Tag Archives: dos attacks

Polish Planes Grounded After Airline Hit With DDoS Attack

Roughly 1,400 passengers were temporarily stranded at Warsaw’s Frederic Chopin airport over the weekend after hackers were purportedly able to modify an entire airline’s flight plans via a distributed denial of service (DDoS) attack. On Sunday someone was able to infiltrate the computer system of the Polish airline LOT and successfully cancel 10 of the carrier’s flights. A dozen other flights were reportedly delayed, according to Reuters. Many passengers were able to board the flights — destined for Munich, Hamburg, Dusseldorf, and Copenhagen, among other cities — later in the day and regular service was resumed Monday according to LOT spokesman Adrian Kubicki. The airline insists that at no point was the safety of any ongoing flights at risk, nor were any other airports affected, but stressed that the attack could be a sign of things to come. “We’re using state-of-the-art computer systems, so this could potentially be a threat to others in the industry,” Kubicki warned, adding that authorities were investigating the attack. LOT’s chief executive Sebastian Mikosz reiterated Kubicki’s sentiments in a press conference on Monday. “This is an industry problem on a much wider scale, and for sure we have to give it more attention,” Mikosz said, “I expect it can happen to anyone anytime.” Kubicki claimed the attack may have been the result of a distributed denial of service attack on Monday and that LOT experienced something he called “a capacity attack” that overloaded the airline’s network. While technical details around the incident have been scant, several security researchers agree it could be cause for alarm. Ruben Santamarta, a principal security consultant for IOActive has called the security of planes into question before and based on the statement given by LOT’s spokesman believes the airline may have fallen victim to a targeted attack. “Initially, it seems that flight’s plan couldn’t be generated which may indicate that key nodes in the back office were compromised,” Santamarta said Monday. “On the other hand the inability to perform or validate data loading on aircraft (including flight plans), using the standard procedures, should make us think of another attack vector, possibly against the ground communication devices.” Last summer at Black Hat Santamarta described how aircraft — including passenger jets – along with ships, oil rigs, and wind turbines could be compromised by exploiting its embedded satellite communications (SATCOM) equipment. Andrey Nikishin, Director of Future Technology Projects at Kaspersky Lab, believes there could be two stories behind the hack. The incident could’ve come as a result of human error, or an electrical or hard drive malfunction, Nikishin claims, or perhaps stem from a “more Hollywood style scenario” wherein the attack is a precursor to a bigger, more significant disruption. “Warsaw airport is fairly small compared to Schiphol (Amsterdam) or Heathrow (London) and, depending on the time of day, there are only around 11 flights taking off every hour. ” “What if the incident was just a training action or reconnaissance operation before a more massive cyber-attack on a much busier airport like Charles de Gaulle in Paris or JFK in New York?” Nikishin said. “Regardless of the reason and the threat actors, we can see how our life depends on computers and how vulnerable to cyber-threats national critical infrastructure objects have become.” Earlier this year security researcher Chris Roberts made headlines by getting removed from an American Airlines flight and questioned by the F.B.I. after he claimed he was able to compromise its onboard infrastructure. Roberts told the F.B.I. that he managed to hack into several planes’ in-flight entertainment systems nearly 20 times from 2011 to 2014 although most airlines have refuted these claims. Source: https://threatpost.com/polish-planes-grounded-after-airline-hit-with-ddos-attack/113412

AINA Brought Down By Massive DDoS Attack

AINA’s website was the target of a massive distributed denial of service attack (DDOS) which made the site unavailable for more than one week. The attack was launched on June 8 and continued until yesterday. The source of the attack is unknown. A DDOS attack floods a site with hundreds of thousands of requests, which overloads the system and forces it to shut down. The attack is launched from computers which have been infected with malware, without the knowledge of their owners. A DDOS attack is difficult to defend against because of the very nature of the internet. A website is by definition designed to respond to requests. Any website can be brought down by such an attack. Source: http://www.aina.org/news/20150617135759.htm

