Tag Archives: ddos news

Can we extinguish the Mirai threat?

The recent massive DDoS attack against DNS provider Dyn has jolted (some of) the general public and legislators, and has opened their eyes to the danger of insecure IoT devices. It is clear by now that it will take joint action by all stakeholders – users, manufacturers, the security industry, ISPs, law enforcement and legislators – to put an end to this particular problem, but it will take quite some time. Theoretical stopgap solutions In … More ?

View post:
Can we extinguish the Mirai threat?

Melbourne Cup is ‘top op for hacked camera DDoS extortionists’

Bet shops ready for old layer 3 stayers, less for IoT swoopers, says Akamai “The race that stops a nation” could also stop betting agencies if the regular barrage of timely distributed denial of service attack (DDoS) extortionists utilise insecure embedded devices, Akamai says.…

Boffin’s anti-worm bot could silence epic Mirai DDoS attack army

And break every computer crime law along the way A GitHub user going by Leo Linsky has forked a repo created by researcher Jerry Gamblin to create an anti-worm “nematode” that could help to patch vulnerable devices used in the massive Mirai distributed denial of service attack.…

See the article here:
Boffin’s anti-worm bot could silence epic Mirai DDoS attack army

How our household devices get hacked and join zombie bot networks in DDoS attacks

The Internet of Things: blessing or curse? That depends on how much you value your privacy against the ability of your fridge to order fresh milk. Either way, we are now more vulnerable to hackers. Here’s how. I won’t even attempt to answer the question in my opening gambit. Who can say for sure this early whether the Internet of Things is a blessing or a curse (aside from the fact that clichés are always a curse). For one this is something we all have to decide for ourselves – hopefully, after diligent public debate. We all have to decide what privacy is in the digital era, and whether it’s important to us. We may support more stringent data protection laws, even a global bill of rights. Or we may find ourselves in the “post-privacy” camp and not really care. It also depends on how highly we value our digital security. Unbeknownst to us Take the DDoS (distributed denial-of-service) attack that brought down a litany of popular websites last Friday (21.10.2016). The affected websites included Esty, Github, HBO Now, PayPal, Pinterest, Playstation Network, Recode, Reddit, Spotify, Twitter, Netflix, Yammer, and Yelp. Your fridge, your mom’s webcam, computers at the local school, and a kid’s doll may have all taken part – without your even knowing it. Someone, somewhere launched a piece of malware called Mirai. We’ve known about Mirai – so something was in the wind. And DDoS attacks themselves have been around for ages. Mirai searched for poorly-protected, networked devices. That is, household devices that had little or no password protection. Reports suggest these included DVRs and webcams made by a Chinese company called Hangzhou XiongMai, which has since issued a recall on its webcams in the US. Mirai turned the connected devices into its slaves. They then launched the DDoS attack on servers run by Dyn, a so-called DNS host, and home to all those websites. Usually, when you call up a website, your “request” goes via one of these servers. But when the servers are overloaded with bad requests consisting of incomplete data, or they are bombarded with more requests than they can handle, they basically freak out. And no one is served. That’s what happened on Friday. Your fridge, webcam, toy truck and thousands more emitted a coordinated attack of useless information, bringing down some of the world’s most popular websites. The rest is history… Friday’s Mirai attack may well be history now, but it’s one which will surely repeat itself. Many, many times. The question is, where will it all end? If it’s only Netflix and Spotify you can’t access, you may really not care. Certainly if they are back up and running within a few hours. But what if it’s a vital government website, online access to your local hospital, the police, or the energy grid… and what if the attack lasts for days, weeks even? This is what we mean when we talk about cybersecurity. Private, commercial concerns, even dating apps, shouldn’t come into it. And yet what we do – and allow – at a private level can have a momumental impact on society. We may think it’s just the fridge ordering our milk or Barbie chatting to our kids. But we forget that every electronic device these days – especially those connected to the network – is vulnerable to hackers. And the Mirai attack has reminded us they can all be reprogrammed to do whatever the hackers want. Source: http://www.dw.com/en/how-our-household-devices-get-hacked-and-join-zombie-bot-networks-in-ddos-attacks/a-36181744

More:
How our household devices get hacked and join zombie bot networks in DDoS attacks

