Tag Archives: var-username

Criminal benefits: profit margin of a DDoS attack can reach 95%

Kaspersky Lab’s researchers have discovered the full extent of the profit margins benefiting criminals from DDoS services that are available on the black market. Kaspersky Lab’s experts have studied the DDoS services available on the black market and determined just how far this illegal business has advanced, as well as the extent of its popularity and profitability. The worrying news is that arranging an attack costs as little as $7 an hour, while the targeted company can end up losing thousands, if not millions, of dollars. The level of service involved when arranging a DDoS attack on the black market is not very different from that of a legal business. The only difference is that there’s no direct contact between the provider and the customer. The ‘service providers’ offer a convenient site where customers, after registering, can select the service they need, pay for it, and receive a report about the attacks. In some cases, there is even a customer loyalty program, with clients receiving rewards or bonus points for each attack. There are a number of factors that affect the cost for the customer. One is the type of attack and its source: for example, a botnet made up of popular IoT devices is cheaper than a botnet of servers. However, not all those providing attack services are ready to specify such details. Another factor is the duration of the attack (measured in seconds, hours and days), and the client’s location. DDoS attacks on English-language websites, for example, are usually more expensive than similar attacks on Russian-language sites. Another big factor affecting the cost is the type of victim. Attacks on government websites and resources protected by dedicated anti-DDoS solutions are much more expensive, as the former are high risk, while the latter are more difficult to attack. For instance, on one DDoS-as-a-service website, the cost of an attack on an unprotected website ranges from $50 to $100, while an attack on a protected site costs $400 or more. It means a DDoS attack can cost anything from $5 for a 300-second attack, to $400 for 24 hours. The average price for an attack is around $25 per hour. Kaspersky Lab’s experts were also able to calculate that an attack using a cloud-based botnet of 1000 desktops is likely to cost the providers about $7 per hour. That means the cybercriminals organising DDoS attacks are making a profit of around $18 per hour. There is, however, yet another scenario that offers greater profitability for cybercriminals – it involves the attackers demanding a ransom from a target in return for not launching a DDoS attack, or to call off an ongoing attack. The ransom can be the bitcoin equivalent of thousands of dollars, meaning the profitability of a single attack can exceed 95 per cent. In fact, those carrying out the blackmail don’t even need to have the resources to launch an attack – sometimes the mere threat is enough. “We expect the profitability of DDoS attacks to continue to grow. As a result, will see them increasingly used to extort, disrupt and mask other more intrusive attacks on businesses. Worryingly, small and medium sized businesses are not confident in their knowledge of how to combat these threats effectively. The longest DDoS attack in 2016 lasted 292 hours according to Kaspersky Lab’s research, or about 12 days,” said says Russ Madley, head of B2B at Kaspersky Lab UK. “Most online businesses can ill-afford to have their ‘doors closed’ for even an hour, let alone for 292 hours, as criminals take advantage of their poor defences. Companies that host these online sites are also under attack on a daily basis. The channel has a significant opportunity with our help to identify risks, provide strategic advice and deliver the right solutions to customers to prevent damaging DDoS attacks.” Interestingly, some cybercriminals have no scruples about selling DDoS attacks alongside protection from them. Kaspersky Lab’s experts, however, do not recommend using criminal services. Source: http://www.information-age.com/connected-cities-suffer-catastrophic-blackouts-123465253/

