Tag Archives: defend against ddos

Distributed Denial of Service `DDoS` mitigation a key component in network security

`Attacker motivations behind distributed denial-of-service attacks (DDoS) have shifted away from solely financial (for example, the extortion of online gambling sites and retailers) toward socially and politically motivated campaigns against government websites, media outlets and even small businesses. Hacktivist collectives such as Anonymous, LulzSec and others have used DDoS attacks to damage a target’s reputation or revenue since December 2010 when Anonymous began targeting corporate websites that opposed Wikileaks. At that time, attacks were conducted using botnets to flood sites’ servers with large quantities of TCP or UDP packets, effectively shutting down the sites for hours at a time. Today, botmasters have begun to use more complex strategies that focus on specific areas of the network, such as email servers or Web applications. Others divert security teams’ attention with DDoS flood attacks while live hackers obtain the actual objective, valuable corporate or personal information. This tactic was utilized in the infamous attack against Sony in 2011, according to Carlos Morales, the vice president of global sales engineering and operations at Chelmsford, Mass.-based DDoS mitigation vendor Arbor Networks Inc. Rapid growth in the sophistication of DDoS attacks combined with the prevalence of attacks across markets makes for a dangerous and fluid attack landscape. Security researchers and providers agree that it’s becoming more important for companies to protect themselves from denial-of-service attacks, in addition to implementing other measures of network security. DDoS attacks can quickly cripple a company financially. A recent survey from managed DNS provider Neustar, for example, said outages could cost a company up to $10,000 per hour. Neustar’s survey, “DDoS Survey Q1 2012: When Businesses Go Dark” (.pdf), reported 75% of respondents (North American telecommunication, travel, finance, IT and retail companies who had undergone a DDoS attack) used firewalls, routers, switches or an intrusion detection system to combat DDoS attacks. Their researchers say equipment is more often part of the problem than the solution. “They quickly become bottlenecks, helping achieve an attacker’s goal of slowing or shutting you down,” the report stated. “Moreover, firewalls won’t repel attacks on the application layer, an increasingly popular DDoS vector.” For those reasons, experts suggest companies with the financial and human resources incorporate DDoS-specific mitigation technology or services into their security strategy. Service providers such as Arbor Networks, Prolexic and others monitor traffic for signs of attacks and can choke them off before downtime, floods of customer support calls, and damage to brand or reputation occur. Purchasing DDoS mitigation hardware requires hiring and training of employees with expertise in the area, but experts say that can be even more expensive. “In general, it’s very hard to justify doing self-mitigation,” said Ted Swearingen, the director of the Neustar security operations center. All the additional steps a company has to take to implement their own DDoS mitigation tool, such as widening bandwidth, increasing firewalls, working with ISPs, adding security monitoring and hiring experts to run it all, make it a cost-ineffective strategy in the long term, he said. Three percent of the companies in Neustar’s survey reported using that type of protection. In some cases, smaller DDoS mitigation providers even turn to larger vendors for support when they find themselves facing an attack too large, too complex or too new to handle on their own. Secure hosting provider VirtualRoad.org is an example. The company provides protection from DDoS attacks for independent media outlets in countries facing political and social upheaval—places where censorship by the government or other sources is rampant, such as Iran, Burma and Zimbabwe. A specific niche like that in a narrow market with small clients doesn’t usually require extra support, but VirtualRoad.org has utilized its partnership with Prolexic a few times in the last year, according to CTO Tord Lundström. They have their infrastructure to deal with attacks, Lundström said, but they also have parameters for the volume and complexity that they can handle. When it gets to be too much, they route the traffic to Prolexic, a security firm that charges a flat fee regardless of how many times you are attacked. “It’s easy to say, ‘We’ll do it when an attack comes,’ and then when an attack comes they say, ‘Well, you have to pay us more or we won’t protect you,’” Lundström said of other services. Extra fees like that are often the reason why those who need quality DDoS protection, especially small businesses like VirtualRoad.org clients, can’t afford it, he said. The impact can be worse for companies if the DDoS attack is being used as a diversion. According to a recent survey by Arbor Networks, 27% of respondents had been the victims of multi-vector attacks. The “Arbor Special Report: Worldwide Infrastructure Security Report,” which polled 114 self-classified Tier 1, Tier 2 and other IP network operators from the U.S. and Canada, Latin/South America, EMEA, Africa and Asia, stated that not only is the complexity of attacks growing, but the size as well. In 2008, the largest observed attack was about 40 Gbps. Last year, after an unusual spike to 100 Gbps in 2010, the largest recorded attack was 60 Gbps. This denotes a steady increase in the size of attacks, but Morales of Arbor Networks believes the numbers will eventually begin to plateau because most networks can be brought down with far smaller attacks, around 10 Gbps. Even if they stop growing, however, DDoS attacks won’t stop happening altogether, Morales said. Not even the change to IPv6 will stop the barrage of daily attacks, as some were already recorded in the report. Because of the steady nature of this attack strategy, experts suggest all companies that function online prepare themselves for this type of attack by doing away with the “it won’t happen to me” attitude. Luckily, recent “hacktivist” activities have given DDoS attacks enough press that CSOs and CEOs are starting to pay attention, but that’s just the first step, Morales said. It’s important to follow through with getting the protection your business needs if you want to achieve the goal, said VirtualRoad.org’s Lundström. “The goal is to keep doing the work,” he said. Source: http://searchsecurity.techtarget.com/news/2240159017/DDoS-mitigation-a-key-component-in-network-security

