Tag Archives: latest-news

$183,000 fine for man who joined Anonymous attack for ‘one minute’

Authorities in the US have shown their intolerance for so-called ‘hacktivism’ by sentencing a 38-year-old Wisconsin man to two years’ probation and an $183,000 fine for joined an online attack for just a single minute. Eric J. Rosol participated in a Distributed Denial of Service attack (DDoS) against the website for American multinational Koch Industries. DDoS attacks ‘take down’ websites by repeatedly loading them using automatic software. The attack was organised by the hacker group Anonymous and succeed in taking the website offline for only 15 minutes. Rosol pleaded guilty to one misdemeanour count of accessing a protect computer, and although both parties agree that the direct loss to Koch Industries (the second largest privately owned company in the US) was less than $5,000, because the corporation had hired a consulting group to protect its web territory for fees of $183,000 – this was the sum that Rosol must now pay. Koch Industries works in a number of industries including petroleum and manufacturing and reported revenues of $115 billion in 2013. The company is controlled by brothers Charles and David Koch (the world’s sixth and seventh richest men) who inherited it from their deceased father Fred C. Koch, the company’s founder. Koch Industries is often the subject of controversy in the US for its financial support of right-wing Tea Party and its opposition to the green energy industry. The brothers have also donated more than $120m to groups working to discredit climage change science. The DDoS attack which Rosol took part in was organized in opposition to Koch Industries’ reported weakening of trade unions. Source: http://www.independent.co.uk/life-style/gadgets-and-tech/183000-fine-for-man-who-joined-anonymous-attack-for-one-minute-8995609.html

View the original here:
$183,000 fine for man who joined Anonymous attack for ‘one minute’

Introducing the DDDoSA: Disguised DDoS Attack

The Distributed Denial of Service (DDoS) attack is becoming the crowbar of the online criminal. In the past we have got rather used to DDoS attacks being one of the favoured approaches of hacktivists, with perhaps the Low Orbit Ion Cannon (LOIC) and later the High Orbit Ion Cannon (HOIC) as used by Anonymous to take down sites being the best known examples. However, recent evidence suggests that taking down a site is increasingly no longer the be all and end all of a DDoS attack, instead it’s just a means to a much more profitable end. A couple of weeks ago I reported how a Bitcoin bank robbery took place under the smokescreen of a DDoS attack. I’ve now learned that a DDoS attack on another Bitcoin-related site, the Bitcointalk.org online forum, could also have been implemented as a smokescreen tactic. Information Week reports the site was actually targeted for a password-stealing exercise with some 176,584 users login credentials at risk. Indeed, as TK Keanini (CTO at Lancope) points out there is an established marketplace out there selling the DDoS capability to anyone with the cash, and relatively little of it is needed to attack a smaller company, so the bad guys don’t even need a DDoS strike capability as a core competency any more. “It is almost always the case these days that DDoS attacks leverage blended methods, where the volumetric technique is included, but not the primary objective” Keanini says, adding “this is a sign of what is to come in 2014 as more adversaries just put together a multi faceted compostable attack and instead of having to have all this expertise in-house, they will be able to outsource via these marketplaces that sell these capabilities.” Jag Bains, CTO at DDoS mitigation experts DOSarrest says that his company has been seeing DDoS attacks sending huge amounts of traffic to a website to overwhelm key points in its infrastructure to send the security team scrambling to fight it off as something of a trend. “This serves as a distraction for the security personnel and aims to weaken the underlying infrastructure” Bains explains “once the security operations are no longer cohesive, criminals can use other methods to target intrusion prevention systems to get in and steal information”. All of which just goes to reinforce that maintaining the focus of core operations during a DDoS attack is an ever increasing problem for IT operations. “As DDoS continues to be used as part of a 1-2 punch in cybercrime and data theft attempts” Bains concludes “IT professionals have become stressed in keeping up with the ever increasing size and sophistication of DDoS attacks”. All of which can influence an organisation to resort to what you might call non-standard, or panicked, practices to deal with the ongoing attack. Things such as disabling their IDS platform for example. Things that further compromise the overall security of the network and enable the attackers to pull off the primary attack with ease.