Taken from:
Criminal benefits: profit margin of a DDoS attack can reach 95%

The Short List of Who Protects Companies Against DDoS Attacks

Here’s a question: when was the last time you got something truly useful for free? Like that time it turned out your phone company was giving you mobile data even though it wasn’t included in the plan you selected, or that time you turned up at the car dealership for a major repair, and they informed you the cost was covered because you’re just such a great customer. Oh right: it was never. So why is it that so many companies seem to think somebody else is responsible for protecting them against distributed denial of service (DDoS) attacks? DDoS mitigation is an important and complex service that requires careful expertise, on-demand or always-on deployment, nearly limitless scalability and huge amounts of network bandwidth. If a company hasn’t taken the steps to invest in this kind of protection, they don’t have it. Attack overview A DDoS attack is a distributed denial of service attack, which is a cyberattack that uses a botnet, a network of internet-connected devices that have been hijacked for remote use, to direct large amounts of malicious traffic at a website that has been targeted. This traffic overwhelms the website, its server or its resources to take it offline or render it so frustratingly slow it can’t be used. Distributed denial of service attacks have been a problem for websites and organizations of all sizes for over 15 years, and the problem is becoming a crisis as DDoS for hire services steadily gain popularity, and botnets steadily gain in size due to unsecured Internet of Things devices. For larger organizations, a successful DDoS attack can cost between $20,000 and $100,000 per hour, and while unquantifiable, the loss of user trust or loyalty that can result from such an attack can be even worse. Erroneous assumptions DDoS attacks haven’t exactly been flying under the radar lately. Their frequency, as well as the threat they pose, should be well known to anyone working in online security. Yet a recent survey by Kaspersky uncovered some staggering statistics. Thirty percent of companies surveyed indicated that they haven’t taken action against the threat of DDoS attacks because they believe they won’t be targeted, 40% believe their ISP will provide protection, and a further 30% believe data centers will provide protection. Perhaps most misguided of all, 12% believe a small amount of DDoS-caused downtime would not have a negative impact on the company. Why ISPs won’t provide complete protection While some ISPs do provide complete DDoS protection as an added service that clients pay good money for, most provide only partial protection. Due to the large amounts of bandwidth an ISP has available, they can do well against large volumetric attacks, but craftier application layer attacks are a problem. Also, while ISPs can be good at identifying malicious traffic, they don’t deal with that malicious traffic efficiently, meaning that while it’s struggling to deal with an influx of malicious traffic, legitimate traffic will be caught in the bottleneck with it or even discarded alongside the bad traffic, resulting in users unable to get through to the website. In other words, while a basic DDoS attack could be thwarted by an ISP, the result – users unable to access the website – ends up being the same. Further, some DDoS attacks like the Slowloris are made up of traffic and requests that are seemingly legitimate, making them difficult to detect for even some intrusion detection systems, let alone an ISP. Perhaps the biggest problem with relying on an ISP for protection is that regardless of what type of attack is launched, there isn’t going to be a quick response from an ISP. They aren’t built for the kind of real-time monitoring and deployment that can catch an attack within seconds. Most often, it will be several hours before an ISP begins to deal with an attack. By then, the damage is done. Why data centers won’t provide complete protection either There’s a caveat here: just as with ISPs, some data centers do provide complete protection against distributed denial of service attacks, but again it is an added service that definitely adds to the data center bill. Similar to ISPs, data centers do provide some measure of DDoS protection, but it can generally only protect against basic attacks that can be stopped with rate limiters, or attacks that are not directly aimed at an application service. Large or complex attacks cannot be stopped by basic data center protection. Moreover, not only do ISPs and data centers not provide complete protection against DDoS attacks, but they also put their clients at a bigger risk of second-hand DDoS damage. If an ISP or data center is struggling with a large or complex attack, websites that weren’t targeted will nonetheless suffer the effects. A-Z protection Professional DDoS protection is built to provide the quickest, most proactive and most complete protection against distributed denial of service attacks. Cloud-based protection is especially excellent at protecting against both network-layer and application-layer attacks, and with the use of a scrubbing server, attack traffic will be kept from ever touching the target website while legitimate traffic is let through unfettered. For companies after a more bang-for-their-buck solution, it may be preferable to look into a quality content delivery network (CDN). CDNs are designed to improve site speed and performance, and all CDNs offer some level of DDoS protection due to the built-in load balancing that comes from their multi-server environments. However, CDNs will also offer additional DDoS protection on top of that. High-quality distributed denial of service protection won’t become a freebie or throw-in until the internet reaches a phase where there’s something so much worse and so much more common than DDoS attacks that they become almost after-thoughts for all the malicious cyberattackers out there. So companies can either root for that reality, or take protection into their own hands by investing in solid DDoS protection. Source: http://www.iotevolutionworld.com/iot/articles/430637-short-list-who-protects-companies-against-ddos-attacks.htm

Servers hosting Daphne Caruana Galizia’s website suffer ‘unprecedented’ DDoS attack

