Tag Archives: dos attacks

Interview with a DDoS troll: Meet ‘the Gods of the Internet’

DDoS attacks are a way to keep corrupt corporations honest, according to an anonymous member of DerpTrolling, who gives us an inside look at the self-proclaimed gods of the Internet. The man behind the curtain One of the first things he says is that he absolutely cannot offer proof. This makes a disappointing amount of sense: he is a self-confessed DDoS troll, a member of the infamous group DerpTrolling. Since distributed denial-of-service attacks could be considered a federal crime under US law — and, indeed, are an offence in many locations around the globe, including the UK and Australia — he, understandably, won’t give a name, location or even rough age. As a corollary, we have no way of knowing that he is who he says he is. We’ll call him Incognito. To talk to him, we plug into a private chat session from opposite sides of the globe (as indicated by time zones) using an encrypted Chrome add-on. “I’ve seen Anonymous at its best,” he tells us. “I participated in their major DDoS attacks against Visa and PayPal, although the role DerpTrolling played in those attacks is pretty much unknown. I’ve seen the rise and fall of LulzSec. So let’s just say I am old enough to know how to stay hidden.” One thing is clear from the outset: Incognito believes that what DerpTrolling does is for the good of everyone. “DerpTrolling as a group shows the world, particularly the gaming community, how big companies and corporations such as Riot or Blizzard only care about money,” he explains. “Our methods are forcing big companies and corporations to upgrade their servers and make sure their clients are their top priority.” DerpTrolling has been around since around 2011 or so, and Incognito has been a member since the beginning. Its method of attack, as mentioned above, is DDoS — overloading servers with external communication requests, rendering the target systems unusable for a period of time. DerpTrolling has attacked several high-profile servers over the years, including those of League of Legends, World of Tanks, EVE Online, DoTA 2, Blizzard, RuneScape and, more recently, Xbox Live and the Nintendo Web store. Although their actions may appear inscrutably juvenile and unwarranted — done for, as the saying goes, the lulz — the team identifies rather strongly with Richard Stallman’s assessment of DDoS as a form of protest against what it perceives as a callous disregard for gamers on the part of games publishers. “A company that doesn’t care only for money would make the effort, which includes time and money, to make sure their servers aren’t able to be crippled by a simple DDoS attack,” Incognito said. “We decided to take action because, if we had the capability to stop corporate greed and we did nothing, that in itself is a crime. We thought DDoS attacks were appropriate because they do not affect customers in a monetary way, unlike leaking data — although we are not opposed to leaking data.” Lines in the sand He is careful to point out that DerpTrolling is against doxxing — that is, the leaking of information about a specific individual, such as address, phone number, Social Security number, credit card and bank account details — and swatting, a term for calling the police to the home of said doxxed individual for spurious reasons. In one of the most famous incidents involving the group, though, one particular individual was doxxed and swatted — Twitch streamer PhantomL0rd. While DerpTrolling was attacking Battle.net, EA.com, Club Penguin and Riot, it was allegedly because those were games PhantomL0rd was playing. At some point during the DDoS activities, PhantomL0rd was doxxed on several gaming websites — and then someone called the police to his home, accusing the streamer of holding five people hostage. Incognito is cagey about the incident, and won’t comment on why the group targeted PhantomL0rd or what precisely DerpTrolling did do — only saying that there is no hard evidence connecting DerpTrolling to the actions. “Yes, Phantoml0rd was doxxed and swatted,” he said. “But we never threatened to harm him physically and we have never taken credit for that attack.” “We decided to take action because, if we had the capability to stop corporate greed and we did nothing, that in itself is a crime.” Incognito He seems determined to impress that there are lines DerpTrolling won’t cross — that what the group does, it does for the good of all. As an example, he mentions that the group is sitting on what could have been a significant customer data leak. “We are currently in possession of over 800,000 usernames and passwords from the 2K gaming studio. As of right now, our members as a whole have decided that leaking data is not what we do, and therefore we will not leak such damaging data,” he said, adding that he had contacted 2K to inform the publisher of the vulnerability in its system — and received no response. “I personally contacted them over a month ago. I did not send them an anonymous letter, I made sure they understood exactly who I was. And offered plenty of proof.” Unless the data is actually leaked, he believes that gaming companies are unlikely to spend the money to issue a fix. CNET has contacted 2K for comment and will update when we receive a reply. Incognito also goes out of his way to dissociate DerpTrolling’s activities from those of LizardSquad, the group that claimed responsibility for calling a bomb threat on a plane carrying Sony Online Entertainment president John Smedley. “I want to make it absolutely clear that DerpTrolling is in no way affiliated with LizardSquad,” he said. Although LizardSquad had requested that the two groups work together, DerpTrolling had refused, he said. “LizardSquad is a run by an extremist hacker who has close ties to UGNazi. You could say that the ISISGang is the elite ‘leaders’ of LizardSquad. We have no wish to associate with any individual or group that has ties with such extremists.” ISISGang has been accused of making prank calls that see their targets swatted and posing as Middle Eastern terrorists, while UGNazi is allegedly responsible for several doxxings and data leaks. Incognito seems quite firm that DerpTrolling wishes to commit no actual harm. The end and the means DerpTrolling has more up its sleeve. Attacks on Xbox Live and the Nintendo Web store on Saturday, September 28 were “test fire” for “upcoming attacks”, Incognito says — although he won’t go into any further detail about that. Nor is it easy to guess who the targets might be. DerpTrolling allows the community to select targets much of the time, Incognito said, via text or tweet. The fact that sometimes the attacks achieve a result justifies the work in his view; Incognito says that League of Legends and Xbox Live have both upgraded their servers in response to DerpTrolling DDoS attacks — in spite of negative public opinion. “Children do not know what is best for them. We are basically the Gods of the Internet, we know what is best for them.” Incognito “The public will always have an opinion that is based on what the media feeds them,” he says. “Children do not know what is best for them. We are basically the Gods of the Internet, we know what is best for them.” When asked if DDoS is a snake chasing its own tail — that is, if no one engaged in DDoS attacks, then companies would not have to dedicate resources to protecting against them — he once again pleads no comment. There is a condition under which DerpTrolling will cease operations: “If the presidents of Sony and Microsoft will wear a shoe on their heads, then DerpTrolling will disband and we will not attack any more servers.” As for Incognito himself, we suspect he might be around for a long time. When asked if he himself would ever hang up his hat, he seems baffled by the question. “Why would I want to stop?” Source: http://www.cnet.com/au/news/the-gods-of-the-internet/

