Lately, DDoS attacks have crept back into the headlines, forcing businesses to reacquaint themselves with the concept. DDoS stands for distributed denial-of-service which uses multiple machines to carry out a DoS attack on unsuspecting victims. It is estimated that over 7,000 attacks happen daily with the motives and severity of consequences varying between different attacks but all have the potential to greatly harm a company’s operations. To minimize any possible damage, it is important to prepare a defense against these malicious attacks especially as they are on the rise and could target your business at any moment. How to realize you are in the midst of a DDoS attack At the beginning of a DDoS attack, you may fail to even realize what is occurring. The optimistic side of you wants to believe that your marketing efforts have finally kicked in and created a sudden wave of interested customers to your website. However great that may be, the reality is as the numbers increase and overwhelm your servers, you are more likely to be under attack. When a DDoS attack occurs they are using one of two avenues: a special malware that infects the machines of others in order to carry out the attack from a large number of hosts or utilizing a large number of volunteers to their cause to perform the attack in unison. Regardless of the technique employed, they both use many host computers to access the target’s website and overwhelm their servers which results in long periods of downtime. Why Attackers Target You The reasons behind DDoS attacks can vary depending on the organization performing the attack and who they are attacking. The most common reason behind an attack is extortion where they perform a small attack on your servers first, then contact you demanding a certain amount of money to prevent a larger attack from occurring. The more profitable a company you are, the higher the chance you will be a target for extortion. Also, if your organization is currently in the spotlight for political controversy, there are many “hacktivists,” like the group Anonymous, who carry out DDoS attacks to satisfy their political agenda. Lastly, in sophisticated and large-scale attacks, the hackers could be attempting a security breach in order to obtain confidential information. All of these causes could create a devastating impact upon your company’s image. The Effects of DDoS Attacks 1. Revenue The more heavily you rely on your website as a means for business, the more severe a DDoS attack will affect your company. The average daily revenue loss from attacks for those that depend heavily on the Internet for their business is $2,000,000 or nearly $100,000 per hour. Even if you are a smaller organization with less reliance on the Internet, the average loss is $10,000 per hour when in downtime. These are significant amounts of losses that could be hard to recover from, especially for a small business. 2. Reputation As a DDoS attack is occurring, it becomes nearly impossible for any customer to access your website and results in an unpleasant experience for them. For instance, if you are a banking website, they can’t access their accounts which is very critical and leaves them feeling like their private information is at risk. Even after the attack is over, you will have to spend time and money in public relations efforts to reinstate faith in your service from your customer base. 3. Lawsuits When the attack breaches security and confidential information, a risk for lawsuits from customers and consumer protection groups occurs. Now you are not only looking at revenue loss from the downtime and from a loss of reputation but also, significant legal fees associated with your company failing to protect customer information. If all three occur, the DDoS attack could be enough to send your company into bankruptcy and impending failure. How to Protect Your Company The devastating effects from a DDoS attack is enough to leave you shaking in your boots, however most companies still fail to provide adequate protection against said attacks. As the sophistication of these attacks increase, your company’s firewall and current security measures may not be enough to handle a full-scale attack. In a recent survey, Neustar only found that 3% of the surveyed organizations had an anti-DoS solution. Here are some steps you should take to protect your company in the event of a DDoS attack: Develop a defense strategy immediately so you are prepared to take action when an attack occurs. Identify current security lapses or vulnerabilities within your website. If you have been a victim from an attack, keep information collected about it so you can determine how to properly fight off future attacks Simulate a DDoS attack to ensure your response measures are adequate. Consider purchasing an anti-DoS service from a security provider to narrow the possibility of attack. Combine anti-DoS service with the above steps to provide a comprehensive approach to protection. As DDoS attacks are on the rise, now is the time to prepare your company in the event of attack. Even smaller organizations could become victims, so it is important to be ready to defend your company’s website and servers from hackers. Following the steps for protection can prevent a DDoS attack from causing results that could be extremely difficult to recover from, allowing you to come out victorious in an otherwise disastrous situation. Source: http://technologyadvice.com/preparing-for-battle-ddos-attacks-on-business/
Monthly Archives: May 2013
Ruby on Fails: Zombie SERVER army built thanks to Rails bug
The undead are coming, and they have 1Gbps pipes! A critical vulnerability in trendy web programming kit Ruby on Rails is being abused to conscript hacked website servers into a growing botnet army.…
See the original article here:
Ruby on Fails: Zombie SERVER army built thanks to Rails bug
