Tag Archives: stop ddos attacks

Legalization of Distributed Denial of Service ‘DDDoS’ attacks as a form of protest

Dutch opposition party D66 has proposed the legalization of DDoS attacks as a form of protest. Activists would have to warn of their action in advance, giving websites time to prepare for their attack. Kees Verhoeven, the campaign’s leader, argues that it is strange that the fundamental right to demonstrate doesn’t extend to the online realm. The coming years would bring more instances of hacktivism, and it would be reasonable to introduce legislation to regulate, not ban it, he says. Verhoeven proposes that DDoS attacks be legalized so long as the protesters say when they will start their action. That way, a website would have time to prepare for the attack, just like an office building has time to get ready for a rally next to it. The proposal also includes restrictions on transmitting information about a website’s visitors, as well as stricter rules against e-mail spying, and other measures to bolster online privacy. DDoS attacks, popular with hacktivist groups such as Anonymous, would therefore become a legal means to express dissatisfaction with a company or a government. One DDoS attack per year would cost over $10,000 for a financial services company that makes 25 per cent of its sales online, according to Internet traffic management firm NeuStar UltraDNS. If the brand reputation of the company heavily depends on the performance of the website, one DDoS attack a year could end up costing over $20,500. However, DDoS attacks are relatively innocuous compared to other forms of hacking, such as phishing and virus infections, which can cost companies and individuals millions of dollars. Nevertheless, DDoS attacks are so far equated to hacking and are illegal in the Netherlands, as well as many other countries. Source: http://www.rt.com/news/dutch-party-d66-ddos-legalized-protest-541/

Follow this link:
Legalization of Distributed Denial of Service ‘DDDoS’ attacks as a form of protest

RBS & NatWest Web services knocked out; Oslo Bors hit by DDoS attack

Royal Bank of Scotland (RBS) and its NatWest and Ulster Bank subsidiaries have been hit by “technical issues” that have left customers unable to access online services. In a statement, RBS says: “We are currently experiencing technical issues which mean that a number of customer account balances have not yet been updated and some of our online services are temporarily unavailable.” A similar message appears on the NatWest Web site, with the bank adding: “We are working hard to fix this issue as soon as possible and will keep you updated on progress. We are experiencing very high call volumes as a result.” In a later update, RBS has revealed that the issue “was caused by a failure of our systems to properly update customers’ balances overnight. The main problem customers are having is that where people have had money go into their accounts overnight, there may be a delay in it showing up on their balance.” The problems have been ongoing for several hours, with NatWest first acknowledging the issue on its Twitter feed at 08.43, eliciting responses from customers complaining that payments have not been processed and wages not paid. The ongoing crisis has forced the bank to take drastic measures, promising to keep over 1000 branches open until 19:00BST on Thursday to assist short-changed customers. Daoud Fakhri, a senior analyst at Datamonitor says the episode is emblematic of wider problems facing the banking sector as a whole. “Many providers, being early adopters of IT systems when the technology was still in its infancy, have been left saddled with inflexible core systems that are often several decades old, and that are increasingly unable to cope with the demands being placed on them,” he says. “The growing expectations of consumers around online and mobile banking means that the tensions between the provision of ever more sophisticated services and the capability of core systems to satisfy these demands are close to breaking point, and this increases the likelihood of episodes such as the NatWest mishap happening again. Separately, the Web site of Norwegian bourse Oslo Børs has been knocked off line, apparently by a DDoS attack . Spokesman Per Eikrem told local outlet NTB that the hit is only affecting the exchange’s site and not its trading, messaging or monitoring systems. Source: http://www.finextra.com/News/Fullstory.aspx?newsitemid=23830

See more here:
RBS & NatWest Web services knocked out; Oslo Bors hit by DDoS attack

