qassam’s botnet, known as Brobot, say they’re uncertain exactly who was behind those attacks. While some attack evidence suggested a link to Brobot, nothing was definitive. The online banking sites of JPMorgan Chase, U.S. Bancorp and Regions Financial Corp. all experienced intermittent outages last week, Keynote says, and the outages appear to be DDoS-related. All three banking institutions have previously been targeted by al-Qassam. Those three banks all declined to comment about the outages, although Chase did acknowledge intermittent online issues July 24 on Twitter , in response to customer complaints. Detecting those online glitches, however, took some digging, says Aaron Rudger, Keynote’s Web performance marketing manager. The online traffic patterns were different from what Keynote has recorded in the past for activity believed to be related to DDoS, he says. “Normally with DDoS attacks, we see a ramping decline in a site’s performance as the load against it builds,” Rudger says. “Eventually, the site falls over when overwhelmed.” But in all three online outages tracked last week, that pattern was not present, he says. “It seems they were hit very hard, very fast – so fast, our agents did not observe the typical ‘ramping’ effect of an attack,” he says. The pattern divergence could signal a different type of DDoS approach, or merely be a byproduct of the steps the affected banking institutions were taking to mitigate their outages, or a combination of the two, he says. And while all three banks suffered slightly different types of attacks – Chase hit by DNS lookup errors, U.S. Bank hit by TCP connection errors and Regions hit by traffic that allowed access to its homepage but kept eBanking inaccessible – Rudger says they all were, at least in part, linked to external issues. Bot Activity The outages linked to Chase began during the morning of July 24, stopped and then picked back up in the afternoon, says one DDoS mitigation expert, who asked to remain anonymous. The first wave of attacks had no commands linked to Brobot, but the second wave did, the source says. The outages at U.S. Bank, which began during the very early morning hours of July 24, also stopped for a while and picked back up in the afternoon, Rudger says. And the outages at Regions showed similar patterns, though the outages spanned two days and eBanking remained inaccessible throughout the duration, he adds. John LaCour, CEO of cybersecurity and intelligence firm PhishLabs, declined to comment about any particular banks affected by DDoS activity, but he confirmed that his company had tracked new attacks. He did not say, however, if those attacks were linked to Brobot. Tracking Attacks Several other DDoS mitigation providers would not comment about last week’s three apparent DDoS attacks. But the anonymous source says no one is certain whether al-Qassam is connected to those attacks. After al-Qassam’s announcement that it planned to launch a fourth phase of attacks, copycats may have decided to take advantage, launching attacks of their own hoping to be mistaken as al-Qassam, the source says. The group hasn’t attacked since the first week of May, when it announced it was halting its DDoS strikes in honor of Anonymous’ Operation USA , bringing an end to its third phase of attacks, which began March 5 (see New Wave of DDoS Attacks Launched ). al-Qassam has repeatedly stated it’s waging its attacks against U.S. banking institutions in protest of a Youtube movie trailer deemed offensive to Muslims. “Other DDoS actors have started their hostilities, trying to blame (or at least be confused with) them on QCF,” the source says. “We saw similar activity from the middle of Phase 2 onward, where fraudsters were attacking known [Operation] Ababil targets in order to straphang on the chaos that QCF was bringing.” Several security vendors tracking the group’s Brobot say that the botnet is growing. “The huge number of servers controlled by the attackers shows that this campaign was fully planned, intentionally organized and deliberate,” says Frank Ip, vice president of U.S. operations for NSFOCUS, which tracks DDoS activity. “This leads us to wonder whether the attack campaign is supported or backed by a country or financially well-off organization behind the scenes. We expect that similar DDoS attack events will occur in the wake of the recent activity, employing more diversified and varying methods.” Source: http://www.govinfosecurity.com/ddos-back-3-banks-attacked-a-5951/p-2

