Tag Archives: denial of service

Five tips to combat a Distributed Denial of Service (DDoS) Attack

Who’s next? That’s a question probably lingering on the minds of many American banking executives these days. After all, eight U.S. banks were hammered by distributed denial of service (DDoS) cyber attacks in recent weeks and more could be in the works. A DDoS attack typically floods a website or network with so much traffic that it shuts down. The attack can last anywhere from hours to days, depending on how long it takes the victim to divert the traffic and how long the perpetrator can keep blasting the traffic at the victim’s site and network. The hacktivist group known as Izz ad-Din al-Qassam Cyber Fighters took credit for the cyber attacks on the banks. In posts on the website www.pastebin.com, the group said the DDoS attacks were in retaliation to a YouTube video insulting the Prophet Muhammad and many Muslims. Could this wave of cyber attacks be the beginning of a new movement? Will hacktivist groups join cyber criminals, ruthless competitors and even angry customers in launching DDoS attacks to shut down company websites? It’s possible. Especially since the tools to launch DDoS attacks are cheap and readily accessible. Currently, there are more than 50 DDoS tools 1 on the market. And if DDoS attacks do become more prevalent, how much damage can they cause? Well, according to one study 2 more than 65% of the respondents said when their websites go down it costs them about $10,000 per hour or $240,000 per day. Most of these companies were in the finance, telecom, travel and IT industries. These costs are due to lost business and lost resources when staff members have to work on matters related to the attack, instead of on their regular jobs. Retailers who sell most of their merchandise online said when their websites go down, it costs them about $100,000 per hour. If this is indeed the case, what can organizations do to protect themselves? Here are five tips offered by computer security experts: Maintain a high level of awareness to spot suspicious site traffic and other anomalies. Install the most advanced intrusion detection signatures (IDS) and intrusion prevention signatures (IDS) as defense mechanisms against cyber attacks. Make sure you have automatic updates scheduled for your anti-virus and other software programs. Review incident recovery plans and employee training strategies to ensure that your staff knows what to do if you do experience a DDoS attack or other form of cyber attack. Work closely with Internet Service Providers, law enforcement and vendors when faced with cyber threats and other suspicious cyber activity. Have you experienced a DDoS cyber attack? If so, how did you respond? We would like to hear about it. Contact us . Source: http://www.lexology.com/library/detail.aspx?g=61781aa7-caf5-4da1-8c2a-18b4590f3b0d

Excerpt from:
Five tips to combat a Distributed Denial of Service (DDoS) Attack

Evolving Distributed Denial of Service (DDoS) Attacks provide the driver for financial institutions to enhance response capabilities

