Tag Archives: defend against ddos

HSBC Falls in Latest Bank DDoS Attacks, What’s Next?

Capital One, HSBC, Bank of America, Wells Fargo are among the near-dozen financial Websites hit by distributed denial-of-service attacks over the past few weeks. These attacks have disrupted daily operations for banks and made it difficult for customers to take advantage of online banking services. A group calling itself Izz ad-Din al-Qassam Cyber Fighters has claimed credits for most of the incidents and has named the institutions it will target a few days before launching the attacks. Even with the prior warning, Websites of some of the country’s largest firms have been affected: Bank of America, JPMorgan Chase, PNC, U.S. Bank, Wells Fargo, Sun Trust, Regions Financial, Capital One, and BB&T. Capital One Bank was hit with two separate attacks, occurring on Oct. 9 and Oct. 16. HSBC was the latest one to be hit, as its Websites suffered online outages on Thursday. A different group, Fawkes Security, claimed credit, but it’s not clear at this point whether the HSBC incident was different from the attacks against other banks or not. “This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking,” the bank said in a statement on its Website. What are DDoS Attacks? A group of computers send larger than usual volume of traffic data to Websites to tie up server resources. Websites can’t handle the high volume, either knocking it offline entirely or being available only sporadically. “You can picture a distributed denial-of-service attack as being something like 15 fat men trying to get through a revolving door at the same time. Nothing moves,” said Graham Cluley, senior technology consultant at Sophos. Often in DDoS attacks, the computers used to bombard the targeted Websites with traffic have actually been hijacked. The computers are often infected with malware that give attackers control over the computer, usually without the owner’s knowledge. In these banking attacks, however, it appears that the perpetrators have hijacked servers instead of client machines, according to recent analysis by Radware. Difficult to Repel For banking customers, these DDoS attacks are just more annoying than damaging, While online systems have been intermittently unavailable, to date, it doesn’t appear that any customer or account information at any of the banks have been exposed because of the attacks. For financial institutions, they’ve been highly disruptive, as IT departments have to deal with significantly large attacks. “These are big, but we’ve seen this big before,” said Neal Quinn, chief operating officer of Prolexic, told Wired last week. “We’ve seen events this big in the past.” Even knowing that the attacks were coming, financial institutions have been unable to keep the attacks from knocking the sites offline. Each of the targeted banks experienced several hours of downtime, although Wells Fargo seemed to have weathered the crisis a little better than others. “I don’t want to minimize the potential damage it could cause to the industry,” Wells Fargo CFO Tim Sloan told Reuters, “But in terms of how the industry performed and how Wells Fargo performed in reaction to the recent efforts, we actually performed very well.” The bank will continue to invest in ways to defend against future DDoS attacks, according to Sloan, who called it as “a cost of doing business today.” Stay On Guard Even though each of the affected institutions have assured customers that no customer or account data has been compromised, security experts warn that it’s still too early to get complacent. DDoS attacks can often be a diversion so that IT teams don’t notice other malicious activity that may be happening at the same time. Gartner’s Avivah Litan told Government Info Security that she had anecdotal accounts of fraud slipping through banks’ overloaded call centers while the online channels are under attack. It wouldn’t be the first time DDoS attacks were used to distract overloaded administrators. Back in April 2011, Sony didn’t notice the attackers breaking into Sony servers to compromise over 100 million user accounts from the PlayStation Network, Sony Online Entertainment, and Qriocity music service because it was distracted by large-scale DDoS attacks overwhelming its servers, the company said in a letter to Congress. “We are assuming that the attackers are doing this to perpetrate fraud,” Mike Smith, a security evangelist with online security provider Akamai Technologies, told Bank Info Security . Smith was specifically referring to the fact that Capital One was targeted for a second time, which may mean that attackers are looking for different ways to try to compromise employees and get access to customer accounts. “That’s the assumption we are operating under at this point,” Smith said. Source: http://securitywatch.pcmag.com/none/304145-hsbc-falls-in-latest-bank-ddos-attacks-what-s-next

See the original article here:
HSBC Falls in Latest Bank DDoS Attacks, What’s Next?