DDoS Attacks Can Take Down Your Online Services Part 3: Defending Against DDoS Attacks

Various defense strategies can be invoked to defend against DDoS attacks. Many of these depend upon the intensity of the attack. We discuss some of these in this article. Mitigation Strategies Some protection from DDoS attacks can be provided by firewalls and intrusion-prevention systems (systems that monitor for malicious activity). When a DDoS attack begins, it is important to determine the method or methods that the attacker is using. The web site’s front-end networking devices and the server’s processing flow may be able to be reconfigured to stop the attack. UDP Attacks UDP (User Datagram Protocol) attacks send a mass of UDP requests to a victim system, which must respond to each request. One example is a ping attack. It is an enormous influx of ping requests from an attacker that requires the victim server to respond with ping responses. Another example of a UDP attack is when the Internet Control Message Protocol (ICMP) must be used by the server to return error messages. The messages may indicate that a requested service is unavailable or that a host or router cannot be reached. An attacker may send UDP messages to random ports on the victim server, and the server must respond with a “port unreachable” ICMP message. Mitigation Strategy In the case of a UDP attack, the firewall could be configured to reject all UDP messages. True, this would prevent legitimate use of UDP messages, such as pings sent by monitoring services to measure the uptimes and response times of the web site. However, to be shown as failed by a monitoring service is much better than actually being down. SYN Attacks In a SYN attack, a mass of connection requests are sent to the victim server via SYN messages. Typically, the victim server will assign connection resources and will respond with SYN ACK messages. The server expects the requesting client to complete the connections with ACK messages. However, the attacker never completes the connections; and the server soon runs out of resources to handle further connection requests. Mitigation Strategy In this case, the server connection facility could be reconfigured so that it did not assign connection resources until it received the ACK from the client. This would slightly extend the time required to establish a connection but would protect the server from being overwhelmed by this sort of an attack. DNS Reflection Attack A DNS reflection attack allows an attacker to send a massive amount of malicious traffic to a victim server by generating a relatively small amount of traffic. DNS requests with a spoofed victim address are sent to multiple DNS systems to resolve a URL. The DNS servers respond to the victim system with DNS responses. What makes this sort of attack so efficient is that the DNS response is about 100 times as large as the DNS request. Therefore, the attacker only needs to generate 1% of the traffic that will be sent to the victim system. DNS reflection attacks depend upon DNS open resolvers that will accept requests from anywhere on the Internet. DNS open resolvers were supposed to have been removed from the Internet, but 27 million still remain. Mitigation Strategy A defense against DNS reflection attacks is to allow only DNS responses from the domain of the victim server to be passed to the server. Mitigation Services Given a sufficiently large DDoSattack, even the steps mentioned here may not protect a system. If nothing else, the attack can overwhelm the bandwidth of the victim’s connection to the Internet. In such cases, the next step is to use the services of a DDoS mitigation company with large data centers that can spread the attack volume over multiple data centers and can scrub the traffic to separate bad traffic from legitimate traffic. Prolexic, Tata Communications, AT&T, Verisign, CloudFare, and others are examples of DDoS mitigation providers. These services will also monitor the nature of the attack and will adjust their defenses to be effective in the face of an attacker that modifies its strategies as the attack progresses. Legality DDoS attacks are specifically outlawed by many countries. Violators in the U.K. can serve up to ten years in prison. The U.S. has similar penalties, as do most major countries. However, there are many countries from which DDoS attacks can be launched without penalty. With respect to the Spamhaus attack described in Part 1, the CEO of CyberBunker, a Dutch company, was arrested in Spain and was returned to the Netherlands for prosecution. Summary Companies must prepare for the likelihood of losing their public-facing web services and must make plans for how they will continue in operation if these services are taken down. This should be a major topic in their Business Continuity Plans. For instance, in the case of the bank attacks described in Part 1, many banks made plans to significantly increase their call center capabilities to handle customer services should their web sites be taken down by a DDoS attack. DDoS attacks are here to stay. They are motivated by too many factors – retaliation, political statements, aggressive competitors, ransom – and are fairly easy to launch. Botnets can be rented inexpensively. There are even sophisticated tools available on the darknet to launch significant attacks. The defenses against DDoS attacks are at best limited. The ultimate defense is to subscribe to a DDoS mitigation service that can be called upon when needed. Source: http://www.techproessentials.com/ddos-attacks-can-take-down-your-online-services-part-3-defending-against-ddos-attacks/

Read the article:
DDoS Attacks Can Take Down Your Online Services Part 3: Defending Against DDoS Attacks