The servers hosting Daphne Caruana Galizia’s personal blog have suffered a DDoS attack. A DDos (denial of service) attack occurs when many systems flood the bandwidth of a targeted system, in an attempt to make the online service unavailable. Mrs Caruana Galizia does not yet know who is behind the attack, but did say it is highly likely to be a person of Maltese nationality.. Prior to the DDoS attack on the servers, she said, a fake Gmail account was setup – similar to her personal email address. The person who created the account, then emailed two persons working for the company who handle software support for the website, and tried to acquire information required to hack the site through them. This, however, did not work and the software support personnel realised that it was not Mrs Caruana Galizia’s email address, and also the use of broken English in the email. This, she said, is what led her to believe that the person behind the attack is Maltese. The police were contacted aftewr the DDOS attack occurred later, and an investigation is ongoing. The fake Gmail address used a proxy server, and thus far no culprit has been identified, she said. She explained that aside from the crime involving the DDoS attack, impersonation is also a crime. Vanilla Communications, a server hosting company owned by David Thake, hosts Daphne Caruana Galizia’s personal blog – a service that she pays for each month, she said. In a Facebook post, Mr Thake said that the servers hosting her website suffered a DDoS attack which he called “unprecedented in scale.” Mr Thake, in his post, said the attack brought the network to its knees. Source: http://www.independent.com.mt/articles/2017-03-21/local-news/Servers-hosting-Daphne-Caruana-Galizia-s-website-suffer-unprecedented-DDOS-attack-6736171884

Follow this link:
Servers hosting Daphne Caruana Galizia’s website suffer ‘unprecedented’ DDoS attack

Nine Ways To Protect Your Technology Company From DDoS Attacks

DDoS attacks can wreak havoc on your company’s efficiency if you’re not careful. The Mirai botnet — malware that can be used for large-scale network attacks — can often go undetected due to common oversights and lack of preparation. It may be daunting to think about how IoT devices that make your company run smoothly can be used against you; however, it doesn’t take much time to set up multiple precautions to prevent it. Below, executives from Forbes Technology Council highlight simple and cost-effective ways that you can safeguard your company from baleful botnets. 1. Start By Looking At Your Infrastructure There are many botnets, Mirai just happens to be one of the largest known ones. Technology companies need to start developing more secure products rather than security being an afterthought. Firms need to look at their internet infrastructure to funnel botnet traffic away from their core business to enable the business to function when these attacks occur. – Heeren Pathak, Vestmark 2. Understand That Anyone Can Be A Target It’s very important to understand that anyone can be a target, no matter if you are a big or small company. If being offline just for a few minutes can cause a big economical impact, then you definitely should find a trusted partner that offers good solutions to mitigate against DDoS attacks. There are some companies offering this kind of service, but a quick Google search should be handy. – Cesar Cerrudo, IOActive 3. Choose The Right Hosting Partners No matter your line of business, your public-facing websites are potential targets of massive DDoS attacks. For business without a dedicated team of security experts, it’s important to choose the right hosting partners. For many customers of AWS, you automatically received free protection against some forms of attacks similar to Mirai botnet with the release of AWS Shield in December of 2016. – Jamey Taylor, Ticketbiscuit, LLC 4. Monitor Your Traffic Companies need to be skeptical of any device they have hanging on their networks. The average company now needs to apply firewall rules on a device-by-device basis, anticipating the possibility of a printer, web camera or AV control system becoming infected. Smart traffic monitoring software and methods of quarantining devices should be commonplace. – Chris Kirby, Voices.com 5. Set Strong, Custom Passwords IT security organizations should ensure their IoT devices have no direct public management access from outside the network. If an IoT device must be managed remotely through publicly accessible IPs, change the management password on the device from the default to a strong, custom one. IT admins need to put intrusion prevention, gateway anti-malware and network sandbox solutions at the network perimeter. – Bill Conner, SonicWall 6. Don’t Rely On The Internet Nearly all consumer products are computer-based in today’s marketplace, which makes reliance on the internet dangerous to a product’s infrastructure. That said, Cloudflare, Akamai and Dynect are solution services that will act as a protective wall for your servers and prevent large-scale network attacks. – Pin Chen, ONTRAPORT 7. Have The Right Company Policies In Place Technology companies should have policies in place to make sure IoT devices default factory credentials are changed as soon as they are procured. Will this guarantee they will never get infected with Mirai botnet? No. But this basic step along with modifying factory default privacy and security settings, firmware updates, audits, etc. will reduce the chances of an IoT device being infected. – Kartik Agarwal, TechnoSIP Inc 8. Cooperate And Act Mirai shows how an internet of everything can cause new kinds of net-quakes. Attackers can fire so much hostile traffic at one target that it takes down entirely unrelated sites nearby, in effect, causing major collateral damage. Unfortunately, there’s no simple defensive fix — it takes cooperation and active network control to deflect traffic tsunamis. – Mike Lloyd, RedSeal 9. Be Prepared Large-scale network attacks are not going away, and technology companies need to ensure they’re prepared. Doing a security audit of what protections are currently in place, and looking for existing holes that need to be plugged, is a good place to start. Also, make sure any IoT devices used at your company have security in place to prevent them from becoming part of this bot army. – Neill Feather, SiteLock Source: https://www.forbes.com/sites/forbestechcouncil/2017/03/16/nine-ways-to-protect-your-technology-company-from-ddos-attacks/2/#73d67f6a7178