Ontario literacy test abandoned due to DDoS attack

There’s no shortage of conspiracy theories when it comes to guessing who’s behind cyber attacks. So when it was announced that a distributed denial of service (DDoS) attack was behind last week’s crash of an Ontario online literacy test for about 190,000 high school students the list was long. –One of the thousands of computer-literate students who want to Get Back At the Education System? (No shortage of them…) –One of the tens of thousands of Ontario high school graduates who want to Get Back At the Education System (Some of whom are reading this right now …) –General mischief makers around the world (Really no shortage of them) –The usual suspects blamed for everything bad (Russia, China). OK, probably not Russia and China. But with DDoS-as-a-service available on the dark web (all you need is Tor and a credit card) and — here’s the tricky part — the right URL — it’s not hard to launch an attack anywhere on the planet. Who had that URL and how they got hold of it is the question. It may not have been that hard because last week’s test was preceded by earlier, smaller ones. What we do know for sure is that on Monday the provincial Education Quality and Accountability Office (EQAO) said the Oct. 20 province-wide trial of the online Ontario Secondary School Literacy Test (OSSLT) had to be terminated because of what it called an “intentional, malicious and sustained” DDoS attack. “An extremely large volume of traffic from a vast set of IP addresses around the globe was targeted at the network hosting the assessment application,” the office said in a statement. No personal or private student information was compromised, it added. According to a statement Thursday from the EQAQ, a third party hosted the application. “We planned for a variety of cyber incidents,” the statement said, “but we are unable to disclose the specifics of this information because of the need to protect our infrastructure’s security. What we can say, however, is that we did not anticipate a DDOS of this magnitude. A forensics firm is investigating. “We were shocked to learn that someone would deliberately interfere with the administration of the online OSSLT,” Richard Jones, the office’s director of assessment, said in a statement. “There will be discussions over the next few weeks to determine how to strengthen the system, and we will continue to work with Ontario’s education community to understand how best to use online assessments to benefit our province’s students.” —Richard Jones, Director, Assessment Last week’s exercise was was a voluntary trial to test the system’s readiness before the regularly scheduled administration of the OSSLT — either online or on paper — in March 2017. The office is determined to keep to that schedule. Source: http://www.itworldcanada.com/article/ontario-literacy-test-abandoned-due-to-ddos-attack/387852

Ubisoft’s Servers Have Been Down For Several Hours, Could Be DDoS

Since early this morning gamers have reported server issues when playing Ubisoft games across all platforms. Ubisoft Support has confirmed the problem, sharing that it is affecting all its services, including its digital shop and official website. Ubisoft has provided the following updates regarding the issue: [12:44PM EDT] We are still looking into this issue. We appreciate your understanding in the meantime.? [1:12PM EDT] Our shop and websites are also affected by this issue. We are still investigating further. Thank you for your patience thus far. Although for some of Ubisoft’s games this is a mere inconvenience, multiplayer-oriented games are currently unplayable. This has resulted in thousands of posts on Twitter directed at Ubisoft, requesting when the problem will be fixed. There is currently no ETA. It is unclear what the root cause of the issue is, although this type of problem usually happens due to DDoS. Source: http://www.gamerevolution.com/news/ubisofts-servers-have-been-down-for-several-hours-could-be-ddos-37913

Read the original post:
Ubisoft’s Servers Have Been Down For Several Hours, Could Be DDoS

