Tag Archives: var-username

How Norway’s biggest news site protects itself from DDoS attacks

Every day hackers attack Norway´s largest news site, VG.  But not without risk. VG has both helped the police put hackers behind bars and alerted mothers about what their adventurous sons are up to. VG.no is one of the most successful news sites in the world. Every week 4 million Norwegians – out of a population of 5 million – visit the site for the latest news. But that also makes VG.no a target for hackers. “Whenever there is a new security hole discovered, someone want to try it on VG,” says Audun Ytterdal, head of IT operations in VG. During the Schibsted Tech Polska Winter Event 2016 he presented “War stories from the ops trenches”, describing how the media house protects itself from a continuous flow of DDoS attacks. Under attack every day VG is well prepared for hacker attacks – and is able to deal with lots of traffic without going down. According to Ytterdal the site can handle up to 30 GB per second. “Usually we see around 10.000 http-hits per second. But during the attacks we can experience up to 100.000 http-hits per second,” he explains. Called the hacker´s mum In the presentation he explains some of the technical measures taken to secure the news site from attack. But he also tells entertaining stories about how the IT staff used their technical skills to identify the hackers. And not always the hackers have everything planned out! Take for instance the young hacker who managed to take over the front page of the business site E24.no with photos of himself in a balaclava taken in his mum´s bathroom. However smart he had been breaking into the site, he had forgotten to remove the location info added to the image file when he took the photo with his mobile phone. “So we could see where he lived – and we called his mum informing her that her son was up to activities she may not approve of,”  laughs Audun Ytterdal. Sent hackers to jail In another case the hackers bragged about their achievement on Twitter. That gave the IT operations department the opportunity to contact them directly.  After a while they also managed to identify two of the hackers. When one of them posted a photo from a town in Southern Norway, VG was able to locate the exact house it had been taken from with use of Google Street View. The information was given to the police – and the two hackers later had to serve time in jail. Entertaining error page For a news room all alarms go off when the main site is down.  And Audun Ytterdal believes it will be very hard to avoid never being shut down. So what to do when it happens? Of course identify and fix the problem. But VG also decided to give people a good laugh by designing an entertaining error page. The error page is a fun version of the normal front page of the site. “The last time we used this we had people tweeting that they would rather see the error page of VG than any other news site,” smiles Ytterdal. Source: http://www.schibsted.pl/2016/02/how-norways-biggest-news-site-protects-itself-from-ddos-attacks/

View the original here:
How Norway’s biggest news site protects itself from DDoS attacks

Serbian President’s website comes under DDoS attack

The Serbian president’s website faced a large-scale “hacking” attack on Monday, which brought it down for several hours, his press office said. A statement carried by Tanjug explained that the distributed denial-of-service attack (SYN flood) targeted www.predsednik.rs, and that the president’s website is “subject to daily hacking attacks.” In a SYN flood attack, the server is overwhelmed by a large number of legitimate and false connections requests which consume its resources and render it unresponsive or difficult to access. “The hosting and security of the president’s website falls within the competence of the Defense Ministry. In cooperation with Telekom Srbija, the ministry blocked and prevented further attacks and possible damage to the computer equipment and services,” the statement said. Source:http://www.b92.net/eng/news/crimes.php?yyyy=2016&mm=02&dd=23&nav_id=97147

Read this article:
Serbian President’s website comes under DDoS attack

US Department of Homeland SecuUS Department of Homeland Security Vows To Tackle DDoS Attacksrity Vows To Tackle DDoS Attacks