Visit link:
Nine Ways To Protect Your Technology Company From DDoS Attacks

Standards and Security: The Great DDoS Challenge

Whether or not you work in IT security, distributed denial of service (DDoS) attacks are becoming more visible by the day. In the last three months of 2016 alone, DDoS attacks greater than 100Gbps increased by 140% year-on-year, according to a recent report. This growth isn’t expected to decelerate any time soon. The damage inflicted by DDoS attacks in the past year has been seen across various aspects of the online world. We often hear of news sites and political campaigns being taken offline, but this is now moving towards more mission critical operations in hospitals, banks and universities. The most significant example in recent months is the DDoS attack against Domain Name Service (DNS) provider Dyn. Let’s take a look at this case and determine the potential impact that conformance to existing standards could have had on the incident. IoT and the DDoS dilemma The Dyn attack in October 2016 impacted a whole host of major websites including Amazon, Netflix, Twitter, Spotify and Github, and was widely reported as the largest of its kind ever recorded. Its substantial impact was down to the huge number of connected devices used in the attack – not just laptops and PCs but routers, printers and baby monitors that make up the so-called Internet of Things (IoT). These devices were deliberately infected with the Mirai malware in order to create a botnet to carry out the momentous attack. It’s important to be clear on the mechanisms of the Mirai malware if we’re to consider the potential impact of standards on the attack. By using known passwords, it is able to search for susceptible IoT devices before infecting them with the malware. As a result, the device becomes part of a botnet which is capable of launching DDoS attacks from all of its infected devices. Seven out of 12 DDoS attacks in Q4 2016 were down to the Mirai botnet. In the Dyn case, it was estimated that the attack involved 100,000 malicious endpoints. The botnet sent around 1 TB of traffic per second to the company’s servers, meaning legitimate requests were denied. Mitigating DDoS attacks This attack was fundamentally a consequence of the devices involved still retaining their default password. There are two arguments as to where culpability lies in this instance. Some blame the users for not changing the default passwords once they were connected. Others feel more responsibility should fall on the manufacturers to ensure operators understand the importance of changing default passwords. In fact, in some cases manufacturers were distributing products with well-known default passwords and no option to change the password without purchasing a new product. In any case, these devices were vulnerable and open to attack. Standards: the silver bullet? DDoS attacks are becoming far more sophisticated so it’s essential that hardware and software manufacturers start to seriously consider standards to address the potential security risks in the growing Internet of Things. One key standard is the Open Trusted Technology Provider Standard, or O-TTPS, which addresses these issues around supply chain security and product integrity. Recently approved as ISO/IEC 20243, this set of best practices can be applied from design to disposal, throughout the supply chain and the entire product life cycle. Standards like the O-TTPS aim to reduce the risk of tainted (e.g., malware-enabled and malware-capable) and counterfeit hardware and software components from entering the supply chains and making their way into products that connect to the internet. This specific standard also has a conformance program that identifies Open Trusted Technology Providers who conform. The vendors involved in the Dyn incident could have followed the O-TTPS’ requirements for vulnerability analysis and notification of newly discovered and exploitable product weaknesses. If they had done so from the outset, the vulnerability that allowed the Mirai botnet to grow would have been caught early. The attack vector would have subsequently been blocked and the impact on businesses and consumers significantly reduced. Securing Information and Communication Technology (ICT) on which our business enterprises and critical infrastructures depend is a serious problem that becomes even more daunting and complex as we extend those environments to IoT devices. ICT and IoT devices are developed, manufactured, and assembled in multiple countries around the world. They are then distributed and connected globally. Providing international standards like the O-TTPS (ISO/IEC 20243) that all IT providers and their technology partners (e.g., component suppliers, manufacturers, value-add resellers) in their supply chains can adopt, regardless of locale, is one significant way to increase cyber and supply chain security. Standards can’t categorically prevent the inception of DDoS attacks, but what they can do is mitigate their effectiveness and limit their economic damage. The adoption of a universal product integrity and supply chain security standard is a major first step in the continued battle to secure ICT products and IoT devices and their associated end users. Further steps need to be taken in the form of collaboration, whereby we reach a point where we can recognise which technology and technology providers can be trusted and which cannot. But adhering to global standards provides a powerful tool for technology providers and component suppliers around the world to combat current and future DDoS attacks. Source: https://www.infosecurity-magazine.com/opinions/standards-security-great-ddos/

See more here:
Standards and Security: The Great DDoS Challenge

DDoS Attacks; Can You Find Who Dunnit?