Twitter down: Sporadic outage leads to speculation of DDoS attack

The social networking service Twitter suffered sporadic outages Thursday, leading some to speculate about a hacker attack. Access came and went, with reports that users were being affected around the world. In a brief update, the company acknowledged some people were having issues using the service. “Users may be experiencing issues accessing Twitter,” they said in a statement. “Our engineers are currently working to resolve the issue.” A micro-blogging service that allows users to send short messages, Twitter has been likened to an international party line. There are myriad running conversations, to which anyone can contribute. As of March there were 140 million active users who generated over 340 million tweets daily, Twitter says. Not long after its initial message, Twitter said that the issue had been “resolved” and that all services were operational. Users often are quick to turn to Twitter to pose questions about emerging events. But in an ironic twist, Thursday’s outage was initially so pervasive that users couldn’t take to the twitterverse to discuss what was happening. But on message boards, comment fora and other social networking services people voiced their concern. Some wondered if the site had been attacked by a distributed denial of service attack by the hacker group Anonymous. Others bemoaned the lack of access. “I’m losing my mind!” Matt Gio wrote at mashable.com. “I have so much to talk about today and I have an important blog post scheduled.” But some took the outage humourously in stride. Olivia Bovery posted at Facebook that she was “going through withdrawal” and going to step outside. “There is this bright yellow ball in the sky that must be investigated. Seems to be giving off a lot of heat. Wonder what it is.” Moments later she followed up. “Finally, its back up! Back to twitter. Yellow ball will have to wait. Source: http://www.theglobeandmail.com/technology/omg-twitter-down-sporadic-outage-leads-to-speculation-of-hacker-attack/article4360263/?cmpid=rss1

View article:
Twitter down: Sporadic outage leads to speculation of DDoS attack

Financial Gain is Main Motivation for Cyber Criminals

Announcing the findings of “The Impact of Cybercrime on Businesses” survey, carried out by Ponemon Institute, Check Point Software Technologies revealed that 65% of the organizations which experienced targeted attacks reported that an attacker’s primary objective was to make a financial gain. Disrupting business operations and stealing customer data were attributed as the next likely motivation for attackers, as stated by 45 % of the surveyed organizations. The report also stated that only around 5% of security attacks were driven by political or ideological agendas. The report, which surveyed 2,618 C-level executives and IT security administrators in the US, United Kingdom, Germany, Hong Kong and Brazil across organizations of various types and sizes, showed that companies reported an average of 66 new security attack attempts per week. Respondents in all countries stated that the most serious consequences of such attacks were disruption of business and loss of sensitive information, including intellectual property and trade secrets. Diminished reputation and impact on brand name were the least of their worries, with the exception of respondents in the UK. Successful attacks could end up costing businesses anywhere between $100,000 and $300,000: the participants estimated the average cost of such an attack at $214,000 USD. Tomer Teller, security evangelist and researcher at Check Point Software Technologies, was quoted in the press release as saying, “Cybercriminals are no longer isolated amateurs. They belong to well-structured organizations, often employing highly-skilled hackers to execute targeted attacks, many of whom receive significant amounts of money depending on the region and nature of the attack.” “For the most part, the goal of attackers is to obtain valuable information. These days, credit card data shares space on the shelves of virtual hacking stores with items such as employee records and Facebook or email log-ins, as well as zero-day exploits that can be stolen and sold on the black market ranging anywhere from $10,000 to $500,000,” he added. While Denial of Service (DoS) attacks were seen as the type of cyber crime that posed the greatest risk to organizations, SQL injections were cited, by 43% of the respondents, as the most serious types of attack organizations had experienced in the last two years, the report stated. Other threats cited in the survey included APTs (Advanced Persistent Threats), botnet Infections and DoS attacks cited by 35%, 33%, and 32% of the respondents respectively. On the threats posed by activities of their employees, organizations, across all the surveyed countries, unanimously cited the use of mobile devices such as smartphones and tablet PCs as the biggest concern, followed by the use of social networks and removable media devices such as USB sticks. Hong Kong and Brazil reported on an average the highest percentage of mobile devices infected through an act of cyber crime, at 25 percent and 23 percent, respectively. The U.S. and Germany had the lowest average of infected mobile devices and machines connected to the network at 11 percent and nine percent respectively. The report found that for protecting themselves from these threats, a majority of organizations have instituted Firewall and Intrusion Prevention solutions. However, at the same time, less than half of the surveyed organizations have implemented the necessary protections to fight botnets and APTs. “Cybercrime has become a business. With bot toolkits for hackers selling today for the mere price of $500, it gives people insight into how big the problem has become, and the importance of implementing preemptive protections to safeguard critical assets,” Teller stated. It was pointed out that only 64% of companies said that they have current training and awareness programs in place to prevent targeted attacks. “While the types of threats and level of concern companies have may vary across regions, the good news is that security awareness is rising,” Dr. Larry Ponemon, chairman and founder, Ponemon Institute, was quoted as saying in the press release. “Across the board, C-level executives reported high levels of concern about targeted attacks and planned to implement security precautions, technology and training to mitigate the risk of targeted attacks.” For fast DDoS protection click here . Source: http://www.computerworld.in/news/check-point-survey-financial-gain-main-motivation-cyber-criminals-12922012

