Tag Archives: marketing

24 million reasons to lock down DNS amplification attacks

Research from Nominum, a US security consultancy that supplies ISPs with DNS-based analytics and revenue advice, claims to show that 24 million home and small office broadband routers around the world are vulnerable to being tapped as part of a massive DDoS attack. Distributed-denial-of-service (DDoS) swarm attacks have been around for years, but hijacking routers is a relatively recent trend, driven largely by the fact that very few users actively update the firmware of their legacy routers. Rather than hack the host computer, Nominum says that the hackers can now manipulate DNS (Domain Name System) traffic lookups – the technology that translates alphabetic domain names (e.g. www.bbc.co.uk) into its numeric identifier (e.g. 987.65.43.21). By spoofing the target’s IP address and generating a small IP request (ICMP) to a vulnerable router, the router will then generate a larger IP data packet to the real IP address. Nominum claims that this `amplification’ effect can be tapped to turn a few megabits of data bandwidth into many tens of gigabits of bandwidth hogging IP streams. This is no theoretical analysis, as the consultancy claims to have spotted over 5.3 million home and office routers being hijacked during February to generate IP attack traffic – with as much as 70 per cent of total DNS traffic being attributed to one attack seen during January. Nominum says the effect on ISP traffic is immense, with trillions of bytes of attack data disrupting ISP networks, websites and individuals. In the longer term, the consultancy says there is a network impact generated by malicious traffic saturating the available bandwidth and a consequent loss of revenue as users migrate to other ISPs due to an apparently poor experience. Sanjay Kapoor, the SVP of strategy with Nominum, said that existing DDoS defences do not work against today’s amplification attacks, which can be launched by any criminal who wants to achieve maximum damage with minimum effort. “Even if ISPs employ best practices to protect their networks, they can still become victims, thanks to the inherent vulnerability in open DNS proxies,” he said. Peter Wood, CEO of pen-testing specialist First Base Technologies, says that the problem identified by Nominum is often found by his research team where remote branch offices and staff working from home are involved. “We’ve recently been testing a Draytek Vigor router in this regard, and the good news is that most of the attack ports that could be used are turned off by default. Conversely, we also tested a Buffalo router, where the exact reverse was true,” he explained. “This is the joy of OpenDNS proxies. It’s also not that obvious how to configure a fixed IP on many routers,” he said, adding that some clients are – thankfully – becoming more aware of the security risks from the amplification attacks identified by Nominum’s research. Sven Schlueter, a senior consultant with Context Information Security, said that DNS application attacks mean that only minimal resources are required to conduct an attack against the availability of a larger system or network. “This type of attack is then often performed from different sources, all spoofing the source ‘to origin from the target’, resulting in a DDoS against the available bandwidth of the targeted hosts and networks when content is returned from the legitimate DNS,” he said, adding that a number of mitigation solutions are now possible. “For example, a DNS server administrator can ensure that the resolver is not open to the Internet. Very rarely – usually only for service providers – is a resolver required to be open to the Internet. However, if necessary, rate limiting and monitoring can be applied to slow down, detect and mitigate attacks,” he said. “ISPs can also enforce restrictions so that spoofing of addresses is not possible. Service owners, such as a Web site administrator, can only slightly mitigate the issue by dynamically allocating more bandwidth and filtering the attack at the border/ISP core, to the network affected,” he added. Jag Bains, CTO of DDoS remediation specialist DOSarrest, said that is a need for focused DDoS protection services as his firm is seeing more and more attack vectors and agents emerge – something that he says is only going to increase as the `Internet of Things’ gains further traction. “Strategic decision makers will need to understand what specific assets need protection and in what specific manner, and ensure they buy the right solution,” he noted. Lamar Bailey, director of security research with Tripwire, said that home and small office modems, gateways and routers are a generally the second weakest link in a home/small office network behind printers. “Internet providers do update or use current technology for home user gateways and the end user is generally stuck with what every the provider gives them. The routers are generally on very old technology and not easy or possible to secure. DDoS and other attacks are very successful on these old routers,” he said. Bailey went on to say that the ISPs need to take security more seriously and help protect their consumers. “In the US each region has limited options for ISPs which is almost a monopoly. This is bad for consumers and great for attackers and bot herders,” he explained. “Internet providers do update or use current technology for home user gateways and the end user is generally stuck with what every the provider gives them. The routers are generally on very old technology and not easy or possible to secure. DDoS and other attacks are very successful on these old routers,” he said. Bailey went on to say that the ISPs need to take security more seriously and help protect their consumers. “In the US each region has limited options for ISPs which is almost a monopoly. This is bad for consumers and great for attackers and bot herders,” he explained. Source: http://www.scmagazineuk.com/24-million-reasons-to-lock-down-dns-amplification-attacks/article/341026/