Follow this link:
Distributed Denial of Service `DDoS` mitigation a key component in network security

Banking Outage Prevention Tips

A series of fresh technology shutdowns this spring at banks around the world reveals the financial services industry still has a long way to go toward ensuring full up time for networks, as well as communicating with the public about why tech glitches have happened and what is being done about them. In May, Santander, Barclays and HSBC were all hit by digital banking outages. Some customers of Barclays and Santander were unable to access accounts online for a time near the end of the month, an outage blamed largely on end-of-the-month transaction volume. At HSBC, an IT hardware failure temporarily rendered ATMs unable to dispense cash or accept card payments in the U.K. Barclays and Santander both apologized for the outages though statements, while HSBC’s approach revealed both the power and peril of social media in such cases. HSBC’s PR office took to social media to communicate updates on the outage, and to also receive criticism about the outage (HSBC, Santander and Barclays did not return queries for comment). After an earlier outage in November, HSBC had set up a social monitoring team to be more proactive about communicating with the public about tech glitches, a move that seemed to have some positive impact, as not all of the Twitter and Facebook postings about the most recent outage were complaints. The basic task of making sure the rails are working, and smoothing things over with customers when systems invariably shut down, is an even more pressing matter considering the propensity for outrage to spread quickly among the public via new channels. “One thing that’s true about outages is we’re hearing more about them. The prevalence of social media use by irate customers and even employees makes these outages more publicized,” says Jacob Jegher, a senior analyst at Celent. Jegher says the use of social media for outage communication is tough – balancing the need to communicate with customers with internal tech propriety is easier said than done. “While it’s certainly not the institution’s job nor should it be their job to go into every technical detail, it’s helpful to provide some sort of consistent messaging with updates, so customers know that the bank is listening to them,” Jegher says. National Australia Bank, which suffered from a series of periodic online outages about a year ago that left millions of people unable to access paychecks, responded with new due diligence and communications programs. In an email response to BTN, National Australia Bank Chief Information Officer Adam Bennett said the bank has since reduced incident numbers by as much as 40 percent through a project that has aimed to improve testing. He said that if an incident does occur, the bank communicates via social media channels, with regular updates and individual responses to consumers where possible. The bank also issued an additional statement to BTN, saying “while the transaction and data demands on systems have grown exponentially in recent years led by online and mobile banking, the rate of incidents has steadily declined due to a culture of continuous improvement…The team tests and uses a range of business continuity plans. While we don’t disclose the specifics, whenever possible we will evoke these plans to allow the customer experience to continue uninterrupted.” While communicating information about outages is good, it’s obviously better to prevent them in the first place. Coastal Bank & Trust, a $66 million-asset community bank based in Wilmington, N.C., has outsourced its monitoring and recovery, using disaster recovery support from Safe Systems, a business continuity firm, to vet for outage threats, supply backup server support in the event of an outage, and contribute to the bank’s preparation and response to mandatory yearly penetration and vulnerability tests. “Safe Systems makes sure that the IP addresses are accessible and helps with those scans,” says Renee Rhodes, chief compliance and operations officer for Coastal Bank & Trust. The bank has also outsourced security monitoring to Gladiator, a Jack Henry enterprise security monitoring product that scours the bank’s IT network to flag activity that could indicate a