See original article:
Financial Gain is Main Motivation for Cyber Criminals

Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging

Distributed denial-of-service (DDoS) have matured with hackers blending different attack techniques and becoming more damaging, observers note. They add that defenses need to evolve to complement infrastructure security that has already been commoditized.” DDoS attacks, where multiple compromised systems usually infected with a Trojan virus, are used to target a single system have been getting more “sophisticated” over the years, Vic Mankotia, security vice president of CA Technologies Asia-Pacific and Japan, noted. Today, there are DDoS attacks coming from automated systems, payloads delivered from USB sticks and protocols such as Bluetooth and magnetic strips of cards, he observed. In the past, DDoS attacks primarily targeted networks using low-level protocol or volumetric attacks, Eric Chan, regional technical director of Fortinet Southeast Asia and Hong Kong, remarked. However, hackers today use a combination of volumetric and application-layer attacking techniques, he noted. An application-layer DDoS targets the application service by using legitimate requests to overload the server, and rather than flood a network with traffic or session, they target specific applications and slowly exhaust resources at the application layer, Chan explained. They can be very “effective” at low traffic rates, which makes them harder to detect, he added. The Sony Playstation breach for example, had been a result of application-layer DDoS attacks, able to camouflage a data breach of over 77 million customer records, he cited. Evolved with IT trends, hackers intent On a basic level, denial-of-service (DoS) has evolved from “taking a pair of wire cutters outside the organization and snipping those wires” 20 years ago, to becoming distributed DoS where “hundreds and thousands of” traffic making computers into botnets to shut down systems, Andrew Valentine, managing principal of investigative response at Verizon observed. Strong connectivity, data centers and cloud, have given mobility center-stage, paved way for the Bring Your Own Device (BYOD) trend making the security parameters “disappear”, Mankotia explained. While mobile devices may not store the target information, but they do allow the DDoS attackers access to the information they seek, he noted. Laptops and devices also have a lot more computing power compared to those in the past, Claudio Scarabello, global security product manager of Verizon added. As such, hardware have a lot more power to flood systems, and can be much more “damaging”, he warned. Another way it has evolved is through the intent, Valentine added. In the past, DDoS had stemmed from “bragging rights”–showing off one’s ability to hack into the server, as well as financial intents, he explained. Today, it is used for political intents, commonly known as hacktivism, and DDoS and data breaches have become “synonymous”, he added, citing the Verizon 2012 data breach investigation report which found a rise in hacktivism against large organizations. “As such, DDoS today is associated with political intent, and making a statement, and not about script kiddies showing off anymore,” he said. Security system with visibility, multi-layered defense needed What is needed is a different type of security to complement the infrastructure security that has already been commoditized–a security system which enables the knowledge of where and who is sharing the data, Mankotia pointed out. DDoS attacks are heavily customized with a signature to get specific information, and security has to evolve as all information is not equal, and all identities, access and system must be in one ecosystem, where content-aware identity and access management are applied and advanced authentication is at its core, he explained. As botnets can send huge amounts of legitimate connections and requests from each compromised machine, and determining whether such connections are valid or not will be crucial, enterprises will need security solutions with “sufficient visibility and context”, Chan added. “These systems should have sufficient visibility and context to detect a wide range of attack types without slowing the flow, and processing of legitimate traffic, and is then able to conduct mitigation in the most effective manner,” he said. Above of, a multi-layer defense strategy is also essential, and the defense strategy must cover both network-layer and application-layer attacks, Chan surmised. In need of protection click here DDoS protection . Source: http://www.zdnetasia.com/ddos-becoming-more-sophisticated-damaging-62305134.htm