Distributed Denial of Service ‘DDoS’ Attacks Increasing In Number and Intensity

Businesses are seeing an increase of Distributed Denial of Service (DDoS) attacks in comparison to last year, with attacks becoming shorter but more robust, according to a quarterly report released Oct. 16 by DDoS mitigation company Prolexic. During a DDoS incident, an attacker prevents users from being able to access a website. In order to achieve this, he typically uses malware to infect a network of computers, or botnet. The attacker can control the botnet to overwhelm a website with data and requests, forcing it to crash or become slow to the point of being unusable. For businesses, DDoS attacks can be crippling, resulting in a loss in profit or customer service until the website can be restored. Prolexic’s report found DDoS incidents have increased by 88 percent when compared to the same period of time last year. Perhaps more troubling, the incidents are becoming more intense, using higher bandwidth volumes. Prolexic President Stuart Scholly said that on average the company is seeing attacks with a bitrate of 20 gigabites per second or more every eight days. Few enterprises have networks with the capacity to withstand attacks of that size, he added. China continues to be the top source country for attacks, responsible for about 35 percent, with the United States following with 27 percent, the report found. Although the United States was the source country for only 8.76 percent of attacks last quarter, Scholly said the United States is typically the second-ranked source country after China. “Twenty gigs is the new norm,” he said. “There’s no doubt in my mind that that trend continues.” A DDoS toolkit called “itsoknoproblembro” was responsible for the majority of the high bandwidth floods this quarter, the report stated. The toolkit is especially effective because it targets vulnerable servers instead of individual computers, making the botnet easier to control and yielding a higher bandwidth, Scholly said. “What might have taken 50,000 compromised home machines before might only take a couple thousand servers now,” he said. “And it’s easier to coordinate the activities of a couple thousand high capacity machines.” The toolkit has been linked in reports to the suspected attacks on financial institutions during September, but Scholly would not comment on what companies were attacked, citing customer privacy. “What I can tell you is that this toolset is something that we’ve been observing over the years, and we’ve seen it used in multiple sectors,” he said. “It was has by no means been targeted at one individual sector.” Scholly would also not comment on what actors were responsible for the toolkit. Motivation for attacks can vary from state-sponsored activities, competing companies trying to get an economic advantage, or the overloading a server as a means of social protest, he said. Another continuing trend is the growing popularity of shorter attacks, Scholly said. “The more you expose your botnet during an attack, the greater likelihood that you have for someone to start taking it down,” he said. “So you want to accomplish your goal, and then kind of move on.” For DDoS protection against your eCommerce site please contact us . Source: http://www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx?List=7c996cd7-cbb4-4018-baf8-8825eada7aa2&ID=929

View original post here:
Distributed Denial of Service ‘DDoS’ Attacks Increasing In Number and Intensity

More Banks Come Under Denial-of-Service Attack

Capital One and SunTrust came under attack this week using denial-of-service techniques that are evading defenses meant to blunt such attacks. Capitol One and SunTrust Banks have become the latest targets of hackers who have leveled attacks at U.S. financial institutions in alleged retaliation for the posting of a movie on YouTube that has offended some Muslims. On Oct. 8, a group calling itself the Izz ad-Din al-Qassam Cyber Fighters posted a message on Pastebin stating that Capital One, SunTrust Banks and Regions Financial would each suffer an eight-hour attack starting with Capital One the next day. Even with the advanced warning, the financial institutions suffered outages, with Capital One’s site frequently inaccessible during the eight-hour period. “Some Capital One customers experienced intermittent online access due to a large volume of traffic going to the Website and servers,” the bank said in a statement posted to its Web site. ”Other banks have experienced similar issues in recent weeks due to targeted efforts designed to flood online systems, also known as a distributed denial-of-service attack.” On Oct. 10, SunTrust Banks suffered some performance issues, as did Regions Financial the next day, according to media reports. The attacks are the latest data floods in a campaign that started in mid-September. Under the name “Operation Ababil,” a group of alleged Iranian protestors called for supporters to attack the Bank of America, JPMorgan, Citigroup and Wells Fargo. Yet the crowd-sourced hacktivism effort caused little damage. Instead, a second attack coming from hundreds—or at most, thousands—of compromised servers made up the most effective part of the data flood. Using compromised servers and customized malware, the attackers have hit targeted sites with between 70G bps and 100G bps of peak traffic, according to experts. The attacks—launched from servers used to publish corporate Websites and blogs but running vulnerable content management software—sent packets of data crafted to evade typical defenses, even those specifically designed to curtail denial-of-service (DoS) attacks. “They had far fewer machines involved and with much larger bandwidth,” Dan Holden, director of security for network-protection firm Arbor Networks, said of the earlier attacks. “These are Web or hosting servers that have been compromised and are obviously poorly administered.” Typical defenses against distributed denial-of-service attacks attempt to minimize the impact of an attack by intercepting the request as far away from the target Website as possible. By blocking attacks in other networks, the customer is not impacted by a massive influx of data. However, the latest attacks are using evasion techniques to get around standard denial-of-service defenses, said Phil Lerner, vice president of technology at security firm Stonesoft. By crafting the data to look like valid encrypted Web requests, the network packets are allowed to get through to the customers’ own computers to decipher the information. Even if that system blocks the request as invalid, the avalanche of data buries the computer, which can’t keep up. “DDoS [distributed denial-of-service] mitigation is not a cure-all,” Learner said. “You don’t have enough protocol decoding capabilities, and you are only doing partial defenses, or none at all, on the evasion detection.” Companies need to adopt security defenses that handle such evasion techniques, he said. In July, a researcher at cloud-security firm Qualys demonstrated that evasion techniques can cause problems for Web application firewalls (WAFs) as well. A variety of tricks, sometimes just adding a single character, could bypass the security offered by WAFs, according to the research. Source: http://www.eweek.com/security/more-banks-come-under-denial-of-service-attack/