potential outage or external attack. The security updates include weekly virus scans and patches. Coastal Bank & Trust’s size – it has only 13 employees – makes digital banking a must for competitive reasons, which increases both the threat of downtime and the burden of maintaining access. “We do mobile, remote deposit capture, all of the products that the largest banks have. I am a network administrator, and one of my co-workers is a security officer. With that being said, none of us has an IT background,” Rhodes says. “I don’t know if I could put a number on how important it is to have these systems up and running.” Much of the effort toward managing downtime risk is identifying and thwarting external threats that could render systems inoperable for a period of time. Troy Bradley, chief technology officer at FIS, says the tech firm has noticed an increase in external denial of service attacks recently, which is putting the entire banking and financial services technology industries on alert for outage and tech issues with online banking and other platforms. “You’ll see a lot of service providers spending time on this. It’s not the only continuity requirement to solve, but it’s one of the larger ones,” he says. To mitigate downtime risk for its hosted solutions, FIS uses virtualization to backstop the servers that run financial applications, such as web banking or mobile banking. That creates a “copy” of that server for redundancy purposes, and that copy can be moved to another data center if necessary. “We can host the URL (that runs the web enabled service on behalf of the bank) at any data center…if we need to move the service or host it across multiple data centers we can do that…we think we have enough bandwidth across these data centers to [deal with] any kind of denial of service attack that a crook can come up with,” Bradley says. FIS also uses third party software to monitor activity at its data centers in Brown Deer, WI; Little Rock and Phoenix, searching for patterns that can anticipate a denial of service attack early and allow traffic connected to its clients to be routed to one of the other two data centers. For licensed solutions, FIS sells added middleware that performs a similar function, creating a redundant copy of a financial service that can be stored and accessed in the case of an emergency. Stephanie Balaouras, a vice president and research director for security and risk at Forrester Research, says virtualization is a good way to mitigate both performance issues, such as systems being overwhelmed by the volume of customer transactions, and operational issues such as hardware failure, software failure, or human error. “If it’s [performance], the bank needs to revisit its bandwidth and performance capacity. With technologies like server virtualization, it shouldn’t be all that difficult for a large bank to bring additional capacity online in advance of peak periods or specific sales and marketing campaigns that would increase traffic to the site. The same technology would also allow the bank to load-balance performance across all of its servers – non-disruptively. The technology is never really the main challenge, it tends to be the level of maturity and sophistication of the IT processes for capacity planning, performance management, incident management, automation, etc.,” she says. In the case of operational issues, server virtualization is still a great technology, Balaouras says, adding it allows the bank to restart failed workloads within minutes to alternate physical servers in the environment or even to another other data center. “You can also configure virtual servers in high-availability or fault-tolerant pairs across physical servers so that one hardware failure cannot take down a mission-critical application or service,” Balaouras says. Balaouras says more significant operational failures, such as a storage area network (SAN) failure, pose a greater challenge to network continuity and back up efforts. “In this case, you would need to recover from a backup. But more than likely a bank should treat this as ‘disaster’ and failover operations to another data center where there is redundant IT infrastructure,” she says. Source: http://www.americanbanker.com/btn/25_7/online-banking-outage-prevention-strategies-1050405-1.html