The contract between Department of Homeland Security (DHS) and Galois was signed in January. However, HackRead had a chance to discuss the contract with Galois. Galois and the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) have formalized a contract to develop technology for preventing and combating extensive, sophisticated DDoS (Distributed Denial of Service) attacks . In fact, an official announcement was made by Galois in which the company informed media about signing up a $1.7million contract with the DHS S&T Cyber Security Division. The contract is part of the larger Distributed Denial of Service Defenses (DDoSD) program initiated by the DHS S&T Cyber Security Division. The problem with DDoS attacks is that these can cripple even the most established and largest organizations. These happen to be devastating for small and/or medium-sized businesses. The generated amount of traffic is adequate to drench their internet connections multiple times and it becomes challenging to get the ISP (internet service provider) to take the matter seriously and respond quickly. DHS Developing Technology to Thwart DDoS attacks Quicker than Ever Before The project that DHS is planning with Galois is dubbed as DDoS Defense for a Community of Peers (3DCoP) and it involves peer-to-peer collaboration mechanism with which the organizations detect and combat DDoS attacks by working in cooperation. According to Adam Wick, Galois’ Research Lead, Mobile & Security Systems Software: “Current DDoS defense systems are proving ineffective because they operate in isolation, which introduces delays in the detection, reporting, and response to a DDoS attack. This delay is critical. It provides positive feedback to the attacker, who will continue to send more and more traffic to the target network. Our solution advances the state of DDoS defense by providing new tools that allow multiple defenders to coordinate their response, resulting in earlier detection and faster DDoS mitigation.” It is not a hidden fact that DDoS attacks are a great threat for all kinds of industries and sectors alike such as news entities, financial institutions, critical infrastructure organizations and government agencies, etc. Under the contract with DHS, Galois aims to curb rising DDoS attack threats via the following measures: 1: Minimizing mitigation response duration by at least 50% and 75 to 90 percent reduction in peak traffic 2: 25% reduction in the duration between the launching of DDoS attack and its detection Resultantly, organizations and institutional entities will be able to thwart DDoS attacks prior to its completion. HackRead had a chance to have a conversation with Adam Wick and here’s what we asked and what he replied: Q: How would you like to explain the difference between your services and services provided by other companies? Answer:  “Currently, DDoS defense systems fail to address large DDoS attacks that fully “clog” the internet connection. In those cases, locally responding to an attack is no longer possible. In general, most solutions work in isolation, which introduces delays in the detection, reporting, and response to a DDoS attack. To effectively mitigate a large attack, an organization must involve organizations “higher up”, like ISPs, that can stop the flow of malicious traffic. We’re developing a unique collaborative model, where multiple organizations automatically work together to detect DDoS attacks through automatic traffic analysis. They then generate traffic blocking rules for the malicious traffic and send that to ISPs further up the chain. The ISPs can, in turn, block the necessary traffic and mitigate the attacks. One can see the basis of this in the way people react to DDoS attacks now, but many of these steps are manual and require complicated conversations over the telephone. In many cases, the process is further complicated because the parties involved have never spoken before, and have to build trust. After all, the actions that one takes to mitigate a DDoS can also be used to perpetrate an attack, so upstream ISPs need to convince themselves that they’re talking to the right person. What we’re looking to do is speed up this process, dramatically, by automating the detection, analysis, and mitigation steps. At the moment, this mitigation can be automatic, or it can be manual. That way, even if an organization’s ISP isn’t hooked up to our system, network admins will be able to detect the problem early and trust our solution to have all the information (and all the evidence!) they need to convince their ISP to take early and effective action.” Q: How will your firm will defend its client against DDoS attack leading to ransom such as the ProtonMail DDoS attack? Answer: “Ransom in DDoS cases is one of those clear indicators that our current approaches to DDoS defense are failing. Attackers can only ask for ransom when an organization has no way to defend themselves. Ransom cases can be mitigated by having effective DDoS defense that doesn’t allow an attack to become a problem in first place. The most effective defenses in the coming years will take into account the bigger picture by connecting everyone involved, for a more timely response. If we can minimize the effect of large DDoS attacks, we effectively reduce cases where attackers demand ransom.” Galois is a renowned firm in the computer science research and development sector. It has been operating since 1999 and boasts of a world class team of computer science experts, mathematicians, programmers, and engineers. The firm has positioned itself as the world’s most reliable company and is ready to take on even the most challenging computer science related task of the world. It has also partnered with defense and intelligence agencies to develop cutting edge technologies to protect their systems and networks. Very often tech firms consult Galois to create reliable, safe and secure systems for their products and services’ security. Source: https://www.hackread.com/us-homeland-security-vows-to-tackle-ddos-attacks/

See the original article here:
US Department of Homeland SecuUS Department of Homeland Security Vows To Tackle DDoS Attacksrity Vows To Tackle DDoS Attacks

FBI arrests Massachusetts man for Anonymous 2014 cyberattack on Boston Children’s Hospital