See original article:
AINA Brought Down By Massive DDoS Attack

DDoS Attack on Voat due to Reddit

Voat was just a small Reddit knock-off before last week — but now it’s becoming overloaded as people threaten to leave the bigger site So many people are leaving Reddit that its closest competitor crashed and had to ask for donations to stay up. Many users of the site protested and left when last week it banned five subreddits for harassment. And since, users have been making good on threats to leave the site — going instead to a Swiss clone of the site, Voat. That site look almost exactly the same as Reddit, and features many of the same communities. But it is committed to a rule of “no censorship” — previously Reddit’s attitude, but one that it has moved away from as it has attempted to reduce the harassment and abuse on the site. So many people have moved to the Swiss knock-off that it has been down entirely many times since the Reddit bans. In response, the site asked for donations in bitcoin to pay for extra technology to keep the site up. That doesn’t seem to have worked, and the site says that it is now under a distributed denial of service attack, where users send a flood of requests to a website to take it down. But despite the problems, the site now has more than twice as many users as it did late last mnth, according to the site’s Twitter account. It had over 96,000 registered users last night, it said — far from the 172 million unique visitors that went to Reddit in the last month, but up many times over recent weeks. Voat’s founder said that the site was “not ready for such a huge influx of new users” and that it hadn’t “prepared for such a large and sudden increase either”. “We are sorry to see Reddit change like this, in this way, in such an accelerated fashion,” Atko wrote. “We would have never anticipated such events.” Source: http://www.independent.co.uk/life-style/gadgets-and-tech/news/reddit-alternative-breaks-because-so-many-people-leave-site-after-harassment-scandal-10321474.html

Anonymous Hijacks Thousands of Insecure Routers to Power Its DDoS Tools

Lack of some elementary security measures can risk your router’s security and this has stemmed to grow into a large-scale denial-of-service (DDoS) attacks using these hacker-controlled routers. A web security firm Incapsula has discovered a new router based botnet Mr Black while investigating some DDoS attacks against its customers since this December. Hackers exploited routers’ negligent security measures to launch these attacks all over the world. According to this report published by the security firm, the routers made by Ubiquiti Networks had DDoS malware installed on them. The routers were not hacked due to some vulnerability in the hardware. Instead, it happened because of the deployment of the router in an insecure manner that exposed their management interfaces using the default credentials over SSH and HTTP. The routers that were inspected were found to have 4 versions of Mr Black, a DDoS program and altogether thirty-seven variations of Mr Black were detected. Other DDoS programs included DoFloo, Mayday and Skynet (a remote sensing tool). In some earlier versions of the report, Incapsula said that it believed that the hacktivist group Anonymous was one of the few groups those used the compromised routers. It is yet not clear that why Anonymous was highlighted in the report, but it is certain that few people who call themselves “Anonymous” were using the routers. The original article on the Daily Dot was edited to remove the fact that botnet directs to irc (dot) anonops (dot) com. Total 40,269 different IP addresses were detected from 1,600 ISPs spread across 109 countries. The main affected countries were Thailand (64%), Brazil (21%), United States (4%) and India (3%). To control these routers, 60 servers were hacked and majority of these were in China and the U.S. To save themselves from the DDoS attacks, users must make sure that their routers’ management interfaces aren’t exposed over HTTP or SSH to the internet. They can also use some tools available to scan their router’s IP for open ports and change their default login credentials. With inputs from Anon.hq Source: http://omdpatel.blogspot.tw/2015/06/anonymous-hijacks-thousands-of-insecure.html