View original post here:
More Banks Come Under Denial-of-Service Attack

U.S. banks warned of another Distributed Denial of Service ‘DDoS’ attack

Just as one type of attack against U.S. banks has subsided, the banks are being warned to get ready for another, called “Project Blitzkrieg,” aimed at online theft. Iran denies launching cyberattacks on U.S. banks The distributed-denial-of-service (DDoS) attacks that briefly disrupted the online services of a half-dozen major financial institutions late last month — Wells Fargo, U.S. Bancorp, PNC Financial Services Group, Citigroup, Bank of America and JPMorgan Chase — ended abruptly about two weeks ago, even though the group that claimed credit for them had threatened to continue them. Izz al-Din al-Qassam Cyber Fighters, the military wing of Hamas, the Islamic party that governs the Gaza Strip, had said in a Pastebin message that the attacks would continue until a trailer of the independent film “Innocence of Muslims,” which they said insults the prophet Mohammed, was taken off the Internet. But now, says a blog post by Mor Ahuvia, cybercrime communication specialist at security firm RSA, another wave of attacks is looming, this one aimed at stealing big money. “A cyber gang has recently communicated its plans to launch a Trojan attack spree on 30 American banks as part of a large-scale orchestrated crimeware campaign,” Ahuvia wrote. “Planned for this fall, the blitzkrieg-like series of Trojan attacks is set to be carried out by approximately 100 botmasters. RSA believes this is the making of the most substantial organized banking-Trojan operation seen to date.” RSA said the gang leadership appears to come from Russia, and plans to use a “Gozi-like Trojan” that RSA is calling Gozi Prinimalka. Prinimalka is derived from the Russian word meaning “to receive.” “According to underground chatter, the gang plans to deploy the Trojan in an effort to complete fraudulent wire transfers via Man-In-The-Middle (MiTM) manual session-hijacking scenarios,” Ahuvia wrote. “If successfully launched, the full force of this mega heist may only be felt by targeted banks in a month or two. The spree’s longevity, in turn, will depend on how fast banks and their security teams implement countermeasures against the heretofore-secret banking-Trojan,” she wrote. Brian Krebs, who writes the blog KrebsonSecurity, said in a recent post that the RSA analysis “seemed to merely scratch the surface of a larger enterprise that speaks volumes about why online attacks are becoming bolder and more brash toward Western targets.” But he also said this particular threat could be a hoax — that there is some suspicion in the cybercrime world that it could be a sting operation by Russian law enforcement, since the announcement has been so public. Krebs said the threat appears to be coming from a series of posts on Underweb forums by a Russian hacker nicknamed “vorVzakone.” His name translates to “thief-in-law,” which Krebs said, “in Russia and Eastern Europe refers to an entire subculture of elite criminal gangs that operate beyond the reach of traditional law enforcement. The term is sometimes also used to refer to a single criminal kingpin.” Krebs said vorVzakone called the campaign “Project Blitzkrieg,” and according to a translation of one of his messages, said he hopes to recruit 100 botmasters to take advantage of authentication weaknesses in U.S. bank systems before they can improve their protection. The botmasters would have to qualify with an online interview and be trained, and would then get to share in the profits. In vorVzakone’s message, he said: “The development of the system took 4 years of daily work and around $500.000 was spent. Since 2008 by using this product not less than $5m was transferred just by one team.” Jason Healey of the Atlantic Council, a cybercrime expert and former White House security official, said it sounds to him like the group is “trying to be the Russian online equivalent of Ocean’s Eleven — call it Ocean’s Odinnadsat’ — or a group that wants to be seen in that light. They can get some cool points, either way.” Most security experts say the financial sector is the best prepared of any in the U.S. to deal with direct attacks. But these attacks will, of course, not be aimed directly at the banks, but at their customers. And vorVzakone also wrote that the operation will flood cyberheist victim phone lines while the victims are being robbed, in an effort to prevent account holders from receiving confirmation calls or text messages from their banks.” In an interview, Brian Krebs said cyber thieves, “almost always target the line of least resistance, and that is the customer. That doesn’t excuse the banks from their obligation to be constantly upgrading their defenses against such attacks. There are thousands of financial institutions in the U.S. and many of them are woefully behind in updating their customer-facing security measures.” He noted that banking law does not protect commercial and business customers at the same level as individual customers, and said banks need to do much better at flagging abnormal transaction behavior, such as, “a sudden addition of many new employees to an organization’s payroll, particularly if those people are spread all over the country geographically.” “You’d be amazed at how many times a month some bank lets this happen, and with disastrous results,” Krebs said. Still, if vorVzakone and his presumed colleagues are serious about their plan, why broadcast it so blatantly? Is that an indication that the whole thing may be a fraud? Krebs said there is reason for skepticism, noting in his blog post that vorVzakone even posted a homemade movie on YouTube, in which he. “introduces himself as ‘Sergey,’ the stocky bald guy in the sunglasses. He also introduces a hacker who needs little introduction in the Russian underground — a well-known individual who used the nickname ‘NSD.’” Krebs then quotes one Russian expert saying vorVzakone’s “language and demeanor is that of street corner drug dealer or a night club bouncer,” not someone who can organize and run a sophisticated cyberheist operation. Krebs himself is not quite as harsh, but said such projects “are announced all the time on the underground, but usually they are in fairly closed, secretive forums. The forums on which this project was announced were moderately secret, but it’s fairly unusual for miscreants to create YouTube videos of such projects and to promote them so openly.” Healey said the public bragging is a mistake. “To succeed with a Trojan, you want it to be somewhat secret with few people involved,” he said. “The few who are involved should be well known and trustworthy. That is the opposite of what Ocean’s Odinnadsat’ has done.” He said that and the fact that they are recruiting people who may be unknown to them “makes it more likely that the intel and threat companies, and law enforcement, can get the code beforehand.” Another problem that could undermine the operation is simple organizational weaknesses. “My sense is that such a project would require a decent amount of operational cohesion and security, and cooperation,” Krebs said. “From what I’ve seen of the underground, the more people you involve in a scheme, the more likely it is to fall apart.” But he said whether this threat is real or not, the need for protection is crucial. The best way for customers to avoid theft is to prevent their computer from being infected. “The trouble is,” Krebs said. “It’s becoming increasingly difficult to tell when a system is or is not infected. That’s why I advocate the use of a Live CD approach to online banking. That way, even if the underlying hard drive is infected with a remote-access, password stealing Trojan like Gozi, your online banking session is protected.” Source: http://www.networkworld.com/news/2012/101012-us-banks-warned-of-another-263227.html?page=1

