Drupal Patches Denial of Service Vulnerability

Details on a patched denial of service vulnerability in the open source Drupal content management system have been disclosed. The vulnerability, patched yesterday, could be abused to crash a website running on the CMS. Researchers Michael Cullum, Javier Nieto and Andres Rojas Guerrero reported the bug to Drupal and urge site owners and Drupal admins to upgrade Drupal 6.x to Drupal core 6.34 or 7.x to Drupal core 7.34. The vulnerability exposes user names in addition to threatening the availability of a Drupal site. The researchers said they were able to guess a valid Drupal user name by exploiting the bug by entering an overly long password; they give an example of a million-character password. They explain that Drupal only calculates a password hash for valid user names; by measuring the time it takes to get a response from the system with a long password, they can infer that the user name they tried is valid. “In Drupal, the way of calculating the password hash (SHA512 with a salt) by using phpass results in the CPU and memory resources being affected when really long passwords are provided,” the researchers wrote. “If we perform several log-in attempts by using a valid username at the same time with long passwords, that causes a denial of service in the server.” Depending on the server configuration—in this case Drupal 7.32 running on Apache with a MySQL default installation—the attack crashes the entire server. The researchers said this happens because the RAM and CPU limits are reached. It can also crash the database, they said. “If the Apache configuration is optimized and tuned to the hardware resources, we are able to reach all sessions available quickly and handle them for 30 seconds which performs a DOS without crashing the server or database,” the researchers said, adding that 30 seconds is the longest a script can run before it is terminated by a parser. “This helps prevent poorly written scripts from tying up the server.” The researchers said they will publish a proof of concept attack at a later time. This vulnerability was rated moderately critical by Drupal, unlike a much more serious SQL injection flaw that became public on Oct. 15. The flaw was found in a Drupal module designed to defend against SQL injection attacks. Attackers quickly wrote automated exploits targeting the vulnerability; the attacks worked without the need for a Drupal account and left no trace. Drupal quickly released an advisory urging site admins to proceed as if every Drupal 7 site that was not patched within hours of the announcement were compromised. “Attackers may have created access points for themselves (sometimes called ‘backdoors’) in the database, code, files directory and other locations. Attackers could compromise other services on the server or escalate their access. Removing a compromised website’s backdoors is difficult because it is not possible to be certain all backdoors have been found,” Drupal said in a statement. The patch was made available on Oct. 15; the vulnerability was found in a database abstraction API that sanitized queries to prevent SQL injection. Source: http://threatpost.com/drupal-patches-denial-of-service-vulnerability-details-disclosed/109502

Original post:
Drupal Patches Denial of Service Vulnerability

Sophisticated Android-based botnet a danger to enterprise networks

A new, more sophisticated and more stealthy version of the NotCompatible Android Trojan continues to strengthen one of the most long-lived and advanced mobile botnets ever to exist (since mid-2012). …

View article:
Sophisticated Android-based botnet a danger to enterprise networks

2015 DDoS attacks to come from Vietnam, India and Indonesia

Vietnam, India and Indonesia might not have the most advanced Internet infrastructure, but they do have a large number of insecure smartphones coming online, making them the big botnet sources for next year’s distributed denial of service attacks, according to a report released today by Black Lotus Communications, a DDOS mitigation vendor. “They have a lot of young people just getting their smartphones, specifically Android smartphones,” said Frank Ip, the company’s vice president of business development. These new users are more susceptible to phishing, and are less aware of how to secure their devices, he added. “We’ve been seeing that trend in the last two quarters,” he said. A single smartphone is already a powerful computing device, he said, and when combined with wireless networks in extremely large numbers, they can add up to a significant threat. In 2014, however, China was the single biggest source of DDOS attacks, the report said, followed by the United States and Russia. Again, the reason China was in the lead because of the available number of potentially vulnerable devices. “It’s nothing about a particular nation state,” Ip said. “And it doesn’t mean that the attack initiator is in China. It could be carried out by somebody anywhere in the world.” China has bandwidth, he said, and, as a developing nation, many people are going to Internet Cafes to surf the web. “Because of a lack of controls, a lot of those are using illegal copies of Microsoft, and there are a lot of infections from malware,” he said. “It’s a very popular place to do a botnet.” The motives for the attacks are straightforward — money. “We don’t see a lot of vandalism, or political attacks,” said Ip. “The majority of attacks are financially motivated, like extortion.” Criminals start out with a small attack against a company, and send a ransom note to the IT department. Most people know better than to pay, but a few do, especially because the amounts are usually low. At first. “If you start paying them once, they’ll come back to you against because they know you’re an easy target,” Ip said. However, if the hackers know that a company is prepared to deal with the attacks, they’ll move on to other targets. Black Lotus dealt with more than a million separate DDOS attacks so far this year, Ip said. However, the bulk of them took place early this year — nearly half a million in the first quarter, more than quarter million in the second quarter, and just above 200,000 in the third quarter. Some of that is due to hackers learning that the particular companies that RedSeal works with are defended, and moving to more vulnerable targets. In addition, the security community publishes botnet information and networks get more effective at shutting down or blocking the botnets. There is also a seasonal factor to DDOS attacks, Ip said, so the downward trajectory might not continue for the fourth quarter. “It’s the high season for shopping,” he said. “That triggers more of the attacks.” The report also showed a change in the style of attack, with the average attack bit volume increasing, while the average attack package volume decreasing. This shows that attackers are moving away from simple attacks based on large numbers of messages to more complex attacks using multiple vectors. This includes “both application layer attacks and SYN flood attacks blended together,” the report said. During the first quarter of the year, there were NTP DrDoS attacks of record-breaking bit volumes, but, over time, attackers could no longer find as many vulnerable NTP daemons with which to amplify their attacks. A DrDos attack, or distributed denial-of-service, is one where requests are sent to computers that will reply to those requests — except that the return address is spoofed, and instead of replying to the attacker, the replies are sent to the target. Source: http://www.csoonline.com/article/2849230/business-continuity/next-years-ddos-attacks-to-come-from-vietnam-india-and-indonesia.html