Distributed Denial-of-Service (DDoS) attacks1 are not a new method employed by cyber criminals to inflict damage on victim entities’ networks. In fact, DDoS attacks were one of the first types of online crimes to appear in the dawn of the Internet age.2 In the past several years, however, cyber threat actors have rekindled this attack to produce two new variants, both of which specifically target the financial services sector. The first variant employs the DDoS attack merely as a diversion technique. In this method, which became noticeable in late 2011 and continues to present day, criminals conduct a DDoS attack on a victim website in order to divert attention and distract bank personnel from the underlying purpose of the attack—to steal online banking credentials and conduct unauthorized wire transfers. To execute this attack, criminals have used a commercially available crimeware kit—known as Dirtjumper—that can be bought and sold on criminal forums for only $200.3 While the purpose of the first type of DDoS is to increase the chance of successful financial fraud, the purpose of the second variant, which is the focus of this article, appears to be in line with the more traditional purpose of a DDoS—to disrupt services by rendering the website inaccessible to legitimate users. The new variant, however, is unprecedented in terms of its size, its industry focus, the attack vector it employs, its longevity and its potential source.4 At the same time, the response to these attacks has been extraordinary in terms of industry collaboration and information-sharing to mitigate the impact of the attacks.5 Given the combination of first-time factors contributing to this variant’s successes and because this new breed of cybercrime may be merely a sign of what awaits financial institutions in 2013, all financial institutions—small, mid-tiered and large alike—are advised to take this opportunity to review, reexamine and enhance their security incident response capabilities. The New DDoS Variant Beginning in mid-September 2012 and continuing over a six-week period, a dozen financial institutions were successfully targeted by a group initiating a series of sophisticated DDoS attacks against these banks’ websites.6 Most of the attacks were preannounced by the group claiming responsibility for the attacks—Izz ad-Din Al-Qassam Cyber Fighters (QCF).7 QCF claimed its motive was to stop widespread and organized offenses to Islamic spiritual and holy issues and, in particular, remove an offensive video from the Internet.8 Some sources, however, attribute the group’s activities to the government of Iran responding to prior alleged U.S. cyber attacks on its systems and networks.9 Approximately one-and-a-half months later, the QCF allegedly initiated a second campaign of attacks. This wave, which started as early as December 11, 2012, targeted many of the same banks and a few additional institutions with similar DDoS attacks.10 Indeed, the group claimed, based on a numerical sequence of “likes and dislikes” to Internet content it deems objectionable, that the attacks would continue for at least 14 months.11 However, seven weeks later on January, 29, 2013, the group claimed victory when the objectionable content was apparently removed from one of the sources on the Internet.12 This DDoS variant is significantly and substantially different from previous types of DDoS attacks in several ways. First, the volume of network traffic used to commit the attacks was substantial. In the first campaign of attacks, it was reported that some banks were hit with a flood of traffic peaking at 65 gigabits-per-second (gbps).13 Given that this volume is magnitudes above previous DDoS attacks, and that a mid-size business may only have the capacity to process 1 gbps of network traffic, this enormous influx of traffic is significant and problematic.14 The high-volume network traffic of this size can overwhelm most of a victim’s network infrastructure, and slow its response time to web inquires, if not grind it to a halt altogether. Second, the attacks were aimed at institutions in the financial services sector. Both the first and second campaigns targeted large financial institutions, while more recent attacks have targeted a broader range of institutions, including smaller banks and credit unions. 15 Although there is no evidence that these attacks have compromised customer accounts, QFC claims its attacks cost U.S. banks $30,000 for every minute their websites were down.16 Third, the attacks used a network of compromised web servers—nicknamed “brobot”—in contrast to the more traditional DDoS, which uses a network of compromised individual “zombie” computers—known as a “botnet.”17 By using web servers, which have significantly larger bandwidth than individual computers, fewer compromised computers are needed and the capability for massive traffic exists to flood the victims’ systems making it unresponsive to legitimate requests.18 Finally, industry experts have identified a layer of variability and persistence of tactics, particularly in that the toolkit allows attackers to react to defenses and modify attack strategy quickly.19 New attack vectors have also increased the effectiveness of strikes, partly because they utilize bilateral strikes against both Internet service providers and victim banks at the application level.20 Certainly, if the suspected source of the attack is true, the ability of the bad actors to draw upon unlimited resources in changing their tactics “on the fly” is not without reason. Industry Response Industry experts attribute an important contribution to minimizing the impact of the attacks to sharing critical threat data in near- to real-time both within the financial services sector and between government and the private sector.21 The Financial Services Information Sharing and Analysis Center (FS-ISAC), the designated operational arm of the Financial Services Sector Coordinating Council, was particularly effective in this regard by providing a mechanism to collect threat intelligence and alert participating members with reports containing anonymized information.22 The FS-ISAC issued a fraud alert the day following the first attack and, a few days later, raised awareness in the U.S. banking industry by changing its cyber threat level from “elevated” to “high.”23 In addition, technology and DDoS mitigation service providers have also provided a significant role in releasing new tools and mechanisms to plug the holes exploited by attackers.24 Some institutions also reached out directly to the government for assistance in the response. Utilizing an established process known as “Request for Technical Assistance” (RTAs), banks reach out to their regulators who, in turn, reach out to the U.S. Treasury Department to draw upon the appropriate resources in the federal government, including the Department of Homeland Security (DHS) and the National Security Agency (NSA), to provide the requested assistance.25 It appears that at least some banks have requested support from the NSA.26 The DHS has also spoken publicly about its ability to help financial institutions to defend against DDoS attacks.27 Regulator Response On December 21, 2012, the Office of the Comptroller of the Currency (OCC), an independent bureau of the U.S. Department of the Treasury, released an alert to CEOs of all national banks, federal branches and agencies, and associated interested parties, calling for a heightened sense of awareness and offering risk mitigation information in response to this series of sophisticated DDoS attacks.28 In the alert, the OCC reiterated its expectations that financial institutions have risk management programs in place to identify evolving threats to online accounts and adjust technology safeguards appropriately.29 Further, banks are expected to ensure that an effective incident response approach with sufficient staffing is in place and proactive due diligence reviews are conducted to identify and mitigate risks imposed by potential DDoS attacks.30 The regulators also encourage participation in information-sharing organizations such as the FS-ISAC.31 Conclusion In the wake of this unprecedented variant of a traditional cybercrime attack, financial institutions of all sizes should take the opportunity to review, reexamine, improve and expand their incident response capabilities. Of course, every situation varies and there is no “one-size-fits-all” response to any incident. However, building upon lessons learned from responding to these particular attacks, institutions may want to consider: developing a structure and mechanism to intake early warning signals and integrate them into an immediate response; participating in information-sharing within the sector and with external parties (vendors, regulators and law enforcement); testing response plans to ensure that outside parties, such as DDoS mitigation service providers, are able to deliver services as planned and anticipated; building a threat/defense matrix into incident response plans for certain threats, such as DDoS attacks; and employing a layered defense with multiple tactical defense options. In addition, financial institutions may want to consider expanding their arsenal of possible responses with creative solutions, such as: cross-industry collaboration (e.g., developing joint strategies with ISPs and information technology and telecommunication providers); employing active defense technologies; exploring informal and formal (i.e., legal) mechanisms to pursue intermediaries caught in the cross-fire; and exploring informal and formal mechanisms to dismantle the bad actor infrastructure. Source: http://www.lexology.com/library/detail.aspx?g=8779273b-682d-4e76-8cf9-eacdd429c406