More here:
24 million reasons to lock down DNS amplification attacks

Millions of home routers expose ISPs to DDoS attacks

DNS software specialist Nominum has revealed that DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers worldwide. The research reveals that more than 24 million home routers have open DNS proxies which potentially expose ISPs to DNS-based DDoS attacks. In February of this year more than 5 million of these routers were used to generate attack traffic. DNS is the most popular protocol for launching amplification attacks and during an attack in January more than 70 percent of total DNS traffic on one provider’s network was associated with amplification. The attraction for the attacker is that DNS amplification requires little skill or effort but can cause major damage. Using home routers helps mask the attack target making it harder for ISPs to trace the ultimate recipient of the waves of amplified traffic. The amount of amplified traffic can amount to trillions of bytes every day, disrupting networks, websites and individuals and leading to additional costs. “Existing in-place DDoS defenses do not work against today’s amplification attacks, which can be launched by any criminal who wants to achieve maximum damage with minimum effort,” says Sanjay Kapoor, CMO and SVP of Strategy at Nominum. “Even if ISPs employ best practices to protect their networks, they can still become victims, thanks to the inherent vulnerability in open DNS proxies”. To address the gap in defenses Nominum has launched its Vantio ThreatAvert product to enable ISPs to neutralize attack traffic. Kapoor says, “ISPs today need more effective protections built-in to DNS servers. Modern DNS servers can precisely target attack traffic without impacting any legitimate DNS traffic. ThreatAvert combined with ‘best in class’ GIX portfolio overcomes gaps in DDoS defenses, enabling ISPs to constantly adapt as attackers change their exploits, and precision policies surgically remove malicious traffic”. Source: http://betanews.com/2014/04/02/millions-of-home-routers-expose-isps-to-ddos-attacks/

View article:
Millions of home routers expose ISPs to DDoS attacks

Blizzard games still suffering after DDoS attack

Blizzard has confirmed that some of its games are being affected by distributed denial of service attacks (DDoS attacks) on its European online services. Diablo , World of Warcraft , StarCraft and Hearthstone may all be affected by the attacks, suffering disconnections and high latency — a longer gap between the time when you click or press a button and the effect of that action, which makes the game can feel laggy. According to Blizzard’s official update, the attacks aren’t focusing on the company’s infrastructure, however the ripples of the DDoS attacks are still being felt by some of the playerbase. The issue may also be causing problems with the Blizzard authentication servers, which in turn leads to failed or slow login attempts. The company stated: “while we are closely monitoring the situation we wanted to thank you for your patience and apologise for any inconvenience this may cause.” On a lighter note, here’s the trailer for Blizzard’s new game Outcasts: Vengeance of the Vanquished . Blizzard Outcasts — Vengeance of the VanquishedBlizzard Entertainment What with it being an April Fool’s Day joke (despite Blizzard’s protestation that they “have no idea why you would doubt us, but yes, we are indeed making this game. For realsies.”) the game is unlikely to be affected by disconnections and latency. Silver linings and all that… Source: http://www.wired.co.uk/news/archive/2014-04/01/blizzard-ddos

Follow this link:
Blizzard games still suffering after DDoS attack

Anonymous DDoS Attack Hits Albuquerque Police Dept. In Response To Homeless Man James Boyd’s ‘Murder’