The hacktivist group launched multiple distributed denial-of-service attacks against the hospital’s servers in protest of the controversial custody case of Justina Pelletier. The FBI has arrested a hacker suspected of participating in Anonymous’ 2014 DDoS attack against Boston Children’s Hospital, The Boston Globe has reported. He was taken into custody after being rescued from a small boat off the coast of Cuba by a Disney cruise ship. Martin Gottesfeld, 31, of Somerville, Massachusetts, was arrested on Feb. 17 in Miami. He’s due to appear in U.S. District Court in Boston, where he’ll be charged with of conspiring to damage the computers at Boston Children’s and another facility in Framingham, Massachusetts, according to the Globe. He faces up to five years in prison and a $250,000 fine. In April 2014 – in protest of the controversial custody case of Justina Pelletier, who was being kept a patient at Boston Children’s as a ward of the state against the wishes of her parents – hacktivist group Anonymous launched multiple distributed denial-of-service attacks that targeted the hospital’s servers and hamstrung its operations for a week. According to the Globe, the FBI had previously questioned Gottesfeld in 2014. He admitted then that he had posted a YouTube clip calling for attacks on Boston Children’s, but denied participating in them. It’s unclear why he wasn’t charged at that time. But a tip this week about his rescue at sea led agents to Florida to take him into custody. He had three laptops with him, according to an FBI affidavit. In a statement, Boston Children’s thanked federal officials for “apprehending the hacker who led the attack and holding him accountable” – also thanking its own employees, “who assisted the FBI throughout its investigation and who helped build the comprehensive systems and procedures that were able to thwart the attack and protect confidential information.” Source: http://www.healthcareitnews.com/news/fbi-arrests-massachusetts-man-anonymous-2014-cyberattack-boston-childrens-hospital

Link:
FBI arrests Massachusetts man for Anonymous 2014 cyberattack on Boston Children’s Hospital

Anonymous: Hackers plan DDoS campaign against Israeli military to protest Mohammed Al-Qeeq detention

Hacktivists with the Anonymous hacking collective have announced plans to launch widespread DDoS strikes against the Israeli military to protest the ongoing detention of Mohammed Al-Qeeq, a Palestinian journalist who has been on hunger strike since November 2015. Al-Qeeq is a reporter for a Saudi news outlet and was arrested at his Ramallah home on 21 November by Israeli police amid claims was linked to Hamas. According to the Independent, he has been in ‘administrative detention’ ever since, which is permitted under Israeli law to detain someone without referring to a judge on the basis they are a threat to the national security. In the week after his detention he went on hunger strike and after roughly 80 days had lost most of his sight, voice and hearing abilities. “We are calling on all citizens of the world to join us in this fight to free an illegally detained man. We are organising many ongoing operations in relation to this issue,” said the hacktivists in a statement posted to PasteBin, who have branded the so-called ‘emergency operation’ as #OpAlQeeq, #OpSaveGaza and #FreeAlQeeq. The statement requested those taking part in the operation to carry out a range of tasks including calling local Israeli embassys, taking to the streets in protest and raising awareness on social media. However, the note also called for major hacking activity against ‘Israeli military forces’ and posted a slew of IP addresses relating to a range of websites including the defence ministry and the Israeli Defense Force (IDF). “Since it was the Israeli military forces that arrested and detained Mohammed Al Qeeq, then Israel military forces, his blood is on your hands,” the statement said. “We are calling on all ‘anons’ and hacktivists across the world to focus fire on Israeli military forces. Included [are] all websites associated with the Israeli military. Dump them, load them with viruses, DDoS them, break them, whatever you can do or see fit. Security analysis is already underway on all targets. Targets are listed by priority level. If this man dies in the custody of the Israeli military, Israel you can expect hell.” Anonymous has a long history with hacking Israeli targets. Last year, in a video posted online, the group vowed an ‘electronic holocaust’ against the nation in apparent statement in support of Palestine. “As we did many times, we will take down your servers, government websites, Israeli military websites, and Israeli institutions,” said a masked anonymous individual. “We will erase you from cyberspace in our electronic holocaust.” Meanwhile, in a separate attack in 2012, hackers attacks and shut down a number of websites including the Tel Aviv Stock Exchange after they were threatened by a Saudi hacker. A spokeswoman for the stock exchange confirmed at the time that the site had come under attack, but claimed that trading systems were not affected. Even most recently, following the hack at the Department of Justice that resulted in the loss of thousands of federal credentials, the hacker using the @DotGovs twitter profile who was thought to be behind the incident frequently signed off with the now-familiar phrase: #FreePalestine. Source: http://www.ibtimes.co.uk/anonymous-hackers-plan-ddos-campaign-against-israeli-military-protest-mohammed-al-qeeq-detention-1544723