Kaspersky Lab and B2B International recently polled 4,000 businesses among 25 countries that had been hit by a distributed denial of service (DDoS) attack; 40% of respondents said they believed that a rival business had launched the attack. Only 20% of DDoS victims blamed foreign governments and secret service organizations, and another 20% suspect disgruntled former employees. These are interesting statistics, given that it is extremely difficult to determine who launched a DDoS attack. Has law enforcement found any trends to support this belief that many DDoS attacks are caused by industrial sabotage? Maybe, maybe not. When it comes to hacking—especially DDoS hacks—law enforcers seldom find the perpetrators, because it is extremely difficult for anyone to trace the origins of DDoS attacks. The source is typically 1) a legitimate third-party server, running a service which has been leveraged by an attacker as part of a reflection/amplification attack, or 2) a direct flood attack from a single device, or 3) a botnet of many devices in which the IP source addresses are easily spoofed to ones that cannot be associated with the attacker. Motivations and Means Hacker motivations vary; some are political, others are financial. Certainly, if a business wanted to inflict financial or reputational harm upon a competitor, a DDoS attack would do the trick. After all, it is easy and relatively inexpensive for anyone to rent a botnet or DDoS-for-hire service to carry out a DDoS attack. Yes, it’s possible, but do victims have any evidence to back up their suspicions, or are they just paranoid about a rival business? Likewise, the threat of a disgruntled, malicious insider or former employee is a reasonable concern. But again, it is hard to trace the breadcrumbs. Speculating about “who dunnit” is usually pointless; there’s little hope of hunting down the perpetrator(s), and it costs time and money to conduct an investigation. Even if the perps are brought to justice, they’ve already damaged your business. The moral of the story is that it’s useless to close the proverbial stable door after the horse has left; the best approach is to prevent an attack by having DDoS protection in place. Source: http://www.dos-mitigation.com/wp-admin/post-new.php

More:
DDoS Attacks; Can You Find Who Dunnit?

IoT DDoS Reaches Critical Mass

In the wake of the Mirai botnet activity that dominated the end of last year, the “DDoS of Things (DoT)”, where bad actors use IoT devices to build botnets which fuel colossal, volumetric DDoS attacks, has become a growing phenomenon. According to A10 Networks, the DoT is reaching critical mass—recent attacks have leveraged hundreds of thousands of IoT devices to attack everything from large service providers and enterprises to gaming services, media and entertainment companies. In its research, it uncovered that there are roughly 3,700 DDoS attacks per day, and the cost to an organization can range anywhere from $14,000 to $2.35 million per incident. In all, almost three quarters of all global brands, organizations and companies (73%) have been victims of a DDoS attack. And, once a business is attacked, there’s an 82% chance they’ll be attacked again: A full 45% were attacked six or more times. There were 67 countries targeted by DDoS attacks in Q3 2016 alone, with the top three being China (72.6%), the US (12.8%) and South Korea (6.3%). A10 found that 75% of today’s DDoS attacks target multiple vectors, with a 60/40 percentage split of DDoS attacks that target an organization’s application and network layers, respectively. Meanwhile, DDoS-for-hire services are empowering low-level hackers with highly damaging network-layer bursts of 30 minutes or less. This relentless attack strategy systemically hurts corporations as colossal DDoS attacks have become the norm too; 300 Gbps used to be considered massive, but today, attacks often push past 1 Tbps thanks to the more than 200,000 infected IoT devices that have been used to build global botnets for hire. No industry is immune: While 57% of global DDoS attacks target gaming companies, any business that performs online services is a target. Software and technology were targeted 26% of the time; financial services 5%; media and entertainment, 4%; internet and telecom, 4%; and education, 1%. Source: https://www.infosecurity-magazine.com/news/iot-ddos-reaches-critical-mass/