More:
Introducing the DDDoSA: Disguised DDoS Attack

RBS hit by DDoS attack that takes down online services again

UK BANKING GROUP Royal Bank of Scotland (RBS) has been hit by a distributed denial of service (DDoS) attack that took down its online services for the second time this week. Earlier this week, RBS irked customers when an IT systems failure shut down its websites and caused its customers’ bank cards to fail. On Friday it admitted that it has been struck by a DDoS attack affecting its online services once again. RBS took to Twitter to reveal news of the DDoS attack. It said, “Due to a surge in internet traffic directed at the Natwest website, customers experienced difficulties accessing some of our sites today. “This deliberate surge of traffic is known as a distributed denial of service (DDoS) attack. We have taken action to restore affected sites. “At no time was there any risk to customers. We apologise for the inconvenience caused.” RBS has yet to comment further, so it’s still unclear which websites were downed in the attack, although the tweet suggested that the RBS, Natwest and Ulster Bank websites were all affected. It is also still unclear who was responsible for the DDoS attack. However, it seems that the problems have not reached as far as those experienced by RBS customers earlier this week, when an IT systems failure struck the entire banking group. Speaking about the system failure on Monday evening, RBS CEO Ross McEwan said on Tuesday, “Last night’s systems failure was unacceptable. Yesterday was a busy shopping day and far too many of our customers were let down, unable to make purchases and withdraw cash. “For decades, RBS failed to invest properly in its systems. We need to put our customers’ needs at the centre of all we do. It will take time, but we are investing heavily in building IT systems our customers can rely on. “I’m sorry for the inconvenience we caused our customers. We know we have to do better. I will be outlining plans in the New Year for making RBS the bank that our customers and the UK need it to be. This will include an outline of where we intend to invest for the future.” Source: http://www.theinquirer.net/inquirer/news/2317692/rbs-hit-by-ddos-attack-that-takes-down-online-services-again

View article:
RBS hit by DDoS attack that takes down online services again

PayPal 14 plea deal a win for DDoS as civil disobedience

Eleven of the fourteen defendants in the PayPal 14 case have reached a plea deal with federal prosecutors. Under the agreement, the defendants will plead guilty to felonies and misdemeanors under the Computer Fraud and Abuse Act (CFAA). If they observe good behavior, federal prosecutors will ask that the felonies be dropped. This comes as good news to those who advance the notion that DDoS (Distributed Denial of Service) attacks are acts of civil disobedience. Two other defendants will serve 90 days in prison after pleading guilty to a misdemeanor charge pled guilty to a misdemeanor, while the last of the fourteen defendants was not eligible for a plea deal in the case. The PayPal 14 are only a small fraction of the over 1,000 participants identified in a DDoS attack aimed at PayPal, which Anonymous hit as part of “Operation Payback” after the company cut service to WikiLeaks’s donations page. Pierre Omidyar, founder of eBay, which is the parent company of PayPal, called for leniency. Ironic given that PayPal provided the Department of Justice with a list of the participants’ IP addresses, which helped the FBI locate the protesters. “I can understand that the protesters were upset by PayPal’s actions and felt that they were simply participating in an online demonstration of their frustration. That is their right, and I support freedom of expression, even when it’s my own company that is the target,” Omidyar wrote two days ago in a Huffington Post op-ed. “The problem in this case however is that the tools being distributed by Anonymous are extremely powerful. They turn over control of a protester’s computer to a central controller which can order it to make many hundreds of web page requests per second to a target website.” DDoS works by connecting thousands of computers together to bombard websites with traffic until it collapses. As Omidyar noted, it multiplies the power of a single protester, which is something that cannot be done in the physical realm without significant grassroots effort. Nevertheless, the plea deal is significant because it sets a legal precedent that DDoS isn’t just some effort to cause significant financial harm. While the plea deal doesn’t define DDoS as digital protest, it might be the first step in acknowledging the attack as something akin to protesters blocking a road or a business. These physical protests are typically prosecuted as misdemeanors, not felonies that can bring hefty prison terms, high restitution costs, and a lifetime designation as a felon. The PayPal 14 plea deal might also help begin the very necessary process of amending the CFAA, which allows stiff penalties for these non-violent crimes in the first place. Shortly before the news was announced, activist lawyer Stanley Cohen tweeted: “Stay tuned for details. Pay Pal 14 will be resolved today, big win for civil disobedience. Up the Rebels.” And a good win for the internet, which is coming of age as the supreme venue for protest against political and financial power. Source: http://www.deathandtaxesmag.com/210854/paypal-14-plea-deal-a-win-for-ddos-as-civil-disobedience/