Hackers using Shellshock to spread Kaiten Mac OS DDoS malware

Hackers are exploiting the Shellshock bug to infect numerous systems, including Apple Mac OS X, with a distributed denial-of-service (DDoS) malware known as Kaiten. Security researchers from Trend Micro reported uncovering the campaign in a blog post, warning that it has the potential to inflict devastating DDoS attacks. “We found that one of the payloads of Bash vulnerabilities, which we detect as TROJ_BASHKAI.SM, downloaded the source code of Kaiten malware, which is used to carry out denial-of-service attacks,” read the post. “Kaiten is old IRC-controlled DDoS malware and, as such, there is a possibility that the attackers employed Shellshock to revive its old activities like DDoS attacks to target organisations.” Discovered earlier in September, Shellshock is a critical vulnerability in the Bash code used by Unix and Unix-like systems. Trend Micro listed the new attack’s ability to infect Mac OS systems as being particularly troubling, highlighting it as evidence that hackers are using Shellshock to expand the victim-base of their campaigns. “Typically, systems infected with Shellshock payloads become a part of their botnet, and therefore can be used to launch DDoS attacks. In addition, the emergence of a downloaded file that targets Mac OS clearly shows that attackers are broadening their target platform,” the security firm said. Trend Micro added that the threat is doubly dangerous as Apple had mistakenly told its users that most should be safe by default. “Users who configured to enable the Advanced Unix Services are still affected by this vulnerability,” read the post. “The Advanced Unix services enables remote access via Secure Shell which offers ease of access to system or network administrators in managing their servers. This service is most likely enabled for machines used as servers such as web servers, which are the common targets Shellshock attacks.” Apple released security patches to plug Shellshock for its OS X Maverick, Lion and Mountain Lion operating systems in September. The Trend Micro researchers added that IT managers should be on guard for the attack as it has advanced detection dodging powers. “When it connects to http://www[dot]computer-services[dot]name/b[dot]c, it downloads the Kaiten source code, which is then compiled using the common gcc compiler. This means that once connected to the URL, it won’t immediately download an executable file,” explained the researchers. “This routine could also be viewed as an evasion technique as some network security systems filter out non-executable files from scanning, due to network performance concerns. Systems configured this way may skip the scanning of the source code because it’s basically a text file.” The Kaiten attack is one of many recently discovered campaigns using Shellshock. Researchers from FireEye caught hackers exploiting the Shellshock Bash vulnerability to infect enterprise Network Attached Storage systems with malware at the end of September. Source: http://www.v3.co.uk/v3-uk/news/2374038/hackers-using-shellshock-to-spread-kaiten-mac-os-ddos-malware

More here:
Hackers using Shellshock to spread Kaiten Mac OS DDoS malware

Secondhand DDoS: Why hosting providers need to take action

Unfortunately, the sheer size and scale of hosting or datacenter operator network infrastructures and their massive customer base presents an incredibly attractive attack surface due to the multiple entry points and significant aggregate bandwidth that acts as a conduit for a damaging and disruptive DDoS attack. As enterprises increasingly rely on hosted critical infrastructure or services, they are placing themselves at even greater risk from these devastating cyber threats – even as an indirect target. What is secondhand DDoS? The multi-tenant nature of cloud-based data centres and shared, hosted environments can be less than forgiving for unsuspecting tenants. A DDoS attack, volumetric in nature against one tenant, can lead to disastrous repercussions for others; a domino effect of latency issues, service degradation and potentially damaging and long lasting service outages. The excessive amount of malicious traffic bombarding a single tenant during a volumetric DDoS attack can have adverse effects on other tenants as well as the overall data centre or hosting providers operation. In fact, it is becoming more common that attacks on a single tenant or service can completely choke up the shared infrastructure and bandwidth resources, resulting in the entire data centre can be taken offline or severely slowed – AKA, secondhand DDoS. Black-holing or black-hole routing is a common, crude defense against DDoS attacks, which is intended to mitigate secondhand DDoS. With this approach, the cloud or hosting provider blocks all packets destined for a domain by advertising a null route for the IP address (es) under attack. There are a number of problems with utilising this approach for defending against DDoS attacks: Most notably is the situation where multiple tenants share a public IP address range. In this case, all customers associated with the address range under attack will lose all service, regardless of whether they were a specific target of the attack. In effect, the data centre or hosting operator has finished the attacker’s job by completely DoS’ing their own customers. Furthermore, injection of null-routes is a manual process, which requires human analysts, workflow processes and approvals; increasing the time to respond to the attack, leaving all tenants of the shared environment suffering the consequences for extended periods of time, potentially hours. The growing dependence on the Internet makes the impact of successful DDoS attacks-financial and otherwise-increasingly painful for service providers, enterprises, and government agencies. And newer, more powerful DDoS tools promise to unleash even more destructive attacks in the months and years to come. Enterprises which rely on hosted infrastructure or services need to start asking the tough questions of their hosting or datacentre providers, as to how they will be properly protected when a DDoS attack strikes. As we’ve seen on numerous occasions, hosted customers are simply relying on their provider to ‘take care of the attacks’ when they occur, without fully understanding the ramifications of turning a blind eye to this type of malicious behavior. What to do to mitigate an attack and protect the infrastructure Here are three key steps for providers to consider to better protect their own infrastructure, and that of their customers. Eliminate the delays incurred between the time traditional monitoring devices detects a threat, generates an alert and an operator is able to respond; reducing initial attack impact from hours to seconds by deploying appliances that both monitor and mitigate DDoS threats automatically. The mitigation solution should allow for real-time reporting alert and event integration with back-end OSS infrastructure for fast reaction times, and the clear visibility needed to understand the threat condition and proactively improve DDoS defenses. Deploy the DDoS mitigation inline. If you have out-of-band devices in place to scrub traffic, deploy inline threat detection equipment quickly that can inspect, analyse and respond to DDoS threats in real-time. Invest in a DDoS mitigation solution that is architected to never drop good traffic. Providers should avoid the risk of allowing the security equipment to become a bottleneck in delivering hosted services—always allowing legitimate traffic to pass un-interrupted, a do no harm approach to successful DDoS defense. Enterprises rely on their providers to ensure availability and ultimately protection against DDoS attacks cyber threats. With a comprehensive first line of defense against DDoS attacks deployed, date centre and hosting providers are protecting its customers from damaging volumetric threats directed at or originating from or within its networks. Source: http://www.information-age.com/technology/security/123458517/secondhand-ddos-why-hosting-providers-need-take-action