See the original post:
IoT DDoS Reaches Critical Mass

How Homeland Security plans to end the scourge of DDoS attacks

The agency is working on a multimillion dollar effort to protect the country’s most critical systems from distributed denial of service attacks, which are among the simplest digital assaults to carry out and the toughest to fight. MARCH 8, 2017 —In late October, in Surprise, Ariz., more than 100 phone calls bombarded the police department’s emergency dispatch line. Calls also overwhelmed the nearby city of Peoria’s 911 system and departments across California and Texas. But each time a dispatcher picked up, no one was on the line – and there was no emergency. The Arizona district attorney’s office says the calls clogging 911 lines resulted from a digital prank, which triggered a distributed denial of service, or DDoS, attack on critical emergency communication systems. The prosecutor’s office tracked the torrent of calls to 18-year-old hacker Meetkumar Hiteshbhai Desai. Now, he’s facing four counts of felony computer tampering. While Mr. Desai said he didn’t intend to cause any harm, according to the Maricopa County Sheriff’s Office, he did surface a potentially devastating glitch in smartphone software that could exact damage on any number of sensitive and critical targets. Whenever anyone clicked a certain link on his webpage via a mobile device, their phone automatically dialed 911. While this kind of DDoS targeting 911 systems is unprecedented, it’s exactly the type of attack that national law enforcement officials have been concerned about for years. In fact, the Homeland Security Department (DHS) has been working on technology to protect 911 centers from DDoS and telephone-based, or TDoS, attacks for three years. The Arizona incident proved someone can “cause a large number of phones or a large number of computers or a large number of whatever connected device to start generating these calls,” says Dan Massey, program manager in the cybersecurity division of the DHS Science and Technology Directorate. “It went from how much damage can I do from my phone” to a situation where, with just a handful of people, “if all of our phones started calling some victim, whether that’s 911 or a bank or a hospital, that can get very fast and very big.” DDoS attacks are both among the simplest forms of cyberattacks to carry out and the most difficult to defend against. They are designed to direct an overwhelming amount of digital traffic – whether from robocalls or web traffic – at targets to overwhelm them so they can’t handle legitimate business. Writ large, there has been an exponential increase in the intensity and frequency of DDoS attacks over the past six months and critical infrastructure components are possible future targets, according to DHS. For a sense of the scale of today’s DDoS attacks, compare the 100 megabits per second Internet speed at a typical company to the more than 1 million megabits (1 terabit) per second speed of a DDoS attack against Web hosting company Dyn in October. The attack, which drew power from insecure webcams and other internet-connected devices, knocked out widely used online services like Netflix, Twitter, and Spotify for hours. Such massive web DDoS assaults may also become a problem for 911, as the country moves toward a next generation 911 system that uses mapping services to locate callers and can support voice, text, data, and video communication. “What you’re seeing is a convergence of the traditional internet with the phone system and next generation 911 is a great example of that,” says Massey. “DDoS attacks and/or TDoS attacks kind of blend together a little bit there.” To help combat the problem, the department has given out $14 million in grants for DDoS prevention studies, including phone-based attacks. Some of that funding is piloting initiatives to stop phone-based attacks at 911 centers in Miami/Dade County and the City of Houston, as well as at a large bank that the department wouldn’t identify. So far, DHS efforts have yielded, among other things, a DDoS early warning system to flag organizations that an attack may be coming, and alerting them to adjust internet network settings to defend against an onslaught of traffic. Additionally, DHS-funded research from tech firm SecureLogix produced a prototype that can thwart phony telephone calls sent to a 911 system or other critical phone operation. The model attempts to detect bogus calls by monitoring for clues that indicate an incoming call is fake. “As we have seen, it is simple to flood a 911 center, enterprise contact center, hospital, or other critical voice system with TDoS calls,” says Mark Collier, SecureLogix chief technology officer. “The research is essential to get ahead” because the assailants “are generating more attacks, the attacks are more sophisticated, and the magnitude of the attacks is increasing. “ To be sure, the race to keep digital adversaries out of the country’s 911 system faces obstacles, some of which are outside the jurisdiction of Homeland Security and dispatch centers. The DHS DDoS defense program is “a good start,” but one “challenge in defending certain types of critical infrastructure is the fact that emergency services like 911 must serve anyone – immediately,” per Federal Communications Commission rules, “due to their life saving nature,” said Mordechai Guri, research and development head at Israel’s Ben-Gurion University Cyber-Security Research Center. “The approach of blocking the DDoS originators must be backed by a change in the laws and regulations.” Before the October attacks on the Arizona 911 systems, he and fellow Ben-Gurion researchers warned that DDoS attacks launched from cellphones could pose a significant threat to emergency services. During one experiment, it took fewer than 6,000 hacked phones to clog emergency services in a simulated US state, the academics wrote in a September 2016 paper. Such an attack can potentially last for days. The very nature of the 911 system makes shutting out any callers potentially dangerous, and some alternatives, like requiring a person in distress to authenticate themselves for assistance, are not viable, says Massey of DHS. “We really need to make sure that we’re not missing a critical 911 call,” he says. “So that’s a challenge for the project to make sure that we’re not misclassifying people.” Source: http://www.csmonitor.com/World/Passcode/2017/0308/How-Homeland-Security-plans-to-end-the-scourge-of-DDoS-attacks