Continued here:
Distributed Denial of Service ‘DDoS’ becoming more ‘sophisticated’, damaging

Breaking Down a DDoS Attack

Distributed Denial of Service attacks have one goal, to make their target unavailable to its users. And there are certainly a number of different ways these attacks can be carried out. Some of the more common DDoS techniques used by attackers include the use of malware to infect computers used to attack their target from a variety of different sources. One of the most well known examples of a Distributed Denial of Service attack is the infamous MyDoom worm that was sent by email spammers and infected the recipient’s computers. The malware targeted domains with a flood of traffic at a predetermined date and time to bring the site down as it could not handle the flood of incoming connections. More commonly, DDoS attack make use of botnets where computers are turned into zombies, after being infected with malware, and are controlled by a central computer. These botnets can then be used to launch the attack against a target of the attacker’s choosing. The numbers inside and attack But just what does it take to launch a successful DDoS attack? How many computers does an attacker use? How much bandwidth to they need to consume? What is the number of connections it takes to successfully bring a web application down? A recent attack gives us a look into these numbers. While it was not the largest DDoS attack ever launched against a website or web application, a recent week long attack against an Asian e-commerce company in early November was the largest attack in 2011. So just what does it take to bring down an e-commerce platform? Let’s take a look: 250,000 zombie computers coming from a variety of botnets. This is an estimated number based on similar attacks in the past and on the amount of traffic and connections that were used to disable the e-commerce platform that was targeted. The number of computers used in previous attacks were easier to estimate as often times, one large botnet was used in the attack. However since large botnets like Rustock and Cutwail were taken down cybercriminals have gotten wise to larger botnets attracting too much attention so the trend it to use smaller botnets, under 50,000 infected computers, and combining them to launch large scale attacks. 45 Gigabytes per second. At its peak, this DDoS attack flooded the company’s site with up to 45 Gbps. To accomplish this, the botnets’ zombie computers sent an average of 69 million packets per second. While this number is rather disturbing for a network engineer, it isn’t the worst consumption of bandwidth ever used in a DDoS attack. In 2010 the 100 Gbps threshold was broken. If this doesn’t seem overly threatening, consider the fact that 100 Gbps used in a DDoS attack shows an 102% increase of bandwidth consumed by these threats over the course of one year and a 1000% increase in bandwidth use since 2005. Yet while the bandwidth consumed in the largest attack of 2011 is significantly lower than that of the previous year’s attack it doesn’t mean that the scope of the problem is decreasing. In fact, the 2011 attack was much more complex as six different attack signatures were used to attack Layer 3, the network layer, and the application Layer, 7. The sophistication of this dual layered attack required less bandwidth to do just as much damage. 15,000 connections per second. 15,000 connections equals that many people trying to connect to a web site, or web application. Not even the most naive, or aggressive, company would think that they had that many people trying to connect to their e-commerce platform every second. This equals 1,296,000,000 connections in a 24 hour period. That much activity can bring some pretty impressive devices to their knees. So far, the name of the company has not been released due to confidentiality agreements. The reason for the attack also remains unclear. Insiders do believe, however, that the attack was launched by a disgruntled user or a competitor looking to gain an edge in the marketplace using industrial sabotage. Regardless of the reason it is clear that the scale and sophistication of DDoS threats continues to grow. In cases like these above it’s always best to have the best DDoS protection .

Read the original:
Breaking Down a DDoS Attack

Accused British hacker launch DDoS attack and charged in U.S. over LulzSec attacks