73% of organisations across the globe have suffered a DDoS attack

A new report from analytics firm Neustar has brought to light the amount of companies around the world who have suffered a DDoS attack, and how they are working to mitigate them. Nearly three-quarters (73 percent) of organisations worldwide have suffered a DDoS attack and 76 percent are investing more in response to the threat of such attacks. For its new global report, Neustar studied 1,002 directors, managers, CISOs, CSOs, CTOs and other C-suite executives to discover how DDoS attacks are affecting them and what they’re doing to mitigate the threat. Respondents represent diverse industries such as technology (18 percent), finance (14 percent), retail (12 percent) and government (seven percent) in North America, EMEA, and Asia Pacific. In EMEA, 75 percent of organisations were attacked. Nearly half (48 percent) were attacked six or more time and 32 percent encountered malware after a DDoS attack. Almost a quarter (21 percent) of attacked organisations reported customer data theft and 70 percent of those specific respondents said they learned of the attack from outside sources, such as social media. Globally, 30 percent of organisations took less than an hour to detect a DDoS attacks. In EMEA, 37 percent of organisations took three or more hours to detect attacks. Despite only two percent of reported attacks exceeding 100+ GBPS, recent DDoS attacks have reached over 620 Gbps and up to almost 1 Tbps in attack size. Organisations are seeking to stay one step ahead of the game and protect against DDoS attacks. To prevent and protect against future attacks, organisations are using: Traditional firewall ISP based prevention (53 percent) Cloud service provider (47 percent) On-premise DDoS appliance and a DDoS mitigation service (36 percent) DDoS mitigation service (29 percent) DDoS mitigation appliance (27 percent) CDN (14 percent) WAF (13 percent) No DDoS protection is used in four percent of organisations. Nearly two-thirds (61 percent) have adopted and actively use IoT devices. In all, 82 percent of IoT adopters experienced an attack compared to just 58 percent of those who have not yet done so. Moreover, 43 percent of IoT adopters that were attacked are investing more than they did a year ago. In emailed commentary to SCMagazineUK .com, Paul McEvatt, senior cyber-threat intelligence manager, UK & Ireland at Fujitsu said, “This latest report revealing the different levels of DDoS attacks has really highlighted the issues with the security of Internet of Things devices, with 82 percent of IoT adopters having experienced an attack compared with just 58 percent of those who have not yet done so. When internet-connected devices are hacked, it again brings to the surface the security risks we face as technology touches every aspect of daily life. McEvatt added, “The issue is that businesses are failing to understand what is needed for a robust application of security from the outset, whether that’s for routers, smart devices or connected cars. Various attackers use online services to look for vulnerable IoT devices, making organisations an easy target for low-level cyber-criminals. The worrying reality is that security is often an afterthought and security fundamentals are still not being followed such as changing default passwords. Many of the cameras used in the recent DDoS attacks were shipped and left connected to the internet with weak credentials such as root/pass, root/admin or root/1111111, so it is little wonder these devices continue to be compromised.” Source: http://www.scmagazineuk.com/73-of-organisations-across-the-globe-have-suffered-a-ddos-attack/article/527211/

More:
73% of organisations across the globe have suffered a DDoS attack

Worry more about small app layer DDoS attacks than huge network blasts, says Canadian vendor

Massive distributed denial of service (DDoS) attacks have been grabbing headlines recently, with cyber security reporter Brian Krebbs being forced to temporarily take his site down after his service provider couldn’t handle a 620 Gbps attack, followed a few days later by a 1 Tbps attack on French hosting provider OVH. The incidents have some worried that DDoS attacks can now scale so high that current mitigation technology renders targeted organizations defenceless. Not so, says a Toronto security firm. In a report issued Tuesday DDoS Strike concludes CISOs worry too much about high volume network layer attacks and not enough about application layer attacks, which can take down a site with as little as 4.3 Gpbs of traffic. “Most organizations are only part way to understanding DDoS attacks and therefore having the capacity to defend against them with full effectiveness,” the report concludes. The report is based on an analysis of data gathered by DDoS Strike, which offers a service for testing enterprise infrastructures on their layer 3-7 denial of service mitigation techniques. DDoS Strike is a division of Security Compass, which makes application development security tools. What the company found after looking at its data from test attacks on 21 systems of Canadian and U.S.-based customers (some companies had more than one system) was that 95 per cent of targets tested suffered service degradation close to knocking a site offline — suggesting their DDoS mitigation efforts were useless. Of attacks at the application layer 75 per cent would have been successful. But, Sahba Kazerooni, vice-president DDoS Strike, said in an interview, network scrubbing techniques are largely effective. with service generally being denied only for a few hours until mitigation can either be tuned or turned on. More importantly, he added, is that application layer attacks are harder to defend, needing multiple tiers of defence, more expertise among IT staff trying to block them and fine controls. The result is more downtime for a successful app layer attack. “Our customers have a skewed way of looking at DdoS as a threat,” he said, “because they were being warned by the industry to worry about major ( network) attacks “and they’re forgetting about high level attacks on the app layer.” “We have this tendency to over-focus on technology when it comes to DDoS. We’re very quick to deploy on-site mitigation devices or to buy a scrubbing service. The piece that’s missing is to focus on the process and the training of staff to handle DDoS attacks.” Some of the customers tested brought their systems back from the brink in an average of 25 minutes, he said. (DDoS Strikes thinks that’s too long.) But of the successful test attacks his company carried out, over 70 per cent had some kind of process or people gap that resulted in longer than necessary downtime, he said. “A lot of companies can benefit not only from buying services and product but also training their employees,” Kazerooni concludes focusing more on their own processes with the goal of ultimately reducing downtime.” The report concludes that • businesses should stop thinking of DDoS attacks as crude acts of brute force, and start thinking of them as sophisticated, incisive attacks as complex as any other major hacking threat; • DDoS mitigation is incomplete out of the box, and can only be effective with proper DDoS simulation testing at all levels; • and DDoS mitigation should be viewed as a multifaceted strategy, involving people, process, and technology, rather than solely a technical fix. Source: http://www.itworldcanada.com/article/worry-more-about-small-app-layer-ddos-attacks-than-huge-network-blasts-says-canadian-vendor/386956