Follow this link:
Anonymous: Hackers plan DDoS campaign against Israeli military to protest Mohammed Al-Qeeq detention

Several bugs detected in IBM Java Runtime could lead to DDoS attacks

Multiple vulnerabilities that could enable a remote attacker to launch a denial-of-service attack have been detected in the IBM Runtime Environment Java Technology Edition v6, according to an IBM Security Bulletin posted on Tuesday. The integrated software is used by Tivoli Composite Application Manager for SOA, a platform which provides management for services, applications and middleware. These bugs, which include the vulnerability popularly known as “SLOTH,” were reported by IBM when it updated Java SDK in January 2016. “The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake,” the bulletin stated. Employing man-in-the-middle techniques, a saboteur could exploit this flaw to mimic a TLS server and glean credentials, IBM wrote. No workarounds or mitigations have yet been provided. Source: http://www.scmagazine.com/several-bugs-detected-in-ibm-java-runtime/article/475405/

Follow this link:
Several bugs detected in IBM Java Runtime could lead to DDoS attacks

How CDSL’s CIO is way ahead in the fight against DDoS attack

As the threat of DDoS attack looms large on the enterprise, CDSL’s CIO, Joydeep Dutta, countered it ahead of time with his in-house DDoS protection. For the past few years, India Inc. and its IT teams have been in a constant state of war with malware, hackers, insidious employees and everything that is a threat to their information security. The only strategy applied—and it wasn’t an effective one—was to deal with the after effects of the attack. But one CIO believed in the age old adage: Prevention is better than cure, and secured the most critical applications of the company from DDOS attacks. “Today, not many companies have implemented in-house DDoS protection though it is the ideal way of preventing denial of service attacks. If done only at the network service provider through clean pipes, it doesn’t give full protection,” says Joydeep Dutta, group CTO, Central Depository Services Limited. According to a recent report released by Akamai, India stands in the fourth position for being the origin of non-spoofed DDoS attacks. Of all the attacks, 7.43 percent originated from the country. The project was therefore a high priority for Dutta as the company’s core depository application, electronic voting for company resolution and other critical applications were Web-based. Not wasting any more time, as the threat loomed large, Dutta implemented an in-house DDoS protection and Web Application Firewall for additional security above the capability of traditional network firewalls. “By implementing Web application firewall (WAF), the internet-facing applications which are part of the core applications for most organizations were additionally protected,” he says. Further explaining the project, Dutta says that the in-premises DDOS equipment is the first layer of defense in the on-premise infrastructure. All the other equipment such as ISP routers, firewalls etc; at customer premise, are underneath this. “A set of security modules including Denial-of-service (DoS) protection, Network Behavioral Analysis (NBA), Intrusion Prevention System (IPS), Reputation Engine and Web Application Firewall (WAF), fully safeguard networks, servers, and applications against known and emerging network security threats,” Dutta says. Another novel thing about the project was the built-in security event information management system which collects and analyzes events from all modules to provide enterprise-wide views. CDSL reaped huge benefits from the on-premise DDoS implementation. “It was easy to proactively monitor the security features of these devices to decide necessary actions to be taken,” he says. It was now easy to black-list the vulnerable IP list received regularly from NCIIPC. It was also possible to stop repeated attacks with the help of the device. Thus, Dutta set an example for his peers to follow by securing the organization against the looming security threats. You too get going. Source: http://www.cio.in/case-study/how-cdsl%E2%80%99s-cio-way-ahead-fight-against-ddos-attack