A federal grand jury in Los Angeles has indicted a 20-year-old British citizen on charges related to attacks by the LulzSec hacking group on the Fox and PBS television networks and Sony’s film and TV studio, authorities said on Wednesday. Ryan Cleary, who is already jailed in the United Kingdom where he faces prosecution over similar charges, is accused of joining other members of LulzSec in harnessing compromised computers, known as a “botnet,” to steal confidential information, deface websites or attack servers. He was indicted on Tuesday. “Cleary is a skilled hacker. He controlled his own botnet, employed sophisticated methods and his broad geographic scope affected a large number of businesses and individuals,” FBI spokeswoman Laura Eimiller said. LulzSec, an offshoot of the international hacking group Anonymous, has taken credit for hacking attacks on government and private sector websites. Anonymous and its offshoots, including LulzSec and AntiSec, initially focused on fighting attempts at Internet regulation and the blocking of free illegal downloads, but have since taken on such targets as Scientology and the global banking system. The charges come just over two months after accused LulzSec hacker Cody Kretsinger pleaded guilty in U.S. District Court in Los Angeles to taking part in an extensive computer breach of Sony Corp’s Sony Pictures Entertainment. In March, court documents revealed that Anonymous leader “Sabu,” whose real name is Hector Xavier Monsegur, had pleaded guilty to hacking-related charges and provided the FBI with information on fellow hackers. According to the indictment released by the FBI, Cleary and his unnamed co-conspirators hacked into the computer systems of News Corp’s Fox Entertainment Group and Sony Pictures Entertainment and stole confidential user information. The indictment also charges Cleary and his co-conspirators of defacing the PBS website and launching “denial of service” attacks against an online gaming website and Britain’s Serious Organized Crime Agency. Cleary is charged with one count of conspiracy and two counts of unauthorized impairment of a protected computer. He faces a maximum sentence of 25 years in prison if convicted. Eimiller said federal authorities would “allow the prosecution to take its course” against Cleary overseas before deciding whether to seek his extradition to the United States. He is next scheduled to be in court in the U.K. on June 25. Anonymous, and LulzSec in particular, became notorious in late 2010 when they launched what they called the “first cyber war” in retaliation for attempts to shut down the WikiLeaks website. They attacked websites including those of MasterCard Inc, which had tried to block payments to WikiLeaks after apparent pressure from the U.S. government following the release of thousands of diplomatic cables. Source: http://www.reuters.com/article/2012/06/14/net-us-usa-lulzsec-hacking-idUSBRE85D00620120614

View article:
Accused British hacker launch DDoS attack and charged in U.S. over LulzSec attacks

“Armenpress” prevented Distributed Denial of Service ‘DDoS’ hacker attack

DDos (Distributed Denial of Service) attack took place in order to thwart the works of “Armenpress” Armenian news agency website, which was prevented by IT specialists of the agency. Earlier Armenpress web site has been attacked. The agency learnt about the hacker attack on June 13 night and informed the enforcement bodies. Armenpress staff continues its work: the agency’s customers receive the news with its full volume. Thanks to the efforts of Armenpress IT specialists the security of agency has been intensified: currently works are carried out to determine the reasons of hacker attack. “Armenpress” expresses gratitude to its colleagues for the support and condemns any kind of hacker attack, qualifying it as a crime in all respects. Source: http://armenpress.am/eng/news/684393/%E2%80%9Carmenpress%E2%80%9D-prevented-ddos-hacker-attack.html

See the original article here:
“Armenpress” prevented Distributed Denial of Service ‘DDoS’ hacker attack

Mascow protest against President Vladimir Putin led to indeptendent Russian websites hit with distributed denial-of-service ‘DDoS’ attack

More than 100,000 protesters on Tuesday joined a march against President Vladimir Putin in central Moscow, organizer and radical left-wing activist Sergei Udaltsov told AFP news agency. “There are more than 100,000 people,” Udaltsov said at the rally, called the March of Millions, which police said had drawn 18,000 people. City authorities allowed up to 50,000 to take part in Tuesday’s event, which coincides with the patriotic Russia Day holiday marking the country’s 1990 declaration of independence from Soviet rule. Moscow police said they were sending 12,000 riot officers and interior ministry troops onto the streets of the capital to keep order. The march will take protesters down Moscow’s Boulevard Ring toward Sakharov Avenue, scene of a dramatic demonstration last December against the outcome of disputed parliamentary elections that month. Meanwhile, independent Russian news websites went offline on Tuesday in a suspected attack by pro-government groups, as protesters gathered in Moscow for a march against President Vladimir Putin’s third Kremlin term. The site of the Moscow Echo radio station went down about a half hour before protesters started to gather on central Pushkin Square. The Dozhd (Rain) TV website and that of the prominent opposition Novaya Gazeta twice-weekly newspaper also could not be accessed as the event officially got under way at 0800 GMT. But the websites of Russia’s main media sources ? including Kremlin-allied papers and state-controlled television stations ? were all accessible and operating without delay. A Dozhd newscaster said their station’s website was the victim of a distributed denial-of-service (DDoS) attack of unknown origin. Opposition leaders have been previously blamed attacks on Russian independent media sources on pro-Putin youth groups. A similar attack, which included the inaccessibility of the same websites during the disputed December parliamentary election, was reported but no one claimed responsibility for that attack, AFP reported. The United States on Monday voiced concern after Russian police raided the homes of top protest leaders ahead of the planned mass rally in Moscow. “The United States is deeply concerned by the apparent harassment of Russian political opposition figures on the eve of the planned demonstrations on June 12,” State Department spokeswoman Victoria Nuland told reporters. Police armed with assault rifles carried out a coordinated sweep of the homes of young Russian politicians, who analysts believe represent the biggest threat to ex-KGB spy Putin’s 12-year rule. Nuland also criticized a new law in Russia that imposes “disproportionate penalties” for violating rules on public demonstrations. Russian police were calling in opposition leaders for questioning one hour prior to the planned rally time on Tuesday in a move “clearly designed to take them off the streets during the demonstration,” she said. “Taken together, these measures raise serious questions about the arbitrary use of law enforcement to stifle free speech and free assembly,” she said. Source: http://english.alarabiya.net/articles/2012/06/12/220172.html