Bitcoin Password Grab Disguised As DDoS Attack

Attacks against bitcoin users continue, as online forum Bitcointalk.org warns users their passwords might have been stolen in distributed denial of service hack. Aficionados of the cryptographic currency known as Bitcoin might have gotten more than they bargained for recently, after a distributed denial-of-service (DDoS) attack appeared to be used as a smokescreen for launching a password-stealing attack against users of Bitcointalk.org. Michael Marquardt (a.k.a. “Theymos”), one of the administrators of the popular bitcoin discussion forum, Sunday warned its 176,584 members of the attack. He said the attack had been traced to a flaw in the systems of domain registration firm AnonymousSpeech, which specializes in anonymous email, as well as running hosting servers outside the United States and the European Union. Attackers hacked AnonymousSpeech to change the bitcoin discussion forum’s DNS settings to an attacker-controlled server. According to Marquardt, the DNS redirection attack was spotted Sunday by forum manager Malmi Martti (a.k.a. Sirius), who immediately moved the domain to a different registrar. “However, such changes take about 24 hours to propagate,” he warned, meaning that users remained at risk unless they logged on to the forum using its IP address, rather than trusting domain name servers to resolve to the non-malicious site. What was the risk to forum users? “Because the HTTPS protocol is pretty terrible, this alone could have allowed the attacker to intercept and modify encrypted forum transmissions, allowing them to see passwords sent during login, authentication cookies, [personal messages], etc.,” Marquardt said. “Your password only could have been intercepted if you actually entered it while the forum was affected. I invalidated all security codes, so you’re not at risk of having your account stolen if you logged in using the ‘remember me’ feature without actually entering your password.” In other words, anyone who logged into the forum between Sunday and Monday, and who entered a password, should assume that it was compromised by attackers. What were the bitcoin forum attackers gunning for? The most likely explanation would be participants’ usernames and passwords, which — if reused on other sites — might have allowed attackers to drain people’s online bitcoin wallets. Likewise, attackers might have been interested in gathering email addresses of people who are interested in bitcoins to target them — via phishing attacks — with malware designed to find and steal bitcoins from their PCs. The DNS hack and DDoS attack against Bitcointalk are just the latest exploits in a long string of attacks targeting bitcoin e-wallet services and payment systems. Last month, Denmark-based bitcoin payment processor Bitcoin Internet Payment System suffered a DDoS attack that allowed the attackers to hide their real target: online wallets storing 1,295 bitcoins, which they successfully stole. At the time, their haul was valued at nearly $1 million. As that haul suggests, the rise in bitcoin-related attacks can be attributed to the bitcoin bubble, which has seen the value of the cryptographic currency rise from a low of $1 per bitcoin in 2011, to $1,200 per bitcoin as of Wednesday. The rise in bitcoin’s value has lead to a number of malicious attacks, as well as a rise in efforts of a different nature. Last week, for example, Malwarebytes researcher Adam Kujawa warned in a blog post that a number of free toolbars and search agents have begun including bitcoin-mining software, which can consume massive amounts of system resources, slowing PCs to a crawl. Bitcoin mining isn’t inherently suspect. In fact, it’s crucial to the success of bitcoins, because it’s what records the chain of bitcoin transactions. Furthermore, the bitcoin system is set up to reward — with bitcoins — anyone who successfully solves related cryptographic puzzles that help maintain the public bitcoin ledger known as the “block chain.” But some people have begun turning PCs into nodes in their personal bitcoin-mining empire, such as online gaming company E-Sports, which was recently hit with a related $325,000 fine by the New Jersey state attorney general’s office. In the case of toolbars and search agents with built-in mining software, however, users who agree to the accompanying end-user license agreement (EULA) might be authorizing a third party to turn their PC into a bitcoin-mining platform. “So take note if your system is running especially slow or if a process is taking up massive amounts of your processing power; it might be malware or even a [potentially unwanted program] running a miner on your system,” said Kujawa at Malwarebytes. “Looks like the bad guys are adapting all of their various technical attacks and business models to the bitcoin world,” CounterHack co-founder and SANS Institute hacking instructor Ed Skoudis said in a recent SANS email newsletter, responding to the Malwarebytes report. “Given the stakes for rapid money-making here, we’ll surely see even more creative bitcoin-related attacks in the near future.” Source: http://www.informationweek.com/security/attacks-and-breaches/bitcoin-password-grab-disguised-as-ddos-attack—-/d/d-id/1112919

