Tag Archives: denial of service

More Banks Come Under Denial-of-Service Attack

Capital One and SunTrust came under attack this week using denial-of-service techniques that are evading defenses meant to blunt such attacks. Capitol One and SunTrust Banks have become the latest targets of hackers who have leveled attacks at U.S. financial institutions in alleged retaliation for the posting of a movie on YouTube that has offended some Muslims. On Oct. 8, a group calling itself the Izz ad-Din al-Qassam Cyber Fighters posted a message on Pastebin stating that Capital One, SunTrust Banks and Regions Financial would each suffer an eight-hour attack starting with Capital One the next day. Even with the advanced warning, the financial institutions suffered outages, with Capital One’s site frequently inaccessible during the eight-hour period. “Some Capital One customers experienced intermittent online access due to a large volume of traffic going to the Website and servers,” the bank said in a statement posted to its Web site. ”Other banks have experienced similar issues in recent weeks due to targeted efforts designed to flood online systems, also known as a distributed denial-of-service attack.” On Oct. 10, SunTrust Banks suffered some performance issues, as did Regions Financial the next day, according to media reports. The attacks are the latest data floods in a campaign that started in mid-September. Under the name “Operation Ababil,” a group of alleged Iranian protestors called for supporters to attack the Bank of America, JPMorgan, Citigroup and Wells Fargo. Yet the crowd-sourced hacktivism effort caused little damage. Instead, a second attack coming from hundreds—or at most, thousands—of compromised servers made up the most effective part of the data flood. Using compromised servers and customized malware, the attackers have hit targeted sites with between 70G bps and 100G bps of peak traffic, according to experts. The attacks—launched from servers used to publish corporate Websites and blogs but running vulnerable content management software—sent packets of data crafted to evade typical defenses, even those specifically designed to curtail denial-of-service (DoS) attacks. “They had far fewer machines involved and with much larger bandwidth,” Dan Holden, director of security for network-protection firm Arbor Networks, said of the earlier attacks. “These are Web or hosting servers that have been compromised and are obviously poorly administered.” Typical defenses against distributed denial-of-service attacks attempt to minimize the impact of an attack by intercepting the request as far away from the target Website as possible. By blocking attacks in other networks, the customer is not impacted by a massive influx of data. However, the latest attacks are using evasion techniques to get around standard denial-of-service defenses, said Phil Lerner, vice president of technology at security firm Stonesoft. By crafting the data to look like valid encrypted Web requests, the network packets are allowed to get through to the customers’ own computers to decipher the information. Even if that system blocks the request as invalid, the avalanche of data buries the computer, which can’t keep up. “DDoS [distributed denial-of-service] mitigation is not a cure-all,” Learner said. “You don’t have enough protocol decoding capabilities, and you are only doing partial defenses, or none at all, on the evasion detection.” Companies need to adopt security defenses that handle such evasion techniques, he said. In July, a researcher at cloud-security firm Qualys demonstrated that evasion techniques can cause problems for Web application firewalls (WAFs) as well. A variety of tricks, sometimes just adding a single character, could bypass the security offered by WAFs, according to the research. Source: http://www.eweek.com/security/more-banks-come-under-denial-of-service-attack/