Link:
Secondhand DDoS: Why hosting providers need to take action

DDoS Attacks Target Online Gaming Sites, Enterprises

DDoS traffic volume was up overall with a third peaking at over 500Mbps and more than five percent reaching up to 4Gbps, according to NSFOCUS. A continuing trend of distributed denial-of-service (DDoS) attacks that are short in duration and repeated frequently has been revealed by the NSFOCUS 2014 Mid-Year Threat report. In parallel, high-volume and high-rate distributed denial of service (DDoS) attacks were on the upswing in the first half of 2014. DDoS traffic volume was up overall with a third peaking at over 500Mbps and more than five percent reaching up to 4Gbps. In addition, findings showed that over 50 percent DDoS attacks were above 0.2Mpps in the first half of 2014, increasing from around 16 percent. More than 2 percent of DDoS attacks were launched at a rate of over 3.2Mpps, according to the report. “The DDoS attack is a relatively easy attack method to be employed with noticeable effects among other network attacks. When online service is stopped, the impact and damage it causes is very apparent and straightforward,” Xuhua Bao, senior researcher at NSFOCUS, told eWeek. “Attacks with high frequency make it hard for attack’ targets to respond to instantly, increasing the difficulty of the defense level.” The longest single attack lasted nine days and 11 hours, or 228 hours, while the single largest attack in terms of packet-per-second (pps) hit at a volume of 23 million pps. More than 42 percent of attack victims were targeted multiple times while one in every 40 victims was repeatedly hit more than 10 times. The highest frequency of attacks experienced by a single victim was 68 separate DDoS attacks. “Today, DDoS attack methods have become highly instrumental and resourceable. When an attacker plans to launch a DDoS attack on a specific target, there are plenty of DDoS attack tools and resources available online to be purchased and used,” Bao said. “With the rise of hacktavism in recent years, DDoS attacks have become a means of protesting or expressing your own opinion, which is widely used by some hacker groups.” The report revealed HTTP Flood, TCP Flood and DNS Flood were the top three attack types, together making up 84.6 percent of all attacks. DNS Flood attacks held their place as the most popular attack method, accounting for 42 percent of all attacks. While the number of DNS and HTTP Flood attacks decreased, TCP Flood attacks grew substantially. More than 90 percent of attacks detected lasted less than 30 minutes, an ongoing trend the report said indicates that latency-sensitive websites, such as online gaming, e-commerce and hosting service should be prepared to implement security solutions that support rapid response. The survey also indicated an increase in Internet service providers (ISPs), enterprises and online gaming sites as targets. Attacks targeting ISPs increased by 87.2 percent, while attacks on enterprises jumped by 100.5 percent and online gaming by 60 percent. “The online gaming industry has been a target of DDoS attacks and are mainly profit-driven. The nature of online gaming relies greatly on the Internet service and often there is a huge amount of money involved making them extremely sensitive to attacks,” Bao said. “When they are being attacked, there are obvious and direct economic losses, as well as the loss of the resources from players, which leads to malicious competition and extortion.” Source: http://www.eweek.com/small-business/ddos-attacks-target-online-gaming-sites-enterprises.html