FBI Links Chinese Government to DDoS Attacks on US Websites

The FBI says it has credible evidence to link the Chinese government to attackers who leveraged two Chinese telecom companies and the Baidu search engine to carry out recent distributed denial of service (DDoS) attacks targeting unnamed U.S. websites. The FBI issued a confidential Flash Alert to U.S. companies alleging that the Chinese government sanctioned activities in which Internet traffic was “manipulated to create cyber attacks directed at U.S.-based websites” using man-in-the-middle (MitM) techniques. “Analysis by the U.S. government indicated that Internet traffic which originated outside China, was intercepted and modified to make unsuspecting users send repeated requests to U.S.-based websites,” the Flash Alert reportedly said. “The malicious activity occurred on China’s backbone Internet infrastructure, and temporarily disrupted all operations on the U.S.-based websites.” Analysis of the attacks revealed that malware was injected into the browsers of users when web traffic reached China Unicom or China Telecom networks – both state-owned telecommunications companies – “at the same points in these routes that censor traffic for the Chinese government.” “The location of the [man-in-the-middle] system on backbone networks operating censorship equipment indicates that the [man-in-the-middle] attack could not have occurred without some level of cooperation by the administrators of these systems,” the Alert said. “The malicious Javascript would direct the unsuspecting user’s browsers to make repeated requests to targeted U.S.-based websites.” While the FBI Flash Alert did not specify which company’s websites were attacked, it is likely that the popular web-based software developers collaboration platform GitHub was among those targeted. Researchers from the University of California at Berkeley, the University of Toronto, and Princeton recently published details of a powerful Chinese MitM tool dubbed the “Great Cannon,” which was used in DDoS attacks targeting websites operated by the anti-censorship project GreatFire.org, and later connected to the attacks on GitHub. “Specifically, the Cannon manipulates the traffic of ‘bystander’ systems outside China, silently programming their browsers to create a massive DDoS attack,” the researchers said. “The operational deployment of the Great Cannon represents a significant escalation in state-level information control: the normalization of widespread use of an attack tool to enforce censorship by weaponizing users.” GitHub was likely targeted because GreatFire.org had begun to mirror some content on the platform. The attacks against GreatFire employed the same techniques as those seen in the GitHub attack, which leveraged hijacked Internet traffic. “The web browser’s request for the Baidu javascript is detected by the Chinese passive infrastructure as it enters China. A fake response is sent out from within China instead of the actual Baidu Analytics script. This fake response is a malicious javascript that tells the user’s browser to continuously reload two specific pages on GitHub.com,” analysis of the attack revealed. This analysis aligns with details of the GreatFire.org attacks which was released previously. “Millions of global internet users, visiting thousands of websites hosted inside and outside China, were randomly receiving malicious code which was used to launch cyber-attacks against GreatFire.org’s websites. Baidu’s Analytics code (h.js) was one of the files replaced by malicious code which triggered the attacks,” officials at GreatFire.org said. “Baidu Analytics, akin to Google Analytics, is used by thousands of websites. Any visitor to any website using Baidu Analytics or other Baidu resources would have been exposed to the malicious code.” GreatFire.org said it has conclusive evidence that the Chinese government using the nation’s infrastructure to conduct the attacks, and had previously published a detailed report, which was further backed up by the analysis provided by the university researchers. “We show that, while the attack infrastructure is co-located with the Great Firewall, the attack was carried out by a separate offensive system, with different capabilities and design, that we term the Great Cannon,” the researchers wrote. “The Great Cannon is not simply an extension of the Great Firewall, but a distinct attack tool that hijacks traffic to (or presumably from) individual IP addresses, and can arbitrarily replace unencrypted content as a man-in-the-middle.” Source: http://en.hackdig.com/06/23256.htm

See the article here:
FBI Links Chinese Government to DDoS Attacks on US Websites

DDoS Attacks Continue To Plague Darknet Markets

The last week brought confirmation that the Agora online marketplace’s recent downtime has been due to a DDoS attack. It joins the long list of darknet services that have been hit by these recent attacks, which now appear to have mostly been based on the darknet markets being held for ransom by attackers. A string of articles on Deep Dot Web recently revealed the source of the issues. The truth was discovered when a market admin’s account was hacked by TheRealDeal, another marketplace, and the admin’s communication were revealed. It was back at the beginning of May when Mr Nice Guy was hit with DDoS attacks. The offenders demanded 8 bitcoins to be paid within an hour to end the assault; however, the admin had another plan in mind. He wanted to negotiate, and he was willing to pay. He offered the attackers $200 a day or $6000 a month to launch DDoS attacks against rival markets including Agora, Nucleus, BlackBank and AlphaBay. The last week brought confirmation that the Agora online marketplace’s recent downtime has been due to a DDoS attack. It joins the long list of darknet services that have been hit by these recent attacks, which now appear to have mostly been based on the darknet markets being held for ransom by attackers. A string of articles on Deep Dot Web recently revealed the source of the issues. The truth was discovered when a market admin’s account was hacked by TheRealDeal, another marketplace, and the admin’s communication were revealed. It was back at the beginning of May when Mr Nice Guy was hit with DDoS attacks. The offenders demanded 8 bitcoins to be paid within an hour to end the assault; however, the admin had another plan in mind. He wanted to negotiate, and he was willing to pay. He offered the attackers $200 a day or $6000 a month to launch DDoS attacks against rival markets including Agora, Nucleus, BlackBank and AlphaBay. The reputation of Mr Nice Guy has surely been greatly damaged by these events. While there is a great deal of competition between darknet markets for the multitude of customers that seek to buy and sell on the Deep Web, in the past similar attacks have been met with collaboration. The darknet markets, though they compete with each other for business recognize the necessity for cooperation, as it only takes a few markets to go down for the integrity of all markets to be questioned. Nowhere was this more evident than when the Evolution marketplace exit scammed, leaving with over $12 million dollars in bitcoin. The aftermath revealed a dark spell of the darknet markets as they all suffered a reduction in customers. In an interview with Deep Dot Web, the man behind Mr Nice Guy spoke about his remorse for what he had done. He said that it would be up to the Deep Web community whether they wished to trust him again. However, he did say that he had learned that the way to attract customers was increasing security as well as providing extra services; he stated that his is the only major marketplace offered in more than one language. While the DDoS attacks are still occurring to an extent, the loss of their contractor has reduced the efforts of the offenders somewhat, and most of the darknet markets have come back online. Yet this saga has definitely shown the weaknesses that exist in the system, and how one stray admin can do an awful lot of damage to the entire network. Source: http://darkwebnews.com/news/ddos-attacks-continue-to-plague-darknet-markets/