View original post here:
More Banks Come Under Denial-of-Service Attack

U.S. banks warned of another Distributed Denial of Service ‘DDoS’ attack

Just as one type of attack against U.S. banks has subsided, the banks are being warned to get ready for another, called “Project Blitzkrieg,” aimed at online theft. Iran denies launching cyberattacks on U.S. banks The distributed-denial-of-service (DDoS) attacks that briefly disrupted the online services of a half-dozen major financial institutions late last month — Wells Fargo, U.S. Bancorp, PNC Financial Services Group, Citigroup, Bank of America and JPMorgan Chase — ended abruptly about two weeks ago, even though the group that claimed credit for them had threatened to continue them. Izz al-Din al-Qassam Cyber Fighters, the military wing of Hamas, the Islamic party that governs the Gaza Strip, had said in a Pastebin message that the attacks would continue until a trailer of the independent film “Innocence of Muslims,” which they said insults the prophet Mohammed, was taken off the Internet. But now, says a blog post by Mor Ahuvia, cybercrime communication specialist at security firm RSA, another wave of attacks is looming, this one aimed at stealing big money. “A cyber gang has recently communicated its plans to launch a Trojan attack spree on 30 American banks as part of a large-scale orchestrated crimeware campaign,” Ahuvia wrote. “Planned for this fall, the blitzkrieg-like series of Trojan attacks is set to be carried out by approximately 100 botmasters. RSA believes this is the making of the most substantial organized banking-Trojan operation seen to date.” RSA said the gang leadership appears to come from Russia, and plans to use a “Gozi-like Trojan” that RSA is calling Gozi Prinimalka. Prinimalka is derived from the Russian word meaning “to receive.” “According to underground chatter, the gang plans to deploy the Trojan in an effort to complete fraudulent wire transfers via Man-In-The-Middle (MiTM) manual session-hijacking scenarios,” Ahuvia wrote. “If successfully launched, the full force of this mega heist may only be felt by targeted banks in a month or two. The spree’s longevity, in turn, will depend on how fast banks and their security teams implement countermeasures against the heretofore-secret banking-Trojan,” she wrote. Brian Krebs, who writes the blog KrebsonSecurity, said in a recent post that the RSA analysis “seemed to merely scratch the surface of a larger enterprise that speaks volumes about why online attacks are becoming bolder and more brash toward Western targets.” But he also said this particular threat could be a hoax — that there is some suspicion in the cybercrime world that it could be a sting operation by Russian law enforcement, since the announcement has been so public. Krebs said the threat appears to be coming from a series of posts on Underweb forums by a Russian hacker nicknamed “vorVzakone.” His name translates to “thief-in-law,” which Krebs said, “in Russia and Eastern Europe refers to an entire subculture of elite criminal gangs that operate beyond the reach of traditional law enforcement. The term is sometimes also used to refer to a single criminal kingpin.” Krebs said vorVzakone called the campaign “Project Blitzkrieg,” and according to a translation of one of his messages, said he hopes to recruit 100 botmasters to take advantage of authentication weaknesses in U.S. bank systems before they can improve their protection. The botmasters would have to qualify with an online interview and be trained, and would then get to share in the profits. In vorVzakone’s message, he said: “The development of the system took 4 years of daily work and around $500.000 was spent. Since 2008 by using this product not less than $5m was transferred just by one team.” Jason Healey of the Atlantic Council, a cybercrime expert and former White House security official, said it sounds to him like the group is “trying to be the Russian online equivalent of Ocean’s Eleven — call it Ocean’s Odinnadsat’ — or a group that wants to be seen in that light. They can get some cool points, either way.” Most security experts say the financial sector is the best prepared of any in the U.S. to deal with direct attacks. But these attacks will, of course, not be aimed directly at the banks, but at their customers. And vorVzakone also wrote that the operation will flood cyberheist victim phone lines while the victims are being robbed, in an effort to prevent account holders from receiving confirmation calls or text messages from their banks.” In an interview, Brian Krebs said cyber thieves, “almost always target the line of least resistance, and that is the customer. That doesn’t excuse the banks from their obligation to be constantly upgrading their defenses against such attacks. There are thousands of financial institutions in the U.S. and many of them are woefully behind in updating their customer-facing security measures.” He noted that banking law does not protect commercial and business customers at the same level as individual customers, and said banks need to do much better at flagging abnormal transaction behavior, such as, “a sudden addition of many new employees to an organization’s payroll, particularly if those people are spread all over the country geographically.” “You’d be amazed at how many times a month some bank lets this happen, and with disastrous results,” Krebs said. Still, if vorVzakone and his presumed colleagues are serious about their plan, why broadcast it so blatantly? Is that an indication that the whole thing may be a fraud? Krebs said there is reason for skepticism, noting in his blog post that vorVzakone even posted a homemade movie on YouTube, in which he. “introduces himself as ‘Sergey,’ the stocky bald guy in the sunglasses. He also introduces a hacker who needs little introduction in the Russian underground — a well-known individual who used the nickname ‘NSD.’” Krebs then quotes one Russian expert saying vorVzakone’s “language and demeanor is that of street corner drug dealer or a night club bouncer,” not someone who can organize and run a sophisticated cyberheist operation. Krebs himself is not quite as harsh, but said such projects “are announced all the time on the underground, but usually they are in fairly closed, secretive forums. The forums on which this project was announced were moderately secret, but it’s fairly unusual for miscreants to create YouTube videos of such projects and to promote them so openly.” Healey said the public bragging is a mistake. “To succeed with a Trojan, you want it to be somewhat secret with few people involved,” he said. “The few who are involved should be well known and trustworthy. That is the opposite of what Ocean’s Odinnadsat’ has done.” He said that and the fact that they are recruiting people who may be unknown to them “makes it more likely that the intel and threat companies, and law enforcement, can get the code beforehand.” Another problem that could undermine the operation is simple organizational weaknesses. “My sense is that such a project would require a decent amount of operational cohesion and security, and cooperation,” Krebs said. “From what I’ve seen of the underground, the more people you involve in a scheme, the more likely it is to fall apart.” But he said whether this threat is real or not, the need for protection is crucial. The best way for customers to avoid theft is to prevent their computer from being infected. “The trouble is,” Krebs said. “It’s becoming increasingly difficult to tell when a system is or is not infected. That’s why I advocate the use of a Live CD approach to online banking. That way, even if the underlying hard drive is infected with a remote-access, password stealing Trojan like Gozi, your online banking session is protected.” Source: http://www.networkworld.com/news/2012/101012-us-banks-warned-of-another-263227.html?page=1