Visit site:
DDoS is Back; 3 Banks Attacked

Regions Bank Hit with New DDoS Attack

Regions Bank was the victim of cyber attackers that shuttered the bank’s website and interrupted its customers’ debit cards, reported AL.com. The bank’s website was hit Friday with a distributed-denial-of-service attack. Customers may have also not been able to use their debit cards at ATMs and merchants, according to a statement released to the website. “Access to regions.com and online banking were disrupted intermittently today by a distributed denial of service (DDoS) attack,” a spokesman told AL.com on Friday. “Some customers may have also been unable to use their CheckCards at ATMs or at merchants. We apologize for the difficulties this has caused and are working to resolve the issues as quickly as possible.” The attack comes on the heels of recent threats by from the hactivist group Izz ad-Din al-Qassam Cyber Fighters. Since last September, al-Qassam has taken responsibility for a series of cyber assaults that have plagued some of the nation’s largest banks — shuttering the online banking operations of Wells Fargo, PNC and dozens of others. Regions Bank was among those hit in early October. The Regions outage and debit card issues that occurred Friday reportedly lasted for nearly two hours. Source: http://www.americanbanker.com/issues/178_145/regions-bank-hit-with-new-ddos-attack-1060942-1.html

Read more here:
Regions Bank Hit with New DDoS Attack

DDoS: Lessons From U.K. Attacks

While U.S. banking institutions brace for the next wave of distributed-denial-of-service attacks by Izz ad-Din al-Qassam, new cyberthreat research reminds us that no industry or global market is immune to DDoS. A new study from online security provider Neustar shows that DDoS attacks are up in the United Kingdom, just as they are in the U.S., and they’re targeting everything from e-commerce sites to government. It’s not just banking institutions that DDoS attackers want to take down – a truth we’ve been preaching for several months. But now, data proves it. Of the 381 U.K. organizations polled between May and June by Neustar, 22 percent said they suffered from some type of DDoS attack in 2012. By comparison, a survey of 704 North American organizations released in April 2012 showed that 35 percent had been targeted by DDoS within the last year. While the financial services sector has been the primary DDoS target in the U.S., telecommunications companies are the No. 1 target in the U.K., according to the Neustar survey, with 53 percent reporting attacks. Half of U.K. e-commerce companies and 43 percent of online retailers surveyed reported attacks. But only 17 percent of the U.K. financial-services organizations say they had been targeted, compared with 44 percent in the North American survey. The North American data is a bit out of date, so the percentage of financial institutions hit by DDoS is now probably even higher. And attacks aimed at U.K. organizations have been nowhere as fierce as those waged against U.S. banks since September 2012. More Attacks on Way Now that al-Qassam has just announced plans for a fourth phase of attacks, we’re all bracing for more strikes against U.S. banks (see DDoS: Attackers Announce Phase 4 ). But the new survey sends a clear message: No organization is safe from DDoS. “As in North America, U.K. companies face serious challenges as they decide on DDoS protection and attempt to mitigate losses,” Neustar writes in its survey study. “While many companies are hoping traditional defenses will suffice, given the frequency of attacks, their growing complexity and the impact when sites go dark, such hopes are badly misplaced.” U.K. organizations could learn quite a bit from the example U.S. banks have set. Experts have noted time and time again that European banks and others are not well-prepped for DDoS. Despite the fact that the attacks waged against U.S. banks have been among the largest the industry has ever seen, the percentage of U.S. organizations that experienced extended outages was much smaller than that of U.K. organizations, the surveys showed. The defenses U.S. banking institutions have put in place have set a new bar. We already knew that, but now Neustar’s survey results support it. According to Neustar, while online outages lasting about 24 hours affected about 37 percent of both North American and U.K. organizations surveyed, outages lasting more than a week affected 22 percent in the U.K. and only 13 percent in North America. Having a site down for more than a week is an embarrassment, and costly. Can you even imagine a major banking institution’s site being down that long? Banks in the U.S. are prepared for DDoS. But what about other organizations? Are non-banks getting ready for DDoS, or do they still see this as only a threat to banking institutions? What you think? Let us know in the comment section below. Source: http://www.bankinfosecurity.com/blogs/ddos-no-industry-safe-p-1524

Visit link:
DDoS: Lessons From U.K. Attacks