See the article here:
DDoS Attacks Target Online Gaming Sites, Enterprises

Hackers Are Already Using the Shellshock Bug to Launch Botnet Attacks

With a bug as dangerous as the “shellshock” security vulnerability discovered yesterday, it takes less than 24 hours to go from proof-of-concept to pandemic. As of Thursday, multiple attacks were already taking advantage of that vulnerability, a long-standing but undiscovered bug in the Linux and Mac tool Bash that makes it possible for hackers to trick Web servers into running any commands that follow a carefully crafted series of characters in an HTTP request. The shellshock attacks are being used to infect thousands of machines with malware designed to make them part of a botnet of computers that obey hackers’ commands. And in at least one case the hijacked machines are already launching distributed denial of service attacks that flood victims with junk traffic, according to security researchers. The attack is simple enough that it allows even unskilled hackers to easily piece together existing code to take control of target machines, says Chris Wysopal, chief technology officer for the web security firm Veracode. “People are pulling out their old bot kit command and control software, and they can plug it right in with this new vulnerability,” he says. “There’s not a lot of development time here. People were compromising machines within an hour of yesterday’s announcement.” Wysopal points to attackers who are using a shellshock exploit to install a simple Perl program found on the open source code site GitHub. With that program in place, a command and control server can send orders to the infected target using the instant messaging protocol IRC, telling it to scan other networked computers or flood them with attack traffic. “You install it on the server that you’re able to get remote command execution on and now you can control that machine,” says Wysopal. The hackers behind another widespread exploit using the Bash bug didn’t even bother to write their own attack program. Instead, they rewrote a proof-of-concept script created by security researcher Robert David Graham Wednesday that was designed to measure the extent of the problem. Instead of merely causing infected machines to send back a “ping” as in Graham’s script, however, the hackers’ rewrite instead installed malware that gave them a backdoor into victim machines. The exploit code politely includes a comment that reads “Thanks-Rob.” The “Thanks-Rob” attack is more than a demonstration. The compromised machines are lobbing distributed denial of service attacks at three targets so far, according to researchers at Kaspersky Labs, though they haven’t yet identified those targets. The researchers at the Russian antivirus firm say they used a “honeypot” machine to examine the malware, locate its command and control server and intercept the DDoS commands it’s sending, but haven’t determined how many computers have already been infected. Based on his own scanning before his tool’s code was repurposed by hackers, Graham estimates that thousands of machines have been caught up in the botnet. But millions may be vulnerable, he says. And the malware being installed on the target machines allows itself to be updated from a command and control server, so that it could be changed to scan for and infect other vulnerable machines, spreading far faster. Many in the security community fear that sort of “worm” is the inevitable result of the shellshock bug. “This is not simply a DDoS trojan,” says Kaspersky researcher Roel Schouwenberg. “It’s a backdoor, and you can definitely turn it into a worm.” The only thing preventing hackers from creating that worm, says Schouwenberg, may be their desire to keep their attacks below the radar—too large of a botnet might attract unwanted attention from the security community and law enforcement. “Attackers don’t always want to make these things into worms, because the spread becomes uncontrollable,” says Schouwenberg. “It generally makes more sense to ration this thing out rather than use it to melt the internet.” The Bash bug, first discovered by security researcher Stéphane Chazelas and revealed Wednesday in an alert from the US Computer Emergency Readiness Team (CERT), still doesn’t have a fully working patch. On Thursday Linux software maker Red Hat warned that a patch initially released along with CERT’s alert can be circumvented. But Kaspersky’s Schouwenberg recommended that server administrators still implement the existing patch; While it’s not a complete cure for the shellshock problem, he says it does block the exploits he’s seen so far. In the meantime, the security community is still bracing for the shellshock exploit to evolve into a fully self-replicating worm that would increase the volume of its infections exponentially. Veracode’s Chris Wysopal says it’s only a matter of time. “There’s no reason someone couldn’t modify this to scan for more bash bug servers and install itself,” Wysopal says. “That’s definitely going to happen.” Source: http://www.wired.com/2014/09/hackers-already-using-shellshock-bug-create-botnets-ddos-attacks/