View article:
Banking Outage Prevention Tips

UFC.com hit with Distributed Denial of Service ‘DDoS’ attack

The FBI was instrumental in arresting two dozen hackers this week that allegedly bought and sold credit card numbers over the Web. If you ask Ultimate Fighting Championship President Dana White, though, he had something to do with it too. Of the 24 individuals apprehended by the Federal Bureau of Investigation this week as part of a two-year undercover sting, at least one wasn’t limiting himself to only computer crimes linked to credit fraud. Mir Islam, 18, was arrested on Tuesday for allegedly selling stolen credit card info on an FBI-run website, according to the United States attorney for the Southern District. Prosecutors say that Islam kept a database of 50,000 credit card accounts and traded the info over the FBI’s own site, Carder Profit. Islam’s biggest opponent wasn’t necessarily federal agents, though. UFC President Dana White has been after Islam and other hackers since at least January and now he says that he thinks he helped bring down a collective of two dozen computer hackers. The feud between hacktivists and White began earlier this year after the president of the US-based Mixed Martial Arts organization announced his support for the Stop Online Piracy Act, or SOPA, a since-defeated congressional proposal that stood to strike down Internet freedoms across the board. As the public caught on to what the passing of SOPA would do to the Web, online advocates began campaigns to crush the legislation before it could clear Congress. Naturally, White’s outspoken support of the bill brought him some unwanted attention from hacktivists, particularly those with the underground collective UGNazi. Along with hackers aligned to the loose-knight Anonymous organization, the UGNazi clan — and particularly Islam’s alias, JoshTheGod — taunted White over his SOPA support, eventually targeted UFC.com with distributed denial-of-service (DDoS) attacks. As one might expect from the man behind a brutal sport such as MMA, White wasn’t quick to turn quiet. “I’m in the fight biz not the website biz!! Might be a big deal to other companies not mine,” White responded to the cyberattacks at the time over Twitter. Other tweets he sent include statements such as, “Lol, I’m not fucking ebay. My website being down doesn’t mean shit” and “I could give a flying rats ass about UFC. Com.” When White taunted hackers by writing, “The Internet is a place where cowards live,” the response was almost instantaneous: soon after his Social Security number and other personal info was published online. Today, White paints a different picture. Speaking to Inc. magazine, the UFC president suggests that this week’s arrests stemmed from his own snitching to the FBI. “I was in Chicago for a fight when I found out these Anonymous guys had started crashing our site. During an interview, I looked right into the camera and dared them to do it again. I said, ‘Who do you think I am, eBay? I’m in the fight business. I could give a shit if you knock my website down. Do it again! Go ahead. I dare you!’” White tells Inc. “You’re gonna send some pizzas to my house and put my Social Security number out? Who gives a shit? If people really wanted to get your Social Security number, I’m sure they could find it. I’m supposed to bow down to you guys now? I’m going to come after you harder. If you want to fight me, you better pack a f—ing lunch, man. Because we’re gonna go until somebody wins and somebody loses.” White says “It was a Twitter war for days,” but the tides turned after he approached the feds to make things more fun. “You get these guys engaged, you get ‘em going, and that’s when you get the FBI involved,” he says. “Because there’s so much piracy of UFC merchandise, the FBI was already monitoring everything that was happening. But after Anonymous hacked our site, we also got U.S. Immigration and Customs Enforcement, part of the Department of Homeland Security, involved. And it helps when they know when and where the hackers are going to attack. So I put my chin out there, and we knew they were gonna punch it. Two weeks after they attacked me, a lot of them started getting busted. I think we contributed to that.” Islam is being accused of helping operate and administering deals on the FBI-run credit card site and other forums. Last week, the UGNazi clan took credit for an hours-long crash of Twitter.com, a claim the social networking site has since rejected. Source: RT

View article:
UFC.com hit with Distributed Denial of Service ‘DDoS’ attack

Distributed Denial of Service ‘DDoS’ Attacks: The Zemra Bot

Symantec has become aware of a new Distributed Denial of Service (DDoS) crimeware bot known as “Zemra” and detected by Symantec as Backdoor.Zemra. Lately, this threat has been observed performing denial-of-service attacks against organizations with the purpose of extortion. Zemra first appeared on underground forums in May 2012 at a cost of €100. This crimeware pack is similar to other crime packs, such as Zeus and SpyEye, in that is has a command-and-control panel hosted on a remote server. This allows it to issue commands to compromised computers and act as the gateway to record the number of infections and bots at the attacker’s disposal. Similar to other crimeware kits, the functionality of Zemra is extensive: 256-bit DES encryption/decryption for communication between server and client DDoS attacks Device monitoring Download and execution of binary files Installation and persistence in checking to ensure infection Propagation through USB Self update Self uninstall System information collection However, the main functionality is the ability to perform a DDoS attack on a remote target computer of the user’s choosing. Initially, when a computer becomes infected, Backdoor.Zemra dials home through HTTP (port 80) and performs a POST request sending hardware ID, current user agent, privilege indication (administrator or not), and the version of the OS. This POST request gets parsed by gate.php, which splits out the information and stores it in an SQL database. It then keeps track of which compromised computers are online and ready to receive commands. Inspection of the leaked code allowed us to identify two types of DDoS attacks that have been implemented into this bot: HTTP flood SYN flood The first type, HTTP flood, opens a raw socket connection, but has special options to close the socket gracefully without waiting for a response (e.g. SocketOptionName.DontLinger). It then closes the socket on the client side and launches a new connection with a sleep interval. This is similar to a SYN flood, whereby a number of connection requests are made by sending multiple SYNs. No ACK is sent back upon receiving the SYN-ACK as the socket has been closed. This leaves the server-side Transmission Control Blocks (TCBs) in a SYN-RECEIVED state. The second type, SYN flood, is a simple SYN flood attack whereby multiple connects() are called, causing multiple SYN packets to be sent to the target computer. This is done in an effort to create a backlog of TCB creation requests, thereby exhausting the server and denying access to real requests. Symantec added detection for this threat under the name Backdoor.Zemra, which became active on June 25, 2012. To reduce the possibility of being infected by this Trojan, Symantec advises users to ensure that they are using the latest Symantec protection technologies with the latest antivirus definitions installed. Source: http://www.symantec.com/connect/blogs/ddos-attacks-zemra-bot