Continue reading here:
U.S. banks warned of another Distributed Denial of Service ‘DDoS’ attack

Expert’s Warning: More Distributed Denial of Service ‘DDoS’ attacks Coming At You

Brace yourself: more distributed denial of service (DDoS) attacks are coming at financial institutions, predicted Scott Hammack, CEO of Hollywood, Fla.-based Prolexic Technologies, a leader in helping big business defend itself against DDoS. “Absolutely, we will see more attacks on banks,” said Hammack in an interview. He traced the current wave of attacks – which have crippled the websites of money center banks including Bank of America and JP Morgan Chase – to probes that began in January. “The attackers did several months of reconnaissance, probing websites for vulnerabilities,” said Hammack. The core DDoS method is to overwhelm a website with a flood of extraneous data. There is so much data coming in that legitimate requests simply cannot be handled. The current attackers, Hammack suggested, come at this with enormous skill, sophistication and funding. He indicated he had no guess about the possible end game or what the objectives of the attackers might be beyond highlighting the vulnerabilities of big banks to attacks. He indicated that the attackers – or people close to them – have frequently posted notices of what institutions they have taken down on Pastebin, a website believed to be frequented by members of the hacker and cyber-criminal community. According to Hammack, the attackers have used the itsoknoproblembro DDoS tool kit and they have come to the battle with deep knowledge of the classic anti DDoS mitigation schemes. Since they know how financial institutions protect themselves at first sight of DDoS, they also know how to maneuver around those protections, said Hammack. Hammack warned: “This is sophisticated in the way Stuxnet was.” Stuxnet’s authorship is unknown, but some have said it was approved by the White House and involved high level cyber security experts from the U.S. and Israel. It specifically targeted Iran’s nuclear program. So far, no credit unions are known to have been targeted in the present wave of DDoS attacks. However, Hammack indicated that in his opinion only the very largest banks are currently prepared to deal with this attack. “A lot of smaller financial institutions have no protection,” he said. “If they get hit they will be out for days.” Source: http://www.cutimes.com/2012/10/01/experts-warning-more-denial-of-service-attacks-com?ref=hp

Link:
Expert’s Warning: More Distributed Denial of Service ‘DDoS’ attacks Coming At You

New Bank Attacks Expected Today?