Continue reading here:
U.S. banks warned of another Distributed Denial of Service ‘DDoS’ attack

Rise in DDoS Attacks, Video Streaming, Over-The-Top Conte

NTT America, a wholly owned U.S. subsidiary of NTT Communications Corporation(NTT Com) and a Tier-1 global IP network services provider, today issued its biannual state of the industry assessment of key trends shaping the broadband and IP transit industry. Michael Wheeler, executive vice president, NTT Communications Global IP Network, NTT America, said preparing Latin America for increased broadband data consumption is a priority, especially as Brazil readies for the 2014 World Cup and 2016 Summer Olympics. Additionally, demand for real-time mobile content and the rise of sophisticated DDoS attacks are other key factors changing the Internet industry. Focus Increases on Developing Brazil’s Telecom Infrastructure as World Cup and Olympics Approach As Brazil prepares for the 2014 FIFA World Cup and 2016 Summer Olympic Games, the biggest hurdle facing the country is developing its telecommunications infrastructure to improve Internet access and bandwidth capacity, according to Wheeler. Telebrás, Brazil’s state-owned service provider, is investing upwards of $400 million dollars (BRL) in the next few years to steer growth and development. As a result, domestic and international carriers are crucial in supporting the Brazilian government to meet the cellular and Internet data needs. These World Cup and Olympic events will represent the first time video content will originate from Brazil and be streamed out in such large numbers globally. NTT Communications was recently awarded a contract by Telebrás as one of two international carriers that will enable São Paulo residents to connect to international markets through a high quality network. NTT Communications was selected due to its direct access to major markets around the world and Point of Presence (POP) location in São Paulo. “Consumption of mobile video and other forms of over-the-top content will continue to grow exponentially through 2016. While most users don’t realize how demanding these service requirements are on providers, new technologies will be the driving force for developing the next-generation Internet services in both wireless and wireline,” said Wheeler. “Successful service providers will have an established infrastructure of high bandwidth, next-generation equipment and industry expertise to manage dynamic content demands.” Video Streaming and Chatting on Mobile Devices Soars; Demands Greater Expectations of Carriers The number of devices connected to IP networks will be nearly three times as high as the global population in 2016, according to a recent report from Cisco. Driven in part by the increase in devices and the capabilities of those devices, the same report concludes that IP traffic per capita will be the equivalent of all movies ever made crossing global IP networks every three minutes in 2016. In terms of consumer Internet traffic categories, Cisco estimated mobile video consumption to grow 83 percent through 2016, and online gaming is estimated to grow by 46 percent by 2016. “This generational consumption shift in Internet-based activities is changing how carriers design networks to provide the best possible user experience,” said Wheeler. “While most don’t realize how demanding these services are on providers, new technologies will be the driving force for developing the next-generation Internet services. Successful service providers will have an established infrastructure of high bandwidth, next-generation equipment and industry expertise to manage dynamic content demands.” Given the increase in over-the-top (OTT) content, the optimal network architecture that is flexible in shaping bandwidth for content distribution and delivery worldwide are fundamental to containing costs. The services Tier-1 providers offer are key to providing high-quality bandwidth and capacity to support the demand for OTT content. NTT Communications’ high level of redundancy, industry leading uptime and extensive network of peering partners can help customers prepare for this growth. DDoS Attacks Grow, Posing a Constant Financial Threat to Online Businesses With more than 7,000 attacks reported daily worldwide, distributed denial of service (DDoS) threats continue to rise in number, size, frequency and complexity. The business costs associated with DDoS attacks are substantial for any online entity. As research from industry reports indicate, monetary losses from a DDoS attack can range from $90,000 to $6.5 million per hour. Despite the growing threats, protection and mitigation efforts of many global companies, government entities and advocacy groups remain inadequate and antiquated. As DDoS attacks become more sophisticated, proper mitigation is critical. Wheeler urges businesses to prioritize a contingency plan for DDoS attacks. When companies select their mitigation service provider, it is important to understand the level and type of security support provided. “While many DDoS mitigation services are entirely automated, and as attacks become more sophisticated, the need for expert human judgment and monitoring are a necessity in determining the legitimacy of traffic,” said Wheeler. “At NTT America, our US based Security and Abuse Team is working 24 hours a day, 7 days a week, assuring that online assets and network availability are aggressively protected.” For immediate DDoS protection against your eCommerce site click here . Source: http://www.dailyfinance.com/2012/10/03/ntt-america-addresses-top-internet-trends-rise-in-/