Anonymous has followed through with a threat to disable the Albuquerque Police Department (APD) website in retaliation for the fatal shooting of mentally ill man James Boyd earlier this month. An APD spokesperson said there was “unusual activity” on their website and an officer confirmed it was from a cyber-attack. Anonymous often uses distributed denial-of-service (DDoS) attacks to shut down websites in protest. A DDoS attack is a flood of exponentially more requests to a targeted website than that sites server can handle, sometimes by using bots and other tools. That overloads the server and makes the website unavailable. The incident in question involves the fatal shooting of Boyd, a 38-year-old homeless and possibly schizophrenic man, after a three-hour encounter in the “foothills” outside Albuquerque. Boyd had a history of violent crimes and often said he was on secret missions under the direction of former President Gerald Ford. Some of Boyd’s violent arrests involved attacks against police officers. He served time in jail and in at least one mental health facility. In a rare move, the APD released the full video of the incident, which shows officers shooting Boyd with beanbags and bullets after Boyd threatened them with a knife multiple times and refused to follow their directives. You can watch the APD briefing on the incident here. Albuquerque Police Chief Gorden Eden says the shooting was justified. The Anon Press released this video on March 25 outlining their disapproval of the APD and planned attack: “On March 30th we are asking the citizens of Albuquerque to occupy the APD HQ and occupy the sites of the Albuquerque Police Department. Let them know that your city is not a place for war games against the homeless and the less fortunate. Anonymous grab your cannons and aim them at Albuquerque police websites.” They also accuse the APD of murdering James Boyd “in cold blood.” The APD says they took measures to defend themselves against the attack but they were not effective. The main APD site that Anonymous targeted is back up as of 6 p.m. on March 30. Another which appears to be a recruitment page, remains unavailable. Federal investigators are now looking into the James Boyd incident, APD Chief Gordon welcomes the probe. Source: http://www.ibtimes.com/anonymous-ddos-attack-hits-albuquerque-police-dept-response-homeless-man-james-boyds-murder-1564905

Visit link:
Anonymous DDoS Attack Hits Albuquerque Police Dept. In Response To Homeless Man James Boyd’s ‘Murder’

Cisco patches six holes to stop DoS attacks

Cisco has released patches for six flaws in its Internetwork Operating System (IOS) which could be used as part of a DDoS (Distributed Denial of Service) attack. The update features five fixes for its IOS Software and a single patch for its Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet uplinks. The company said that the vulnerabilities are serious as they could be used to mount DoS attacks on its customers. It advises Systems Administrators to use the Cisco IOS Software Checker to determine if a given release is exposed to a Cisco product vulnerability. Not exploited yet So far there is no evidence that the vulnerabilities are being exploited, but any flaws that serious in Cisco’s IOS are made more significant because of the amount of control the software has over the market. IOS is a widely used network infrastructure and is working on millions of systems, ranging from the small home office router to the core systems of the world’s largest service provider networks. DoS attacks are the weapon of choice of hacktivists, though other groups have begun experimenting with it. Leaked PRISM documents proved a secret spy unit linked to the UK Government Communications Headquarters (GCHQ) had mounted DoS attacks against the Anonymous collective earlier in February. Cisco boasts that it is the most widely used network infrastructure software in the world. You can see details of the flaws and the patches at the Cisco site here. Source: http://www.techradar.com/news/networking/lan/cisco-patches-six-holes-to-stop-dos-attacks-1237692

View article:
Cisco patches six holes to stop DoS attacks

Beware the headless browser DDoS Attacks!