Is another wave of distributed denial of service attacks imminent? For the past two weeks, DDoS attacks that caused online outages at several major U.S. banks started on Tuesday mornings and ended by Friday afternoons, says Mike Smith, a senior security evangelist at Akamai Technologies, an Internet platform provider. Smith and other security experts are standing by to see if this week brings a third round of attacks. While they wait, these thought-leaders offer insights in response to these outstanding questions: Why were banks unable to stop the DDoS attacks from causing outages? What steps should banks and other organizations take now to prepare for additional attacks? Technology does play a role in thwarting such attacks, says Smith, who also blogged about the attacks. But a renewed focus on information sharing is the best investment an organization can make, he says. “Packet captures from the attack traffic we shared with our customers, for instance, allowed them to build IDS [intrusion detection system] signatures, so when they first start to receive that traffic, they can block it,” he says. Why Attacks Succeeded DDoS attacks are not new – they have been around since at least 2001. Simply defined, a DDoS attack usually involves an external party saturating a targeted website with traffic until the site’s servers are overloaded, ultimately rendering the site unable to respond and unavailable. This is what happened to the banks, whose customer-facing websites subsequently faced varying degrees of unavailability. Yet as Anton Chuvakin, a security analyst at Gartner, pointed out in May, DDoS attacks seem to have become a “forgotten area” of security – until the latest string of incidents. “Denial-of-service attacks, in general, cannot be stopped,” Chuvakin says. “If their entire network connection is full of traffic, nothing they do on their own will remove the flood.” The recent wave of attacks is unique for its scale, Smith says. The average online user in the United States and Western Europe uses about 1 megabyte per Internet node per second. “Even at the height of the Anonymous attacks, we saw traffic coming in from 7,000 or 8,000 people [at approximately 1 gigabyte per second] involved in attacks at any given time,” he says. “That’s a lot.” But in the most recent attacks, the traffic coming in was the equivalent to about 65 gigabytes per second, Smith says. “A typical DDoS attack waged by a hacktivist group looks much different than what we saw here,” he says. “You would expect less than 1 gbps [gigabyte per second] of attack traffic for the average hacktivist, and would expect peaks up to, maybe, 2 gbps.” Avivah Litan, fraud analyst at Gartner who blogged about the attacks, says, based on what she’s been told, the attacks together added up to 100 gigabytes of traffic. “The leading DDoS prevention software, more or less, stops working when the attacks get larger than 60-70 gigabytes,” Litan writes. “The major ISPs only have a few hundred gigabytes bandwidth for all their customers, and even if they added more on to that, the hacktivists could quickly and easily eat the additional bandwidth up.” Where Did Attacks Originate? Recent attacks have been attributed to Izz ad-Din al-Qassam. But this group, which in the past has been known to support Hamas, has not historically been affiliated with hacktivism, says Bill Wansley, a fraud expert at financial-services consultancy Booz Allen Hamilton. “All of the sudden, for them to become a hacktivist group, it’s just really interesting,” Wansley says. “We’ve never seen that before” (see More U.S. Banks Report Online Woes). Thus, determining, with any certainty, who or what is actually behind the attacks has proven difficult. “There are indications it’s an Iranian group,” Wansley says, based on the IP addresses linked to the attack and the timestamp of the attacks. These latest attacks are unlikely to be the product of traditional hacktivists, experts say, citing this evidence: The sheer number of hits seem too large to be waged by social or political hacktivists. “The volume of the traffic is far higher than what we normally see,” Smith says. During a typical hacktivist attack, variations in the site traffic are evident. “The attacks in this case were homogeneous, which is not typical,” Smith says. “The traffic looked the same.” And there wasn’t a lot of bragging going on after the attacks, either, which also is typical in a hacktivist event. “The attacks are unique and seem to have a different character than previous [hacktivist] attacks,” Wansley says. How Can Organizations Respond? Although U.S. banks have been the initial targets of the latest DDoS attacks, experts say all organizations should be on notice: They could be next. Gregory Nowak, a principal research analyst for the Information Security Forum, says security leaders need to realize that these incidents are ideological attacks against the U.S. “The attacks have nothing to do specifically with the activities of these banks – they were innocent bystanders,” Nowak says. “The message is: This can happen to any organization, and they need to consider [hacktivism response] as part of their risk management” (see Banks Under Attack: PR Missteps). So, what can organizations do to prepare? Litan says DDoS is not an issue any individual organization can control. “It’s a networking bandwidth and network security software issue,” she says. “Simply put, the DDoS prevention software can’t handle this large of an attack, in terms of the bandwidth it consumes.” Among the steps organizations can take: Protect default online pages or homepages. “This is the page most commonly attacked in a DDoS and can be easily protected with basic caching,” Smith says. Communicate with ISPs about suspicious traffic. “The [organization] has to work with its ISP, and potentially other ISPs, to see if the ISP can identify the traffic before it gets to the website and drop it earlier in its travels,” says Alex Horan of CORE Security, an online security firm that specializes in vulnerability assessment and testing. “But the [organization] doesn’t want to accidently drop legitimate traffic when doing that, so it has to be very cautious.” But organizations also must know the privacy limitations ISPs face when it comes to blocking or removing computers or users linked to attacks. “We need every ISP to be able to work together,” Horan says. “While this appears to be in the ISPs’ favor, most would be reluctant to do it, as it would mean they would have to inspect the packets sent by their customers, and it could very easily be seen as an invasion of privacy.” What’s Next? DDoS attacks occur on a daily basis, Smith notes. So Institutions and others need to focus on intrusion detection and DDoS attack identification. ISPs also should have mechanisms in place to block DDoS attacks. “That way, they limit an attack against one customer and limit the impact to their other customers,” Smith says. “The ISP is the conduit; they are at risk, and they know this. That’s why they also usually offer protective services.” If the ISP with which an institution works does offer protective services, banks and others should take advantage, Smith says. But if the ISP doesn’t offer protective services or does not have the ability to filter traffic, the institution can at least block traffic coming in from IP addresses identified as being connected to an attack. Information sharing between banking institutions and among institutions, ISPs, law enforcement and third-party vendors is critical. “The attackers will change,” Smith says. “Understanding how those attacks are changing is critical.” For now, however, experts are anxious to see if the wave of attacks that targeted banks the last two weeks will continue. “What does this week hold?” Smith asks. “We’ll soon know if the pattern will continue.” For immediate DDoS protection click here . Source: http://www.bankinfosecurity.com/new-bank-attacks-expected-today-a-5155/p-2

