Tag Archives: defend against ddos

Network Solutions Recovers After DDoS Attack

Network Solutions said it’s fully mitigated a distributed denial of service (DDoS) attack that compromised some services last week, and that attack volumes against the company had returned to normal. “We experience DDoS attacks almost daily, but our automatic mitigation protocols usually handle the attacks without any impact to our customers,” said John Herbkersman, a spokesman for Network Solutions’ parent company, Web.com, via email. Network Solutions manages more than more than 6.6 million domains, provides hosting services, registers domain names and also sells SSL certificates, among other services. But Monday, some customers reported still experiencing domain name server (DNS) and website updating difficulties that dated to the start of the DDoS attacks. The company, however, disputed those claims. “Some customers may be experiencing issues, but they are not related to last week’s DDoS attack,” said Herbkersman. The DDoS attacks began last week, with Network Solutions at first reporting that “some Network Solutions hosting customers are reporting latency issues,” according to a “notice to customers who are experiencing hosting issues” posted to the company’s website on Tuesday, July 16. “Our technology team is aware of the problem, and they’re working to resolve it as quickly as possible. Thank you for your patience,” it said. As the week continued, the company posted updates via Twitter and to its Facebook page. By Wednesday, it said that the outages were due to a DDoS attack “that is impacting our customers as well as the Network Solutions site.” It said that the company’s technology staff were “working to mitigate the situation.” Later on Wednesday the company declared via Twitter: “The recent DDOS attack affecting customers has now been mitigated. Customer websites should be resolving normally. Thanks for your patience.” The Network Solutions website wasn’t available or updateable for the duration of the attacks. But that wasn’t apparent to all customers, who might not have turned to Facebook and Twitter seeking updates about the company’s service availability. One InformationWeek reader, who emailed Friday, accused Network Solutions of being less than forthcoming about the fact that the outages were being caused by a DDoS attack, “which they acknowledged only when calling them,” after he found only the “notice to customers who are experiencing hosting issues” post on the company’s site. “They have been trying to bury it,” he alleged. “Some sites were down for the entire day.” Herbkersman brushed off the criticism. “In addition to Facebook, we communicated via the Network Solutions’ website and via Twitter,” he said. “We also responded directly to customers who called our customer service team and those who contacted us via social media channels.” Friday, the company did publish a fuller accounting of the outage to its website. “Earlier this week, Network Solutions experienced a distributed denial of service (DDoS) attack on its servers that affected our customers. The Network Solutions technology team quickly identified the issue and implemented measures to mitigate the attack,” read a statement posted to the company’s site and cross-referenced on its Facebook page. “We apologize to our customers who were impacted.” “Are we getting refunded some money because of your 99.99% uptime guarantee?” responded one member via Facebook. “Feel free to call our support team and they will be happy to discuss,” came a reply from Network Solutions. Customers might have had to contend with more than just the DDoS attack. A Tuesday Facebook post — since deleted, which the company said it made to help direct customers to more recent information about the DDoS-driven outages — drew comments from customers reporting DNS issues. “There were multiple reports on the July 16, 2013 Facebook thread that appear to indicate customer DNS records were corrupted before the DDoS induced outage,” Craig Williams, a technical leader in the Cisco Systems threat research group, said in a blog post. The one-two punch of domain name resolution difficulties and a DDoS attack could have left numerous sites inaccessible not just during the attack, but in subsequent days, as the company attempted to identify the extent of the damage and make repairs in subsequent days. Last week’s DDoS attack was the second such attack for Network Solutions customers in less than a month. “In [the] previous outage, domain name servers were redirected away from their proper IP addresses,” said Williams. In that case, however, at least some of the DNS issues appeared to be “a result of a server misconfiguration while Network Solutions was attempting to mitigate a DDoS attack.” Herbkersman, the Web.com spokesman, said last week’s outages were entirely driven by the DDoS attacks, rather than the company’s response to those attacks. Source: http://www.informationweek.com/security/attacks/network-solutions-recovers-after-ddos-at/240158685