LulzSec Members Confess To Distributed Denial of Service ‘DDoS’ Attacks to SOCA, Sony and etc

Four alleged members of the LulzSec hacktivist group had their day in British court Monday. Two of the people charged–Ryan Cleary, 20, and Jake Leslie Davis, 19–appeared at Southwark Crown Court in England to enter guilty pleas against some of the charges against them, including hacking the public-facing websites of the CIA and Britain’s Serious Organized Crime Agency (SOCA). All told, Cleary, who’s from England, pleaded guilty to six of the eight charges lodged against him, including unauthorized access to Pentagon computers controlled by the U.S. Air Force. Meanwhile, Davis–who hails from Scotland’s Shetland Islands–pleaded guilty to two of the four charges made against him. The pair pleaded not guilty to two charges of violating the U.K.’s Serious Crime Act by having posted “unlawfully obtained confidential computer data” to numerous public websites–including LulzSec.com, PasteBin, and the Pirate Bay–to encourage or assist in further offenses, including “supplying articles for use in fraud.” They did, however, confess to launching numerous botnet-driven distributed denial-of-service (DDoS) attacks under the banners of Anonymous, Internet Feds, and LulzSec. According to authorities, the pair targeted websites owned by the Arizona State Police, the Fox Broadcasting Company, News International, Nintendo, and Sony Pictures Entertainment. The pair have also been charged with targeting, amongst other organizations, HBGary, HBGary Federal, the Atlanta chapter of Infragard, Britain’s National Health Service, the Public Broadcasting Service (PBS), and Westboro Baptist church. [ Learn about another hacker indictment. See Feds Bust Hacker For Selling Government Supercomputer Access. ] The two other alleged LulzSec members charged Monday are England-based Ryan Mark Ackroyd, 25, as well as a 17-year-old London student who hasn’t been named by authorities since he’s a minor. Both also appeared at Southwark Crown Court and pleaded not guilty to four charges made against them, including participating in DDoS attacks, as well as “encouraging or assisting an offense.” All four of the LulzSec accused are due to stand trial on the charges leveled against them–for offenses that allegedly took place between February and September 2011–on April 8, 2013. According to news reports, the court heard Monday that reviewing all of the evidence just for the charges facing Cleary will require 3,000 hours. Three of the accused have been released on bail. Cleary was not released; he had been released on conditional bail in June 2011, but violated his bail conditions by attempting to contact the LulzSec leader known as Sabu at Christmastime. LulzSec–at least in its original incarnation–was a small, focused spinoff from Anonymous, which itself sprang from the free-wheeling 4chan image boards. LulzSec was short for Lulz Security, with “lulz” (the plural of LOL or laugh out loud) generally referring to laughs gained at others’ expense. According to U.S. authorities, Davis often operated online using the handles topiary and atopiary, while Ackroyd was known online as lol, lolspoon, as well as a female hacker and botnet aficionado dubbed Kayla. What might be read into Ackroyd allegedly posing as a female hacker? According to Parmy Olson’s recently released book, We Are Anonymous, such behavior isn’t unusual in hacking forums, given the scarcity of actual women involved. “Females were a rare sight on image boards and hacking forums; hence the online catchphrase ‘There are no girls on the Internet,’ and why posing as a girl has been a popular tactic for Internet trolls for years,” wrote Olson. “But this didn’t spell an upper hand for genuine females. If they revealed their sex on an image board … they were often met with misogynistic comments.” In related LulzSec prosecution news, Cleary last week was also indicted by a Los Angeles federal grand jury on charges that overlap with some of the ones filed by British prosecutors. At least so far, however, U.S. prosecutors have signaled that they won’t be seeking Cleary’s extradition, leaving him to face charges in the United Kingdom. The shuttering of LulzSec both in the United States and Great Britain was facilitated by the efforts of SOCA, as well as the FBI, which first arrested Anonymous and LulzSec leader Sabu–real name, Hector Xavier Monsegur–in June 2011, then turned him into a confidential government informant before arresting him again, earlier this year, on a 12-count indictment. As revealed in a leaked conference call earlier this year, British and American authorities were working closely together to time their busts of alleged LulzSec and Anonymous operators on both sides of the Atlantic, apparently using evidence gathered by Monsegur. Source: informationweek

