Tag Archives: latest-news

How a website flaw turned 22,000 visitors into a botnet of DDoS zombies

Researchers have uncovered a recent denial-of-service attack that employed an unusual, if not unprecedented, technique to surreptitiously cause thousands of everyday Internet users to bombard the target with a massive amount of junk traffic. The attack worked by exploiting a Web application vulnerability on one of the biggest and most popular video sites on the Web, according to a blog post published recently by researchers at security firm Incapsula, which declined to identify the site by name. Malicious JavaScript embedded inside the image icons of accounts created by the attackers caused anyone viewing the users’ posts to run attack code that instructed their browser to send one Web request per second to the DoS victim. In all, the technique caused 22,000 ordinary Web users to unwittingly flood the target with 20 million GET requests. “Obviously one request per second is not a lot,” Incapsula researchers Ronen Atias and Ofer Gayer wrote. “However, when dealing with video content of 10, 20, and 30 minutes in length, and with thousands of views every minute, the attack can quickly become very large and extremely dangerous. Knowing this, the offender strategically posted comments on popular videos, effectively created a self-sustaining botnet comprising tens of thousands of hijacked browsers, operated by unsuspecting human visitors who were only there to watch a few funny cat videos.” The novel attack was made possible by the presence of a persistent cross-site scripting (XSS) vulnerability in the video site, which Incapsula didn’t identify except to say it fell in the Alexa top 50 list. XSS exploits effectively allow attackers to store malicious JavaScript on a website that gets invoked each time someone visits. The booby-trapped user icons contained an iframe tag that pulled malicious instructions off an attacker-controlled command and control server. The malicious instructions caused browsers to surreptitiously flood the DDoS target with an unusually high number of GET requests. Incapsula was able to mitigate the effects of the attack using a combination of progressive challenges and behavior-based security algorithms. Remember the Samy Worm? The attack is only the latest to harness the tremendous power of XSS vulnerabilities. The technique came into vogue in 2005 with the advent of the Samy worm. Named after its creator, a hacker named Samy Kamkar, the XSS exploit knocked MySpace out of commission for a day by forcing anyone who viewed his profile to become a MySpace friend. In less than 24 hours, Kamkar, who later served time in jail for the stunt, gained more than one million followers. “The nature and beauty of persistent XSS is that the attacker doesn’t need to target specific users,” Matt Johansen, senior manager of Whitehat Security’s threat research center, told Ars. “The malicious JavaScript is stored on the website and replayed to anybody who visits this in the future. This particular JavaScript forced each browser that was running it to make a request in one-second intervals.” Last year, Johansen and other colleagues from Whitehat Security demonstrated a proof-of-concept ad network that created a browser-based botnet using a technique that’s similar to the one Incapsula observed exploiting the XSS weakness. “The delivery mechanism [in the Incapsula-observed attack] was different as it was from persistent XSS in the site instead of an ad network,” Johansen explained. “The only difference there was how the malicious JavaScript was rendered in the user’s (bot’s) browser. The code that is quoted in the [Incapsula] article is using a very similar technique to the code we wrote for our talk. Instead of using (image) tags like we did, this attacker is using tags which then make one request per second. We were just loading as many images as possible in the time our JavaScript was running.” Incapsula’s discovery comes three months after criminals were observed using another novel technique to drastically amplify the volume of DDoS attacks on online game services and other websites. Rather than directly flooding the targeted services with torrents of data, an attack group sent much smaller sized data requests to time-synchronization servers running the Network Time Protocol. By manipulating the requests to make them appear as if they originated from one of the gaming sites, the attackers were able to vastly increase the firepower at their disposal. The technique abusing the Network Time Protocol can result in as much as a 58-fold increase or more. Miscreants have long exploited unsecured domain name system servers available online to similarly amplify the amount of junk traffic available in DDoS attacks. Incapsula’s finding underscores the constantly evolving nature of online attacks. It also demonstrates how a single weakness on one party’s website can have powerful consequences for the Internet at large, even for those who don’t visit or otherwise interact with the buggy application. Source: http://arstechnica.com/security/2014/04/how-a-website-flaw-turned-22000-visitors-into-a-botnet-of-ddos-zombies/