Read the original:
Network Solutions Recovers After DDoS Attack

Four steps for denying DDoS attacks

Financial institutions have been battling waves of large distributed denial of service attacks since early 2012. Many of these attacks have been the work of a group called the Qassam Cyber Fighters, which until recently posted weekly updates on Pastebin about the reasons behind its attacks, and summarising Operation Ababil, its DDoS campaign, writes Terry Greer-King, UK managing director, Check Point ( right ). Other hacktivist groups have launched their own DDoS attacks and targeted financial services institutions with focused attacks on web forms and content. There have also been reports of nation-state organised cyber assaults on banks and government agencies, along with complex, multi-vector efforts that have combined DDoS attacks with online account tampering and fraud. These incidents against all sizes of banks have shown that there are many kinds of DDoS attacks, including traditional SYN and DNS floods, as well as DNS amplification, application layer and content targeted methods. Denial of Service (DoS) activities that have targeted SSL encrypted webpage resources and content are an additional challenge. In some instances, the adversaries have moved to a blended form of attack that incorporates harder-to-stop application layer methods alongside ‘cheap’, high-volume attacks that can be filtered and blocked through simpler means. To cope with this level of malicious activity, CIOs, CISOs, and their teams need to have a plan in place, and consider a set of defensive tools that combine on-premise technologies and cloud-based scrubbing services. They should also begin to explore and ultimately implement intelligence gathering and distribution methodologies that help lead to a comprehensive DoS mitigation strategy. Here are four steps to help in devising that strategy Have a scrubbing service or ‘cleaning provider’ to handle large volumetric attacks : the volumes associated with DDoS activity have reached a level where 80 Gbps of DDoS traffic is a normal event. There are even reports of attacks in the range of 300 Gbps. Few, if any organisations can maintain sufficient bandwidth to cope with attacks of this size. When faced with DDoS incidents this large, the first thing an organisation needs to consider is the option to route their Internet traffic through a dedicated cloud-based scrubbing provider that can remove malicious packets from the stream. These providers are the first line of defense for large volumetric attacks, as they have the necessary tools and bandwidth to clean network traffic so that DDoS packets are stopped in the cloud and regular business as usual traffic is allowed. Use a dedicated DDoS mitigation appliance to isolate and remediate attacks: the complexity of DoS attacks and the tendency to combine volumetric and application methods require a combination of mitigation methods. The most effective way to cope with the application and “low and slow” elements of these multi-vector attacks is to use an on-premise dedicated appliance. Firewalls and intrusion prevention systems are critical to the mitigation effort, and DDoS security devices provide an additional layer of defense through specialised technologies that identify and block advanced DoS activity in real-time. Administrators can also configure their on-premise solutions to communicate with cloud scrubbing service providers to enable automated route away during attack. Tune firewalls to handle large connection rates: t he firewall will also be an important piece of networking equipment during DDoS attacks. Administrators should adjust their firewall settings in order to recognise and handle volumetric and application-layer attacks. Depending on the capabilities of the firewall, protections can also be activated to block DDoS packets and improve firewall performance while under attack. Develop a strategy to protect applications from DDoS attacks: a s well as using security solutions, administrators should also consider tuning their web servers, and modifying their load balancing and content delivery strategies to ensure the best possible uptime. This should also include safeguards against multiple login attempts. Machine-led, automated activities can also be blocked by including web pages with offer details, such as opportunities for interest rate reduction or information on new products, so that users much click on “accept” or “no thanks” buttons in order to continue deeper into website content. Content analysis can also help – simple steps such as ensuring there are no large PDF files hosted on high-value servers can make a difference. The above methods are crucial to any DDoS mitigation strategy. Organisations must also reach out to service providers and ISPs and work with them to identify novel mitigation techniques. After all, DDoS attacks use the same Internet routes as bank customers, and ISPs carry both forms of traffic. Of increasing importance is the need to investigate and implement intelligence gathering and distribution strategies, both within company networks and across other companies operating in financial services. Getting more information about who the attacking agent is, the motivations behind the attack, and methods used, helps administrators anticipate and proactively architect around those attacks. Attack profile information can range from the protocols used in the attack (SYN, DNS, HTTP), the sources of attack packets, the command and control networks, and the times of day during which attacks began and ended. While valuable in mitigating attacks, there is no easy way to communicate this data, and regulatory hurdles make it even more difficult to share attack information. Right now, information-sharing consists of friends talking to friends. Information sharing needs to evolve into an automated system where multiple organisations can log in to a solution and see correlated and raw log data that provide clues about current and older attacks. Such systems could also be used to share attack intelligence and distribute protections. An industry information sharing capability would help elevate financial services companies’ abilities to cope with DDoS activity and bring the industry as a whole to a new level of preparedness. Source: http://www.bankingtech.com/154272/four-steps-for-denying-ddos-attacks/