Visit site:
DDoS Attacks Continue To Plague Darknet Markets

DDoS attack on DigitalOcean for Alleged on-campus rape

Denial of service attack staged against DigitalOcean, which hosts video stemming from Columbia University student’s protest about alleged on-campus rape The service provider hosting the latest visual art project by Columbia University graduate Emma Sulkowicz has confirmed the site was temporarily disabled by a sophisticated cyberattack after the film which she warns “may resemble rape” was published online last week. Sulkowicz graduated from Columbia in May after completing a year-long performance art project in which she carried a dorm room mattress everywhere she went on campus to protest about the school’s refusal to expel the man she accuses of raping her. The website hosting Sulkowicz’s video, titled Ceci N’est Pas Un Viol, French for This Is Not a Rape, was hit by a denial of service (DoS) attack, in which hackers attempt to force a targeted website offline, according to Keith Anderson, platform support lead at DigitalOcean, where Sulkowicz site is hosted. “We can confirm that there was a denial of service attack on Thursday,” Anderson said. “On Friday there was also a spike in outbound bandwidth coming from the website, likely due to a sudden increase in traffic and unrelated to the attack, so we worked with their web team to resolve the issue and their site is back up and running.” Sulkowicz told the Guardian that she has no doubt the cyberattack was deliberate. But she said she was prepared for it. Her accusation that a classmate raped her was met with a backlash, counter-accusations and trolling. In the video Sulkowicz and an unidentified man engage in a sexual encounter that appears to begin consensually before turning violent. During the act the man slaps her multiple times, ignores her protests and and continues to have violent sex. Sulkowicz and her mattress became a powerful symbol of the movement to reform campus responses to sexual violence after vowing to carry it around campus as her visual arts senior thesis. The video is the artist’s first major work since the conclusion in May of her performance art piece Mattress Performance: Carry That Weight. Sulkowicz accuses Paul Nungesser of raping her in August 2012 at the start of their sophomore year. Columbia investigated the incident and later cleared Nungesser of all responsibility during a campus tribunal. Nungesser has maintained that the encounter was consensual and has since filed a lawsuit against the university, its president and an art professor alleging that the school enabled a harassment campaign. Sulkowicz called the experience of making the video “terrifying” and “traumatizing” but said she was determined to make it because she believed so strongly in its importance. “I was in a very scared, emotional state for days,” Sulkowicz told the Guardian. Sulkowicz said she conceptualized the project in December and pitched it to artist Ted Lawson, whom she met through performance artist Marina Abramovi?. While collaborating on a separate project with Lawson, Sulkowicz said she suggested the video and asked him to direct it. In an interview with ArtNet News, Lawson said: “It was a super risky piece and I thought very courageous, so of course I agreed.” They filmed the video in one of the university’s dorm rooms over spring break, Sulkowicz said. The male actor remains anonymous and his face is blurred in the video. The timestamps on the videos are blurred. Though Sulkowicz said her friends and family have been very supportive in private, she said it can hurt when they don’t support her publicly online. “The trolls don’t upset me as much as when my friends don’t support it,” she said. “I expect the trolls but to see my friends not support it [vocally] is upsetting.” Sulkowicz has said the encounter with Nungesser began consensually but then turned violent. The video echeos her account of that night in August 2012. Though Sulkowicz says it is not a re-enactment, she does appear in the video. Introductory text for the video contains a trigger warning: “The following text contains allusions to rape.” In complementary text published with the video Sulkowicz writes: “Ceci N’est Pas Un Viol is not about one night in August, 2012. It’s about your decisions, starting now. It’s only a re-enactment if you disregard my words. It’s about you, not him.” She characterized reaction to her latest piece as “somber”. Asked what that meant, she said: “With this piece there’s really nothing to rally behind. It’s really more of a quiet, reflective type of support.” Sulkowicz said she was working on a new art piece that she expects to publish soon. She would not give any hints about the theme of the new project. “It’s a different piece,” she said, “but I have only one body and one history to work with.” Source: http://www.theguardian.com/us-news/2015/jun/09/emma-sulkowiczs-this-is-not-a-site-taken-down-by-cyberattack