More:
Evolving Distributed Denial of Service (DDoS) Attacks provide the driver for financial institutions to enhance response capabilities

The multiple faces of Distributed Denial of Service (DDoS) Attacks

According to Stratecast, DDoS attacks are increasing in number by 20 per cent to 45 pc annually Google, Microsoft, Apple, PayPal, Visa, MasterCard… many of the world’s largest websites have all been victims of Distributed-Denial-of-Service (DDoS) attacks. A DDoS attack consists in having a multitude of systems attack a single target in an attempt to make its resources unavailable to its intended users. During the last decade, the number of DDoS attacks has increased and their motivations and targets have evolved. Karine de Ponteves, FortiGuard AV analyst at Fortinet, traces the evolution of these attacks. Early 2000: Into the spotlight Although we can’t be sure when the first real DDoS attack occurred, the first large-scale distributed attack (DDoS) happened in 1999, against the IRC server of the University of Minnesota. 227 systems were affected and the attack left the university’s server unusable for two days. In February 2000, many popular websites including Yahoo!, eBay, CNN and Amazon.com, were paralyzed for hours. Yahoo! suffered a loss of $500,000 during its three hours of downtime, while the volume of activity of the CNN.com site dropped by 95%. The downtime loss was huge. A 15-year old Canadian known as “Mafiaboy” was arrested and charged for the attacks. His motivation? Defiance. This teenager just wanted to show off his skills. To do so, he scanned a network to find a number of vulnerable hosts; compromised the hosts by exploiting a known vulnerability; deployed software turning the host into a “zombie”; and then propagated the attack so that each zombie would in their turn compromise new targets, following the same process. 2005: A lucrative attack In the early 2000s, in order to create a botnet to launch a DDoS attack, the hacker would have to follow the same steps as the ones used by Mafiaboy. With the advent of Internet worms, those steps became automated, enabling a hacker to trigger large-scale attacks. In August 2005, 18-year-old Farid Essabar, who had never studied computer programming, was arrested for the spread of the MyTob worm. The worm would open a backdoor on the infected MS Windows host, connecting to a remote IRC server and waiting for commands. It would self-propagate at reboot copying itself over network shares, opening the door to massive DDoS attacks with all the hosts compromised by the worm and executing the commands sent over IRC. The outbreak was covered live on CNN as the TV channel own computers network became infected. What were the intentions this time? Not to actually disrupt corporate networks, but to extort thousands of dollars from companies by threatening to target DDoS attacks to their networks. Quickly, the targeted enterprises decided to pay the extortionists rather than deal with the consequences of a DDoS attack. 2010: DDoS and hacktivism In 2010, mainstream media extensively reported high-profile DDoS attacks motivated by political or ideological issues such as the well-publicized Wikileaks/Anonymous series of incidents. That year, attackers dramatically increased attack volumes, and, launched for the first time attacks breaking the 100Gbps barrier, which represents about 22,000 times the average bandwidth of an Internet user in the U.S. in 2010. In December, Wikileaks came under intense pressure to stop publishing secret United States diplomatic cables. In response, the Anonymous group announced its support, and termed Operation Payback the series of DDoS attacks it led against Amazon, PayPal, MasterCard and Visa in retaliation of the anti-Wikileaks behavior. These attacks caused both MasterCard and Visa’s websites to be brought down on December 8th. The tool behind the Anonymous/Wikileaks attacks is called the Low Orbit Ion Cannon (LOIC). Although it was originally an open-source load-testing tool, designed to conduct stress tests for web applications, it was in that case used as a DDoS tool. 2012 and beyond: The acceleration of application-layer based attacks Although there are many different attack methods, the DDoS attacks can be generally classified into two categories: Volumetric attacks: Flood attacks saturate network bandwidth and infrastructure (e.g.: UDP, TCP SYN, ICMP). Application-layer attacks: These attacks are designed to target specific services and exhaust their resources (HTTP, DNS). Because they use less bandwidth, they are harder to detect. The ideal situation for application-layer DDoS attacks is where all other services remain intact but the webserver itself is completely inaccessible. The Slowloris software was born from this concept, and is therefore relatively very stealthy compared to most flooding tools. According to Stratecast, DDoS attacks are increasing in number by 20% to 45 pc annually, with application-based DDoS attacks increasing in the triple digits levels. The trend toward application-layer DDoS attacks is clear, and unlikely to reverse. This trend is not, however, an indication that network-layer or flow-based, volumetric attacks will cease. On the contrary, both types of attacks will combine to be more powerful. The 2012 Verizon Data Breach Investigations Report reveals that several high profile application-layer DDoS attacks hiding behind volumetric attacks were used to obscure data theft efforts, proving that multi-vector attacks are now used to hide the true target of the attack. DDoS attacks are growing in frequency and severity while, in parallel, the means to launch an attack are simplified and the availability of attacker tools increases. In addition, the complexity of these attacks is increasing due to their polymorphic nature as well as the development of new tools to obfuscate their true nature. As a result, traditional methods of detection are often useless and mitigation gets more difficult. With such evolution, it is essential that organizations revise their security posture and make sure they have the right defenses in place to be protected against DDoS attacks. Here, the main challenge is to have sufficient visibility and context to detect a wide range of attack types without slowing the flow and processing of legitimate traffic; and then to mitigate the attack in the most effective manner. A multi-layer defense strategy is thus essential to enable granular control and protection of all components that are in the critical path of online activities. Source: http://www.ciol.com/ciol/experts/174422/the-multiple-ddos-attacks/page/2