Continued here:
New Bank Attacks Expected Today?

DDoS attack on GoDaddy takes down millions of websites

A massive DDoS attack struck GoDaddy’s name servers today, temporarily plunging thousands of websites into the internet abyss. “GoDaddy, the massive Web hosting company, went down on Monday, taking an untold number of websites with it,” reported CNN. Mashable.com reported, “The more problematic part is that any domain registered with GoDaddy that uses its nameservers and DNS records are also down. This means that even if you host your site elsewhere, using GoDaddy for DNS means it is inaccessible.” PC World reports: “In a YouTube video (http://www.youtube.com/watch?v=SPGBZWGUE2g), secretive hacking group Anonymous has taken credit for the outage, claiming the move is a reaction to the company’s support of the U.S. government’s efforts “to censor and control the Internet,” through its support of the Stop Online Privacy Act (SOPA).” But claiming Anonymous did this attack may be false, it turns out. The apparent attacker said, himself, that he was not affiliated with the Anonymous collective: “It is not Anonymous collective it’s only me. Don’t use Anonymous collective name on it, just my name,” wrote Twitter user Anonymous Own3r. (http://www.foxnews.com/tech/2012/09/10/every-godaddy-registered-site-…) Most likely scenario? A false flag cyber security attack in order to provide the excuse for Obama to sign a freedom-killing executive order focused on “cyber security.” The attack has taken down GoDaddy’s website, DNS servers, phone support and email accounts. It’s almost as if a nuclear bomb went off at GoDaddy headquarters. This attack appears to be hugely successful from the point of view of Anonymous hackers, although it’s not clear why GoDaddy was targeted in particular. GoDaddy manages 48 million domains spanning more than 9 million customers. The failure of its DNS likely means that millions of websites were taken offline. Domain Name Servers are a known vulnerability Domain Name Servers are a well-known vulnerability of the internet infrastructure. As this attack by Anonymous has masterfully demonstrated, DNS provides a centralized single point of attack that, if penetrated, can bring down literally millions of websites. DNS also provides a single point of government seizure, where rogue governments that hate free speech can take control over websites by commandeering their DNS records. For these reasons, you need to know how to reach NaturalNews.com even if DNS is compromised There is a workaround to DNS. You can bypass it and go straight to NaturalNews by simply entering the following “IP address” into your browser: 174.132.185.226 This is the equivalent of typing “NaturalNews.com” into your browser and it will work even if Domain Name Servers are being hacked or seized. This IP address will take you right to our website. It is our “digital address” recognized by all web browsers. WRITE THIS NUMBER DOWN on a piece of paper and carry it in your wallet or purse. Even if the Domain Name Servers are illegally seized by the government in an assault on the freedom of the press — or if they’re brought down by hackers as was demonstrated today — you can still use the IP address to reach us. If NaturalNews.com appears to be unreachable during a crisis event, revert to using the numbers instead of the name, and the site will likely respond. An even better way: Subscribe to our email newsletter An even better way to make sure you can hear from us is to subscribe to our FREE email newsletter (see subscription form below). Email is virtually impossible for anyone to block. Unless there’s a nuclear holocaust or something, we will always be able to email you with the latest alerts and information, even if our web servers are hacked or physically taken offline. Even if you don’t want to read our email newsletter each day, simply staying subscribed is valuable because we will be able to reach you with urgent alerts about what’s really happening. We don’t sell email addresses to anyone. Your privacy is completely protected, and you can unsubscribe at any time. Subscribing to our email newsletter is your way of allowing us to reach you even in a crisis, a seizure, or a hack attack. For fast DDoS protection against your eCommerce site click here . Source: http://www.naturalnews.com/037140_DDoS_attack_GoDaddy_Domain_Name_Servers.html