Visit site:
How a website flaw turned 22,000 visitors into a botnet of DDoS zombies

Media hacking continues as Czech news sites suffer DDoS attacks

Media websites continue to be attacked by cyber criminals with reports now emerging that titles in the Czech Republic have been targeted. Three of the country’s most widely-read sites – ihned.cz, idnes.cz, and novinky.cz – have confirmed the slowing or crashing of their web pages according to Reuters, though it is not clear who is responsible for the hacks at present. Indicating the use of commonly-deployed Distributed Denial of Service (DDoS) attacks, Lucie Tvaruzkova, the head of business daily ihned.cz, said, “We are receiving great numbers of requests at our servers, which is a typical way to attack.” The incident follows other well-documented cyber-assaults on major media outlets this year, with both the New York Times and Wall Street Journal revealing their networks were breached in attacks they believed originated in China. Elsewhere, security researchers said last week that hackers have been targeting government agencies across a number of European countries, including the Czech Republic, Ireland, and Romania. A flaw in Adobe Systems ADBE.O software has apparently been exploited in the attacks. Source: http://www.itproportal.com/2013/03/04/media-hacking-continues-as-czech-news-sites-suffer-ddos-attacks/#ixzz2yBakJKEu

DDoS Attack on Ellie Mae site Suspects Attackers Had Industry Knowledge

The distributed denial-of-service attack that crashed Ellie Mae’s loan origination system was cleverly disguised and could have been carried out by individuals with mortgage industry expertise, the vendor says. The March 31-April 1 attack overwhelmed the company’s servers with data requests that had the look and feel of legitimate communications. Specifically, the attack flooded the servers with requests to a URL that is used to download an XML file containing a list of third-party technology vendors that integrate with the Encompass LOS via the Ellie Mae Network. “It was a massive number of requests that came in and consumed the full capacity of one set of our servers around a specific URL,” Ellie Mae President and Chief Operating Officer Jonathan Corr says in his first interview since the attack was disclosed. “Where a classic denial-of-service attack would be a request that comes in that is not valid and would just create a lot of failed attempts, this was a valid request with a normal signature.” The investigation into the incident is ongoing, but the manner in which the attack was carried out may indicate that it was carried out by people familiar with the mortgage industry. “I find it very coincidental that this was using a valid request and a normal signature, which if you look at just a random attack, that’s not typically the case,” Corr says. “And it occurred on the last day of the month and the quarter, starting first thing in the morning” — a critical time for loan closings. “That could be coincidence, I don’t have evidence otherwise, but we find it very disturbing and we’re trying to figure it out. It seems like that could be a possibility,” he adds. The XML file contains no sensitive data and is accessible through a so-called open request, which doesn’t require the type of authentication needed to access actual loan files in the system. The attack resembled data requests that would come from the smart client application used to access Encompass and the Ellie Mae Network. This similarity initially made the communications difficult to identify as a threat. “Because of the way it came in, it looked just like a request that we would expect and it wasn’t something that someone out there randomly could do,” Corr says. “Somebody obviously understood a basic public request that would come from an Encompass system.” Ellie Mae has hired Stroz Friedberg, a cyber-security and digital forensics investigation firm, to piece together evidence and trace the attack, evaluate Ellie Mae’s response to the incident, as well as validate that the vendor did not suffer a data or security breach. “We’re asking them to validate that so we can provide a third-party perspective to our customers so that they can turn around and let their regulators know,” Corr says. Ellie Mae, based in Pleasanton, Calif., has put protocols in place to defend against an attack of this nature, and Corr says the company will make additional investments “to further harden the walls” of its infrastructure. “We’re really focused on how to get even better at dealing with anybody that might try to affect the livelihood of our customers,” he says. Source: http://www.americanbanker.com/issues/179_65/ellie-mae-suspects-attackers-had-industry-knowledge-1066689-1.html

Visit site:
DDoS Attack on Ellie Mae site Suspects Attackers Had Industry Knowledge