Excerpt from:
Four steps for denying DDoS attacks

Many online newspapers become DDoS victims

At 4.11 pm of July 7, when accessing Dan Tri newspaper at dantri.com.vn, readers would see the words “Ban hay thuc hien phep tinh de tiep tuc su dung bao Dan Tri” showing that the access was denied. Dan Tri was just one of the many online newspapers hacked in recent days under a large scale DDoS offensive of the hackers. The hacking made a lot of newspapers inaccessible. Some readers still could access websites, but they had to try many times and wait with patience. Internet security experts have commented that the attack might have been well prepared for a long time, because it was conducted in a very methodical way. HVAOnline, a security forum, reported that since July 4, Thanh Nien, Tuoi tre, Dan Tri, VietNamNet, Kenh 14 have been the victims of the DDoS attacks, noting that the number of hacked online newspapers is on the rise. It is estimated that each of the newspapers incur the DDoS attack capacity of 50-70 Mbps, while the capacity was up to 1.3 Gbps for some newspapers. To date, some newspapers have fixed the problems, but the access remains unstable. According to Vo Do Thang, Director of Athena, an Internet security training center in HCM City, the current attack power would be unbearable to the small online newspapers. As such, the hacking would cause serious consequences, especially if it lasts for a long time. The experts said hackers purposely attacked the server of VDC 2 (the Vietnam Data communication Company) where the servers of many online newspapers are located. As a result, not only the VDC 2’s server, but the newspapers’ servers also suffered. HVAOnline said the forum itself and many other forums, information portals in Vietnam also incurred many DDoS attacks, but at weaker intensity. In fact, experts said the attacks began in June 2013 already at low intensity, which could be the preparation for the “general offensive” in July. They believe that the hackers may belong to a big and powerful organization to be able to mobilize such large botnets and zombies for the large scale attack. The hackers reportedly timed their attacks in their way. After finishing one attack aiming to one goal, they began the attack to another goal. After that, they unexpectedly returned and attacked the first aiming point. This way of hacking might make readers and the newspapers’ administrators misunderstand that the newspapers got troubles, while they did not think of a DDoS attack. Buu Dien newspaper on July 11 quoted the Director of an Internet security firm as saying that the firm, after analyzing the attack, found out that the attack was originated from an IP in Vietnam. BKAV’s Nguyen Minh Duc said two days ago that BKAV has not received any request for help from the hacked newspapers. A Symantec’s report in 2011 said that Vietnam has become the favorite space of the world’s hackers, and that it is the biggest botnet in the world. One of the reasons behind this is that Vietnamese don’t install anti-virus software on their computers, and they have the habit of installing cracked software pieces, or downloading some software products from unreliable websites. Source: http://english.vietnamnet.vn/fms/science-it/79186/many-online-newspapers-become-ddos-victims.html

See more here:
Many online newspapers become DDoS victims

Staying Informed About DDoS Threats

Distributed-denial-of-service attacks have plagued U.S. banks since last September. But DDoS attacks pose a persistent, genuine threat to other sectors as well. Any organization with an online presence is at risk. Successful DDoS attacks can take a website offline, damaging brand image and chipping away at consumer trust. But they also can do much more. In some cases, these attacks can be used to mask fraud by distracting security and IT departments while banking accounts or confidential files are simultaneously being taken over. To provide insights on the latest DDoS threats – and effective mitigation strategies – Information Security Media Group has launched a DDoS Resource Center . The resource center, sponsored by online security firms Akamai, Fortinet, Neustar, Radware and VeriSign, includes timely interviews, in-depth features, news stories and blogs that offer insights about emerging botnets and attack techniques from those who are analyzing and battling DDoS on the frontlines. The resource center also offers expert insights on practical steps for minimizing the impact of DDoS attacks. By visiting the resource center, you’ll get the latest information on the different types of DDoS attacks, such as DNS reflection and application layer attacks, as well as the attacks’ possible links to fraud . You’ll learn about DDoS protections and mitigation services , notification and response strategies, and DDoS detection measures. Here’s a sampling of the variety of content our resource center offers: An interview with ex-FBI investigator Shawn Henry , who shares insights about cross-border and cross-industry collaboration that’s taking place behind the scenes to strengthen DDoS and cybersecurity knowledge. An analysis of a new type of DDoS strike that targeted two U.S. banks for what some say could have been a test for more attacks to come. A blog about how the botnet, known as Brobot, that’s been used in DDoS attacks against U.S. banks is being retooled to defeat common mitigation practices. And an interview with former federal banking examiner Amy McHugh about why community banks are prime targets for DDoS strikes being waged as modes of distraction to veil account takeover attempts. The DDoS Resource Center also provides research, white papers and webinars, including a session on new defense strategies for DDoS , which includes insights from Rodney Joffee of DDoS-mitigation provider Neustar and Mike Wyffels, senior vice president and chief technology officer of multibank holding company QCR Holdings Inc. Source: http://www.bankinfosecurity.com/blogs/staying-informed-about-ddos-threats-p-1506