The attacks that you nor your security provider know about, the classic “unknown unknowns”, are often seen as the biggest challenge. I met with Jag Baines, CTO of DOSarrest some time ago on a visit to the UK with general manager Mark Teolis, who talked of such an attack vector that had not been as widely reported as they had hoped. The two admitted that the methods of denial-of-service (DoS) attack had changed in the past few years, to the use of sophisticated botnets, and with more access power to compromised computing power, that gives access to tools such as “headless browsers”. Baines explained that a headless browser is a web browser for all intents and purposes, just without the graphical elements; a legitimate browser web kit that has been modified to run a series of queries and target basic UIs on your website. “It is gaining popularity on the ‘big and dumb’ attacks. You have no web application firewall and no box is going to be able to figure out what this thing is doing,” Baines said. “You can download the software for free and modify it, PhantomJS is the most popular headless browser and people use it for legitimate purposes like monitoring services. We looked at adding a monitoring service to see how our website was doing a couple of years ago, and you can add a sensor and a certain location and tell it to tell you the load times of each element of the site, but others are modifying it for less than gallant reasons.” Teolis said that such tools were made by programmers to test out their websites, but they were now used for nefarious purposes. “You open up hundreds of sessions on your laptop and see how it runs, but now you can have unlimited process using Javascript, cookies and Captcha, and any challenge.” Baines said that any attacker would need access to the tool, and while you cannot effectively run headless browsers, an attacker would need to load up the program and need a victim to actively run it. “An attacker accesses it and loads it up via a VBScript, the victim sends back a response and the headless browser tells you it looks like a legitimate session to get access to what they can find. It works because the attacker understands how the website is designed, tells you where the weaknesses are and point it at it. You cannot set up a web application firewall to prevent it as it is using the same protocol as a real visitor would.” Teolis said that this attack form is low and slow, and the headless browser would infect a laptop, go to a command and control centre and await instructions. “It could download code, but the idea is to exhaust resources – it is Slow Loris attack version 2,” he said. “All of the boxes could not stop it as slow and low attacks come twice an hour, but there are 50,000 of them, so how do you distinguish what is real and fake traffic? With headless browsers, it can process Javascript and Captcha and jump through hoops; so this will be a big problem for older boxes.” Baines said that there tends to be a focus on volumetric attacks, but while users are scared of that, a lot of the headless browser attacks are TCP-based, so only around five to ten Gbps, but it is in the background and that is what is killing the site. “You’ll never see it, it runs as a separate process in the background. The only way you’ll know is to run a NetStack to see what is running out of port 80 and it is very sophisticated.” DOSarrest admitted that there is no detection of a large collection of botnets for this service, but they predicted that this will happen as a victim can be hit 10 times or 50 times a minute. Baines said: “You can rent a botnet for $10 an hour, but with a headless browser you have to be sophisticated to use it. It takes time and effort to get it installed, so you can run it on 10/15 machines to be effective and once you have your sophisticated botnet you are not going to share that, you are going to keep it and use it when the time calls for it. These guys are motivated either politically or commercially and will bring it out like a sniper only when they see fit.” Asked if this could be used as part of a targeted attack, Teolis said that this is different as it uses DoS tactics, but if there are 10,000 different IPs attacking every ten minutes or every hour, then it will be hard to deal with. Baines said: “If you look at it from the perspective of the cyber criminal, they want to cover their tracks and pull out data without anyone knowing and using headless browsers for any purposes, but there is going to be some footprint left behind. I don’t see it as a tool for theft, it is more about how to make the website unavailable and how does the attacker look like every other visitor. “The intentions are different and to leave no logs or trace. There will be difference in patterns but it takes a dogged support guy to figure it out.” The concept was presented last summer at the Def Con conference in Las Vegas, and Teolis said that the response was positive from delegates. In terms of how to protect against it, the solution does lay with a pure play DDoS protection service as this does not require signature-based solution. Teolis said that it offers support to parse it, run analysis on it and see the pattern and anything in particular that wasn’t there an hour ago. “We are defending our customers during non attack periods , to compare and contrast and look at the pattern, look at the implementation. At the worst case we can put our finger in the dyke and block it, or we look at rate limiting expressions, maybe sanitise the options that come through – it is all dependant on what data we can gather,” he said. “With real time support there is a human involved and you can develop some rule sets to determine what is going on and implement this module. We can do that in seconds, and that is part of our software and we can do it in under a minute.” Source: http://itsecurityguru.org/gurus/beware-headless-browser/#.UzMvWleTqM6

Excerpt from:
Beware the headless browser DDoS Attacks!