Read More:
2015 DDoS attacks to come from Vietnam, India and Indonesia

DDoS attacks continue to fall in size and frequency

The newest up-and-coming countries of origin for DDoS attacks will be Vietnam, India and Indonesia in 2015, according to Black Lotus. While these countries don’t have the necessary bandwidth to lau…

View article:
DDoS attacks continue to fall in size and frequency

Asian mobiles the DDOS threat of 2015, security mob says

Beware traffic from hacked Vietnam, India and Indonesia fondleslabs Vietnam, India and Indonesia will be the distributed denial of service volcanoes of next year due to the profieration of pwned mobiles, according to DDoS security bod Shawn Marck.…

More here:
Asian mobiles the DDOS threat of 2015, security mob says

Fasthosts outage blamed on DDoS attack

Fasthosts’ five-hour collapse today has been blamed on a Distributed Denial of Service attack and a security flaw spotted on its Windows 2003 shared web server kit. The company explained the torrid morning it had suffered in an emailed statement to The Register . Earlier today, after we reported that Fasthosts had gone titsup, Reg reader x2uk suggested that the firm had been targeted by hackers. “Some of our customers’ domains seem to have been shifted onto their DNS overnight which may mean something nefarious is afoot,” he told us. Fasthosts finally responded to our questions just as it was telling its biz customers on Twitter that the service was coming back to life. It said: As a result of a denial-of-service attack, Fasthosts shared hosting customers experienced a loss of DNS performance, and as a result, periods of website downtime. In accordance with its procedures, Fasthosts acted swiftly to resolve the root cause, and has now implemented measures to return the majority of its hosting customers back to full performance. We apologise for any disruption incurred by our customers this morning as a result of this issue. If any customer has outstanding issues, we ask that they contact our technical support team who will assist them. Incredibly, the company’s strife didn’t end there: it has also been battling a serious security hole in its Microsoft servers. Fasthosts said: As a result of our routine and extensive security monitoring, Fasthosts today identified a vulnerability specific to part of its Windows 2003 shared web server platform. The small affected proportion of our large hosting platform was immediately isolated, and work is being undertaken to investigate and fix the issue as swiftly as possible. As a precautionary measure, some shared hosting servers on this specific platform have been taken offline, resulting in a small proportion of our hosting customers experiencing downtime. All efforts are being focused on returning this platform to service. Fasthosts added that “the security of our customer data remains of paramount importance to us.” It claimed to have “excellent levels of security monitoring, systems and resources to keep our customers’ data safe from threats.” However, the company made no mention of compensation for businesses affected by Monday morning’s outage. “We apologise unreservedly for the inconvenience caused to those customers affected today, and we remain committed to providing the highest possible standards of service,” Fasthosts said. Source: http://www.theregister.co.uk/2014/11/17/fasthosts_outage_blamed_on_ddos_hack_attack_and_windows_2003_vuln/

Follow this link:
Fasthosts outage blamed on DDoS attack

Holy cow! Fasthosts outage blamed on DDoS hack attack AND Windows 2003 vuln

Monday, bloody Monday Fasthosts’ five-hour collapse today has been blamed on a Distributed Denial of Service attack and a security flaw spotted on its Windows 2003 shared web server kit.…

More:
Holy cow! Fasthosts outage blamed on DDoS hack attack AND Windows 2003 vuln