See the original article here:
Staying Informed About DDoS Threats

Financial Security: Learning From DDoS Attacks

Exactly how big are distributed denial of service (DDoS) attacks in mid-2013? “Just big enough” is what most attackers would say. The Cyber Fighters of Izz ad-din Al Qassam, a group claiming to protest an anti-Moslem video and considered by many experts to be the perpetrators of the attacks, have shown a knack for ratcheting up the volume as banks invest in greater DDoS mitigation bandwidth. The al Qassam template hasn’t gone unnoticed. In the cyber underground, criminal gangs have chatted about the group’s favorite weapon, the “itsoknoproblembro” DDoS toolkit, which hits various parts of a web site at the same time and floods servers with traffic up to 70Gbps. The al Qassam botnet — dubbed the “brobot” — is striking too. Instead of marshaling tens of thousands of infected home computers, it uses hosting providers’ or business’ commercial content servers, which offer fatter pipes and bandwidth galore. The same tactics are available to those whose motive is greed, with the Internet itself serving as their weapons storehouse. Since they never pay for those high-capacity servers and all that power, what’s to stop attackers from using as much as they want? Though an attack of less than 2Gbps can take down many sites, attackers want to be sure your site is down throughout the world. In fact, they use free web monitoring services to make sure that folks in Chicago and Paris can’t reach you. If the attack isn’t working globally, the attackers up the ante. Just figuratively, though–humongous attacks cost no more than surgical strikes. If this is bad news for top-tier banks, it’s potentially disastrous for smaller institutions lacking the budget and expertise to handle attacks themselves. Fortunately, a little planning and preparation can make a big difference. “Does This Hardware Make Me Look Fat?” It Pays To Be Less Attractive To Attackers. Short of making arrests, the good guys can’t stop the bad guys from launching DDoS attacks. So increasingly, larger banks have taken steps to become less-appealing targets — less likely to go offline for long periods of time and more likely to retain customers thanks to helpful communications. Best practice number one: Distribute your Internet infrastructure. Separate your DNS, e-commerce, payment gateways and VPNs. If everything’s on the same infrastructure and you’re socked with a DDoS attack, the damage is more widespread and the attackers win. Say your DNS is hit. Not good, but if your VPN, for instance, is on a different circuit (either real or virtual), your staff has backdoor access to email and other functions. Because you’ve segregated your private- and public-facing systems, business doesn’t grind to a complete halt. To accomplish this, find a trusted third party to manage infrastructure like DNS. Or at least have a Plan B, enabling you to park your DNS, VPN or web service somewhere else until the attack ends. By lining up a willing provider well in advance, you’ll spare yourself some agony when the dirt hits the fan. It’s also smart to assume that someday you’re going to be hit. To paraphrase Trotsky, you may not be interested in DDoS, but DDoS is interested in you. With over 7,000 attacks daily, it’s only a matter of time, so more banks and credit unions are crafting emergency plans. Like natural disaster planning or certain business recovery efforts, these preparations go far beyond technical responses. It starts with being ready to do business, gasp, offline. If your credit union site is down, you may decide to extend your regular business hours, which in turn might require extra tellers and call center operators, or even coffee and cookies for customers in long lines. You’ll also need to let people know about any such contingencies. Be ready to communicate with customers quickly and reassuringly. Email may not be an option, so consider radio announcements or other media outlets, including a company web page separate from the one that’s under attack. Also think about a toll-free number your customers can call. How much detail should you reveal about the impact of an attack? That’s up to you, of course. Some financial institutions have chosen to say as little as possible, for fear of feeding attackers valuable information. Others have been more transparent, betting they’ll reap the reward in customer gratitude and fewer account defections. Whatever procedures you develop, be sure to practice them. You’ll never be ready for everything, but executing the basics well can help enormously. Again, the throes of a crisis aren’t the best time to white-board responses. Run drills of your emergency plan and you’ll likely accomplish two things: more effective DDoS mitigation and better core service, the latter tending to slip when attacks are all-consuming. While al Qassam is a role model for cyber miscreants, the major banks are a more positive one in the DDoS protection arena. Smaller banks and credit unions don’t have the same deep pockets, but they can still make plans, develop responses and make smart technology investments. Inertia is the one thing they truly can’t afford. For protection against your eCommerce site click here . Source: http://www.banktech.com/risk-management/financial-security-learning-from-ddos-at/240157243