Westboro, Northboro Verizon service hit by DDoS attack

Since March 3 — and perhaps as far back as Feb. 26 — Verizon customers in Westboro and Northboro had been experiencing regular and constant interruptions to their Internet and phone service. Dozens of Westboro residents have discussed the service outages on Facebook (and offer sharp-tongued critiques of Verizon’s response), and six have filed complaints with the state Office of Consumer Affairs and Business Regulation. The disruptions, according to Verizon spokesman Philip G. Santoro, were caused by repeated cyberattacks on one residential customer in Westboro. The cyberattack is called a dynamic denial of service, a DDOS or DOS. In an email, Mr. Santoro described the attack thusly: “Someone deliberately flooded that customer with an overwhelming amount of traffic that rendered their Internet service inoperable.” “When that happened, it caused Internet service to periodically slow down for other customers in Westborough,” he wrote. “We are working to restore service to normal as soon as possible. DOS attacks are all too common today among customers of all Internet providers. It’s important to remind Internet users to keep their firewalls operating and to keep their security software current.” Interestingly, though, when I first asked Mr. Santoro about this, he said there were no widespread outages reported. I think that is because there was nothing physically wrong with the FiOS lines — no technical problems, no trees on the line, etc. At Verizon, the lines were all reported to be working as normal. But customers were calling in complaints and opening repair tickets left and right. The state logs the complaints and passes them on to the service provider, in this case Verizon, said Jayda Leder-Luis, communications coordinator for the Office of Consumer Affairs and Business Regulation. “DOS is a cybersecurity issue, one that can affect voice services that rely on access to the Internet (like VOIP),” she wrote in an email, referring to Voice Over Internet Protocol, in which phone service is provided through an Internet connection. “Those were the kinds of complaints we were receiving.” For dozens of residential and business customers in Westboro and Northboro, the interruptions were frustrating. “It happened around 3 o’clock, every day,” said Allen Falcon, chief executive officer for Cumulus Global, a cloud computing company in Westboro. “Sometimes it was a few minutes, sometimes 45 minutes to an hour.” A few times, the interruptions occurred in the morning, just after 9 a.m., he said. Since the company’s phone service and Internet connection runs through a FiOS line provided by Verizon, when the FiOS line goes out, customers lose both phone and Internet. “For us, it’s incredibly embarrassing as a technology company, to lose our service like this,” he said. “We’re talking to someone and the phone lines goes down, the Internet goes down.” The company has workarounds, in which the office can switch its Internet and phone service to a 4G service provided by their cellphones. “But it’s slower performing and more expensive,” he said. “Some days, around 3 p.m., we have to consider, ‘Should we switch, just in case?’ “ Several customers reported that Verizon had a lot of trouble pinpointing the cause of the interruptions, and several of them had Verizon technicians visit their homes and replace their routers. Since the cause was later determined to be this DOS cyberattack, replacing their routers looks like, in hindsight, a waste of time and money. Steve Winer, a Westboro resident, said Verizon installed a new router at his home, but it made no difference. The outages continued. “I am just wondering how much time and money was wasted on this,” he wrote in an email. “I know I spent at least a couple of hours on the phone, and others shared similar stories. But, if you add up all the shipped routers and unnecessary service calls, along with the time both of us customers and (Verizon) personnel, I am sure it really adds up, and could have been avoided if someone had simply put two and two together and posted a chronic outage which began in February.” On Tuesday, Verizon apparently pinpointed the exact Internet Protocol address of the Verizon customer being attacked, and shut down the customer’s FiOS service. The slowdowns and service interruptions have stopped. Let’s hope they never return. Source: http://www.telegram.com/article/20140323/COLUMN73/303239976/1002/business

View the original here:
Westboro, Northboro Verizon service hit by DDoS attack

Hootsuite Quickly Responds To DoS Attack, Ensures Users Their Data Is Secure

At 6:45 am PST the team at HootSuite were forced to deal with a denial of service (DoS) attack. The company quickly responded to the attack and then responded proactively to the attack. On the HootSuite blog CEO Ryan Holmes writes: “While HootSuite users were for a short time unable to access the dashboard, service has now been restored, and no customer data was compromised. Only web traffic to the dashboard and mobile APIs was affected. HootSuite Engineering and Security teams were able to respond immediately, and are working with hosting providers to mitigate the impact of any future attacks.” Hackers use DoS attacks as a simple, albeit crude method, for taking down a company’s internet capabilities. Hackers essentially send millions, even billions of requests to a company’s services, hoping to overload their capabilities, thus shutting down their systems. In his post Holmes puts user minds at ease: “The security of our customers’ information is our highest priority. It was not put at risk today.” The company goes on to thank customers for their patience as they deal with the attack. At approximately 12:00 PM Central time the company sent an update tweet: We’ve made it no secret at SocialNewsDaily that we are fans of the HootSuite platform for both personal and enterprise use, this quick and proactive response only further strengthens our view on their platform. Source: http://socialnewsdaily.com/27263/hootsuite-dos-attack-response/