See the original article here:
The multiple faces of Distributed Denial of Service (DDoS) Attacks

9 steps that help defend against Distributed Denial of Service (DDoS) Attacks

Most experts agree that agencies can’t defend against and mitigate the impact of denial of service attacks all by themselves, but there are step they can take to strengthen their defenses. Denial of service — DOS — is a blanket term for a variety of types of attacks, carried out in numerous ways, all directed at making online resources unavailable to the public. Attacks can be launched from multiple platforms, creating a distributed denial of service attack, or DDOS. Although they usually do not damage the target systems or compromise data, they can damage reputations, cost money and interfere with carrying out missions. Specifics will vary with each attack, but the U.S. Computer Emergency Readiness Team notes that, “In general, the best practice for mitigating DDOS attacks involves advanced preparation.” Some recommendations for advance preparation from US-CERT include: Develop a checklist for standard operating procedures to follow in the event of an attack, including maintaining a checklist of contact information for internal firewall teams, intrusion detection teams and network teams, as well as for service providers. Identify who should be contacted during an attack, what processes should be followed by each and what information is needed. ISPs and hosting providers might provide mitigation services. Be aware of the service-level agreement provisions. Identify and prioritize critical services that should be maintained during an attack so IT staff will know what resources can be turned off or blocked as needed to limit the effects of the attack. Ensure that critical systems have sufficient capacity to withstand an attack. Keep network diagrams, IT infrastructure details and asset inventories current and available to help understand the environment. Have a baseline of the daily volume, type, and performance of network traffic to help identify the type, target and vector of attack. Identify existing bottlenecks and remediation actions needed. Harden the configuration settings of the network, operating systems and applications by disabling unnecessary services and applications. Implement a bogon (bogus IP address) block list at the network boundary to drop bogus IP traffic. Employ service screening on edge routers where possible to decrease the load on stateful security devices such as firewalls. Separate or compartmentalize critical services, including public and private services; intranet, extranet, and Internet services; and create single-purpose servers for services such as HTTP, FTP, and DNS. Some additional advice for preparing yourself from Marc Gaffan, cofounder of Incapsula: Have the capacity to absorb additional traffic. It might be impractical to provision all the bandwidth needed, and the exact amount to have available will be a business decision. But a good rule of thumb would be to maintain about 150 percent of normally needed capacity. Maintain customer transparency. Ideally, people coming to the site shouldn’t know it is defending itself against an attack. “People don’t like to hang around where something bad is going on,” Gaffan said. And if a bogus connection is suspected, give the user a chance to verify. It might be impractical to use additional security such as Captcha verification for every connection during an attack, but don’t arbitrarily drop every questionable connection. Differentiate between legitimate automated traffic and DOS traffic. There can be a high volume of legitimate automated traffic generated by search engine crawls and management tools that should not be blocked. Knowing what this traffic looks like in advance can help identify DOS traffic. Be prepared to quickly identify and respond to DOS attacks so that defenses can be brought to bear quickly, minimizing downtime. For DDoS protection against your eCommerce site click here . Source: http://gcn.com/Articles/2013/01/24/9-steps-defend-against-DDOS.aspx?Page=2