Continue Reading:
Bitcoin Password Grab Disguised As DDoS Attack

5 DDoS defence strategies every company should know

If there is any one fact that remains consistent when it comes to distributed denial of service (DDoS) attacks, it is this: whatever mitigation solution your security engineers implement today, hackers will find a way to defeat it within the next two years. The pain of re-engineering a security program every 24 months is dwarfed by the potential pain of DDoS-provoked outages. In 2011, these attacks cost businesses more than a billion dollars, according to the Yankee Group. So how can companies defend themselves against attacks that are growing larger in scale, more complex in nature and more damaging to corporate reputations? Start with these five strategies: 1. Get educated, and be prepared Attackers are highly educated and highly motivated. Whether they shut sites down for financial gain or idealistic causes, the hackers who may target you today will do so with complex attacks at the application layer, Layer 7, where they can deplete your server resources by imitating legitimate users. They are likely to attack websites that rely on SSL by exploiting a Web server’s limited ability to handle large amounts of HTTPS sessions. These are not the straightforward DNS reflection attacks or TCP SYN floods of yesterday 2. Learn which attacks can be defeated with which solutions In order to combat increasingly sophisticated DDoS attacks, your company needs to learn what methods attackers are embracing today and continually research the most effective tools and services for addressing them. For example, you can defeat the OSI model, and Layer 3 and 4 attacks at the network and service layers with access control lists (ACLs), policies and commercially available DDoS mitigation solutions. On the other hand, you’ll need inspection by proxy to identify and fight Layer 7 attacks. 3. Ignore attacker inquiries It’s not unusual for a hacker to contact a company as he is assaulting its websites. You might receive demands if the motive behind the attack is pure financial extortion. If the attacker views himself as more of an activist, he might contact you simply to taunt the company during the outage. The best reaction to these communications is no reaction. Ignore them. Doing so generally lowers the probability that the attack will occur, if it hasn’t already, or that it will continue, if it’s already in progress. 4. Build secure networks Let start with the basics: avoid firewalls. This old security standby maintains the connection state which can be quickly filled by an attacker, rending the system useless and making it easier to take the server offline. This makes even the largest firewalls vulnerable to even the smallest attacks. Look for a hosting provider that can manage and secure your servers or build proxies using load balancers. Load balancers such as nginx or haproxy enable your host to dampen the effect of low-and-slow Layer 7 attacks, which is particularly critical if you are on a Windows Server. Finally, it’s worth it to upgrade your networks to modern equipment. Make sure your service contracts are up to date and purchase products that have a reputation for withstanding prolonged attacks. 5. Have a contingency plan Because hackers are constantly learning and DDoS attacks are constantly changing, you could make all the right decisions and still find your company under fire. That’s why a holistic approach is important. Your business should have secure network and system architecture, onsite packet filters, additional mitigation capacity with a third-party service, and skilled security staff. If you don’t have an in-house security expert, it is all the more essential that you have a DDoS mitigation service on call. Such a partner should be available on short notice and dedicated to helping you during a worst-case-scenario attack. Effective DDoS mitigation doesn’t come down to one solution, one partner or one vendor. Defending your company against attacks requires that you stay educated, stay prepared and stay vigilant. A hosting service with the right DDoS partner can be a valuable asset in your company’s business continuity plan (BCP). Whether you decide to manage your security on-site or outsource it, make sure that you build a DDoS mitigation strategy that accounts for your company’s specific needs, as well as the ever-evolving nature of attack scenarios. Source: http://www.itproportal.com/2013/12/03/5-ddos-defence-strategies-every-company-should-know/