View post:
LulzSec Members Confess To Distributed Denial of Service ‘DDoS’ Attacks to SOCA, Sony and etc

Legalization of Distributed Denial of Service ‘DDDoS’ attacks as a form of protest

Dutch opposition party D66 has proposed the legalization of DDoS attacks as a form of protest. Activists would have to warn of their action in advance, giving websites time to prepare for their attack. Kees Verhoeven, the campaign’s leader, argues that it is strange that the fundamental right to demonstrate doesn’t extend to the online realm. The coming years would bring more instances of hacktivism, and it would be reasonable to introduce legislation to regulate, not ban it, he says. Verhoeven proposes that DDoS attacks be legalized so long as the protesters say when they will start their action. That way, a website would have time to prepare for the attack, just like an office building has time to get ready for a rally next to it. The proposal also includes restrictions on transmitting information about a website’s visitors, as well as stricter rules against e-mail spying, and other measures to bolster online privacy. DDoS attacks, popular with hacktivist groups such as Anonymous, would therefore become a legal means to express dissatisfaction with a company or a government. One DDoS attack per year would cost over $10,000 for a financial services company that makes 25 per cent of its sales online, according to Internet traffic management firm NeuStar UltraDNS. If the brand reputation of the company heavily depends on the performance of the website, one DDoS attack a year could end up costing over $20,500. However, DDoS attacks are relatively innocuous compared to other forms of hacking, such as phishing and virus infections, which can cost companies and individuals millions of dollars. Nevertheless, DDoS attacks are so far equated to hacking and are illegal in the Netherlands, as well as many other countries. Source: http://www.rt.com/news/dutch-party-d66-ddos-legalized-protest-541/

Follow this link:
Legalization of Distributed Denial of Service ‘DDDoS’ attacks as a form of protest

RBS & NatWest Web services knocked out; Oslo Bors hit by DDoS attack

Royal Bank of Scotland (RBS) and its NatWest and Ulster Bank subsidiaries have been hit by “technical issues” that have left customers unable to access online services. In a statement, RBS says: “We are currently experiencing technical issues which mean that a number of customer account balances have not yet been updated and some of our online services are temporarily unavailable.” A similar message appears on the NatWest Web site, with the bank adding: “We are working hard to fix this issue as soon as possible and will keep you updated on progress. We are experiencing very high call volumes as a result.” In a later update, RBS has revealed that the issue “was caused by a failure of our systems to properly update customers’ balances overnight. The main problem customers are having is that where people have had money go into their accounts overnight, there may be a delay in it showing up on their balance.” The problems have been ongoing for several hours, with NatWest first acknowledging the issue on its Twitter feed at 08.43, eliciting responses from customers complaining that payments have not been processed and wages not paid. The ongoing crisis has forced the bank to take drastic measures, promising to keep over 1000 branches open until 19:00BST on Thursday to assist short-changed customers. Daoud Fakhri, a senior analyst at Datamonitor says the episode is emblematic of wider problems facing the banking sector as a whole. “Many providers, being early adopters of IT systems when the technology was still in its infancy, have been left saddled with inflexible core systems that are often several decades old, and that are increasingly unable to cope with the demands being placed on them,” he says. “The growing expectations of consumers around online and mobile banking means that the tensions between the provision of ever more sophisticated services and the capability of core systems to satisfy these demands are close to breaking point, and this increases the likelihood of episodes such as the NatWest mishap happening again. Separately, the Web site of Norwegian bourse Oslo Børs has been knocked off line, apparently by a DDoS attack . Spokesman Per Eikrem told local outlet NTB that the hit is only affecting the exchange’s site and not its trading, messaging or monitoring systems. Source: http://www.finextra.com/News/Fullstory.aspx?newsitemid=23830