See more here:
How Homeland Security plans to end the scourge of DDoS attacks

7 Security Steps To Defend Your Company Fram A DDoS Attack

Of all the cybersecurity threats today’s businesses face, distributed denial-of-service (DDoS) attacks are among the most complex and devastating. This type of breach involves multiple compromised systems that work in conjunction to shut down service. Although security technology is becoming more sophisticated, so are hackers, and you don’t want to be caught unprepared if (or more likely, when) your company’s data gets compromised. Below, a few members of Forbes Technology Council each offer one important prevention measure to help your IT department defend against a DDoS attack. 1. Continue To Add Layers Of Defense Remain vigilant, continuing to add layers of security as they become available. Also provide your department with signs to look for so they have a better idea of potential threats. This provides for a much more proactive approach to security. – Chalmers Brown, Due 2. Practice Your Response Plan Have a plan on what to do and who should do it, then do a dry run against it a few times a year. Go further than just your IT team – involve your vendors, executive team, etc. and ask for feedback on what would help them help you in the face of a DDoS attack. Update your plan each time. This practice helps your team execute fast and has the added benefit of showing those around you that you’re prepared. – Brian Fritton, Patch of Land 3. Use A Web Application Firewall (WAF) A Web Application Firewall (WAF) is your best line of defense against a DDoS attack. It acts like an antivirus that blocks all malicious attacks on your website. It sits above your application at the network level to provide protection before the attacks reach your server. Using a WAF not only protects you against DDoS attacks, but also improves application performance and enhances user experience. – Thomas Griffin, OptinMonster 4. Leverage Cloud Services And Educate Yourself Continually Cloud providers will handle security better than you can do in-house — especially if you’re a target. Even the U.S. government leverages cloud providers to consult and augment security. Amazon has DDoS mitigation services, and their DNS is both inexpensive and secure. Educate yourself to stay aware of the potential threats and mitigation services that are available to you. – Tim Maliyil, AlertBoot 5. Help Employees Educate Each Other Since our inception, we’ve had a personal ‘buddy’ assigned to any new team member. They are responsible for teaching the new person all of the dos and don’ts of the department, and also get them more culturally aligned with the team/company. – Pin Chen, ONTRAPORT 6. Get Senior Management Involved In Security Planning It is critical for companies to include senior management in DDoS prevention planning. Most attacks are due to poor ongoing security practices or setups. Ransomware attacks alone cost over $1B in 2017. Companies should consider cloud solutions that offer cost-effective managed security solutions, with ongoing security and maintenance updates, so that they can focus on building their core business. – Cristina Dolan, Trading Screen 7. Segment Your IoT Devices Behind A Firewall While DDoS attacks are difficult to prevent, you can minimize the impact by enabling DDoS and flood protection on your organization’s firewalls. To restore order quickly in the event of an attack, develop a DDoS response plan. To minimize the chance of your IoT infrastructure being used in a DDoS attack, make sure all IoT devices are segmented on a dedicated safe zone behind a firewall. – Bill Conner, SonicWall Source: https://www.forbes.com/sites/forbestechcouncil/2017/03/07/7-security-steps-to-defend-your-company-fram-a-ddos-attack/#4a04a540408