Link:
Worry more about small app layer DDoS attacks than huge network blasts, says Canadian vendor

Expect ‘Flood’ of DDoS Attacks After Source Code Release

The source code behind the massive distributed denial of service attack against security researcher Brian Krebs’s website has been released online. In a blog post over the weekend, Krebs wrote that the so-called Mirai source code’s release pretty much guarantees that “the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders, and other easily hackable devices.” Krebs knows all too well what Mirai is capable of. Last month, the “Internet of Things” botnet launched a “historically large” 620Gbps DDoS attack against his well-known and respected site KrebsOnSecurity, inundating it with so much spam traffic that DDoS protection provider Akamai dropped the site to protect other subscribers. The Mirai source code leak came to light on Friday via the Hackforums community, Krebs said. A user with the alias “anna-senpai” posted the code there for anyone to use, likely to avoid getting caught. “It’s an open question why anna-senpai released the source code for Mirai, but it’s unlikely to have been an altruistic gesture: Miscreants who develop malicious software often dump their source code publicly when law enforcement investigators and security firms start sniffing around a little too close to home,” Krebs wrote. “Publishing the code online for all to see and download ensures that the code’s original authors aren’t the only ones found possessing it if and when the authorities come knocking with search warrants.” The malware spreads by “continuously scanning the Internet for [vulnerable] IoT systems” that are using default or hard-coded usernames and passwords. Vulnerable devices are then turned into bots, which together can be used to launch DDoS attacks designed to send so much traffic to a website that it’s knocked offline. “My guess is that (if it’s not already happening) there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth,” Krebs wrote. “On the bright side, if that happens it may help to lessen the number of vulnerable systems.” Source: http://www.pcmag.com/news/348404/expect-flood-of-ddos-attacks-after-source-code-release

See the article here:
Expect ‘Flood’ of DDoS Attacks After Source Code Release

Newsweek Website Suffers DDoS Attack After Publishing Controversial Trump Report

Newsweek reported suffering a massive DDoS attack right after they published an exposé on how some of Donald Trump’s companies had violated the United States embargo on trading with Cuba. The attack was sufficient to prevent access to the article on Friday, September 30, but the attack subsided, and the report was available the following day. Kurt Eichenwald, the journalist that penned the piece, and Jim Impoco, Newsweek Editor-in-Chief, both categorized the incident as a cyber-attack. “The reason ppl couldnt read #TrumpInCuba piece late yesterday is that hackers launched a major attack on Newsweek after it was posted,” Eichenwald wrote on Twitter. “Last night we were on the receiving end of what our IT chief called a ‘massive’ DoS (denial of service) attack,” Impoco told fellow media outlet TalkingPointMemo (TPM) via email. Some websites that generate enough hype can suffer from huge traffic loads that overcome servers. Nevertheless, Newsweek is a reputable news portal that has the resources to deal with such traffic spikes. Impoco was very adamant that the incident was because of a coordinated DDoS attack, which he claims might have originated from Russia, but did not elaborate beyond explaining that the DDoS attack’s “main” IP address was from Russia. This explanation doesn’t make any technical sense since DDoS attacks don’t have “main” IP addresses. Source: http://news.softpedia.com/news/newsweek-website-suffers-ddos-attack-after-publishing-controversial-trump-report-508874.shtml

More:
Newsweek Website Suffers DDoS Attack After Publishing Controversial Trump Report