See more here:
RBS & NatWest Web services knocked out; Oslo Bors hit by DDoS attack

Twitter down: Sporadic outage leads to speculation of DDoS attack

The social networking service Twitter suffered sporadic outages Thursday, leading some to speculate about a hacker attack. Access came and went, with reports that users were being affected around the world. In a brief update, the company acknowledged some people were having issues using the service. “Users may be experiencing issues accessing Twitter,” they said in a statement. “Our engineers are currently working to resolve the issue.” A micro-blogging service that allows users to send short messages, Twitter has been likened to an international party line. There are myriad running conversations, to which anyone can contribute. As of March there were 140 million active users who generated over 340 million tweets daily, Twitter says. Not long after its initial message, Twitter said that the issue had been “resolved” and that all services were operational. Users often are quick to turn to Twitter to pose questions about emerging events. But in an ironic twist, Thursday’s outage was initially so pervasive that users couldn’t take to the twitterverse to discuss what was happening. But on message boards, comment fora and other social networking services people voiced their concern. Some wondered if the site had been attacked by a distributed denial of service attack by the hacker group Anonymous. Others bemoaned the lack of access. “I’m losing my mind!” Matt Gio wrote at mashable.com. “I have so much to talk about today and I have an important blog post scheduled.” But some took the outage humourously in stride. Olivia Bovery posted at Facebook that she was “going through withdrawal” and going to step outside. “There is this bright yellow ball in the sky that must be investigated. Seems to be giving off a lot of heat. Wonder what it is.” Moments later she followed up. “Finally, its back up! Back to twitter. Yellow ball will have to wait. Source: http://www.theglobeandmail.com/technology/omg-twitter-down-sporadic-outage-leads-to-speculation-of-hacker-attack/article4360263/?cmpid=rss1

View article:
Twitter down: Sporadic outage leads to speculation of DDoS attack

Asia to see rise in cloud DDoS security biz

COMMUNICASIA, SINGAPORE–With the rise of cloud services adoption, businesses also have escalating security concerns over distributed denial of service (DDoS) attacks, and that presents an opportunity for carrier service providers to offer cloud-based DDoS protection, which one industry executive adds is set to gain traction in Asia. Among enterprises, the constant discussion around cloud to make it “sexy and pervasive” to customers cannot ignore the question of what happens when the cloud service becomes unavailable due to an attack, said Lau Kok Khiang, director for Asia-Pacific IP division at Alcatel-Lucent. There is hence “strong pent-up demand” for cloud-based DDoS protection, for which carrier cloud services are in a good position to provide, he said. Lau was presenting at the Telco Rising Cloud conference in CommunicAsia here Tuesday. Large attacks have become commonplace, and enterprises are basically losing the arms race in the Internet security space, Lau described. Among the various DDoS attacks in 2011 alone that saw businesses worldwide suffer a “great amount of damage” involved Sony PlayStation Network, the Hong Kong stock exchange, Visa, MasterCard, PayPal, and WordPress, he pointed out. The executive emphasized that cloud-based DDoS security was a “win-win” scenario for both the service provider and enterprise customers. For the service provider, it is a new revenue opportunity, which also complements existing enterprise services such as virtual private network (VPN) and business broadband. Additionally, this could help drive customer stickiness, Lau said. That is because from the customers’ point of view, having cloud-based DDoS protection ensures 24-by-7 availability of the cloud services they use, which mean better safeguards for their enterprise assets such as confidential client data, he added. On the event sidelines, Lau told ZDNet Asia that cloud DDoS security is set to gain traction in Asia, due to increasing awareness of the risks and prevalence of DDoS. This will prompt companies to consider cloud DDoS protection as added security measures, in order to ensure their service availabilities meet customer demands as well as industry-specific regulations. Also, apart from commercial entities, governments in the region are also pushing the message that organizations need to protect themselves from becoming the next victim of an attack, he added, referring to the massive DDoS attacks that disrupted Internet services in Myanmar in November 2010. Another speaker at the conference, Anisha Travis, partner at law firm Webb Henderson, said while the cloud has benefits and opportunities for businesess, they should go into space with “their eyes open”. In other words, they need to understand and prepare for mitigate the major risks associated with cloud, one of which is service levels, she pointed out during her presentation. It is essential that service level agreements (SLAs) are well-drafted for specific service levels and must also include “practical remedies” when there is downtime or outage, Travis advised. Customers cannot rely solely on the service provider, and should do their due diligence in clarifying ownership, consequences, and failures, she added. Source: http://www.zdnetasia.com/communicasia/asia-to-see-rise-in-cloud-ddos-security-biz-62305165.htm