Read this article:
Rise in DDoS Attacks, Video Streaming, Over-The-Top Conte

New Bank Attacks Expected Today?

Is another wave of distributed denial of service attacks imminent? For the past two weeks, DDoS attacks that caused online outages at several major U.S. banks started on Tuesday mornings and ended by Friday afternoons, says Mike Smith, a senior security evangelist at Akamai Technologies, an Internet platform provider. Smith and other security experts are standing by to see if this week brings a third round of attacks. While they wait, these thought-leaders offer insights in response to these outstanding questions: Why were banks unable to stop the DDoS attacks from causing outages? What steps should banks and other organizations take now to prepare for additional attacks? Technology does play a role in thwarting such attacks, says Smith, who also blogged about the attacks. But a renewed focus on information sharing is the best investment an organization can make, he says. “Packet captures from the attack traffic we shared with our customers, for instance, allowed them to build IDS [intrusion detection system] signatures, so when they first start to receive that traffic, they can block it,” he says. Why Attacks Succeeded DDoS attacks are not new – they have been around since at least 2001. Simply defined, a DDoS attack usually involves an external party saturating a targeted website with traffic until the site’s servers are overloaded, ultimately rendering the site unable to respond and unavailable. This is what happened to the banks, whose customer-facing websites subsequently faced varying degrees of unavailability. Yet as Anton Chuvakin, a security analyst at Gartner, pointed out in May, DDoS attacks seem to have become a “forgotten area” of security – until the latest string of incidents. “Denial-of-service attacks, in general, cannot be stopped,” Chuvakin says. “If their entire network connection is full of traffic, nothing they do on their own will remove the flood.” The recent wave of attacks is unique for its scale, Smith says. The average online user in the United States and Western Europe uses about 1 megabyte per Internet node per second. “Even at the height of the Anonymous attacks, we saw traffic coming in from 7,000 or 8,000 people [at approximately 1 gigabyte per second] involved in attacks at any given time,” he says. “That’s a lot.” But in the most recent attacks, the traffic coming in was the equivalent to about 65 gigabytes per second, Smith says. “A typical DDoS attack waged by a hacktivist group looks much different than what we saw here,” he says. “You would expect less than 1 gbps [gigabyte per second] of attack traffic for the average hacktivist, and would expect peaks up to, maybe, 2 gbps.” Avivah Litan, fraud analyst at Gartner who blogged about the attacks, says, based on what she’s been told, the attacks together added up to 100 gigabytes of traffic. “The leading DDoS prevention software, more or less, stops working when the attacks get larger than 60-70 gigabytes,” Litan writes. “The major ISPs only have a few hundred gigabytes bandwidth for all their customers, and even if they added more on to that, the hacktivists could quickly and easily eat the additional bandwidth up.” Where Did Attacks Originate? Recent attacks have been attributed to Izz ad-Din al-Qassam. But this group, which in the past has been known to support Hamas, has not historically been affiliated with hacktivism, says Bill Wansley, a fraud expert at financial-services consultancy Booz Allen Hamilton. “All of the sudden, for them to become a hacktivist group, it’s just really interesting,” Wansley says. “We’ve never seen that before” (see More U.S. Banks Report Online Woes). Thus, determining, with any certainty, who or what is actually behind the attacks has proven difficult. “There are indications it’s an Iranian group,” Wansley says, based on the IP addresses linked to the attack and the timestamp of the attacks. These latest attacks are unlikely to be the product of traditional hacktivists, experts say, citing this evidence: The sheer number of hits seem too large to be waged by social or political hacktivists. “The volume of the traffic is far higher than what we normally see,” Smith says. During a typical hacktivist attack, variations in the site traffic are evident. “The attacks in this case were homogeneous, which is not typical,” Smith says. “The traffic looked the same.” And there wasn’t a lot of bragging going on after the attacks, either, which also is typical in a hacktivist event. “The attacks are unique and seem to have a different character than previous [hacktivist] attacks,” Wansley says. How Can Organizations Respond? Although U.S. banks have been the initial targets of the latest DDoS attacks, experts say all organizations should be on notice: They could be next. Gregory Nowak, a principal research analyst for the Information Security Forum, says security leaders need to realize that these incidents are ideological attacks against the U.S. “The attacks have nothing to do specifically with the activities of these banks – they were innocent bystanders,” Nowak says. “The message is: This can happen to any organization, and they need to consider [hacktivism response] as part of their risk management” (see Banks Under Attack: PR Missteps). So, what can organizations do to prepare? Litan says DDoS is not an issue any individual organization can control. “It’s a networking bandwidth and network security software issue,” she says. “Simply put, the DDoS prevention software can’t handle this large of an attack, in terms of the bandwidth it consumes.” Among the steps organizations can take: Protect default online pages or homepages. “This is the page most commonly attacked in a DDoS and can be easily protected with basic caching,” Smith says. Communicate with ISPs about suspicious traffic. “The [organization] has to work with its ISP, and potentially other ISPs, to see if the ISP can identify the traffic before it gets to the website and drop it earlier in its travels,” says Alex Horan of CORE Security, an online security firm that specializes in vulnerability assessment and testing. “But the [organization] doesn’t want to accidently drop legitimate traffic when doing that, so it has to be very cautious.” But organizations also must know the privacy limitations ISPs face when it comes to blocking or removing computers or users linked to attacks. “We need every ISP to be able to work together,” Horan says. “While this appears to be in the ISPs’ favor, most would be reluctant to do it, as it would mean they would have to inspect the packets sent by their customers, and it could very easily be seen as an invasion of privacy.” What’s Next? DDoS attacks occur on a daily basis, Smith notes. So Institutions and others need to focus on intrusion detection and DDoS attack identification. ISPs also should have mechanisms in place to block DDoS attacks. “That way, they limit an attack against one customer and limit the impact to their other customers,” Smith says. “The ISP is the conduit; they are at risk, and they know this. That’s why they also usually offer protective services.” If the ISP with which an institution works does offer protective services, banks and others should take advantage, Smith says. But if the ISP doesn’t offer protective services or does not have the ability to filter traffic, the institution can at least block traffic coming in from IP addresses identified as being connected to an attack. Information sharing between banking institutions and among institutions, ISPs, law enforcement and third-party vendors is critical. “The attackers will change,” Smith says. “Understanding how those attacks are changing is critical.” For now, however, experts are anxious to see if the wave of attacks that targeted banks the last two weeks will continue. “What does this week hold?” Smith asks. “We’ll soon know if the pattern will continue.” For immediate DDoS protection click here . Source: http://www.bankinfosecurity.com/new-bank-attacks-expected-today-a-5155/p-2