DDoS Attacks Go Mobile

The cyber security industry has a new front to defend. Hackers are migrating their malicious techniques and technology to mobile platforms and businesses, organizations and users are already feeling the impact. Android: The New DDoS Launchpad A new Android app is causing the mass distribution of a DDoS malware. This DDoS tool uses a Low Orbit Impact Cannon (LOIC) to send TCP/UDP packets to a URL of the hacker’s choosing. Originally, LOIC was an attack that originated from desktops. But a hacker took the open-source LOIC and converted it into an Android app that has sent the security industry reeling. Current mobile infrastructures are vulnerable to hacking and cyber hijacking—the standard security measures of desktop networks and operating systems are rarely seen on mobile devices. The Problem of Super Proxies DDoS attacks sent from mobile devices present a difficult challenge for mitigation; malicious data packets sent from mobile devices travel in “Super Proxies,” or secure servers channeling data from countless other mobile devices. Data traveling in Super Proxies is notoriously difficult to separate and filter. Simply installing a piece of hardware that can stop traffic from specific IPs is not enough; this will cause the server to group bad traffic with that of legitimate users. When users can’t get through to the server, the DDoS hacker has succeeded in ‘denying service.’ Mobile DDoS and Android.DDoS.1.origin The cyber-security community is trying to take lessons from a dangerous mobile DDoS event in 2012. Most substantial DDoS events require a ‘botnet’ or ‘zombie’ army to carry out the attack, and Android.DDoS.1 was no different. It began when a hacker disguised malware in a fake Google Play application. Users downloaded the bogus software onto their devices, giving the hacker remote command of the mobile’s computing power. After amassing a significant botnet army, the hacker sent commands via SMS (didn’t the hacker know about Whatsapp?) to the DDoS viruses. These instructions included the target’s server address and a script to repeat. Once confirmed, the mobile devices also sent out spam text messages to the victim’s contact list, likely to spread the virus. With thousands of these infected mobile devices operating in unison, their requests generated a powerful DDoS force capable of overwhelming even large target servers. One mobile device sending bad requests does little, but an army can do some serious damage. Even experienced users who are wary of the typical trappings of PC-based malware may not be aware of the new dangers on mobile. Expect to see hackers getting more creative as the vulnerabilities in mobile networking are exposed. Handling the New Wave of Mobile DDoS Organizations and businesses trying to stay ahead of the DDoS mobile evolution are entrusting their security measures to experienced third-party protection services, whose robust networks are equipped to handle TCP and UDP attacks, among all other major attack methods in the security landscape. Source: http://www.sitepronews.com/2014/09/25/ddos-attacks-go-mobile/

Continue reading here:
DDoS Attacks Go Mobile

Chain Radio Returns After A Massive DDoS Attack

Who’d have thought it would be such a chore to run a radio station? Chain Radio, which launched a at the end of July, and since then they’ve dealt with some major issues. Namely, they’ve been the subject of DDoS attacks for weeks, but it really caught up with them in the last week. Rockstar, the head of Chain Radio, made a post on their page talking about what they’ve had to deal with in order to get their site up and running again, and the challenges they’ve faced. Unlike many other sites in the world of Bitcoin land we are operating a fleet of streaming servers which can not be simply placed behind the protection of CloudFlare. When someone is attacking our servers we are in a constant state of battle blocking IP ranges, blocking specific IPs and trying to keep everything online. Nevertheless, Rockstar remained defiant in the face of adversity. “It costs us over a thousand dollars each month to keep this service online for our listeners and if the DDOS attacks continue it will likely cost even more,” he said. “That said, we are committed to seeing this project through and NOT letting a few jerks silence what we are doing and the community that we are creating.” As to the identity of those “few jerks” and their motives, it remains unknown. As of this writing, Chain Radio is back up and running. They’re running a non-profit operation, relying largely on donations from the community. They’re taking donations to help offset the cost of the project through their website. Source: http://thecoinfront.com/chain-radio-returns-after-a-massive-ddos-attack/