Originally posted here:
9 steps that help defend against Distributed Denial of Service (DDoS) Attacks

The dark cloud over US bank Distributed Denial of Service (DDoS) Attacks

Some in the US point the finger at Iran. Another group called the Izz ad-Din al-Qassam Cyber Fighters, motivated by the US Government’s inability to remove an anti-Muslim video called the Innocence of Muslims, claimed responsibility for the recent Dedicated Denial of Service (DDoS) attacks which have brought down US banking sites since September. But the identity of the perpetrator behind these recent events is only of secondary concern in this story which has been gracing US headlines for months now. This is because at the moment, for the banks that were attacked, the problem all lies in the Cloud. Since September last year, the attack has affected some of the world’s biggest banking names including Wells Fargo, the Bank of America, Citigroup and HSBC. The attackers did not make away with personal data, or commit any form of fraud but they did move DDoS off of the PC and into the remote server, where they could push forth with new improved artillery, powered by faster performance and better and more network connections. Those who point the finger at Iran say their reason for blame lies in the sophistication of the attack, but security company Imperva’s CTO and co-founder Amichai Shulman says to some extent, launching an attack from the server, especially when the Cloud is involved, can be easier and even more importantly more cost effective. “Basically the attackers still use compromised PCs. They use these PCs to search for vulnerable servers and then exploit these, injecting code into the server so that from that time on, the attackers control the servers from a central location, usually behind an anonymizer,” Shulman says. If the attack only relied on PCs, Shulman says 10 to 100 times more compromised PCs would be required then servers to launch an attack of a similar magnitude. “It is more complex managing 100,000 PCs or even 10,000 than managing those compromised servers. Once they can reduce the management complexity they can reduce costs and increase their ability to launch operations on a more frequent basis.” According to security firm Radware’s VP of Security Solutions Carl Herberger, who was talking with the American Banker, banks have never seen such large-scale DDoS attacks. Radware has been working with banks and cloud computing providers following the attacks, which have risen with the increased uptake of cloud adoption by the financial services industry. Herbenger says one unnamed bank with enough internet capacity to handle 40bn bytes of data saw nearly twice that amount of traffic as a result of the DDoS onslaught. “The multiplying of the flood is unbelievable,” Herberger told American Banker. “Their servers, processors and offloading devices simply could not handle this problem.” Has this not been though of before? Security, you would think, will always be top of concern for a financial services player. But the Cloud has made security much more difficult a promise, according to both Shulman and Herberger. “Cloud increases the risk because it is easier to use by the attackers and harder to mitigate by the bankers,” Shulman says. Herberger says the main problem comes from banks’ leasing of cloud services, an approach that ties together the facilities of the banks and cloud computing providers. This makes it more difficult to block data from a particular internet address when an organization comes under cyber attack. He says eventually such attacks could be used for distraction for more malicious and fraudulent activity. Shulman says in the past, banks (which are no stranger to DDoS attacks) have overcome the DDoS threat by installing higher amounts of bandwidth. “But you cannot over allocate network bandwidth just because there might be the possibility of someone launching a large attack at some time. It is just too costly,” Shulman says. “The bank’s primary risk is its data set, or financial fraud, and they are well prepared for that. But this is another technique coming up, and the threat is a very real threat. One thing to remember though is that while these banks have suffered from the recent attacks, there wasn’t a single attack that actually took down one of the banking applications for an entire day.” A new challenge This could be good news but Shulman says in the world of the hacker it can also mean another challenge – and that, in the long run, means more persistent attacks. Shulman says Imperva has been studying this new trend in its own labs and that every day, he sees attackers targeting a new vulnerable type of server, often finding hundreds and thousands of potential victims. “They keep collecting compromised servers, and in some cases they will lose some – but it means for the industry overall there is clearly a higher risk,” Sulman says. Shulman says the recent attacks highlight the risk to anyone using a web service, right down to the small and medium-sized business user. “If you have a web server or web application in the enterprise, you are going to be the target of attackers, even if you don’t have valuable information in your server. Just having enough bandwidth and the server makes you a target,” In some instances the trade-off for added security, will have to be latency as data travels through more security. “The consequence could be that all traffic going in and out of a compromised server would eventually be blocked by security devices along the way,” Shulman says. The real question then – at least for now – will be how latency stands up to denied access when services are given a long-term view? For DDoS protection against your eCommerce site click here . Source: http://www.datacenterdynamics.com/focus/archive/2013/01/dark-cloud-over-us-bank-ddos-attacks