View article:
DDoS attack on GoDaddy takes down millions of websites

Teenager who launched Distributed Denial of Service ‘DDoS’ attack on high profile websites says life is ‘serene’ offline

A Scots teenager who admitted hacking into the websites of the Serious Organised Crime Agency (Soca) and other prominent organisations said life is “serene” without access to the internet. Jake Davis, 19, admitted conspiring to carry out a “denial of service” attack on the crime agency at Southwark Crown Court in June. He also admitted hacking the NHS website. Davis, from the island of Yell, faced five charges following a Met Police investigation into the hacking groups LulzSec and Anonymous. The groups have been linked to a number of cyber-attacks on government agencies and multi-national companies. LulzSec has also been linked to hacking attempts on Sony and The Sun newspaper. Davis told the Observer newspaper: “The last time I was allowed to access the internet was several moments before the police came through my door in the Shetland Isles, over a year ago. One of my co-defendants and I have also been indicted with the same charge in the United States, where we may possibly be extradited, and if found guilty I could face several decades in an American prison. “Now I am on conditional bail and have to wear an electronic tag around my ankle. I’m forbidden from accessing the internet. “I’m often asked: what is life like without the net? It seems strange that humans have evolved and adapted for thousands of years without this simple connectivity, and now we in modern society struggle to comprehend existence without it. In a word, life is serene. “I now find myself reading newspapers as though they weren’t ancient scrolls; entering real shops with real money in order to buy real products, and not wishing to Photoshop a cosmic being of unspeakable horror into every possible social situation. Nothing needs to be captioned or made into an elaborate joke to impress a citizenry whose every emotion is represented by a sequence of keystrokes.” He added: “Things are calmer, slower and at times, I’ll admit, more dull. I do very much miss the instant companionship of online life, the innocent chatroom palaver, and the ease with which circles with similar interests can be found. Of course, there are no search terms in real life – one actually has to search. However, there is something oddly endearing about being disconnected from the digital horde. “It is not so much the sudden simplicity of daily life – as you can imagine, trivial tasks have been made much more difficult – but the feeling of being able to close my eyes without being bombarded with flashing shapes or constant buzzing sounds, which had occurred frequently since my early teens and could only be attributed to perpetual computer marathons. “Sleep is now tranquil and uninterrupted and books seem far more interesting. The paranoia has certainly vanished. I can only describe this sensation as the long-awaited renewal of a previously diminished attention span.” He said people’s attentions spans had suffered since the advent of the internet. “A miracle cure or some kind of therapeutic brilliance are not something I could give, but I can confidently say that a permanent lack of internet has made me a more fulfilled individual. And as one of many kids glued to their screens every day, I would never before have imagined myself even thinking those words. “Before, the idea of no internet was inconceivable, but now – not to sound as though it’s some kind of childish and predictable revelation spawned as a result of going cold turkey – I look back on the transcripts of my online chats (produced as legal evidence in my case, in great numbers) and wonder what all the fuss was about.” He added that he hoped others involved in the hacker community could take a short break from the internet to see if they could feel similar effects adding he had “forgotten how easy it was simply to close a laptop lid”. For fast DDoS protection against your eCommerce site click here . Source: http://news.stv.tv/north/189464-teenager-who-hacked-major-websites-says-life-is-serene-without-web-access/