#OpKKK: Anonymous launches DDoS attacks on KKK websites

Anonymous claims it has taken down several Ku Klux Klan websites and Twitter accounts as part of what internet hacktivists describe as a “cyber war”, inspired by KKK threats of using “lethal force” against Ferguson protesters. Anonymous listed the KKK websites it put offline Sunday night on its Twitter feed, with reports on the attacks coming with the hashtag #OpKKK. The group has acknowledged, though, that its anti-KKK action was not running smoothly enough. “ A lot of the sites being DDOS’d in #OpKKK seem to be going down, coming up, going back down, coming back up, etc ,” Anonymous explained. The hacktivists have also announced having taken over two KKK Twitter accounts @KuKluxKlanUSA and @YourKKKCentral. “ Based on the direct messages sent from and to this account, we can confirm that this account was run by an official Klan member ,” the group posted at one of the hacked accounts, promising more details in a statement coming in a few hours. The group is targeting the Ku Klux Klan over fliers it distributed among residents of the St. Louis area. The leaflets described protesters in Ferguson as “terrorists” and warned the KKK was ready to use lethal force against them. READ MORE: Missouri KKK: We will use ‘lethal force’ against Ferguson protesters The hacktivists reacted to the threats by releasing a video, announcing the launch of a “cyber war” on the KKK. “ DDos attacks have already been sent and have infiltrated your servers over the past 2 days… d0x’s have also been launched on leaders of the KKK. All information retrieved will be given to the public ,” the video says. The online attacks by the Anonymous come as tensions rise in St Louis, where a decision by a grand jury is expected any day now, though the date of the verdict has not been announced. The ruling will determine whether criminal charges will be brought against white police officer Darren Wilson, who shot unarmed black teenager Michael Brown, killing him. On Sunday, a crowd of demonstrators staged a peaceful protest in St. Louis, marking 100 days since the fatal shooting. Protesters lay down on chalk-marked areas, pretending to have been shot. Source: http://rt.com/usa/206067-anonymous-hacks-kkk-accounts/

See the original article here:
#OpKKK: Anonymous launches DDoS attacks on KKK websites

DDoS Attack Against Svenska Spel

The debate about Sweden’s restrictive online gambling legislation is heating up, as Gustaf Hoffstedt , from the country’s Moderate Party, proposed a motion to the Swedish Parliament to modify the current law in favor of an open and regulated market. After the European Commission (EC) decided to refer the country to the European Court of Justice to finally define whether Sweden’s monopoly on gambling is in conflict with EU laws or not, the pressure for a legislative change now comes from inside the country. “Sweden’s monopoly only exists on paper, therefore it is natural to change this to a licensing system where more operators can apply for a license in Sweden,” Hoffstedt said. “The companies that meet the highest standards should, on application, be given a license to operate in Sweden.” Hoffstedt believes that a change in the legislation is needed since it’s time for Sweden’s authorities to face the fact that the gambling monopoly in the hands of the State-controlled Svenska Spel did not work as initially expected. Especially as a large number of Swedish citizens regularly play on rooms that should not be reached from within the country. “When we talk about foreign gaming companies, these are in fact, in many cases, Swedish companies, since Sweden is one of the leading export nations in the gaming industry with companies like Unibet and Betsson ,” Hoffstedt explained to GamingIntelligence . “The current gaming law forces these companies to operate abroad. It is easy to see that a business policy that forces world-leading Swedish companies to leave the country can hardly be regarded as successful.” Similarly to the EC, the member of Sweden’s Moderate party believes that the country’s gambling monopoly did not succeed also in protecting players from the perils of compulsive gambling. “Compulsive gambling is a medical diagnosis, but today only 30 of the 290 municipalities provide specialised gambling treatment,” he stated. Hoffstedt parliamentary motion is only the last chapter of a long debate that many believe will soon result in the opening of Sweden’s gambling market. Also Sweden’s Minister of public administration Ardalan Shekarabi agrees with Hoffstedt on the fact that the country should rethink its approach to gambling and allow more companies to join an open, yet regulated, market. In a comment reported by PokerNews in October, Shekarabi explained how he believes it will be the government’s intention to “accelerate the work that is currently taking place to find a licensing system which can be implemented in Sweden.” Right when the Parliament was busy discussing the possibility to end the state-controlled gambling monopoly, things did not go too well for the country’s monopolistic company Svenska Spel. With a note published on the company’s website on Nov. 13, Svenska Spel’s press officer Johan Söderkvist announced that “the poker room had to temporarily shut down because of DDoS attacks.” “Svenska Spel has undergone several targeted denial of service attacks, known as DDoS attacks,” the note explains. “Given the major disruptions caused by the attacks, it has been decided to temporarily shut down the poker room. Cancelled games will be refunded according to Svenska Spel’s terms and conditions,” the note continued. “Svenska Spel has filed a police report the incident.” Heavy DDoS attack against Svenska Spel were also reported on Nov. 2, when the poker room was forced to cancel the inaugural event of its 2014 Swedish Masters . Source: http://www.pokernews.com/news/2014/11/ddos-attacks-against-svenska-spel-continue-19823.htm

Originally posted here:
DDoS Attack Against Svenska Spel