More:
How CDSL’s CIO is way ahead in the fight against DDoS attack

HSBC Calls In Cops To Chase DDoS Attackers Who Took Online Banking Down

HSBC said today it was working with local police to find those who disrupted its online banking services with a denial of service attack, as customers complained of not being able to access their accounts. The attack was made even more painful for customers as the last Friday of the month is a traditional payday in the UK, the home of HSBC. Little information was provided by HSBC other than a terse statement over Twitter: “HSBC UK internet banking was attacked this morning. We successfully defended our systems. “We are working hard to restore services, and normal service is now being resumed. We apologise for any inconvenience.” A spokesperson told the BBC a denial of service attack was the cause of the downtime. A subsequent tweet revealed the police had been contacted: “HSBC is working closely with law enforcement authorities to pursue the criminals responsible for today’s attack on our Internet banking.” HSBC was hit by a distributed denial of service (DDoS), where infected machines fire an overwhelming number of data packets at a server to stop it working, most recently in 2012. That time the Anonymous hacktivist crew was believed to have carried out the hit. DDoS attacks in general have been causing havoc in recent months, as criminals have tried to extort targets, threatening to knock businesses offline unless a ransom was paid. Encrypted email provider ProtonMail was criticised for paying a ransom of $6,000 in Bitcoin at the end of 2015 to a DDoS extortionist crew called the Armada Collective. That group targeted other secure email providers Hushmail, Runbox and VFEMail. Anti-DDoS provider Arbor Networks reported earlier this month that the record for DDoS power hit a new peak in 2015, hitting 500Gbps. Numerous organizations had reported attacks in the 400Gbps-500Gbps range throughout 2015, Arbor noted. With so much power, and such easy money to be made with extortion attacks, no business appears immune from DDoS downtime. Professor Alan Woodward, a security expert from the University of Surrey, said an attack capable of taking down an entity like HSBC would need to be big. “In addition we’re seeing the emergence of techniques that mean that these attacks are circumventing some of the systems put in place to mitigate agains these attacks,” Woodward said. He also warned DDoS has been used as a “smokescreen” for other malicious activity in the past. “They want to tie up the technical departments, of which there is obviously a finite number, so that they might miss some unusual activity that would give away the fact that the hackers are breaches the corporate boundary.” Source: http://www.forbes.com/sites/thomasbrewster/2016/01/29/hsbc-ddos-downtime/2/#4eea0f825126 http://www.forbes.com/sites/thomasbrewster/2016/01/29/hsbc-ddos-downtime/#109a8cc451c2

Taken from:
HSBC Calls In Cops To Chase DDoS Attackers Who Took Online Banking Down