More here:
Asia to see rise in cloud DDoS security biz

Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging

Distributed denial-of-service (DDoS) have matured with hackers blending different attack techniques and becoming more damaging, observers note. They add that defenses need to evolve to complement infrastructure security that has already been commoditized.” DDoS attacks, where multiple compromised systems usually infected with a Trojan virus, are used to target a single system have been getting more “sophisticated” over the years, Vic Mankotia, security vice president of CA Technologies Asia-Pacific and Japan, noted. Today, there are DDoS attacks coming from automated systems, payloads delivered from USB sticks and protocols such as Bluetooth and magnetic strips of cards, he observed. In the past, DDoS attacks primarily targeted networks using low-level protocol or volumetric attacks, Eric Chan, regional technical director of Fortinet Southeast Asia and Hong Kong, remarked. However, hackers today use a combination of volumetric and application-layer attacking techniques, he noted. An application-layer DDoS targets the application service by using legitimate requests to overload the server, and rather than flood a network with traffic or session, they target specific applications and slowly exhaust resources at the application layer, Chan explained. They can be very “effective” at low traffic rates, which makes them harder to detect, he added. The Sony Playstation breach for example, had been a result of application-layer DDoS attacks, able to camouflage a data breach of over 77 million customer records, he cited. Evolved with IT trends, hackers intent On a basic level, denial-of-service (DoS) has evolved from “taking a pair of wire cutters outside the organization and snipping those wires” 20 years ago, to becoming distributed DoS where “hundreds and thousands of” traffic making computers into botnets to shut down systems, Andrew Valentine, managing principal of investigative response at Verizon observed. Strong connectivity, data centers and cloud, have given mobility center-stage, paved way for the Bring Your Own Device (BYOD) trend making the security parameters “disappear”, Mankotia explained. While mobile devices may not store the target information, but they do allow the DDoS attackers access to the information they seek, he noted. Laptops and devices also have a lot more computing power compared to those in the past, Claudio Scarabello, global security product manager of Verizon added. As such, hardware have a lot more power to flood systems, and can be much more “damaging”, he warned. Another way it has evolved is through the intent, Valentine added. In the past, DDoS had stemmed from “bragging rights”–showing off one’s ability to hack into the server, as well as financial intents, he explained. Today, it is used for political intents, commonly known as hacktivism, and DDoS and data breaches have become “synonymous”, he added, citing the Verizon 2012 data breach investigation report which found a rise in hacktivism against large organizations. “As such, DDoS today is associated with political intent, and making a statement, and not about script kiddies showing off anymore,” he said. Security system with visibility, multi-layered defense needed What is needed is a different type of security to complement the infrastructure security that has already been commoditized–a security system which enables the knowledge of where and who is sharing the data, Mankotia pointed out. DDoS attacks are heavily customized with a signature to get specific information, and security has to evolve as all information is not equal, and all identities, access and system must be in one ecosystem, where content-aware identity and access management are applied and advanced authentication is at its core, he explained. As botnets can send huge amounts of legitimate connections and requests from each compromised machine, and determining whether such connections are valid or not will be crucial, enterprises will need security solutions with “sufficient visibility and context”, Chan added. “These systems should have sufficient visibility and context to detect a wide range of attack types without slowing the flow, and processing of legitimate traffic, and is then able to conduct mitigation in the most effective manner,” he said. Above of, a multi-layer defense strategy is also essential, and the defense strategy must cover both network-layer and application-layer attacks, Chan surmised. In need of protection click here DDoS protection . Source: http://www.zdnetasia.com/ddos-becoming-more-sophisticated-damaging-62305134.htm

Continued here:
Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging