Tag Archives: web-development

Threat of the Week: Sept. 11 Quiet But DDoS On The Rise (Again)

September 11 came, it went and despite the FBI warning to credit unions to be ready for a bump in hostile activities on that anniversary date, multiple experts said they saw absolutely no traffic increase. But they also had worrisome news: There has been a sharp rise in low-grade Distributed Denial of Service (DDoS) attacks aimed at financial institutions, often in association with attempted fraud, but sometimes apparently simply an angry act by a rejected loan applicant or a terminated employee. First, the 9/11 news: “Nothing unusual happened on September 11. The reason there is nothing to report is that the volume is the same as the day before,” said Ashley Stephenson, CEO of Corero, a Hudson, Mass.-based DDoS mitigation firm. “Every day there are attacks.” Chris Novak of the Verizon Risk Team said likewise: “We saw no spike in activity on 9/11.” Rich Bolstridge, a DDoS expert with Cambridge, Mass-based network traffic firm Akamai, made it three: “We saw no increase in activity on September 11. We had expected to see activity. But it was very quiet.” The big DDoS guns fired by al Qassam and other actors usually said to be connected to nation states in the Middle East may not have been out on 9/11, but the bad news is the jump in low-grade attacks that may be small compared to the giant attacks unleashed by al Qassam are plenty large enough to knock an unprepared credit union off line and, said the experts, most credit unions remain unprepared to adequately deflect DDoS assaults of just about any magnitude. “We are surprised how naive CUs are about DDoS,” said Kirk Drake, CEO of Hagerstown, Md.-based CUSO Ongoing Operations. “They don’t realize how easy it has become for just about anyone to aim DDoS at a target.” That is the rub, Terrence Gareau, principal research scientist for DDoS mitigation firm Prolexic in Hollywood, Fla., explained: “There is a very low barrier to entry for DDoS. We are talking $5 that will buy you 600 seconds of DDoS.” That may only be 10 minutes, but the plunger who can come up with $50 could put a credit union down for an afternoon. A chilling factoid via a report from Santa Clara, Calif.-based NSFOCUS, a DDoS mitigation firm: “Based on traffic analysis, there are 1.29 DDoS attacks occurring worldwide every two minutes, on average.” The company added, “Most attacks are short and small. The report found that 93.2% of DDoS attacks were less than 30 minutes in duration and 80.1% did not surpass a traffic rate of 50 Mbps.” By contrast, the data throughput in al Qassam attacks has sometimes exceeded 45 Gbps, meaning it is vastly larger. Van Abernethy, an NSFOCUS spokesperson, elaborated, “The main news – the press focuses on the big DDoS – but the reality is that unreported DDoS goes on all the time. There are a lot of small attacks.” And then it gets worse still: “Small attacks are often accompanied by data exfiltration attempts, especially at financial institutions,” said Abernethy. Verizon’s Novak agreed: “We are seeing where DDoS is used to distract a medium-size financial institution. While they are busy fighting off the DDoS. they don’t see that terabytes of data just walked out the door. That’s scary.” A similar warning was issued a few weeks ago by respected Gartner analyst Avivah Litan who said she knew of three instances where DDoS was used to distract financial institution security as fraud was committed. She declined to offer specific details. At CUNA Mutual, risk expert Ken Otsuka said that in the past year one loss associated with a DDoS attack had been filed. He also offered no specifics. Add it up, however, and the situation is grim. DDoS as a service – available for hire by those with a grudge or with criminal intent – is increasingly available, it is cheap, and at least some providers happily accept Bitcoin, the virtual currency with some anonymity built in. Importantly, just about no technical skill is required, just a few dollars and a willingness to name a target. On the credit union front, the sense among experts is that the largest institutions – perhaps the top 25 or 50 – may have credible DDoS mitigation tools in place. As for the many thousands of others, the collective opinion is that probably most are unprotected. That could paint an attractive bull’s-eye for crooks. “There’s a trend where we see attacks going down market,” said Novak, “where the criminals are attacking smaller financial institutions because they don’t have the same defenses as the big banks.” Source: http://www.cutimes.com/2013/09/13/threat-of-the-week-sept-11-quiet-but-ddos-on-the-r

Read the article:
Threat of the Week: Sept. 11 Quiet But DDoS On The Rise (Again)

Countering Attacks Hiding In Denial-Of-Service Smokescreens

Denial-of-service attacks have long been considered the blunt wooden club of online hazards, a multi-gigabit stream of shock and awe. Yet, increasingly the noisy attacks are being used to hide more subtle infiltrations of a target’s network. A number of financial institutions, for example, have been targeted by distributed denial-of-service (DDoS) attacks immediately following a wire transfer, according to security firms familiar with the cases. The attacks, generated by computers infected with the DirtJumper DDoS malware, attempt to disrupt any response to the fraudulent transfer of funds, which are usually in the six-figure dollar range, according to a report by Dell Secureworks published in April. “The analogy is signal jamming,” says Kevin Houle, director of threat intelligence for managed security provider Dell Secureworks. “To the extent that you can use the DDoS attack to do cause chaos electronically, to prevent access to particular systems during an attack, the tactic has proven successful.” While DirtJumper has focused on causing chaos immediately following money transfers, the technique could be generalized to other attack scenarios. A variation of the attack has been used by Iranian hacktivists groups to disrupt the online operations of U.S. financial institutions by hiding more subtle application-layer attacks within larger packet floods. And South Korean companies were flooded with data while malware deleted information on organizations’ servers. “Your goal is to sow confusion,” says Vann Abernethy, a senior product manager at NSFOCUS, a DDoS mitigation firm. “A DDoS attack is designed to get your IT department to run around like their hair is on fire.” In addition, noisy DDoS attacks could attract more attackers, says Terrence Gareau, principal security architect for Prolexic, a DDoS mitigation firm. A very public attack could convince other groups to attempt their own operations in the chaos, he says. “If it’s a very public attack, then there is a high probability that other opportunistic attackers could take part as well,” Gareau says. “Opportunistic criminals will say, wow they are under a DDoS attack, so lets look at the network and see what changes have been made.” Companies need to structure their response group to handle a large infrastructure attack, but not be blinded by the influx of alerts to their system. Like magicians, the goal of the attackers is to force the security staff to only pay attention to a distraction to keep them from discovering the actual trick. “You almost have to have a team that deals with the infrastructure attack, and a separate group that goes into hyper-vigilance to find any other attacks coming in,” says NSFOCUS’s Abernethy. A third-party provider, who can use intelligence from attacks on other customers to more quickly identify new attacks, can help eliminate much of the inbound attack traffic, dialing down the volume of alerts that the security team has to process. The level of alerts seen by a security team during a denial-of-service attacks can increase by an order of magnitude. Filtering them out at the edge of the Internet can greatly reduce the impact on a business’s network and employees. “If you don’t have to have all those alerts on your network, you can pay attention to what matters,” Prolexic’s Gareau says. “Using a third part mitigation provider can significantly reduce the noise.” Yet, attacks that use a variety of traffic and techniques in a short time period can cause problems for denial-of-service mitigation firms, says Lance James, head of intelligence for Vigilance, a threat information firm that is now part of Deloitte. “They are not perfect,” James says. “We still see major banks going down. But they do well against long period term DDoS attacks.” While DirtJumper, also known as Drive, is not the only botnet that is used for combined attacks, it a popular one. DirtJumper has a half dozen ways of attacking infrastructure, including flooding Web sites with GET requests and POST requests, targeting infrastructure with two types of IP floods, and using UDP packets to slow down networks. Source: http://www.darkreading.com/threat-intelligence/countering-attacks-hiding-in-denial-of-s/240161237

Continued here:
Countering Attacks Hiding In Denial-Of-Service Smokescreens

9/11 DDoS Alert for Banks, Agencies

U.S. and Israeli government agencies and banking institutions should be on alert for a potential Sept. 11 wave of distributed-denial-of-service attacks launched by the same groups behind the unsuccessful Operation USA and Operation Israel attacks in May. That warning comes from cybersecurity experts and alerts issued by the Federal Bureau of Investigation and the Financial Services Information Sharing and Analysis Center. While OpUSA and OpIsrael, which were designed to take down websites operated by globally recognized brands and governmental agencies, were not successful, cybersecurity experts say the threat this time is genuine. The groups behind these attacks are now more organized, better equipped and trained, and more determined than they were the first time around, they say. The FBI, however, notes that the attacks are not expected to have a serious or significant impact. “It is thought that due to the fact that hackers will be relying on commercial tools to exploit known vulnerabilities, and not developing custom tools or exploits, that the skill levels are, at best rudimentary, and capable of causing only temporary disruptions of any of the targeted organizations,” the FBI alert states. Attack Alerts On Aug. 5, the FS-ISAC issued a warning to its membership about a new wave of DDoS attacks that could target U.S. banks. David Floreen, senior vice president of the Massachusetts Bankers Association , says the FBI, which issued a separate alert on Aug. 30, and the FS-ISAC asked banking associations to spread the word about the possibility of attacks. “The attacks are expected to occur in two phases,” notes the FBI alert. “Phase I will take place over a period of 10 days and target several commercial and government sites with DDoS attacks. … “Phase II is scheduled to take place on September 11, with a more widespread attack threatened, along with Web defacements.” The FBI recommends organizations: Implement data backup and recovery plans; Outline DDoS mitigation strategies; Scan and monitor e-mail attachments for malicious links or code; and Mirror and maintain images of critical systems files The FBI did not release its alert to the public, an FBI spokeswoman acknowledges. But in an effort to get the word out, the Massachusetts Bankers Association posted the FBI and FS-ISAC warnings on its site, Floreen says. The FS-ISAC alert names top-tier banks that are likely to be targeted during an upcoming attack. The list of potential attack targets includes the same 133 U.S. banking institutions named in the April 24 Anonymous post that appeared on Pastebin during the first OpUSA campaign, says financial fraud expert Al Pascual, an analyst with consultancy Javelin Strategy & Research. The FS-ISAC alert does not reference OpIsrael, but experts say OpUSA and OpIsrael are connected. Planning Attacks Gary Warner, a cyberthreat researcher at the University of Alabama at Birmingham who also works for the anti- phishing and anti- malware firm Malcovery, claims the hacktivist groups’ main focus, for now, is Israel. If attacks against Israeli targets are successful, then U.S. targets will be next, he warns. Since June, two hacktivist groups, AnonGhost and Mauritanian Attacker, have been building plans for OpIsrael Reborn, according to Warner’s research. So far, these groups have not been linked to new attacks planned for a sequel to OpUSA, Warner says. Both groups, however, were involved in OpIsrael and OpUSA, he notes. “As part of our process of watching the phishers who create counterfeit bank websites, we track where many of those criminals hang out and what sorts of things they are discussing,” he says. “We became aware of OpIsrael Reborn while reviewing posts made by criminals who have been phishing U.S. banks and Internet companies.” Announcements for the new campaign began Sept. 2. But more posts were added on Facebook and in underground forums within the last week to recruit additional attackers, he says. “AnonGhost and Mauritanian Attacker have taken the time to build a strong coalition of hackers,” Warner says. “In that June release, there were no dates, no members and no targets announced.” Since that time, attackers have honed their targets, and they claim to have already compromised several government and banking sites in Israel, he says. On Sept. 11, they plan to publish information they’ve compromised from during those attacks, Warner adds. “They claim [on YouTube ] they are going to begin publishing the internal government documents of Israel,” he says. “The video also makes reference to the recent FBI claim that they have dismantled Anonymous.” Attackers are uniting this time out of anger over those claims made by the FBI as well as recent attacks waged against Islamic businesses believed to be backed by an Israeli hacktivist group, Warner explains. So why is this wave of attacks being taken more seriously than the first OpIsrael? The sheer number of attackers, their tools and the way the hacktivist groups have been building momentum through social networking sites such as Facebook has raised serious concern, Warner says. “They’ve been gathering tools since June 9, and training attackers on how do SQL and DDoS attacks,” he says. “It’s a SANS-quality training for hackers, and they’re prepping for wiping Israel off the [online] map.” On Sept. 9, two Israeli government websites were successfully taken offline for a period of time, Warner adds. “We did not see that success in OpIsrael or OpUSA,” he says. “If they pull this thing off against Israel, they will keep hitting others,” he says. No Attack Link to Al-Qassam Experts, including Warner, say Izz ad-Din al-Qassam Cyber Fighters , the self-proclaimed hacktivist group that’s been targeting U.S. banks since September 2012, does not appear to be involved in these most recent campaigns. And although U.S. banking institutions have built up strong online defenses over the last year to mitigate cyber-threats such as DDoS attacks, other sectors are far less prepared, Javelin’s Pascual says. “The lack of success that Izz ad-Din al-Qassam achieved during the fourth round of DDoS attacks was indicative of how well fortified U.S. banks have become,” Pascual says. But Rodney Joffe , senior technologist at DDoS-mitigation provider Neustar, says security professionals should be concerned that other attackers have learned lessons from al-Qassam’s strikes. “I don’t believe there is any connection between OpUSA and AQCF [al-Qassam Cyber Fighters],” he says. “However, the reason I think it is more worrying this time is because, as I have said over and over, the underground learned a lot of groundbreaking lessons from AQCF. … And this time around, they may be more successful.” Source: http://www.bankinfosecurity.com/911-ddos-alert-for-banks-agencies-a-6054

See the article here:
9/11 DDoS Alert for Banks, Agencies

SatoshiDice hit by DDoS attack, but bets continue

Bitcoin gambling site SatoshiDice has recovered after being felled for several days by a DDoS attack. The site went down several days ago, and was inaccessible from the Internet. Erik Voorhees, who created the site and sold it for $11.5 million in July, no longer runs the site, but naturally still has insights into how it operates. DDoS attacks happen a lot to bitcoin gambling sites, he said. “They largely wasted their money,” he said of the attackers, pointing out that the website isn’t needed for the placing of bets. It simply provides information about bet statistics, and bitcoin addresses to send to. These addresses are constant, available outside of the main site, and can easily be retained by regular gamblers even when the site goes down, meaning that bets can still be processed. “They’d have to launch an attack against the whole bitcoin network,” Voorhees said. There is a back-end computer processing the bets, but this isn’t the same computer that hosts the website. Attackers could potentially disrupt betting if they were able to find that machine, but Voorhees points out that it could easily be moved. The attack didn’t seem to affect the site’s popularity in the long term. SatoshiDice vanity addresses made up eight of the most popular bitcoin addresses used on the network overnight. Source: http://www.coindesk.com/satoshidice-hit-by-ddos-attack-but-bets-continue/

Visit site:
SatoshiDice hit by DDoS attack, but bets continue

Major DDoS attacks .cn domain; disrupts Internet in China

China’s Internet was hit with a major distributed denial of service (DDoS) attack Sunday morning that briefly disrupted and slowed access to sites in the .cn domain. The DDoS attack was the largest in history against the domain servers for China’s .cn ccTLD (country code top level domain), according to the China Internet Network Information Center (CNNIC), which administers the domain. The first attack started Sunday around midnight Beijing time, and was then succeeded by a larger attack at 4 a.m, the CNNIC said in an Internet posting. A number of sites were affected, but Internet service to the sites had been gradually restored by 10 a.m. Sunday It’s unclear where the attack originated from or if it was still continuing. A CNNIC spokeswoman said on Monday it would update the public once more information was gathered. Chinese regulators have already launched unspecified measures to protect the domain system, while CNNIC has apologized for the disruption. China has often been accused of launching DDoS attacks. In this year’s first quarter, it was the top source country for DDoS attacks, according to security vendor Prolexic. The U.S. was ranked second. DDoS attacks can commonly work by deploying armies of hacked computers to send traffic to a website, saturating it with data so that it becomes inaccessible to normal users.A China, however, has said its facing a surge of Trojan and botnet attacks against the country. Many of those attacks are coming from the U.S., South Korea and Germany. China has also denied the country sponsors hacking, despite claims brought by U.S. officials and security vendor Mandiant that its government actively conducts cyber-espionage. Source: http://www.computerworld.com/s/article/9241899/Major_DDoS_attacks_.cn_domain_disrupts_Internet_in_China

Cybercrooks use DDoS attacks to mask theft of banks’ millions

Distributed denial of service attacks have been used to divert security personnel attention while millions of dollars were stolen from banks, according to a security researcher. At least three US banks in recent months have been plundered by fraudulent wire transfers while hackers deployed “low powered” DDoS attacks to mask their theft, Avivah Litan, an analyst at research firm Gartner, told SCMagazine.com. She declined to name the institutions affected but said the attacks appeared unrelated to the wave of DDoS attacks last winter and spring that took down Web sites belonging to JP Morgan , Wells Fargo, Bank of America, Chase, Citigroup, HSBC, and others. “It wasn’t the politically motivated groups,” she said. “It was a stealth, low-powered DDoS attack, meaning it wasn’t something that knocked their website down for hours.” Litan described the attack method in a blog post last week that warned banks’ losses could have been much greater. “Once the DDoS is underway, this attack involves takeover of the payment switch (eg, wire application) itself via a privileged user account that has access to it,” she wrote. “Now, instead of having to get into one customer account at a time, the criminals can simply control the master payment switch and move as much money from as many accounts as they can get away with until their actions are noticed.” Litan, an expert in financial fraud and banking security, did not describe how attackers gained access to the wire payment switch at banks, but she offered banks advice on how they might better protect themselves. “One rule that banks should institute is to slow down the money transfer system while under a DDoS attack,” she wrote. “More generally, a layered fraud prevention and security approach is warranted.” Security researchers have previously highlighted the growing trend of using DDoS attacks to hide fraudulent activity at banks. The Dell SecureWorks Counter Threat Unit issued a report (PDF) in April to warn that a popular DDoS toolkit called Dirt Jumper was being used to divert bank employees’ attention from attempted fraudulent wire transfers of up to $2.1 million. In a joint statement (PDF) issued last September with the Financial Services Information Sharing and Analysis Center and the Internet Crime Complaint Center, the FBI warned that the $200 Dirt Jumper toolkit was being used as a smokescreen to cover fraudulent wire transfers conducted with pilfered employee credentials. “In some of the incidents, before and after unauthorized transactions occurred, the bank or credit union suffered a distributed denial of service (DDoS) attack against their public Website(s) and/or Internet Banking URL,” the report said. “The DDoS attacks were likely used as a distraction for bank personnel to prevent them from immediately identifying a fraudulent transaction, which in most cases is necessary to stop the wire transfer.” Source: http://news.cnet.com/8301-1009_3-57599646-83/cybercrooks-use-ddos-attacks-to-mask-theft-of-banks-millions/

Read the article:
Cybercrooks use DDoS attacks to mask theft of banks’ millions

DDoS Attacks Strike Three Banks

Izz ad-Din al-Qassam Cyber Fighters’ so-called Phase 4 of distributed-denial-of-service attacks against major U.S. banks hasn’t stalled, it’s just been ineffective at disrupting online availability, security experts say The latest attacks have been sporadic and seemingly less targeted. U.S. banking institutions, which have been under attack since September 2012, have adapted their defenses, making their online-banking sites hard to take down, experts say. But Brobot , the botnet used by al-Qassam Cyber Fighters, is still active; it targeted banking institutions as recently as last week, says John LaCour, CEO of cybersecurity and intelligence firm PhishLabs. “PhishLabs can confirm that we detected QCF [Qassam Cyber Fighters] related DDoS attacks on Wednesday [Aug. 14] and Thursday [Aug. 15],” LaCour says. “Three large banks were attacked that we have seen targeted previously.” LaCour would not name the banks that were hit. He did say, however, attacks last week were linked to Brobot, and that Brobot still appears to be controlled by al-Qassam. Experts say they don’t feel Brobot has been leased out for hire, and that al-Qassam is still the group using the botnet against banks. Disruptions at 2 Banks JPMorgan Chase and Citigroup suffered intermittent online disruptions last week, according to Fox Business . Neither one of those banking institutions responded to Information Security Media Group’s request for comment. But according to tweets posted last week, Chase and Citi both acknowledged suffering site issues Aug. 15. “We’re experiencing issues with our website and Chase mobile,” Chase tweeted. “We apologize for the inconvenience. Please stay tuned for updates.” In its tweet, Citi said: “We are aware of system issues at this time. We are working to get the issue resolved.” Keynote, an online and mobile cloud testing and traffic monitoring provider, confirms both banks’ online banking sites did experience intermittent issues Aug. 15. But the cause of those online interruptions is not known, says Keynote’s Aaron Rudger. “The Chase banking website appears to have been unavailable from 8:55 a.m. ET until 10:21 a.m. ET,” he says. “Our monitoring agents reported DNS [Domain Naming System] lookup errors throughout that period, across the U.S.” DNS is the system that translates a website’s name, such as www.chase.com, into an Internet protocol address that’s assigned to a Web server for that site, Rudger explains. “Our monitoring agents did observe only a very small number of errors trying to download the Citibank homepage, starting at 12:52 p.m. ET,” he adds. “But that only lasted until 1:09 p.m. ET.” But other experts who asked to remain anonymous say the outage at Citi was not linked to Brobot; it was an internal technical issue. What’s Next for Brobot? Because attacks against banks are increasingly ineffective, some question what’s next for Brobot. Rodney Joffe, senior technologist at DDoS-mitigation provider Neustar, believes the attacks against banks are nearing an end. What’s next is anyone’s guess, he adds. But Joffe and others have suggested Brobot will likely soon be used to target other industries, especially those impacting critical infrastructure. The attackers will take aim at other targets to avoid admitting their campaign has been a failure, some suggest. “We’ll start to see disruptions that cause a little more fear in the U.S. public,” Joffe says. “We have heard about the compromise of water systems in small towns. I wouldn’t be surprised if we really start to see attacks like that.” Source: http://www.bankinfosecurity.com/ddos-attacks-strike-three-banks-a-6006

Continued here:
DDoS Attacks Strike Three Banks

DOSarrest begins Offering Vulnerability Testing and Optimization

VANCOUVER, BRITISH COLUMBIA–(Marketwired – Aug. 14, 2013) – DOSarrest Internet Security announced today that it will begin offering a website Vulnerability Testing and Optimization ( VTO ) service. The services is a comprehensive test that will intelligently crawl a website and find any vulnerabilities in the site’s coding, as well as analyze the structure of the website to see what can be optimized for better performance, all for a safer and better web experience for your visitors. The Vulnerability portion of the scan is able to analyze web code while it is being executed, even for a very large site with dynamic pages, and test with the most advanced SQL Injection and Cross Site Scripting (XSS) analyzers. A report is provided at the end that details all identified security breaches and the line of code that is the culprit as well as how to fix it. A secondary Optimization scan is executed again on all pages within a website, applying best practice rule sets which identify what elements and design structure can be optimized, and how to do it. A DOSarrest security specialist will walk the customer through the report and retest if necessary. “Our customers have come to greatly appreciate our efforts, to not only protect them from DDoS attacks, but to also assist their IT operations in securing their web servers in house “, says Jag Bains, CTO of DOSarrest. Bains, goes on to state “We’re able to leverage our experience and expertise to provide our customers a framework for securing their operations. With web application hacking on the rise, the VTO service is taking our customer partnerships to another level.” More information on this service can be found at: http://www.dosarrest.com/en/vulnerability-testing.html . About DOSarrest Internet Security: DOSarrest founded in 2007 in Vancouver, BC, Canada is one of only a couple of companies worldwide to specialize in only cloud based DDoS protection services. Their global client base includes mission critical ecommerce websites in a wide range of business segments including financial, health, media, education and government. Their innovative systems, software and exceptional service has been leading edge for over 6 years now.

More here:
DOSarrest begins Offering Vulnerability Testing and Optimization

UCAS under DDoS attack

Ucas has been the victim of a hacking attempt, when its website was the target of a denial of service attack. The site was unavailable late on 14 August, the day before thousands of A-level students were due to receive their results across the country. A spokesperson for Ucas said: “The UCAS website suffered a sustained, criminal ‘denial of service’ attack. The site was down for an hour and then restored fully. No personal information was compromised. Confirmation and Clearing went ahead as normal. The attack originated in the Asia Pacific region and the police have been informed.” The chief executive of Ucas, Mary Curnock Cook, speaking to the Huffington Post, said staff were ‘pretty upset’ at the attempt. “The incident was contained very, very quickly and no personal data was released to anybody.” As of yesterday evening, over one million students had logged into Track. Ucas placed nearly double the number of students through clearing this year, in comparison with numbers from last year. 7,970 students had found a place through clearing, compared with 4,180 last year. The attempt to wreck the system was stopped, thanks to new technology that Ucas have installed in their software. Cumock Cook said: “This year we have made a step-change in our technology arrangements and most of our critical services are deployed in the cloud, which gives us massive resilience.” Source: http://www.independent.co.uk/student/news/ucas-hacked-ahead-of-alevel-results-8770993.html

Link:
UCAS under DDoS attack

Police nab alleged DDoS extortion gang at Heathrow Airport

Two Polish men were arrested at Heathrow Airport earlier this week in connection with an alleged DDoS extortion attack on a Manchester-based business, news sources have reported. Details are light but it is known that a website connected to the business was brought down during the attack, which happened at an unspecified time before the 7 August arrests. “This investigation centres on an allegation that the on-line company was blackmailed,” said Detective Inspector Chris Mossop, of Greater Manchester Police’s Serious Crime Division “As part of this blackmail attempt, one of the company’s websites was made temporarily unavailable by the offenders,” he added. “Denial of service attacks have become increasingly common offences in recent years and can have a devastating effect on the victim’s on-line business or presence.” The investigation continued in several countries, including the UK, the US and Poland, police said. Although such cases rarely come to light, cyber-extortion has flourished in the last decade. In almost every case, DDoS is the weapon of choice. These days, small and medium-size businesses are the usual target because they are far less likely to have DDoS mitigation in place to defend themselves. The other less common technique involves attackers stealing data and threatening to release it unless a ransom is paid. An example of this type of attack came to light last year when a Belgian bank was blackmailed by hackers. Last December, hackers tried to extort $4,000 AUS (£2,600) from a medical centre in Australia after breaching its network and encrypting its customer database. A recent survey suggested that one in five UK businesses had been affected by DDoS attacks during 2012. Source: http://news.techworld.com/security/3463285/police-nab-alleged-ddos-extortion-gang-at-heathrow-airport/

Read the article:
Police nab alleged DDoS extortion gang at Heathrow Airport