See the original article here:
Mascow protest against President Vladimir Putin led to indeptendent Russian websites hit with distributed denial-of-service ‘DDoS’ attack

Wawa’s website under suddle DDoS attack

Hackers caused problems for Wawa’s website, www.wawa.com, late Friday, although it appeared to be back to normal by Saturday. Some visitors to the convenience retailer’s site did not see the usual images of hoagies and smoothies and gasoline promotions. Instead, those images were replaced with a cartoon of Adolf Hitler and the name of the group claiming responsibility, UGNazi. According to a report by The Daily Times, Wawa.com visitors were met with a black screen reading “Welcome Nazis, Targets & Reasons” and the drawing of Hitler. Beneath the group’s name was a list of individuals who allegedly hacked the site: Arya Ebrahimi, Justin Martin, Alex Irvin and Thomas Ryan. The group included a link to follow it on Twitter. UGNazi tweeted about high gasoline prices and plans to also hack the convenience store’s gasoline pumps, reported CBS Philly. According to a Courier Post report, the group tweeted, “How much ?#havoc would be caused by shutting down all of the Wawa gas pumps? Love having access to the gas control relay centers .” In a statement provided to CSP Daily News on Saturday, Wawa public relations director Lori Bruce said, “Please be assured that we have no evidence to indicate our website has been breached. Images on our website were not replaced; however, a domain name server is being intermittently redirected to a nonlegitimate webpage. We have rectified the situation with our domain registrar, but it may take another 24 hours to propagate to all domain name servers. Until then, people trying to visit Wawa.com may see a page other than Wawa.com.” (The website seemed to be displaying normally by Saturday, with no trace of the bogus page evident.) “Unfortunately, today, many well-known brands have become targets for online mischief or worse. We will continue to actively monitor and report this to the proper authorities,” Bruce added. “This obviously had nothing to do with Wawa and it is certainly not something we condone,” she told the Courier-Post. “We will be working with authorities to get to the bottom of this.” Pennsylvania State Police told the paper that the hacking would fall under the purview of the Internet Crimes Task Force. “We did this not only for the fame but for the ‘lulz’ [“laugh out louds”] and the fact that Wawa has scorching high gas prices and receives many complaints daily,” Cosmo, one of the UGNazi hackers, told technology website Softpedia.com. He claimed that the group has gained access to the websites entire database, but that it has not found anything valuable to leak. According to Wikipedia, UGNazi, also known as the Underground Nazi Hacktivist Group, is a computer hacker group that has claimed responsibility for several attacks conducted over the Internet. It is best known for its “Tango Down” distributed denial of service (DDoS) attacks on U.S. government websites and for leaking the personal information of government officials. The Wawa, Pa.-based c-store chain operates 594 stores in Pennsylvania, New Jersey, Delaware, Maryland and Virginia, of which 311 sell fuel. Source: http://www.cspnet.com/news/technology/articles/wawas-website-hacked

View article:
Wawa’s website under suddle DDoS attack