See the original post:
Teenager who launched Distributed Denial of Service ‘DDoS’ attack on high profile websites says life is ‘serene’ offline

Arizona man sentenced for Distributed Denial of Service ‘DDoS’ attack

A man who was reportedly part of one of the first “DDOS-for-hire” electronic attack hit squads will serve two-and-a-half years in prison for selling access to malware-infected computers. Joshua Schichtel, 30, of Phoenix, AZ, was sentenced on Sept. 6 to 30 months in prison for selling command-and-control access to, and use of, thousands of malware-infected computers, announced Assistant Attorney General Lanny Breuer of the Justice Department’s Criminal Division and U.S. Attorney for the District of Columbia Ronald Machen, Jr. Schichtel was also ordered to serve three years of supervised release. Schichtel pleaded ea on August 17, 2011, to one count of attempting to cause damage to multiple computers without authorization by the transmission of programs, codes or commands, a violation of the Computer Fraud and Abuse Act. Schichtel was allegedly part of one of the first “DDOS-for-hire” rings uncovered in 2004. He was caught up in an investigation into a Massachusetts businessman’s scheme to launch an organized Distributed Denial of Service (DDOS) attack on his competitors by hiring hackers who knew how to perform the electronic assaults. According to court documents, Schichtel sold access to “botnets,” which are networks of computers that have been infected with a malicious computer program that allows unauthorized users to control infected computers. Individuals who wanted to infect computers with various different types of malicious software (malware) would contact Schichtel and pay him to install, or have installed, malware on the computers that comprised those botnets. Specifically, said the documents, Schichtel pleaded guilty to causing software to be installed on approximately 72,000 computers on behalf of a customer who paid him $1,500 for use of the botnet.

Visit site:
Arizona man sentenced for Distributed Denial of Service ‘DDoS’ attack

Distributed Denial of Service ‘DDoS’ attack stymies vote in Miss Hong Kong beauty contest

Residents of the island, a Special Administrative Region of China, are up in arms after plans for a popular vote in the Miss Hong Kong beauty pageant were sidelined by a distributed denial-of-service attack that knocked the voting system offline. The attack on Sunday evening swamped systems used for the vote with millions of bogus votes – far more than contest organizers had anticipated. Organizers were forced to cancel the online vote and ask the pageant judges to elect the winner themselves, according to a story in The Standard . Hong Kong Station TVB issued a statement on Monday apologizing for the wrinkle in the first ever Idol-style vote for the island’s beauty queen, putting the blame on audience reaction that was more “warm” than expected. The voting snafu forced organizers to throw the decision to the pageant judges, who chose a winner based on the three finalists overall performance. (Isn’t that how it’s supposed to work, anyway?) According to a story in The Standard , however, the “overly warm” response from viewers was, in fact, a DDoS attack against the pageant’s Microsoft Azure cloud-based voting system that flooded the servers with millions of votes, knocking them offline. The RC station planned for around half a million viewers to vote during a 10-minute slot Sunday evening, but actual traffic far exceeded that, according to TVB’s deputy director for foreign affairs Tsang Sing-ming, who is quoted by the media. Another station official, TVB general manager Cheong Shin-keong, is quoted saying that the extra traffic was “deliberately made” and that the station had hired an outside firm to investigate. The controversy over the apparent DDoS attack was exacerbated by the judges’ decision to choose contestant Carat Cheung Ming-nga as the next Miss Hong Kong, rather than Tracy Chu Chin-suet, the public’s favorite, who was second runner-up, The Standard reported. A related contest to give a Mini Cooper car to an online voter, selected at random, was cancelled after the voting system went down. Immediately after the vote, Hong Kong’s Communications Authority was flooded with more than 400 complaints on Monday about the aborted voting. The incident was a black eye for Microsoft, as well. That company partnered with TVB, lending its Azure cloud based infrastructure to host the voting system. Outraged viewers also left comments on TVB’s webpage, castigating the station for its mistake, for its reliance on Microsoft and – not least – for picking the wrong gal. Once a British colony, Hong Kong transferred to China in 1997 and has been run as one of two Special Administrative Regions ever since, following a “one government, two systems” policy under which residents enjoy greater freedom of expression and political voice than their countrymen on the Chinese mainland. However, that system is slowly changing, with the Communist Party slowly exerting control over more facets of life on the island. In July, thousands of citizens took to the streets to protest changes to Hong Kong’s public schools and school curriculum that was seen as emphasizing Communist Party orthodoxy and downplaying Hong Kong’s unique history. Hong Kong being Hong Kong, the parallels between the aborted Miss Hong Kong vote and the island’s larger political context weren’t lost on viewers. “Prove in Hong Kong does not have universal suffrage!” wrote one viewer on the TVB website. For fast DDoS protection against your e-commerce site click here . Source: http://nakedsecurity.sophos.com/2012/08/28/ddos-hong-kong-beauty/