Continue reading here:
Chain Radio Returns After A Massive DDoS Attack

The Escapist #GamerGate Forums Brought Down In DDoS Attack

Earlier this week, Milo Yiannopoulos of Breitbart London published an article containing emails between a group of video game journalists, all members of an email list called GameJournoPros. The Breitbart piece suggested collusion between these journalists to provide a specific spin on news during the early days of the Zoe Quinn scandal, which has now blossomed into the broader #GamerGate movement, and to clamp down on discussion of the topic across sites and forums. Yiannopolous also published the full exchange of emails, which provided a more nuanced look at the situation. In the emails various game writers discuss the Quinn scandal and how to approach it. Some suggest sending a note of solidarity, while others push back against this idea, citing the need for professional distance between journalists and their subjects. All told, it appears to be a largely civil conversation between professionals. But two moments in the thread ought to raise eyebrows. In one, writer Ryan Smith asks questions about where other writers and publications draw the line on writing about the private lives of subjects. He is quickly shouted down. More important is an exchange between Polygon writer Ben Kuchera and The Escapist’s Editor-in-Chief Greg Tito. Kuchera urges Tito to shut down The Escapist forum where the discussion of Quinn was occurring, but Tito refuses, arguing that a place for discussion is a healthy thing. “The conversation may be distasteful to some of us,” Tito writes in response to Kuchera and others, “but I don’t know if the answer is to delete the thread. The Escapist is not giving harassment a home, but allowing civil discussion on a matter that people are emotional about.” Since these emails took place, #GamerGate has been born and even the release of Bungie’s popular video game Destiny hasn’t dampened the voices on both sides. However, it appears that many forums where discussion of #GamerGate has been occurring have been clamping down. Both reddit and 4chan have been banning users and shutting down forums related to the topic. One of the only places outside of Twitter where any discussion has been occurring has been at The Escapist. This morning The Escapist came under a DDoS (denial of service) attack, according to the co-founder and GM of the site Alexander Macris. “A DDOS attack is currently underway against @TheEscapistMag. The attackers are specifically targeting the GamerGate forum thread,” Macris tweeted this morning. After a brief interlude the attacks began again, and eventually the publication was forced to take down the forums temporarily. The attack consists of “a large number of IP addresses targeted the GamerGate thread for reload many times per second.” At this point there is no information of the perpetrator of the attack though The Escapist is working to find out. The timing of the attack, following the revelations in the GameJournoPros emails, does raise questions. We will continue to follow this story and update as more information comes to light. If anyone has information about the attacks please don’t hesitate to reach out. Source: http://www.forbes.com/sites/erikkain/2014/09/20/the-escapist-forums-brought-down-in-ddos-attack/

Continued here:
The Escapist #GamerGate Forums Brought Down In DDoS Attack

DDoS Attack on RT News Website

The RT news website has undergone the most powerful Distributed Denial of Service (DDoS) attack in its history, the press service of the channel reported Wednesday. “Thanks to the website’s reliable technical protection, RT.com was unavailable just for a few minutes,” the statement reads. According to the channel’s press service, RT.com has been repeatedly subjected to DDoS-attacks. One of the most powerful hacker attacks occurred on February 18, 2013. The website was unavailable for about 6 hours. In 2012 the channel’s English and Spanish websites also came under attack. The attack was claimed by anti-WikiLeaks hacker group AntiLeaks. A DDoS-attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. The RT network’s first channel was launched in December 2005 and now consists of three global news channels broadcasting in English, Spanish and Arabic. RT has 22 bureaus in 19 countries and territories. RT reaches over 644 million people in more than 100 countries. Source: http://en.ria.ru/society/20140918/193035597/Hackers-Attack-RT-News-Website.html

View original post here:
DDoS Attack on RT News Website