Millions of home routers expose ISPs to DDoS attacks

DNS software specialist Nominum has revealed that DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers worldwide. The research reveals that more than 24 million home routers have open DNS proxies which potentially expose ISPs to DNS-based DDoS attacks. In February of this year more than 5 million of these routers were used to generate attack traffic. DNS is the most popular protocol for launching amplification attacks and during an attack in January more than 70 percent of total DNS traffic on one provider’s network was associated with amplification. The attraction for the attacker is that DNS amplification requires little skill or effort but can cause major damage. Using home routers helps mask the attack target making it harder for ISPs to trace the ultimate recipient of the waves of amplified traffic. The amount of amplified traffic can amount to trillions of bytes every day, disrupting networks, websites and individuals and leading to additional costs. “Existing in-place DDoS defenses do not work against today’s amplification attacks, which can be launched by any criminal who wants to achieve maximum damage with minimum effort,” says Sanjay Kapoor, CMO and SVP of Strategy at Nominum. “Even if ISPs employ best practices to protect their networks, they can still become victims, thanks to the inherent vulnerability in open DNS proxies”. To address the gap in defenses Nominum has launched its Vantio ThreatAvert product to enable ISPs to neutralize attack traffic. Kapoor says, “ISPs today need more effective protections built-in to DNS servers. Modern DNS servers can precisely target attack traffic without impacting any legitimate DNS traffic. ThreatAvert combined with ‘best in class’ GIX portfolio overcomes gaps in DDoS defenses, enabling ISPs to constantly adapt as attackers change their exploits, and precision policies surgically remove malicious traffic”. Source: http://betanews.com/2014/04/02/millions-of-home-routers-expose-isps-to-ddos-attacks/

View article:
Millions of home routers expose ISPs to DDoS attacks

Blizzard games still suffering after DDoS attack

Blizzard has confirmed that some of its games are being affected by distributed denial of service attacks (DDoS attacks) on its European online services. Diablo , World of Warcraft , StarCraft and Hearthstone may all be affected by the attacks, suffering disconnections and high latency — a longer gap between the time when you click or press a button and the effect of that action, which makes the game can feel laggy. According to Blizzard’s official update, the attacks aren’t focusing on the company’s infrastructure, however the ripples of the DDoS attacks are still being felt by some of the playerbase. The issue may also be causing problems with the Blizzard authentication servers, which in turn leads to failed or slow login attempts. The company stated: “while we are closely monitoring the situation we wanted to thank you for your patience and apologise for any inconvenience this may cause.” On a lighter note, here’s the trailer for Blizzard’s new game Outcasts: Vengeance of the Vanquished . Blizzard Outcasts — Vengeance of the VanquishedBlizzard Entertainment What with it being an April Fool’s Day joke (despite Blizzard’s protestation that they “have no idea why you would doubt us, but yes, we are indeed making this game. For realsies.”) the game is unlikely to be affected by disconnections and latency. Silver linings and all that… Source: http://www.wired.co.uk/news/archive/2014-04/01/blizzard-ddos

Follow this link:
Blizzard games still suffering after DDoS attack

DDoS Trends Report Reveals Spike in Botnet Activity

A new study documenting distributed denial of service (DDoS) trends found an average of more than twelve million unique botnet-driven DDoS attacks are occurring weekly in the last 90 days, representing a 240% increase over the same period in 2013. “Unlike network DDoS attacks, Layer 7 attack sources can’t hide behind spoofed IPs. Instead they resort to using Trojan infected computers, hijacked hosting environments and Internet-connected devices,” the report stated “Large groups of such compromised resources constitute a botnet; a remotely controlled “zombie army” that can be used for DDoS attacks and other malicious activities.” Key findings on network (Layer 3 & 4) DDoS attacks included: Large SYN Floods account for 51.5% of all large-scale attacks Almost one in every three attacks is above 20Gbps 81% of attacks are multi-vector threats Normal SYN flood & Large SYN flood combo is the most popular multi-vector attack (75%) NTP reflection was the most common large-scale attack method in February 2014 Key findings on application (Layer 7) DDoS attacks included: DDoS bot traffic is up by 240% More than 25% of all Botnets are located in India, China and Iran USA is ranked number 5 in the list of “Top 10” attacking countries 29% of Botnets attack more than 50 targets a month 29.9% of DDoS bots can hold cookies 46% of all spoofed user-agents are fake Baidu Bots (while 11.7% are fake Googlebots) “2013 was a game-changing year for DDoS attacks, with higher-than-ever attack volumes and rapid evolution of new attack methods,” the report states. “Now, the perpetrators are looking to raise the stakes even higher by introducing new capabilities, many of which are specifically designed to abuse the weaknesses of traditional anti-DDoS solutions. As a result, in 2014, many IT organizations will need to re-think their security strategies to respond to latest Layer 3-4 and Layer 7 DDoS threats.” Source: http://www.tripwire.com/state-of-security/top-security-stories/ddos-trends-report-reveals-spike-botnet-activity/