Ukrainian Interior Ministry Website Reportedly Hit By DDoS Attack

The website Ukraine’s Interior Ministry is currently inaccessible, having apparently fallen foul of a distributed denial-of-service (DDoS) attack by hackers, local media said Sunday. Ukraine’s IT specialists claimed that they were behind the outage, which came after police violently dispersed a pro-EU rally in downtown Kiev Saturday, and promised to take down other Ukrainian government websites, pravda.com.ua reported. “Unfortunately, not each Ukrainian can come to Mykhailivska Square in Kiev or other local squares… That’s why I suggest an efficient way that everyone can show their protest in the Internet… I mean DDoS attack on the sites of our enemies in the government,” IT specialists said in a statement. The report said the Ukrainian government portal, www.kmu.gov.ua, also went out of service Sunday after suspected hacking. Some 35 people were injured after riot police cracked down on protesters camping out in the Independence Square in the capital Kiev Saturday, doctors said. Seven people still remain in hospital. A total of 35 people were briefly detained by police. Protesters regrouped Saturday near a monastery at Mykhailivska Square in downtown Kiev, which became the new place for continuing pro-EU rallies. Activists spent a night there and said they would form a national resistance task force to prepare a nationwide strike. Source: http://en.ria.ru/world/20131201/185186195/Ukrainian-Interior-Ministry-Website-Reportedly-Hit-By-Hackers.html

See the original post:
Ukrainian Interior Ministry Website Reportedly Hit By DDoS Attack

Google Nexus 5 vulnerable to DDoS attack

Google Nexus smartphones including the latest Google Nexus 5 running Android 4.4 KitKat are vulnerable to denial-of-service attack via Flash SMS messages; it has been revealed on Friday during DefCamp security conference in Bucharest, Romania. Bogdan Alecu, a system administrator working with Levi9 – an IT services company, performed a live test during the conference on a Nexus 4 phone running Android 4.3. Alecu showed through the test that after receiving 30 odd Flash messages, the smartphone became unresponsive. During this state the phone neither responded to screen taps nor was it able to receive any phone calls and had to be rebooted manually to get it in functional order. Flash messages are Class 0 SMS that gets displayed on phones’ screen directly without getting stored on the device. Users have the option to saving the message or dismissing it. According to Alecu, there have been instances during this tests that the phone behaves in a different manner at times and loses mobile network connectivity temporarily. The connectivity is restored in a short while with ability to place and receive phone calls, but internet connectivity is lost up until the phone is manually restarted. There are instances when the messaging app crashes and the Nexus smartphone reboots. The issue has been discovered over a year ago revealed Alecu and has been tested on all Google Galaxy Nexus smartphones running Android 4.x including the recently released Nexus 5. Alecu revealed that he has contacted Google multiple times just to receive automated response. Some one did respond that the issue will be resolved in Android 4.3, but unfortunately it still persists and has been passed onto Android 4.4 KitKat. There is no official fix for the vulnerability and till then the only workaround is an app named Class0Firewall (https://play.google.com/store/apps/details?id=com.silentservices.class0firewall&hl=en) developed by Michael Mueller, an IT security consultant from Germany in collaboration with Alecu. Source: http://www.techienews.co.uk/973439/google-nexus-5-vulnerable-denial-service-attack/