Businesses blame rivals for DDoS attacks

Industrial sabotage is considered to be the most likely reason behind a distributed denial of service attack, a study has revealed More than 40% of businesses hit by a distributed denial of service (DDoS) attack worldwide believe their competitors were behind it, research by Kaspersky Lab and B2B International has revealed. Rival firms are considered more likely culprits than cyber criminals, which were cited as suspects by just 38% of DDoS victims on average. Industrial sabotage is considered to be the most likely reason behind a DDoS attack, coming out higher than political conspiracy and personal vendettas against a business. Typically, DDoS attacks target web servers and aim to make websites unavailable to users. Although no data is stolen, the interruption to the service can be costly in terms of lost business damage to reputation. For example, a massive DDoS attack on Luxembourg’s government servers that started on 27 February 2017 reportedly lasted more than 24 hours, and affected more than a hundred websites. The joint Kaspersky Lab, B2B International study, which polled 4,000 businesses in 25 countries, found that only 20% of DDoS victims overall blamed foreign governments and secret service organisations, with the same proportion suspecting disgruntled former employees. Companies in Asia Pacific are the most suspicious of competitors, with 56% blaming their rivals for DDoS attacks and 28% blaming foreign governments. Personal grudges also carry more suspicion in the region too, with 33% blaming former staff. In Western Europe, only 37% of companies suspect foul play by their competitors, with 17% blaming foreign governments. Looking at attitudes by business size, businesses at the smaller end of the scale are more likely to suspect their rivals of staging an experienced DDoS attack. The study found that 48% of small and medium business representatives believe this to be the case compared with only 36% of enterprises. In contrast, respondents from big companies put more blame on former employees and foreign governments. “DDoS attacks have been a threat for many years, and are one of the most popular weapons in a cyber criminals’ arsenal,” said Russ Madley, head of B2B at Kaspersky Lab UK. “The problem we face is that DDoS attacks can be set up cheaply and easily, from almost anyone, whether that be a competitor, a dismissed employee, socio-political protesters or just a lone wolf with a grudge. “It’s therefore imperative that businesses find an effective way to safeguard themselves from such attacks,” he said. Significant advances in DDoS attacks There were significant advances in DDoS attacks in the last quarter of 2016, according to Kaspersky, with the longest DDoS attack in lasting 292 hours or 12.2 days, which set a record for 2016 and was significantly longer than the previous quarter’s maximum of 184 hours. The last quarter of 2016 also saw the first massive DDoS attacks using the Mirai IoT (internet of things) botnet technology, including attacks on Dyn’s Domain Name System (DNS) infrastructure and on Deutsche Telekom, which knocked 900K Germans offline in November. There were also similar attacks on internet service providers (ISPs) in Ireland, the UK and Liberia, all using IoT devices controlled by Mirai technology and partly targeting home routers in an attempt to create new botnets. Stakeholders recognise lack of security in IoT devices According to Kaspersky, stakeholders worldwide, in particular in the US and EU, recognise the lack of security inherent in the functional design of IoT devices and the need to set up a common IoT security ecosystem. Kaspersky expects to see the emergence of further Mirai botnet modifications and a general increase in IoT botnet activity in 2017. Researchers at Kaspersky Lab also believe that the DDoS attacks seen so far are just a starting point initiated by various actors to draw up IoT devices into the actors’ own botnets, test drive Mirai technology and develop attack vectors. First, they demonstrate once again that financial services like the bitcoin trading and blockchain platforms CoinSecure of India and BTC-e of Bulgaria, or William Hill, one of Britain’s biggest betting sites, which took days to come back to full service, were at the highest risk in the fourth quarter and are likely to remain so throughout 2017. Second, cyber criminals have learnt to manage and launch very sophisticated, carefully planned, and constantly changing multi-vector DDoS attacks adapted to the mitigation policy and capacity of the attacked organisation. Kaspersky Lab’s analysis shows that the cybercriminals in several cases tracked in 2016 started with a combination of various attack vectors gradually checking out a bank’s network and web services to find a point of service failure. Once DDoS mitigation and other countermeasures were initiated, researchers said the attack vectors changed over a period of several days. DDoS enters its next stage of evolution Overall, they said these attacks show that the DDoS landscape entered the next stage of its evolution in 2016 with new technology, massive attack power, as well as highly skilled and professional cyber criminals. However, the Kaspersky researchers note that unfortunately, this tendency has not yet found its way into the cyber security policies of many organisations that are still not ready or are unclear about the necessary investments in DDoS protection services. Source: http://www.computerweekly.com/news/450414239/Businesses-blame-rivals-for-DDoS-attacks

Visit site:
Businesses blame rivals for DDoS attacks