Continued here:
New Bank Attacks Expected Today?

Bank Of America Website Slows After Islamic Hacker Threats

Bank of America’s website experienced periodic outages Tuesday, possibly due to cyber attacks launched in retaliation for “Innocence of Muslims,” the amateurish film whose mocking portrait of the Prophet Muhammad has incited deadly riots throughout the Middle East. The attack was foretold by a Pastebin.com message posted earlier in the day. Allegedly authored by “Cyber fighters of Izz ad-din Al qassam,” a reference to the military wing of Hamas, the posting also declared that the New York Stock Exchange would suffer a similar assault–a threat that has evidently gone unfulfilled. The posting blamed both the United States and the “Zionist Regime” for the offending film and promised continued aggression until the “erasing of that nasty movie,” which YouTube has blocked in volatile regions but which remains freely accessible elsewhere. The initial targets were chosen, the posting declares, because they “are properties of America-Zionist Capitalists.” Bank of America told Reuters that the website had suffered some problems but was available to customers. “We are working to ensure full availability,” Mark Pipitone, a bank spokesman told Reuters. Without specifically commenting about a possible denial-of-service attack, Pipitone said: “I can tell you that we continuously take proactive measures to secure our systems.” The New York Stock Exchange, operated by NYSE Euronext, declined to comment, Reuters reported. Bill Pennington, chief strategy officer at WhiteHat Security, said in an interview that Bank of America’s website problems do not necessarily verify the Pastebin claims. Stating that “it’s reasonable to believe it could be coincidence,” he cited the recent GoDaddy outage, which saw hackers attempt to take responsibility for what was in fact a series of internal technical errors. Nonetheless, he said the incident could have been a denial-of-service attack. “They’re pretty easy,” he stated. “You can rent computing resources from various botnets for almost pennies on the dollar.” Even if one lacks the technical sophistication to launch an attack, simply announcing malicious goals can be enough, he said. Groups such as Anonymous, for example, can take down a site not merely through the efforts of active members and sympathizers but also “a bunch of people watching, generating traffic” while they wait to see what happens. Additional risks, he said, include unaffiliated groups that “hop into” the fray, knowing that scrambling companies will find it “very difficult to pick out” attackers. Pennington cautioned that companies need to be aware that cyber attacks are part of “the landscape we live in today.” He said that many organizations have done their parts, declaring that security concerns–once the purview of “geeks in the IT department”–are now addressed by executives in boardrooms. Each second a site like Bank of America’s is offline, he explained, the company loses money, so “business people are starting to understand … what would actually happen if their site is largely unavailable for three days.” Security-minded companies can thwart DDoS attacks “to some extent,” he said, but “it’s really hard to build an infrastructure” that won’t be overwhelmed by a massive attack. “If a million people log on right now, they’re going to have a problem,” he stated. Efforts to block coordinated DDoS attacks are hampered by the relatively unimposing nature of the devices that hackers sometimes employ. A phone has less computing power than a laptop, for example, but Pennington said “if all it needs to do is make an http request every second, and you have all the phones in the world doing that, it becomes difficult to withstand. There’s only so much you can do.” Indeed, while it is unlikely that an attack could actually harness billions of phones, hackers and malware authors have continually carved out new methods for creating botnets and the brute computing force that comes with them. Even Macs, once all-but-immune to nefarious intruders, can be reduced to “zombie” machines via illicit toolkits that are so cheap as to remove all barriers to entry. Bank of America’s situation still poses more questions than answers, with only the perpetrators and, possibly, the victims fully aware of what transpired. Details should emerge in the coming days, but Pennington said businesses should expect more attacks, no matter the veracity of the Pastebin claims. “It’s probably going to get worse before it gets better,” he said. Source: http://www.informationweek.com/security/attacks/bank-of-america-website-slows-after-isla/240007581?cid=edit_stub_WST