Excerpt from:
The dark cloud over US bank Distributed Denial of Service (DDoS) Attacks

New White House petition seeks to legitimize Distributed Denial of Service (DDoS) Attacks

This week, a petition was filed on the White House’s “We the People” website that aims to legitimize the use of distributed denial of service attacks (DDoS) as a legitimate form of protest. “It is the equivalent of repeatedly hitting the refresh button on a webpage. It is, in that way, no different than any ‘occupy,’ protest,” the petition states. “Instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time. As part of this petition, those who have been jailed for DDoS should be immediately released and have anything regarding a DDoS, that is on their ‘records,’ cleared.” Some have speculated that Anonymous is behind the petition—but Anons aren’t the only one making this argument: Evgeny Morozov, a Belarus-born tech author, scholar, and journalist made a similar case back in December 2010. However, he later warned: “Declaring that DDoS is a form of civil disobedience is not the same as proclaiming that such attacks are always effective or likely to contribute to the goals of openness and transparency pursued by Anonymous and WikiLeaks. Legitimacy is not the same thing as efficacy, even though the latter can boost the former. In fact, the proliferation of DDoS may lead to a crackdown on Internet freedom, as governments seek to establish tighter control over cyberspace.” The White House’s “We the People” website opened in 2011 and allows anyone to submit a petition to the government on any topic. If a petition gets 25,000 signatures or more, the Obama Administration will be compelled to provide a formal response. Most responses have been fairly mild, however—save releasing the White House beer recipe in late 2012. Citizens have used the system to criticize its “vapid” responses, to challenge Transportation Security Administration policy, and to encourage the president to veto SOPA, among other things. Still, as of this writing, the DDoS petition only has around 1,255 signatures—23,745 to go. Source: http://arstechnica.com/tech-policy/2013/01/new-white-house-petition-seeks-to-legitimize-ddos-attacks/

More here:
New White House petition seeks to legitimize Distributed Denial of Service (DDoS) Attacks

Distributed Denial of Service (DDoS) Attacks on Major Banks Causing Problems for Customers