View the original here:
Financial Security: Learning From DDoS Attacks

LinkedIn DDoS response botched

More than half of Linkedin’s members were knocked off the service for an extended period yesterday following a botched response to a DDOS by service provider Network Solutions. Users were redirected in error to India-based website confluence-networks.com which did not require Secure Sockets Layer connections meaning users’ cookies were sent in clear text. Initial media reports suggested the company’s DNS had been hijacked and user security potentially compromised as user’s cookies may have been visible as plain text during the outage. Linkedin subsequently confirmed on Twitter that the outage was due to human error not malice. “Yesterday’s issue was not malicious in any way It was an error by the company that manages our domain,” the statement said. In a post on its site the company claimed LinkedIn member data was not compromised. For protection against your eCommerce site click here . Source: http://www.scmagazine.com.au/News/347578,linkedin-ddos-response-botched.aspx

LulzSec Hacker Ryan Cleary To Be Released

Convicted LulzSec hacker Ryan Cleary, 21, is set to be released “imminently” after appearing Wednesday in a London courtroom for sentencing relating to charges that he made and possessed 172 indecent images of children on his PC. “Some of these images showed children aged as young as six months old in circumstances where they were completely vulnerable,” Judge Deborah Taylor told Cleary, reported The Independent in Britain. “These images were such as would make any right-minded person concerned at you viewing such images.” Cleary, aka Viral, previously pleaded guilty to two charges of making indecent images of children and one charge of possessing indecent images of children. Taylor said Wednesday that although U.K. sentencing guidelines required incarceration for the offenses to which Cleary had plead guilty, “time has been served in any event.” Based on time served, his pleading guilty to all charges filed against him and agreeing to wear an electronic device that will monitor his location, Cleary received a three-year community service order, which requires that he work in the community without pay. He also received a 36-month supervision order, which is akin to probation and requires that Cleary meet weekly with his probation officer. Finally, Cleary was ordered to sign the U.K.’s Violent and Sex Offender Register, which is a database used by police and prison officials to track people convicted of related offenses. Cleary previously appeared in court last month, when he was sentenced to 32 months in prison, followed by a five-year serious crime prevention order that can be used to restrict where he’s allowed to travel and which jobs he’ll be allowed to work. Also sentenced in May were fellow LulzSec participants Jake Davis (Topiary), Mustafa al-Bassam (Tflow) and Ryan Ackroyd (Kayla). Together with Cleary, they pleaded guilty to charges of hacking a number of sites, including the CIA, Britain’s Serious Organized Crime Agency (SOCA) and National Health Service (NHS), and Sony Pictures Entertainment, as well as leaking the credit card data and personal information of hundreds of thousands of people. Cleary also pleaded guilty to launching numerous distributed denial of service (DDoS) attacks under the banners of Anonymous, Internet Feds and LulzSec. British police said the attacks in which Cleary participated caused an estimated $31 million in damages. British police said that when they arrested Cleary at his home on June 20, 2011, they found him in the middle of launching a DDoS attack against the website of SOCA, which was conducting a joint investigation with the FBI into the activities of LulzSec, Anonymous and AntiSec. Clearly was first arrested in 2011 and released on bail, subject to his refraining from using the Internet. He was re-arrested on bail violation charges on March 5, 2012, for going online in December 2011 to contact LulzSec leader Sabu. The day after Cleary’s arrest, federal officials revealed that in June 2011, Sabu — real name Hector Xavier Monsegur — had been arrested and turned confidential government informant, and was helping the FBI investigate hackers and information security attacks. The news of Cleary’s imminent release after serving less than his full jail sentence has led some members of Anonymous to accuse him of having cut a deal with authorities, although no evidence has been produced to back up that assertion. “Anyone who gets away with child porn charges is obviously collaborating with the feds,” according to a post by “ro0ted” to the pro-Anonymous CyberGuerilla blog. Cleary’s legal troubles might not be over, as he was indicted last year by a Los Angeles federal grand jury on hacking charges. But his attorney, Karen Todner, said last year that U.S. prosecutors had indicated that they wouldn’t be seeking his extradition. Furthermore, if that changed, she said her client would fight any such request. “Cleary suffers from Asperger’s syndrome and is on the autistic spectrum and extradition to the United States is totally undesirable,” she said. Source: http://www.informationweek.com/security/attacks/lulzsec-hacker-ryan-cleary-to-be-release/240156590?cid=RSSfeed_IWK_Government

Are DDoS Attacks Against Banks Over?

Distributed-denial-of-service attacks against U.S. banks have been dormant for nearly four weeks, leading security experts to question when and if a new phase of attacks might emerge. The hacktivist group Izz ad-Din al-Qassam Cyber Fighters , which since last September has taken credit for the hits against banks, claimed its attacks were in protest of a YouTube movie trailer deemed offensive to Muslims. But some observers have speculated that Iran was backing the DDoS strikes against banks as payback for cyber-espionage attacks, such as Stuxnet, Flame and Duqu, that have over the last three years affected Iranian computer systems. Rodney Joffe, senior technologist for online security provider Neustar Inc., says the current lull could be a sign that the attacks waged by the hacktivist group are over. “It’s a wild conjecture,” Joffe says. “But we may have seen the end of them.” Joffe says indirect activity linked to the al-Qassam Cyber Fighters’ botnet, known as Brobot, has continued. But there have been no direct attacks. And that lack of activity raises questions about whether al-Qassam will wage any more attacks, Joffe says. “The botnet is no bigger than it was,” he says. “We take [compromised] machines down and then new machines keep getting adding. I still have hope that the government will have some impact or effect, but don’t know one way or the other.” The Federal Bureau of Investigation in April warned that Brobot had been modified, “in an attempt to increase the effectiveness with which the [botnet’s] scripts evade detection.” The FBI said the actors behind Brobot were changing their attack methodology to circumvent mitigation efforts put forth by U.S. banking institutions The FBI also noted that as of April 10, 46 U.S. banking institutions had been targeted by more than 200 separate DDoS attacks of “various degrees of impact” since September. Financial fraud expert Avivah Litan , an analyst at Gartner, says intervention from federal authorities may have spurred al-Qassam to halt its attacks. But, like Joffe, she says there is no way to be sure. “I do know the banks were trying to get the White House to do something politically, and that could be what’s happened.” But other experts, such as Mike Smith of Web security provider Akamai Technologies, don’t think there’s been anything going on behind the scenes to keep the attacks from resuming. Different Attack Actors Other experts anticipate that another group could emerge to resume DDoS attacks against banks if Izz ad-Din al-Qassam Cyber Fighters ends its campaigns. “There has been a lull in the al-Qassam-like attacks,” says Scott Hammack , CEO of DDoS-mitigation provider Prolexic. “But I would definitely not misunderstand this lull as being an end to these types of attacks. The attacks will continue; it’s really just a question of when, not if.” The current break comes after a third phase of hacktivist attacks, which kicked off in March. The latest campaign ran eight weeks, the longest-running so far. The break from the third phase of attacks has lasted four weeks so far. By comparison the break between the first campaign , which began Sept. 18, and the second campaign , which kicked off Dec. 10, lasted six weeks. And the break between the second and third campaigns lasted five weeks. Hammack, like Smith, says Brobot, as well as other botnets, continue to grow. In fact, over Memorial Day weekend, Prolexic helped to mitigate a 167-gigabyte DNS-reflection attack, the largest attack recorded to date, Hammack says. “The attack traffic was global and required us to use all four of our cloud-based scrubbing centers,” he says. DNS-reflection was the attack method used in Operation Stophaus , an attack waged in March by The Spamhaus Project, a Geneva-based not-for-profit organization dedicated to fighting Internet spam. And while it’s not an extremely sophisticated type of attack, Hammack says these types of DDoS strikes are only going to become more prevalent. “There are plenty of countries where rogue elements will continue to exist,” he says. “You’re never going to overcome that. I think, if anything, people should be taking advantage of this down time to fortify their infrastructures.” The application-layer attacks al-Qassam Cyber Fighters favored in its last two campaigns have remained inactive, despite that the group appears to continue efforts to grow and strengthen its botnet. “The botnets are out there,” Hanmmack says. “We have between 15,000 and 100,000 compromised web servers out there that we know of. So the artillery is still out there to create these types of attacks. We just haven’t seen any of the web server attacks for the last 30 days.” Why Have Attacks Stopped So why have the hacktivists remained quiet for the last month? On May 6, al-Qassam Cyber Fighters claimed on the open forum Pastebin that its attacks would cease for just a week, out of respect for OperationUSA , a separate hacktivist movement organized by Anonymous that proved unsuccessful Many experts predicted the group’s attacks against banks would resume by May 14. But they didn’t. Some have speculated that international law enforcement could be close to nailing members of the al-Qassam team. But Hammack says drawing conclusions based on the ebbs and flows of DDoS attacks is dangerous because hacktivists attack in waves. “Certain attacks die down after certain periods,” he says. “That doesn’t mean, though, that the attacks are over.” Banking institution leaders say they’ve been advised by groups such as the Financial Services Information Sharing and Analysis Center not to lessen their DDoS mitigation efforts. Litan says banks are heeding that advice. “The banks have more vendors involved now,” she says. “I don’t think they’ll ever pull back. They have put a lot of systems in. They really can’t go back now, and they shouldn’t.” Source: http://www.bankinfosecurity.com/are-ddos-attacks-against-banks-over-a-5801/op-1

Iranian Hackers Launching Cyber-Attacks on U.S. Energy Firms: Report

Iranian hackers launched attacks as part of a campaign against the country’s oil and gas industry, according to current and former U.S. government officials. Iranian hackers have amped up a campaign of cyber-attacks against America’s energy industry, according to a report from The Wall Street Journal . Citing current and former U.S. officials speaking under the blanket of anonymity, the Journal reported that Iranian hackers accessed control system software that could have allowed them to manipulate oil or gas pipelines. The attacks raise the stakes in cyber-space between the U.S. and Iran, which has been accused by U.S. officials of being behind a spate of distributed denial-of-service attacks (DDoS) against U.S. banks stretching back to 2012. “This is representative of stepped-up cyber activity by the Iranian regime. The more they do this, the more our concerns grow,” a source told the Journal . “What they have done so far has certainly been noticed, and they should be cautious.” Alireza Miryousefi, Iran’s spokesperson at the United Nations, denied any connection between hackers and the regime in an interview with the Journal . The officials who spoke to The Wall Street Journal did not name any of the energy companies targeted in the attacks. But two former officials said oil and gas companies located along the Canadian border were among those hit. Word of the attacks comes a week after Charles Edwards, deputy inspector general at the U.S. Department of Homeland Security, told members of a Senate subcommittee that industrial control systems were increasingly coming under attack in cyber-space in ways that could potentially cause “large-scale power outages or man-made environmental disasters.” Securing these systems is complicated, as many are more interconnected with the Internet than people realize, explained Tom Cross, director of security research at network security vendor Lancope. “It is also difficult to fix security flaws with these systems because they aren’t designed to be patched and restarted frequently,” he said. “It is extremely important,” he continued, “that operators of industrial control networks monitor those networks with systems that can identify anomalous activity that might be associated with an attack. Because of the relatively homogenous nature of network activity on many control systems networks, anomaly detection can be can be a powerful tool in an environment where other kinds of security approaches fall flat.” Much of the talk about improving the security of critical infrastructure companies has focused on information sharing between the government and private sector. Improving communication between government and business figured prominently in the executive order on cyber-security that President Barack Obama issued in February. However, many officials and security experts have said that the order does not undo the need for legislation. “The increases in cyber-assaults on our energy systems from Iranian-backed hackers are another signal to the government and the industry that measures must be taken to fortify the security of our critical infrastructure,” said Lila Kee, chief product and marketing officer at GlobalSign and a North American Energy Standards Board (NAESB) board member. “However, there is a fine line between cyber-security regulation and voluntary standards,” she said. “Regulations cannot be so rigid so as to prevent protection from today’s evolving advanced persistent threats, and voluntary standards cannot be so loose so as to provide no purpose. In today’s modern world of malware, solutions must be fluid and scalable to battle aggressive cyber-attacks.” Source: http://www.eweek.com/security/iranian-hackers-launching-cyber-attacks-on-us-energy-firms-report/