Continued here:
DDoS Trends Report Reveals Spike in Botnet Activity

Anonymous DDoS Attack Hits Albuquerque Police Dept. In Response To Homeless Man James Boyd’s ‘Murder’

Anonymous has followed through with a threat to disable the Albuquerque Police Department (APD) website in retaliation for the fatal shooting of mentally ill man James Boyd earlier this month. An APD spokesperson said there was “unusual activity” on their website and an officer confirmed it was from a cyber-attack. Anonymous often uses distributed denial-of-service (DDoS) attacks to shut down websites in protest. A DDoS attack is a flood of exponentially more requests to a targeted website than that sites server can handle, sometimes by using bots and other tools. That overloads the server and makes the website unavailable. The incident in question involves the fatal shooting of Boyd, a 38-year-old homeless and possibly schizophrenic man, after a three-hour encounter in the “foothills” outside Albuquerque. Boyd had a history of violent crimes and often said he was on secret missions under the direction of former President Gerald Ford. Some of Boyd’s violent arrests involved attacks against police officers. He served time in jail and in at least one mental health facility. In a rare move, the APD released the full video of the incident, which shows officers shooting Boyd with beanbags and bullets after Boyd threatened them with a knife multiple times and refused to follow their directives. You can watch the APD briefing on the incident here. Albuquerque Police Chief Gorden Eden says the shooting was justified. The Anon Press released this video on March 25 outlining their disapproval of the APD and planned attack: “On March 30th we are asking the citizens of Albuquerque to occupy the APD HQ and occupy the sites of the Albuquerque Police Department. Let them know that your city is not a place for war games against the homeless and the less fortunate. Anonymous grab your cannons and aim them at Albuquerque police websites.” They also accuse the APD of murdering James Boyd “in cold blood.” The APD says they took measures to defend themselves against the attack but they were not effective. The main APD site that Anonymous targeted is back up as of 6 p.m. on March 30. Another which appears to be a recruitment page, remains unavailable. Federal investigators are now looking into the James Boyd incident, APD Chief Gordon welcomes the probe. Source: http://www.ibtimes.com/anonymous-ddos-attack-hits-albuquerque-police-dept-response-homeless-man-james-boyds-murder-1564905

Visit link:
Anonymous DDoS Attack Hits Albuquerque Police Dept. In Response To Homeless Man James Boyd’s ‘Murder’

Beware the headless browser DDoS Attacks!