The websites of major U.S. banks are facing a new round of cyber attacks linked to the same group responsible for similar assaults earlier this year. The latest attacks started last week and have hit Bank of America Corp., SunTrust Banks Inc. (STI), JPMorgan Chase & Co. (JPM), U.S. Bancorp, Wells Fargo & Co. (WFC) and PNC Financial Services Group Inc. (PNC), according to two executives at companies providing security to some of the targeted banks, who asked for anonymity because they weren’t authorized to discuss clients and didn’t want their companies to become targets of computer assaults. PNC was under attack today, the executives said. A group calling itself Izz ad-Din al-Qassam Cyber Fighters announced plans to attack banks in a Dec. 10 statement posted on the website pastebin.com. The same group claimed responsibility for a series of distributed denial-of-service (DDoS) attacks in September and October that flooded bank websites with Internet traffic and caused disruptions and slowdowns for online customers. “The purpose of it is to try to disrupt or stop online banking access,” said Bill Nelson, president of the Financial Services Information Sharing and Analysis Center, which disseminates cyber threat information to the financial services industry. “There are some outages occasionally, but it hasn’t prevented customers from transacting business.” The Izz ad-Din group has said in Internet postings that the cyber attacks are in response to a video uploaded to Google Inc. (GOOG)’s YouTube ridiculing the Prophet Muhammad and offending some Muslims. Multiple Targets The current attacks, which began last week, involve the same tactics used in the earlier assault, harnessing commercial servers to pump traffic at bank websites and attacking applications including security devices such as firewalls or intrusion-detection systems, said Carl Herberger, a vice president at Radware Ltd. (RDWR), a Tel Aviv-based network security provider that is working with some of the banks. While the attackers targeted one bank per day in the previous campaign, they are hitting multiple banks in a single day this time, Herberger said. PNC, in a statement posted on its website, said it’s aware of the potential cyber threat, which could “make it difficult for our customers to log onto online banking.” “Please be assured that PNC’s website is protected by sophisticated encryption strategies that shield customer information and accounts,” the statement reads. “We have no information regarding timing, duration or intensity of this potential threat.” Slow Access Wells Fargo said its website was experiencing an unusually high volume of traffic, creating slow or intermittent access for some customers. “The vast majority of customers are not impacted, but for those who are, we encourage them to access their accounts through our stores, ATMs or by phone as we work to resolve the issue,” according to a statement e-mailed yesterday by Bridget Braxton, a Wells Fargo spokeswoman. Mark T. Pipitone, a Bank of America spokesman, declined to comment, as did Tom Kelly, a spokesman for JPMorgan. The attackers are changing their “signatures,” or techniques, every 7 to 10 minutes, requiring constant monitoring, said Scott Hammack, chief executive officer of Prolexic Technologies, a Hollywood, Florida-based company that provides protection from DDoS attacks. DDoS Attacks Denial-of-service attacks have long been a favored tactic of hacker-activists, and software kits to mount such assaults are available for purchase on the black market, Meaghan Molloy, a senior threat analyst at Mandiant Corp., an Alexandria, Virginia-based information-security firm, said in an e-mail. While the Izz ad-Din al-Qassam Cyber Fighters group said the attacks are in retaliation for the YouTube video, “it’s worth noting” that the Federal Bureau of Investigation last year warned that DDoS attacks were being used to deflect attention from fraudulent wire transfers from compromised bank accounts, Molloy said. Banks targeted in the current attacks are working with Internet-service providers and the U.S. government to share information on the tactics and techniques of the attackers, said Nelson, of the Financial Services Information Sharing and Analysis Center. Source: http://www.bloomberg.com/news/2012-12-20/major-banks-under-renewed-cyber-attack-targeting-websites.html

Read the original:
Distributed Denial of Service (DDoS) Attacks on Major Banks Causing Problems for Customers

National banking regulator advises on Distributed Denial of Service (DDoS) Attack deluge

The regulator for national banks issued an alert Friday about the apparent uptick in distributed denial-of-service (DDoS) attacks being waged against financial institutions. The note from the Office of the Comptroller of the Currency (OCC), which was addressed to the heads of national banks, federal branches and agencies, technology service providers and other related organizations, described how a recent wave of DDoS attacks are disrupting the availability of some bank websites. The spate seemed to kick off in early fall, and many top banks are still experiencing on-and-off attacks. “Each of these groups had different objectives for conducting these attacks, ranging from garnering public attention to diverting bank resources while simultaneous online attacks were underway and intended to enable fraud or steal proprietary information,” the alert said. The bulletin recommends that banks maintain a “heightened sense of awareness regarding these attacks” and ensure they are prepared to deal with them. That includes appropriating staff and third-party contractors to help thwart the attacks; implementing an incident response plan across various departments; and sharing information among affected organizations. In addition, because often the attacks target banks’ service providers, the OCC suggests that financial institutions review the response capabilities of their ISPs and web-hosting vendors. The alert also encourages banks that are sustaining a DDoS attack to remain in communication with customers, conveying any risks they face, as well as safeguards they can take. The OCC said banks should view their security in terms of risk management. But the alert also reminded institutions that they are obligated to follow the Federal Financial Institutions Examination Council (FFIEC) guidelines, which were updated in 2011 to address corporate account takeovers. Often, DDoS attacks run cover for attackers who are simultaneously logged in to victims’ bank accounts while fraudulently transferring out money from their accounts. Avivah Litan of research firm Gartner said in a blog post Friday that the alert shows the OCC is taking the threat seriously, and this will likely result in increased regulatory enforcement. “Some banks do spend enough on security – but many do not,” she wrote. “This will help ensure that all – and not just some – of the banks regulated by the OCC at least, are putting the requisite resources into defending against DDoS attacks and their attending damage.” Source: http://www.scmagazine.com/national-banking-regulator-advises-on-ddos-deluge/article/273769/

See original article:
National banking regulator advises on Distributed Denial of Service (DDoS) Attack deluge