Excerpt from:
Distributed Denial of Service ‘DDoS’ attack stymies vote in Miss Hong Kong beauty contest

Keep Your Content Online in Case of a Distributed Denial of Service ‘DDoS’ attack

San Francisco, CA – infoZine – Denial of service attacks – flooding websites with traffic in order to make them unavailable to the public – have become an increasingly popular way to take down or block Internet content. A new online guide from the Electronic Frontier Foundation (EFF) outlines how website operators can fend off these attacks and keep their sites alive and accessible. “Denial of service attacks have been used by governments to silence online criticism as well as by activists protesting companies and organizations they don’t like,” said EFF Director for International Freedom of Expression Jillian York. “Major websites often have the resources to keep running during a denial of service attack, but smaller sites – such as those belonging to independent media or human rights organizations – are sometimes taken down permanently. Our online guide is aimed at leveling the playing field.” EFF’s “Keeping Your Site Alive” guide includes tips on choosing an appropriate webhost to provide the security and technical assistance needed to weather an attack. The guide also gives advice on how to back up and mirror content so it can be made available elsewhere in case the site is compromised, and includes tutorial videos with background information on the technical concepts involved. Denial of service attacks are an issue for websites across the globe, so EFF’s guide is available in many different translations, including Chinese, Russian, Persian, and Arabic. “Lack of resources or knowledge can mean some websites are more vulnerable than others,” said EFF International Freedom of Expression Coordinator Eva Galperin. “We want to give website operators around the world the tools they need to protect their content and stay online.” Source: http://www.infozine.com/news/stories/op/storiesView/sid/52927/

View article:
Keep Your Content Online in Case of a Distributed Denial of Service ‘DDoS’ attack

Russia Today hit by Distributed Denial of Service ‘DDoS’ attack as anti-Wikileaks group claims responsibility

The website of the Kremlin-funded news network Russia Today has been hit with a denial-of-service attack that some have linked with the station’s support for Wikileaks founder Julian Assange, and others with the impending Pussy Riot verdict. The English-language Russia Today (RT) tweeted on Friday morning that its hosting provider had confirmed RT.com was “under DDoS attack”. An anti-Wikileaks group subsequently claimed responsibility, but there is as yet no proof of this connection. It is notable that Friday is the day when a Russian court will decide the fate of three members of the punk protest band Pussy Riot, which has been very critical of Vladimir Putin. RT’s tweet came through at 8:12am. Around 20 minutes later, Antileaks tweeted that it was responsible for the DDoS, and attached a hashtag supporting Pussy Riot. The Wikileaks account then went on to condemn the attack, suggesting that it was connected with RT’s support of Assange, rather than the punk band. Assange, who faces extradition from the UK to Sweden to face questioning over sexual assault allegations, had a chat show on RT, with one of his guests having been Ecuadorian president Rafael Correa. Correa granted Assange diplomatic asylum on Thursday. However, that move has so far had a limited effect, since the UK does not recognise that type of asylum and Assange cannot get safe passage to an airport. RT is a strong supporter of Assange, but it is also a supporter of the Russian leader. Many free-speech advocates are incensed at the likelihood of the Pussy Riot members facing jail time for playing an anti-Putin song in a church. Summary: The Kremlin-funded channel, which featured Julian Assange as a talk-show host, says it has come under denial-of-service attack. Antileaks says it’s responsible, but the timing could more to do with the Pussy Riot verdict than Wikileaks. For fast DDoS protection against your e-commerce website click here . Source: http://www.zdnet.com/russia-today-hit-by-ddos-as-anti-wikileaks-group-claims-responsibility-7000002794/

Excerpt from:
Russia Today hit by Distributed Denial of Service ‘DDoS’ attack as anti-Wikileaks group claims responsibility