Original post:
Hootsuite Quickly Responds To DoS Attack, Ensures Users Their Data Is Secure

Hack DDoS attacks battled by net’s timekeepers

A massive worldwide effort is under way to harden the net’s clocks against hack attacks. The last few months have seen an “explosion” in the number of attacks abusing unprotected time servers, said security company Arbor. Unprotected network time servers can be used to swamp target computers with huge amounts of data. About 93% of all the vulnerable servers are now believed to have been patched against attacks. ‘Appropriate’ use The attack that paved the way for the rapid rise was carried out by the Derp Trolling hacker group and was aimed at servers for the popular online game League of Legends, said Darren Anstee, a network architect at net monitoring firm Arbor. That attack took advantage of weaknesses in older versions of the software underlying the network time protocol (NTP). Known as an “NTP reflection” attack, it used several thousand poorly configured computers handling NTP requests to send data to the League of Legend servers. Around the world about 1.6 million NTP servers were thought to be vulnerable to abuse by attackers, said Harlan Stenn from the Network Time Foundation that helped co-ordinate action to harden servers. Precise timings are very important to the steady running of the net and many of the services, such as email and e-commerce, that sit on it. Early 2014 saw the start of an Open NTP initiative that tried to alert people running time servers to the potential for abuse, Mr Stenn told the BBC. Now, he said, more than 93% of those vulnerable servers had been updated. However, he said, this did leave more than 97,000 still open to abuse. Arbor estimates that it would take 5,000-7,000 NTP servers to mount an overwhelming attack. The feature that attackers had exploited had been known for a long time in the net time community and was not a problem as long as those servers were used “appropriately”, he said. “This was before spammers, and well before the crackers started using viruses and malware to build bot armies for spamming, phishing, or DDoS attacks,” he said. Distributed Denial of Service (DDoS) attacks are those that try to shut servers down by overwhelming them with data. The success of the Derp Trolling attack prompted a lot of copycat activity, said Mr Anstee from Arbor. “Since that event it’s gone a bit nuts to an extent and that tends to happen in the attack world when one particular group succeeds,” he said. “We’ve seen an explosion in NTP reflection activity.” NTP reflection attacks can generate hundreds of gigabits of traffic every second, said Mr Anstee, completely overwhelming any server they are aimed at. The copycat attacks have fed into a spike in the number of “large events”, mainly DDoS attacks, that Arbor sees hitting the net, he said. “Historically we used to see a couple of hundred gigabit events every year,” said Mr Anstee. “In February 2014 we tracked 43.” Source: http://www.bbc.com/news/technology-26662051

Link:
Hack DDoS attacks battled by net’s timekeepers

Elance hit by major DDoS attack, downing service for many freelancers

The freelancer platform Elance has been under a sustained distributed denial-of-service (DDoS) attack for more than a day, making the service unavailable for many users — but apparently not compromising their data. The attack seems to have been a so-called NTP reflection attack, judging from an Elance tweet referencing a piece I recently wrote about the technique. Such attacks use botnets and badly configured NTP servers — essentially time checks for computers’ clocks — to amplify a small amount of data into a large one that overpowers the targets’ systems. Mountain View, Calif.-based Elance has over 4 million users (it will roughly double that through its upcoming merger with chief rival oDesk). It’s not clear how many have been affected by the outage, as a company spokeswoman told me only that “some users have not been impacted.” One comment on my February DDoS story suggests that oDesk was also down in the last day, though it’s not yet clear whether this was connected to the Elance attack. Elance’s spokeswoman said by email that the attack began at 6am PT on Monday and remains ongoing, albeit sporadically. She didn’t respond to a question about the possible motivation, but she did say Elance had defenses in place to ward off DDoS attacks on its service, and has “since invested in new technology to try to thwart the attackers.” She added: “We have a unique community of both businesses and freelancers and we’ve reached out to inform them about the attack and let them know that none of their data was compromised but to expect delays. Both sides of our community have been very responsive and sympathetic.” Source: http://gigaom.com/2014/03/18/elance-hit-by-major-ddos-attack-downing-service-for-many-freelancers/

More:
Elance hit by major DDoS attack, downing service for many freelancers