Taken from:
DDoS attack on DigitalOcean for Alleged on-campus rape

China Overtakes US as Top Source of Distributed Denial of Service Attacks

More Distributed Denial of Service (DDoS) attacks originated in China than in any other country, followed by Germany and the United States, according to the Q1 2015 State of the Internet – Security Report by cloud services provider Akamai. China is responsible for 23.45% of the world’s DDoS attacks , malicious attempts to make servers unavailable to users by interrupting the services of a host connected to the Internet, while 17.39% came from Germany and 12.18% from the US. The number of Chinese DDoS has risen 66% in attack source IPs compared with the US, although researchers say it could be attributed to the increase in redirected traffic from Asia. The United States was the origin of 32% of DDoS attacks in Q4 2014, with China at 18%. The percentage drop does not indicate a decline in attacks from these countries, but rather a change in proportions as the number of total DDoS attacks worldwide soars. DDoS attacks have increased 117% quarter-over-quarter and 35% quarter-on-quarter. The quarter set a record for the number of DDoS attacks observed over the Prolexic network, while the attack duration is now 43% longer than in Q1 2014, according to the report. The US was the top source country of attacking IPs, at 52%, followed by China at 11% and Brazil at 6%, among source countries for web application attacks. US-based websites were the most targeted for web application attacks in Q1 2015, receiving 82% of attacks , while no other country was targeted for more than 2% of attacks. Retail, media/entertainment and hotel/travel were the most targeted industries for web application attacks in Q1 2015. This stems from previous attacks on the financial service sector, which hardened its security policy significantly. Meanwhile, retail and media attacks and breaches of 2014 signaled that these industries were softer targets, leading attackers to probe them for vulnerabilities. Source: http://www.hotforsecurity.com/blog/china-overtakes-us-as-top-source-of-distributed-denial-of-service-attacks-11929.html

More:
China Overtakes US as Top Source of Distributed Denial of Service Attacks

Google Chrome extension turned users into a DDoS botnet

Hola turned users’ PCs into a botnet, without their consent. Hola, an online service used for watching blocked videos and TV shows from websites outside of your country, has turned users’ PCs into a botnet without their consent. According to The Verge , the free-to-use software – which is available as a Chrome plugin – was secretly selling users’ “idle resources” (bandwidth), allowing anyone to buy traffic and redirect it to any site as a denial-of-service attack. This means that Hola users could have been part of a botnet attack. The reports came to light after sites were affected by the denial-of-service attacks from Hola’s network. Hola’s founder Ofer Vilenski said the site has “always made it clear” how its business model works. However, according to The Verge Hola’s users seem to have been almost universally unaware that their bandwidth was being sold off. Source: http://mybroadband.co.za/news/internet/127760-google-chrome-extension-turned-users-into-a-ddos-botnet.html

Continue Reading:
Google Chrome extension turned users into a DDoS botnet

DDoS Attack Update: Idaho Teen Faces Felony Charges After Unleashing a DDoS Attack on School District

In May 15, KTVB reported that a student recently launched a cyber-attack on one of Idaho’s largest school districts. The attack, which was identified as a Distributed Denial of Service (DDoS), practically rendered the entire district’s internet unable to function. The attack was so powerful that it caused internet problems for the affected school district for weeks without ceasing. A lot of Idaho students working on achievement tests lost all their data, and some even had to retake the exam multiple times because of the gravity of the attack. Even the administrative network itself, which, unfortunately, included the teachers’ payroll data was compromised. A DDoS attack occurs when multiple systems compromised by a Trojan are used by a host, or in this case, a channel, to target a single host simultaneously causing a denial of service. In simple terms, the attack floods a single network with immeasurable internet traffic until it simply stops dead on its tracks. Most of these attacks exploit problems within the victim computer’s TCP/IP system. Because a DDoS attack comes from hundreds, possibly even thousands of sources at once, it is practically impossible for any program on earth to track down the actual source of the problem. To make matters worse, a DDoS attack makes it impossible to identify actual, legitimate traffic, because everything gets lost in a haze of incoming data. Despite the overwhelming odds, the authorities managed to trace the attacker’s IP address back to the high school student. Today, he faces the possibility of expulsion, as well as 180 days in a juvenile detention center. Authorities say that he might even be facing serious federal charges. Moreover, the culprit’s parents will also be expected to pay any losses that the school district has incurred due to the attacks. A representative for the West Ada School District said that there might be other students within the area who know how to carry out this cyber-attack. Nevertheless, the spokesperson reassured everyone that further attacks will be dealt with more readily. The district also sent a message to parents of students enrolled in their schools, urging them to help keep their children from committing cyber attacks. Source: http://www.chinatopix.com/articles/51791/20150527/idaho-teen-felony-charges-ddos-attack.htm

Original post:
DDoS Attack Update: Idaho Teen Faces Felony Charges After Unleashing a DDoS Attack on School District