More:
Google Nexus 5 vulnerable to DDoS attack

Anonymous DDoS attack snowballs, affects several Microsoft services

Hacktivist collective Anonymous has taken credit for an attack that unintentionally affected a number of Microsoft services last week. On Monday, members of the loose-knit hacker group posted on Pastebin about how a distributed denial-of-service (DDoS) attack targeting Japanese Microsoft websites and servers had gone awry – resulting in several of the technology giant’s services going down. “A couple days ago a DDoS attack was launched at Japanese Microsoft (Domain) Websites and Servers,” according to the Anonymous post. “We are sorry to report that the Japanese Microsoft Websites and Servers did not go down as planned. Although something did go down. We took the pretty much the entire Microsoft domains down.” It appears the hackers had a motive. “The DDoS attack was launched in response to Taiji…Operation Killing Bay OR #OpKillingBay,” according to the post. Operation Killing Bay is an initiative protesting the slaughter of dolphins in the village of Taiji in Japan – a controversial topic that has gained a lot of coverage in recent years. “It’s the thought that counts right?” the hacktivists wrote, insinuating that they would strike against Taiji again. The claim explains why several people were reporting outages and disruptions of Microsoft services, including microsoft.com, outlook.com, msn.com, office365.com, Microsoft Developer Network, TechNet, SkyDrive, the Windows Store, sites hosted on Windows Azure, xbox.com and Xbox Live. Most of Microsoft’s affected services were restored quickly. Source: http://www.scmagazine.com/anonymous-ddos-attack-snowballs-affects-several-microsoft-services/article/322945/

See the original post:
Anonymous DDoS attack snowballs, affects several Microsoft services

Want Cheaper Bitcoins? Hit Someone With a DDoS Attack

Two months ago, BTC-China was growing fast. It was on a blazing trajectory that would soon see it become the world’s largest Bitcoin exchange. With Bitcoin, the world’s most popular digital currency, in the midst of an tremendous upswing of its own, BTC was on the verge of hitting it very, very big. But before that, there would be the double-barreled rite of passage. First came the extortion attempt, and then the non-stop computer attacks, known as distributed denial of service (DDoS) attacks. The extortionists contacted BTC-China in mid-September. Over instant-message chats, they first said they wanted just a few hundred dollars — paid out in bitcoins, naturally — but the demands soon escalated. BTC-China CEO Bobby Lee doesn’t want to get into specifics, but he says that they claimed to have been hired by one of his competitors. He doesn’t believe this, but he thinks that other Bitcoin companies should be concerned. “The DDoS attackers are hitting more and more of us, and it’s going to be a widespread problem,” he says. Since, September, there have been dozens of these attacks on BTC-China. According to Lee, one of them used up a remarkable 100 G/bits per second in bandwidth. “They’re throwing big-time resources into these attacks,” says Marc Gaffan, co-founder of Incapsula, the company that Lee hired to protect his exchange from the criminals. “The attack on BTC-China was one of the largest ever.” Incapsula has about two-dozen clients that are involved in Bitcoin businesses, Gaffin says. A year ago, it had none. CloudFlare, another provider of DDoS protection services has seen a big jump in attacks over the past three months, says Matthew Prince, the company’s CEO. “We’re seeing daily attacks targeting Bitcoin related sites on our network, most of which are relatively small but some get to very high volumes.” Some attacks have even exceeded the 100 G/bits per second volume that hit BTC-China, he says. Yesterday, European payment processor BIPS said it had been hit with a DDoS attack, and then hacked to the tune of nearly 1,300 bitcoins, or $1 million. Last week, Bitstamp, another major Bitcoin Exchange, went offline temporarily. The company has not responded to requests for comment, but it blamed the outage on software and networking issues, not a DDoS. On most websites, hackers can steal credit card numbers or personal information, but these have to be sold somehow. When you break into a Bitcoin business and get access to digital wallets, as was the case with BIPS and an Australian company, Inputs.io, which was hit last month, you’re stealing money itself. “If a Bitcoin wallet can get compromised, then the hackers can actually steal real money and there’s no way to refund the money,” Lee says. In April, Mt. Gox got clobbered via DDoS. The point, the company speculated, was to destabilize Bitcoin, and fuel panic-selling. “?Attackers wait until the price of bitcoins reaches a certain value, sell, destabilize the exchange, wait for everybody to panic-sell their bitcoins, wait for the price to drop to a certain amount, then stop the attack and start buying as much as they can,” Mt. Gox wrote on its website. Gaffan and Lee agree that, in addition to extortion, market manipulation is likely a motive with the recent DDoS attacks too. “It’s about trying to influence the market,” Gaffan says. “We see more Bitcoin exchanges going under attack.” Source: http://www.wired.com/wiredenterprise/2013/11/ddos_bitcoin/

Read the original:
Want Cheaper Bitcoins? Hit Someone With a DDoS Attack