More:
Bank Of America Website Slows After Islamic Hacker Threats

DDoS attack on GoDaddy takes down millions of websites

A massive DDoS attack struck GoDaddy’s name servers today, temporarily plunging thousands of websites into the internet abyss. “GoDaddy, the massive Web hosting company, went down on Monday, taking an untold number of websites with it,” reported CNN. Mashable.com reported, “The more problematic part is that any domain registered with GoDaddy that uses its nameservers and DNS records are also down. This means that even if you host your site elsewhere, using GoDaddy for DNS means it is inaccessible.” PC World reports: “In a YouTube video (http://www.youtube.com/watch?v=SPGBZWGUE2g), secretive hacking group Anonymous has taken credit for the outage, claiming the move is a reaction to the company’s support of the U.S. government’s efforts “to censor and control the Internet,” through its support of the Stop Online Privacy Act (SOPA).” But claiming Anonymous did this attack may be false, it turns out. The apparent attacker said, himself, that he was not affiliated with the Anonymous collective: “It is not Anonymous collective it’s only me. Don’t use Anonymous collective name on it, just my name,” wrote Twitter user Anonymous Own3r. (http://www.foxnews.com/tech/2012/09/10/every-godaddy-registered-site-…) Most likely scenario? A false flag cyber security attack in order to provide the excuse for Obama to sign a freedom-killing executive order focused on “cyber security.” The attack has taken down GoDaddy’s website, DNS servers, phone support and email accounts. It’s almost as if a nuclear bomb went off at GoDaddy headquarters. This attack appears to be hugely successful from the point of view of Anonymous hackers, although it’s not clear why GoDaddy was targeted in particular. GoDaddy manages 48 million domains spanning more than 9 million customers. The failure of its DNS likely means that millions of websites were taken offline. Domain Name Servers are a known vulnerability Domain Name Servers are a well-known vulnerability of the internet infrastructure. As this attack by Anonymous has masterfully demonstrated, DNS provides a centralized single point of attack that, if penetrated, can bring down literally millions of websites. DNS also provides a single point of government seizure, where rogue governments that hate free speech can take control over websites by commandeering their DNS records. For these reasons, you need to know how to reach NaturalNews.com even if DNS is compromised There is a workaround to DNS. You can bypass it and go straight to NaturalNews by simply entering the following “IP address” into your browser: 174.132.185.226 This is the equivalent of typing “NaturalNews.com” into your browser and it will work even if Domain Name Servers are being hacked or seized. This IP address will take you right to our website. It is our “digital address” recognized by all web browsers. WRITE THIS NUMBER DOWN on a piece of paper and carry it in your wallet or purse. Even if the Domain Name Servers are illegally seized by the government in an assault on the freedom of the press — or if they’re brought down by hackers as was demonstrated today — you can still use the IP address to reach us. If NaturalNews.com appears to be unreachable during a crisis event, revert to using the numbers instead of the name, and the site will likely respond. An even better way: Subscribe to our email newsletter An even better way to make sure you can hear from us is to subscribe to our FREE email newsletter (see subscription form below). Email is virtually impossible for anyone to block. Unless there’s a nuclear holocaust or something, we will always be able to email you with the latest alerts and information, even if our web servers are hacked or physically taken offline. Even if you don’t want to read our email newsletter each day, simply staying subscribed is valuable because we will be able to reach you with urgent alerts about what’s really happening. We don’t sell email addresses to anyone. Your privacy is completely protected, and you can unsubscribe at any time. Subscribing to our email newsletter is your way of allowing us to reach you even in a crisis, a seizure, or a hack attack. For fast DDoS protection against your eCommerce site click here . Source: http://www.naturalnews.com/037140_DDoS_attack_GoDaddy_Domain_Name_Servers.html