The attacks that you nor your security provider know about, the classic “unknown unknowns”, are often seen as the biggest challenge. I met with Jag Baines, CTO of DOSarrest some time ago on a visit to the UK with general manager Mark Teolis, who talked of such an attack vector that had not been as widely reported as they had hoped. The two admitted that the methods of denial-of-service (DoS) attack had changed in the past few years, to the use of sophisticated botnets, and with more access power to compromised computing power, that gives access to tools such as “headless browsers”. Baines explained that a headless browser is a web browser for all intents and purposes, just without the graphical elements; a legitimate browser web kit that has been modified to run a series of queries and target basic UIs on your website. “It is gaining popularity on the ‘big and dumb’ attacks. You have no web application firewall and no box is going to be able to figure out what this thing is doing,” Baines said. “You can download the software for free and modify it, PhantomJS is the most popular headless browser and people use it for legitimate purposes like monitoring services. We looked at adding a monitoring service to see how our website was doing a couple of years ago, and you can add a sensor and a certain location and tell it to tell you the load times of each element of the site, but others are modifying it for less than gallant reasons.” Teolis said that such tools were made by programmers to test out their websites, but they were now used for nefarious purposes. “You open up hundreds of sessions on your laptop and see how it runs, but now you can have unlimited process using Javascript, cookies and Captcha, and any challenge.” Baines said that any attacker would need access to the tool, and while you cannot effectively run headless browsers, an attacker would need to load up the program and need a victim to actively run it. “An attacker accesses it and loads it up via a VBScript, the victim sends back a response and the headless browser tells you it looks like a legitimate session to get access to what they can find. It works because the attacker understands how the website is designed, tells you where the weaknesses are and point it at it. You cannot set up a web application firewall to prevent it as it is using the same protocol as a real visitor would.” Teolis said that this attack form is low and slow, and the headless browser would infect a laptop, go to a command and control centre and await instructions. “It could download code, but the idea is to exhaust resources – it is Slow Loris attack version 2,” he said. “All of the boxes could not stop it as slow and low attacks come twice an hour, but there are 50,000 of them, so how do you distinguish what is real and fake traffic? With headless browsers, it can process Javascript and Captcha and jump through hoops; so this will be a big problem for older boxes.” Baines said that there tends to be a focus on volumetric attacks, but while users are scared of that, a lot of the headless browser attacks are TCP-based, so only around five to ten Gbps, but it is in the background and that is what is killing the site. “You’ll never see it, it runs as a separate process in the background. The only way you’ll know is to run a NetStack to see what is running out of port 80 and it is very sophisticated.” DOSarrest admitted that there is no detection of a large collection of botnets for this service, but they predicted that this will happen as a victim can be hit 10 times or 50 times a minute. Baines said: “You can rent a botnet for $10 an hour, but with a headless browser you have to be sophisticated to use it. It takes time and effort to get it installed, so you can run it on 10/15 machines to be effective and once you have your sophisticated botnet you are not going to share that, you are going to keep it and use it when the time calls for it. These guys are motivated either politically or commercially and will bring it out like a sniper only when they see fit.” Asked if this could be used as part of a targeted attack, Teolis said that this is different as it uses DoS tactics, but if there are 10,000 different IPs attacking every ten minutes or every hour, then it will be hard to deal with. Baines said: “If you look at it from the perspective of the cyber criminal, they want to cover their tracks and pull out data without anyone knowing and using headless browsers for any purposes, but there is going to be some footprint left behind. I don’t see it as a tool for theft, it is more about how to make the website unavailable and how does the attacker look like every other visitor. “The intentions are different and to leave no logs or trace. There will be difference in patterns but it takes a dogged support guy to figure it out.” The concept was presented last summer at the Def Con conference in Las Vegas, and Teolis said that the response was positive from delegates. In terms of how to protect against it, the solution does lay with a pure play DDoS protection service as this does not require signature-based solution. Teolis said that it offers support to parse it, run analysis on it and see the pattern and anything in particular that wasn’t there an hour ago. “We are defending our customers during non attack periods , to compare and contrast and look at the pattern, look at the implementation. At the worst case we can put our finger in the dyke and block it, or we look at rate limiting expressions, maybe sanitise the options that come through – it is all dependant on what data we can gather,” he said. “With real time support there is a human involved and you can develop some rule sets to determine what is going on and implement this module. We can do that in seconds, and that is part of our software and we can do it in under a minute.” Source: http://itsecurityguru.org/gurus/beware-headless-browser/#.UzMvWleTqM6

Excerpt from:
Beware the headless browser DDoS Attacks!