Two Arrested in DDoS Attacks Linked to Online Gambling Site Extortion

Last month’s arrest in Bosnia and Herzegovena of two individuals connected to the cyber-crime group DD4BC have been definitely linked to a series of DDoS extortion attacks over the past 18 months, many of which were targeted at online-gambling firms.  PokerStars and Betfair are among the various companies to have been targeted by the extortionists, who typically sought modest and largely-anonymous payments made in Bitcoins in exchange for ceasing the attacks. The DD4BC group, an acronym for DDoS (Distributed Denial of Service attack) For BitCoins, is a loosely organized group of online hackers and thieves who have congregated in some of the Internet’s darker, more anonymous holes.  The group’s widespread members share information and online weaponry in their attempts to extract payments from their targets.  Failure to provide payoffs by the group’s targeted victims typically results in intermittent and ongoing DDoS attacks, designed to flood the victim’s servers with meaningless online traffic, making normal business impossible. The arrests of the two unidentified individuals was announced by Europol earlier this month, with one of the two individuals described as being a leader of the informal DD4BC group.  These initial arrests were part of an international operation dubbed Operation Pleaides. According to the Netherlands-based Europol, which is the official intelligence agency of the European Union, “The action was initiated as part of a global law enforcement response against the criminal organisation. Key members of the organised network were identified in Bosnia and Herzegovina by the UK Metropolitan Police Cyber Crime Unit (MPCCU) which provided vital information to the investigation. Police authorities from Australia, France, Japan, Romania, the USA, Switzerland and INTERPOL supported the coordinated activities. “Operation Pleiades resulted in the arrest of a main target and one more suspect detained,” the Europol statement added. “Multiple property searches were carried out and an extensive amount of evidence was seized,” indicating that more arrests of DD4BC members are likely in the coming weeks and months.  The actual “Operation Pleiades” action was initiated in Austria and included Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce. The operation slowly unwound the ghostly online tracks of the extortionists by examining “blockchain” entries for Bitcoin transactions related to the DDoS threats, plus other data linked to the group’s activities.  Bitcoin-based transactions are anonymous but not perfectly transparent, and can often be traced back to their originators using secondary means. The DD4BC attacks, which appear to have started in early 2014, have targeted several different business and government sectors.  Victims range from online gambling firms to Bitcoin exchanges and mining groups, to online banking and payment processors.  Even some government institutions have been targeted. Online-poker market leader PokerStars was confirmed as one the DD4BC extortion attempts in April 2015, amid information on the DD4BC attacks assembled by Arbor Networks, the security division of NetScout Systems, Inc.  Massachusetts-based NetScout appears to have assisted international authorities in identifying the perpetrators behind the hundreds of DD4BC attacks. In addition to PokerStars, Betfair is almost certainly another of the DD4BC group’s victims.  Betfair was also targeted last April in a DDoS attack strong enough to knock both its betting exchange and fixed-odds sportsbook offline.  The attack on the “unnamed online casino” (likely Betfair) began in earnest on April 10th, following an initial probing attack launched the day before, along with a demand for payment. The information amassed by Arbor Networks also includes many of the threats e-mailed by DD4BC members to their intended victims.  Here’s the e-mail that was sent to the “unnamed” casino company (likely Betfair), immediately following attacks against Stars and online payment processor NETeller: From: DD4BC Team [mailto:dd4bct@gmail.com] Sent: 10 April 2015 02:07 PM To Subject: Re: DDOS ATTACK! Hitting pokerstars.com at the moment. Good luck if you think you can stop what they can’t. But you still have time. On Thu, Apr 9, 2015 at 3:46 PM, DD4BC Team wrote: Hello, To introduce ourselves first: https://blogs.akamai.com/2014/12/dd4bc-anatomy-of-a-bitcoin-extortion-campaign.html http://bitcoinbountyhunter.com/bitalo.html http://cointelegraph.com/news/113499/notorious-hacker-group-involved-in-excoin-theft-owner-accusesccedk-of-withholding-info Or just google “DD4BC” and you will find more info. Recently, we were DDoS-ing Neteller. You probably know it already. So, it’s your turn! is going under attack unless you pay 20 Bitcoin. Pay to 18NeYaX6GCnibNkwyuGhGLuU2tYzbxvW7z Please note that it will not be easy to mitigate our attack, because our current UDP flood power is 400-500 Gbps, so don’t even bother. Right now we are running small demonstrative attack on your server. Don’t worry, it will stop in 1 hour. It’s just to prove that we are serious. We are aware that you probably don’t have 20 BTC at the moment, so we are giving you 48 hours to  get it and pay us. We do not know your exact location, so it’s hard to recommend any Bitcoin exchanger, so use Google. Current price of 1 BTC is about 250 USD. IMPORTANT: You don’t even have to reply. Just pay 20 BTC to 18NeYaX6GCnibNkwyuGhGLuU2tYzbxvW7z – we will know it’s you and you will never hear from us again. We say it because for big companies it’s usually the problem as they don’t want that there is proof that they cooperated. If you need to contact us, feel free to use some free email service. But if you ignore us, and don’t pay within 48 hours, long term attack will start, price to stop will go to 50 BTC and will keep increasing for every hour of attack. ONE MORE TIME: It’s a one-time payment. Pay and you will not hear from us ever again! Variations on the same extortion letter were sent to several other victims; this sample was distinct with the specific mentions of PokerStars and NETeller.  In addition to those two firms and the likely inclusion of Betfair, several other online-gambling companies are known to be targets of the group.  Those companies include Nitrogen Sports, Malta-based NRR Entertainment Ltd. (including slottyvegas.com and betatcasino.com), Betbtc.com, Redbet.com and others. It is also likely that last July’s DDoS attacks against several New Jersey (U.S.) online sites were the work of DD4BC extortionists.  Though those attacks are not referenced in the ASERT compilation, the July attacks are also outside the date range of most of the earlier attacks included in that report.  When the New Jersey attacks occurred, NJ Division of Gaming Enforcement director David Rebuck stated this about the perpetrator: “He’s a known actor. He’s done this before.” While DD4BC seems likely to be peeled open by international invetigators, DDoS-based extortion attempts aren’t going to go away.  The reason is that the tools needed to launch such attacks are too cheaply and commonly available to would-be cyber-attackers.  As a result, the best defense remain vigilance, rapid response… and robust Internet connectivity. According to Wil van Gemert, Europol’s Deputy Director of Operations, “Law enforcement and its partners have to act now to ensure that the cyberspace affecting nearly every part of our daily life is secure against new threats posed by malicious groups. These groups employ aggressive measures to silence the victims with the threat of public exposure and reputation damage. Without enhanced reporting mechanisms law enforcement is missing vital means to protect companies and users from recurring cyber-attacks. Police actions such as Operation Pleiades highlight the importance of incident reporting and information sharing between law enforcement agencies and the targets of DDoS and extortion attacks.” Source: http://www.flushdraw.net/news/misc/two-arrested-in-ddos-attacks-linked-to-online-gambling-site-extortion/