Legitimate online services enable DDoS-attacks-for-hire sites

A recent expose shines a light onto the strange world of “booter” or “stressor” web sites which offer DDoS-attacks-for-hire Is an online payment giant Paypal unwittingly enabling DDoS attacks? That’s the question posed by security researchers who have studied a small, weird corner of the market for distributed denial of service (DDoS) services: so-called “booter” or “stressor” web sites. Speaking at The Security B-Sides Boston security conference on Saturday, independent researchers Allison Nixon and Brandon Levene said that their investigation of booter sites found that many rely on legitimate online services, including Paypal to accept payment on behalf of customers interested in attacking web sites they do not own, and Cloudflare, a DDoS prevention service. The presentation was just the latest to peek into the strange world of “booter” or “stressor” web sites, which offer DDoS attacks for hire, often targeted at online gaming services popular with teenagers. In the past week, the web site krebsonsecurity.com published exposes on two such sites: assylumstressor.net and Ragebooter.net, both booter services for hire. In the process, Krebs revealed the identities of the purported owners of the sites and details of conversations he had with them about their services. In their presentation Saturday, Levene and Nixon, who assisted Krebs in his research, said that the booter sites were common online, but wholly different from the massive, 300Gbps attacks directed at Spamhaus, or the site-crippling DDoS attacks on leading banks and financial services firms like Citi, Chase, Wells Fargo and others in recent months. Rather, the services use mostly simple, reflected DNS and UDP flood attacks to knock small sites and residential home routers offline, the two researchers said. Many of the features of sites like Ragebooter.net are poorly designed or don’t work at all, said Nixon. Most victims are very often small websites hosting online gaming servers. In fact, the most reliable customers of booter sites are often other booter sites, said Nixon. The sites are not hugely profitable, but do generate some income. An analysis of data on the site Asylumstressor.com by Nixon and Levene suggest that site operators made, at most, $23,000 in 2012 – though probably much less. The sites operate more or less in the open. Speaking with Brian Krebs last week, a Tennessee man named Justin Poland, the operator of ragebooter.net, argued that the services were legal. “Since it is a public service on a public connection to other public servers this is not illegal,” Poland told Krebs in a Facebook chat. Poland even claimed to be working on behalf of the local FBI, turning over information gleaned from his service to law enforcement as needed. The Memphis FBI would not confirm or deny that Poland’s claims were true. Legal or not, most booter sites operate more or less in the open and with impunity, Nixon told an audience at B-Sides Boston, which was held at Microsoft’s New England Research and Development Center (NERD) in Cambridge. Site operators – many teenagers and 20-somethings with little technical sophistication – make little effort to conceal their identities. Paypal payments are often sent to e-mail accounts that are also associated with public Facebook profiles, making it easy to link booter sites to real world identities like Poland’s, she said. Law enforcement seems unconcerned with small scale attack sites like Ragebooter.net, or those who operate them, meaning that booter site operators continue to operate despite ample evidence about who they are and the illegal nature of their business, Nixon said. Similarly, services like PayPal and Cloudflare enable small-scale DDoS operations to continue, by turning a blind eye to the true nature of their businesses. Nixon said as many as 70 percent of booter sites use Cloudflare, a DDoS protection site. The service mainly protects booter sites from other booter sites, she said. Paypal isn’t the only online payment service, but it is easy and convenient to use and widely respected. Inexperienced booters who had to go through the trouble of setting up an account at a site like LibertyReserve might think twice, Nixon argued. In an e-mail statement to ITworld and other news outlets, Paypal said that it couldn’t discuss the specifics of customer accounts but that it “will review suspicious accounts for malicious activity and work with law enforcement to ensure cyber criminals are reported properly.” “We take security very seriously at PayPal,” the statement continued. “We do not condone the use of our site in the sale or dissemination of tools, which have the sole purpose to attack customers and illegally take down web sites.” Cloudflare CEO Matthew Prince said that his company protects millions of web sites – most of them legitimate private and public sector entities. However, his company doesn’t discriminate, and Prince admits that some sites protected by Cloudflare are troubling, including the booter and stressor sites. Cloudflare works closely with law enforcement and always responds promptly to requests for information from the courts or law enforcement offiicals. However, in the absence of any action by law enforcement, Prince said that it isn’t for him or his company to decide who to work with. “I do find it troubling when there are extralegal measures taken to determine what is and is not going on,” he said, in an apparent reference to the investigation by Krebs, Nixon and Levene. “How far do you go with that, if someone assumes XYZ shouldn’t be on the Internet? Should Google remove them from their search index?” he asked. “We believe in due process,” said Prince. Source: http://www.itworld.com/it-management/357306/legitimate-online-services-enabling-ddos-attacks-hire-sites

Read this article:
Legitimate online services enable DDoS-attacks-for-hire sites