British student found guilty of Anonymous PayPal Distributed Denial of Service (DDoS) Attacks

A British student has been convicted over his role in a series of denial of service attacks against PayPal, which cost the payment firm £3.5m. Christopher Weatherhead was part of an Anonymous gang that attacked PayPal in protest at the firm’s decision not to handle payments being made to whistle-blowing website Wikileaks, in an attack dubbed ‘Operation Payback’. According to multiple reports, the jury hearing the case took little more than two hours to reach their guilty verdict. Three other members of the gang had already pleaded guilty but Weatherhead had argued he had not taken part in the attacks, claiming his role had been limited to operating Anonymous chat rooms. The judge presiding over the case, Peter Testar, told the defendants that he regarded the offences as serious. Weatherhead, who was a student at Northampton University at the time of the attacks, was found guilty under the Criminal Law Act 1977, and could face jail time as a result of the guilty verdict. The Metropolitan Police arrested five youths in 2011 in connection with Operation Payback, while other suspected members were arrested by the Dutch authorities. Operation Payback had initially begun as a protest against the music industry’s anti-piracy stance, but the focus changed after Wikileaks published a series of leaked diplomatic memos. Several financial services firms including PayPal, MasterCard and Visa withdrew services from Wikileaks, and as a result drew the ire of the Anonymous activists. Source: http://www.v3.co.uk/v3-uk/news/2230251/british-student-found-guilty-of-anonymous-paypal-ddos-attacks

Link:
British student found guilty of Anonymous PayPal Distributed Denial of Service (DDoS) Attacks

Protecting Your Network Against Distributed Denial of Service ‘DDoS’ Attacks

As leaders in their field, IT managers are tasked with the burden of not only managing but protecting company networks. Dedicated servers can be adversely affected by DDoS attackers, as their firewalls can be penetrated and flooded with malicious communication requests. Before assessing how you can prevent DDoS attacks it is first important to understand what they are and where they come from. What Are DDoS Attacks? A DDoS attack attempts to render a network or machine inaccessible or unresponsive for any considerable length of time. DDoS attacks typically saturate a network with requests as to slow, disrupt or obstruct communication from the intended user. In some cases, a DDoS attack may overwhelm network firewalls, leaving the problem up to IP providers to fix. Typical symptoms may include the following: a high volume of spam emails, in-accessibility of websites or services or exceptionally slow network performance. Either way, a DDoS attack can adversely affect business by bringing down a website, company application or cloud based computing platform. Here are a few suggestions to go about mitigating the risk associated with DDoS attacks: Preventative Measures Against Attack Properly setup of network firewalls are a must. These days, modern firewalls can be configured to deny unusual protocols from un-identified IP addresses. For instance, if your network firewall is configured to block traffic from sources it can’t identify, it may drop any or all illegitimate service requests as to maintain a normalized bandwidth threshold. Though IP bottlenecks are not always a symptom of DDoS attacks, configuring a firewall to block traffic incoming from specific ports is a form of preventative maintenance. As stated earlier, DDoS attackers may flood a system as to render it unresponsive. Rate limiting switches detect incoming traffic and may filter or slow IPs in such a way that prevents them from flooding the system. Many switches have wide-area-networks fail overs, which adjust incoming IP filtering thresholds automatically. Again, it is important to configure these systems correctly in order for them to remain effective. If system upgrades are in order then IT managers need to weigh the cost against the risk posed by DDoS attacks. Costs To Consider Personnel Costs – If attacked, how many IT workers will it take to address and remedy the problem? Support Calls – Do you really want to be tied up on the phone calling tech support? Factor in the time spent at the help desk Lost Business – If a DDoS attack causes downtime to your website, how much revenue may be lost? Lost Customers – Investing in network protection means you are also investing in consumer confidence. How many customers may be lost due to downtime. Brand Reputation – When network outages occur, brands may suffer damage to their reputation. It is important to consider this last factor. Lastly, it is important to remember that DDoS attacks may also occur by accident. Some sites may experience a denial of service when they experience a high amount of traffic. In any case where a popular website links to a trending event, traffic may suddenly spike creating a unintentional denial of service. Focus your energies on preventing the malicious attacks and it’ll be smooth sailing for your business or enterprise. For DDoS protection against your eCommerce site click here . Source: http://www.colocationamerica.com/blog/protecting-your-network-against-ddos-attacks.htm

Original post:
Protecting Your Network Against Distributed Denial of Service ‘DDoS’ Attacks