Excerpt from:
Two Arrested in DDoS Attacks Linked to Online Gambling Site Extortion

World’s Largest DDoS Attack Breaks Records, Clocks At Massive 500 Gbps

In its latest Worldwide Infrastructure Security Report, Arbor Networks reports on the biggest distributed denial of service attack, which had a whopping load of 500 Gbps. The previous largest DDoS attack was of “only” 300 Gbps. It involved young aspiring hacker Seth Nolan-Mcdonagh, who temporarily took down SpamHaus’ webpage. In some cases, the attacks are carried out by state-funded organizations instead of individuals. Last year, GitHub went down after it suffered a DDoS attack, and the main suspect was China, which has a tumultuous history with the software repository. The programming website was even blocked by the Chinese authorities for a short amount of time. The yearly Arbor survey uses data from hosts, mobile service providers and service providers. The survey, which ran until November 2015, got the results based on the 354 global participants who answered questions on network safety specifically about protocols used for reflection/amplification. “The largest attack reported by a respondent this year was 500Gbps, with other respondents reporting attacks of 450Gbps, 425Gbps, and 337Gbps,” the report states. This marks a worrying trend among top-end size DDoS attacks, which get more ambitious every year. The security firm has the numbers to back this statement up. In the previous report, Arbor discovered that one-fifth of respondents got slammed with attacks that topped 50 Gbps. This year’s survey shows a hefty increase, as a quarter of respondents talk of attacks that go more than 100 Gbps. While only five respondents found evidence of DDoS attacks topping 200 Gbps, there were many reports of attacks between 100 and 200 Gbps. Arbor Networks points out that cloud-based services are increasingly becoming tempting targets, as they now make up 33 percent of attacks. Another staple of last year’s hacking attempts is the exploitation of weaknesses in the network time protocol. Reflection and amplification attacks can easily make use of the soft spots in the security infrastructure, leading to significant damages. As a countermeasure, servers keep receiving updates and security patches that should (in theory) keep them safe from attackers who gain a large response to a small query and use it towards a target of their choosing. “[S]ecurity is a human endeavor and there are skilled adversaries on both sides,” Darren Anstee, chief security technologist at Arbor Networks, says. An interesting shift exists in the DDoS attackers’ motivation: the perpetrators no longer seem to find joy in hacktivism or vandalism. Unlike in previous years, extorting the victims and banking on the vulnerabilities of network systems now seem to be the prevalent reasons. In order to accomplish this, they use multi-vector simultaneous attacks which plow through applications, services and infrastructure. A vast majority of respondents identified application-layer DDoS attacks, which targeted DNS services instead of Web servers. Looking at the larger picture, multi-vector attacks counted for 56 percent of customer outages, up from 42 percent in the previous year. More than 50 percent of the respondents told Arbor that DDoS attacks go after the inline firewalls and bring down the internet connectivity. Arbor explains that these devices are the first to fall in case of a DDoS attack and underlines that being inline can greatly add to network latency. Source: http://www.techtimes.com/articles/128260/20160127/worlds-largest-ddos-attack-breaks-records-clocks-at-massive-500-gbps-worldwide-infrastructure-security-report.htm

View article:
World’s Largest DDoS Attack Breaks Records, Clocks At Massive 500 Gbps