Why having a DDoS Playbook is essential for your organisation

Just like any major emergency, IT managers must prepare a playbook to follow in case a DDoS attack occurs. What follows are some of the most important considerations every manager needs to consider when creating their DDoS playbook: it’s about 75% preparation, 25% organised action. Situation awareness Every business operates within the context of certain realities. There are the human, political realities: are there competitors, activists or people who might have something against your organisation? Your team should be actively monitoring social media for indications of growing tension. And then there are known technological realities: what device types and browsers normally access your public websites? What is within the range of normal legitimate traffic and what is not? Document what’s normal, what’s not, how to monitor for it, and what to do about it when things change. Know thy network, and protect it In order to effectively protect your network, you and your team must understand it completely. Establish the following practices, share in a safe location, and update regularly: Create a detailed depiction of your network topology. This will ensure everyone is working from the same page and will be useful for team coordination while under attack. Establish baselines. Collect baseline measurements of all network activity as it relates to your public access points. Examples are graphing and threshold alerts for bits per second and packets per second on major ingress and egress links in your network. You should also identify all critical services (for example, DNS, web servers and databases) running in your network and define monitoring indices to assess health in real time. Defend from the edge. Deploy technology at the edge of your network to defend as best as possible. Understand it may have limited capabilities, but can be of use in thwarting a small attack or identifying a ramping attack. Give yourself options. Design a secure remote access configuration, preferably out of band, to allow for remote management of your systems while under attack. Create a strong DDoS response team Help your people be successful by designating a strong team leader and making sure everyone knows and understands their responsibilities. Include the following: Who should be notified and when (emergency contact info for your ISP, your own senior management, customer service and PR managers)? What info needs to be collected and when, and where is it logged? What action needs to be taken to protect infrastructure or service? What is the escalation path for critical decisions? Communicate the DDoS plan It’s not enough to have created a DDoS plan, but you need to share it and staff needs to know exactly when to initiate a DDoS response. It should be part of orientation for new staff, with hard copies at stations and version in your wiki or online shared resources. Run drills periodically, including contacting your ISP. Partner when necessary If an attack is beyond the capabilities of your team or your ISP, make sure you have done your research and know which expert you want to call. There are companies whose sole expertise is preparing for and defending against sophisticated and large scale DDoS attacks. Make sure you understand your needs and vendors’ service offerings beforehand so that when the need arises, you will have taken that difficult decision-making process out of the equation. Source: http://www.techradar.com/news/software/security-software/why-having-a-ddos-playbook-is-essential-for-your-organisation-1232315

View original post here:
Why having a DDoS Playbook is essential for your organisation

Huobi Site Down as It Fends Against DDOS Attacks

Huobi, claimed to be the world’s largest Bitcoin exchange by volume, appears to be down due to “maintenance” to fend off “a large number of DDOS attacks”. The homepage immediately redirects to the warning. Trading and all site functions are unavailable. The warning states that all should return to normal by 15:00. As of 17:00 China Standard Time (CST), the site is still down. Bitcoin (BTC) remains at 3475 yuan on Huobi, or $558, diverging from the $565 found on other major exchanges. For Huobi, the last week has been one of when it rains, it pours. Earlier last week, they launched Litecoin trading. Litecoin prices underwent an enormous boom and bust in span of 48 hours as hype quickly built up in anticipation for LTC’s addition to Huobi, followed by its crash back to earth. On Friday, Bitcoin on Huobi took a reverse course: it crashed by 14% from 3700 to 3200, only to immediately reverse course almost all the way back to par. On OKCoin, BTC swung by double the magnitude, bottoming at 2653, or a loss of 30%. The “flash crash” seemed to have resulted from a rumor on Weibo that China’s central bank issued a document asking all Bitcoin transactions to cease by April 15. The Weibo was forwarded to Sino Financial Report, one of the biggest news agencies in China, without confirmation, and from there to a large number of readers. The Sina news feed was later edited to have a vaguer tone and then removed altogether. So rapid was the rumor and its “retraction” that USD-based exchanges barely had time to react at all, with BTC-e and Bitstamp losing no more than 7% during the period. Since the event, Bitcoin prices have followed a gradual downtrend, trading well below $600, their lowest levels since MtGox’s was becoming a reality. The “flash crash” is reminiscent to the one observed in equity markets on May 6, 2010, when the Dow Jones Industrial Average crashed by over 1000 points (9%) and recovered in a matter of minutes. There, an abnormally large sell order triggered a sell-off exaggerated by high frequency traders looking to capitalize. It has not been confirmed if the flash crash and today’s outage are linked in any way. In theory, one can speculate that the abnormally high volume and severe price movements exposed a vulnerability to potential hackers not previously observed. Source: http://www.dcmagnates.com/huobi-site-down-as-it-fends-against-ddos-attacks/

See original article:
Huobi Site Down as It Fends Against DDOS Attacks