View article:
DDoS attack on GoDaddy takes down millions of websites

Teenager who launched Distributed Denial of Service ‘DDoS’ attack on high profile websites says life is ‘serene’ offline

A Scots teenager who admitted hacking into the websites of the Serious Organised Crime Agency (Soca) and other prominent organisations said life is “serene” without access to the internet. Jake Davis, 19, admitted conspiring to carry out a “denial of service” attack on the crime agency at Southwark Crown Court in June. He also admitted hacking the NHS website. Davis, from the island of Yell, faced five charges following a Met Police investigation into the hacking groups LulzSec and Anonymous. The groups have been linked to a number of cyber-attacks on government agencies and multi-national companies. LulzSec has also been linked to hacking attempts on Sony and The Sun newspaper. Davis told the Observer newspaper: “The last time I was allowed to access the internet was several moments before the police came through my door in the Shetland Isles, over a year ago. One of my co-defendants and I have also been indicted with the same charge in the United States, where we may possibly be extradited, and if found guilty I could face several decades in an American prison. “Now I am on conditional bail and have to wear an electronic tag around my ankle. I’m forbidden from accessing the internet. “I’m often asked: what is life like without the net? It seems strange that humans have evolved and adapted for thousands of years without this simple connectivity, and now we in modern society struggle to comprehend existence without it. In a word, life is serene. “I now find myself reading newspapers as though they weren’t ancient scrolls; entering real shops with real money in order to buy real products, and not wishing to Photoshop a cosmic being of unspeakable horror into every possible social situation. Nothing needs to be captioned or made into an elaborate joke to impress a citizenry whose every emotion is represented by a sequence of keystrokes.” He added: “Things are calmer, slower and at times, I’ll admit, more dull. I do very much miss the instant companionship of online life, the innocent chatroom palaver, and the ease with which circles with similar interests can be found. Of course, there are no search terms in real life – one actually has to search. However, there is something oddly endearing about being disconnected from the digital horde. “It is not so much the sudden simplicity of daily life – as you can imagine, trivial tasks have been made much more difficult – but the feeling of being able to close my eyes without being bombarded with flashing shapes or constant buzzing sounds, which had occurred frequently since my early teens and could only be attributed to perpetual computer marathons. “Sleep is now tranquil and uninterrupted and books seem far more interesting. The paranoia has certainly vanished. I can only describe this sensation as the long-awaited renewal of a previously diminished attention span.” He said people’s attentions spans had suffered since the advent of the internet. “A miracle cure or some kind of therapeutic brilliance are not something I could give, but I can confidently say that a permanent lack of internet has made me a more fulfilled individual. And as one of many kids glued to their screens every day, I would never before have imagined myself even thinking those words. “Before, the idea of no internet was inconceivable, but now – not to sound as though it’s some kind of childish and predictable revelation spawned as a result of going cold turkey – I look back on the transcripts of my online chats (produced as legal evidence in my case, in great numbers) and wonder what all the fuss was about.” He added that he hoped others involved in the hacker community could take a short break from the internet to see if they could feel similar effects adding he had “forgotten how easy it was simply to close a laptop lid”. For fast DDoS protection against your eCommerce site click here . Source: http://news.stv.tv/north/189464-teenager-who-hacked-major-websites-says-life-is-serene-without-web-access/

See the original post:
Teenager who launched Distributed Denial of Service ‘DDoS’ attack on high profile websites says life is ‘serene’ offline

Arizona man sentenced for Distributed Denial of Service ‘DDoS’ attack

A man who was reportedly part of one of the first “DDOS-for-hire” electronic attack hit squads will serve two-and-a-half years in prison for selling access to malware-infected computers. Joshua Schichtel, 30, of Phoenix, AZ, was sentenced on Sept. 6 to 30 months in prison for selling command-and-control access to, and use of, thousands of malware-infected computers, announced Assistant Attorney General Lanny Breuer of the Justice Department’s Criminal Division and U.S. Attorney for the District of Columbia Ronald Machen, Jr. Schichtel was also ordered to serve three years of supervised release. Schichtel pleaded ea on August 17, 2011, to one count of attempting to cause damage to multiple computers without authorization by the transmission of programs, codes or commands, a violation of the Computer Fraud and Abuse Act. Schichtel was allegedly part of one of the first “DDOS-for-hire” rings uncovered in 2004. He was caught up in an investigation into a Massachusetts businessman’s scheme to launch an organized Distributed Denial of Service (DDOS) attack on his competitors by hiring hackers who knew how to perform the electronic assaults. According to court documents, Schichtel sold access to “botnets,” which are networks of computers that have been infected with a malicious computer program that allows unauthorized users to control infected computers. Individuals who wanted to infect computers with various different types of malicious software (malware) would contact Schichtel and pay him to install, or have installed, malware on the computers that comprised those botnets. Specifically, said the documents, Schichtel pleaded guilty to causing software to be installed on approximately 72,000 computers on behalf of a customer who paid him $1,500 for use of the botnet.

Visit site:
Arizona man sentenced for Distributed Denial of Service ‘DDoS’ attack