Threat of the Week: DDoS For Hire on the Rise
Just when you thought you could tune out the fears about DDoS (distributed denial of service) attacks, listen up: the risks for you suddenly are much graver, and it may be the time when defensive action on your part has become necessary. Yes, the fear-mongering over the May 7th DDoS blitzkrieg – which turned out to be a non-event – has prompted many credit union executives to turn off the DDoS discussion. That’s a mistake, however. “Three years ago I would have called DDoS a nuisance. Now it is a threat to many more businesses,” said Vann Abernethy, an executive with security firm NSFOCUS. A big change that is occurring, sources insist to Credit Union Times , is that for-rent DDoS networks – often costing spare change – are proliferating and they have plenty of firepower to take down most credit unions’ online presences. The scariest part: absolutely no technical skills are required to deploy what is being called DDoS as a service. All that’s needed is digital money – PayPal or BitCoin and there even are some providers that take MasterCard and Visa. Barry Shteiman, senior security strategist at Imperva, named names of sites that he said offer what seems to be DDoS for hire: SSH Booter, Empire Stresser, Quantum Stresser, Asylum Stresser, Titanium Stresser, Illuminati Stresser, Legion Stresser, Agony Stresser. The list is not complete. “There are dozens of companies selling DDoS as a service now,” said Sean Bodmer, chief researcher, Counter-Exploitation Intelligence, for CounterTack. Note: Almost all such sites claim to offer, not rogue DDoS for hire, but “stress testing” so that an organization – a credit union for instance – can check its DDoS defenses. Just one problem: sources insisted that the majority of stress-testing sites they are familiar with do no verification that the person buying the “stress test” has any affiliation whatsoever with the target. What’s fueled the rise in DDoS as a service? For one, the intense publicity for DDoS has just about everybody aware of the attack format. For two, “As email spam has become more and more a solved problem it has forced criminals with botnets to find other uses for them. DDoS lets them monetize their botnets,” said Matthew Prince, CEO of CloudFlare, a DDoS mitigation company. DDoS as a service prices are also tumbling. Hemant Jain, vice president of engineering for security company Fortinet, said that he has found providers who are selling an hour of DDoS for $5, a 24-hour day of it for $40 and a week for $260. Can’t these DDoS as service provider be shut down by law enforcement? It’s not that easy. Commented Carl Herberger, vice president of security solutions at mitigation provider Radware, “It’s important to note that ‘DDos for Hire’ websites move around in terms of their technical underpinning. They don’t stay in one area or one location for too long. It’s almost like a game of “Whack-a-Mole” – just when you think you’ve identified the location of the website, it’s already moved.” Added Chris Ensey, COO of security company Dunbar Digital Army, “These (DDoS as a service) sites are being resold like white-labeled products now. Most of the sellers are just affiliates who leverage another botnet or platform” – that is, they have none of their own infrastructure and, poof, they can be here today and back tomorrow under a new flag. That’s the problem: it is very hard to pinpoint the location of a DDoS command and control center and when it’s found, said sources, it generally is in a country with little or no law enforcement reciprocity with the United States. The bottom line for credit unions: “They have to take DDoS seriously. There is no turning this back,” said Shteiman. The good news: the attack throughputs via DDoS for hire are tiny fractions of what al Qassam is throwing at money center banks – 1% or 2% of the volume in many cases. But that is plenty to knock out a credit union that lacks defenses. As for what defenses are needed to thwart for hire DDoS, experts indicated that in most cases low-cost mitigation, within the budget of just about every credit union, ought to suffice. Talk with mitigation companies, also ask Web hosts what protections they have on hand or can line up, Small expenditures ought to bring peace of mind – at least that’s what the experts are saying today Source: http://www.cutimes.com/2013/05/28/threat-of-the-week-ddos-for-hire-on-the-rise?ref=hp
View the original here:
Threat of the Week: DDoS For Hire on the Rise
Microsoft loads botnet-crushing data into Azure
C-TIP gives ISPs near-realtime access to MARS data Microsoft is plugging its security intelligence systems into Azure so that service providers and local authorities can get near-realtime information on botnets and malware detected by Redmond.…
Iranian Hackers Launching Cyber-Attacks on U.S. Energy Firms: Report
Iranian hackers launched attacks as part of a campaign against the country’s oil and gas industry, according to current and former U.S. government officials. Iranian hackers have amped up a campaign of cyber-attacks against America’s energy industry, according to a report from The Wall Street Journal . Citing current and former U.S. officials speaking under the blanket of anonymity, the Journal reported that Iranian hackers accessed control system software that could have allowed them to manipulate oil or gas pipelines. The attacks raise the stakes in cyber-space between the U.S. and Iran, which has been accused by U.S. officials of being behind a spate of distributed denial-of-service attacks (DDoS) against U.S. banks stretching back to 2012. “This is representative of stepped-up cyber activity by the Iranian regime. The more they do this, the more our concerns grow,” a source told the Journal . “What they have done so far has certainly been noticed, and they should be cautious.” Alireza Miryousefi, Iran’s spokesperson at the United Nations, denied any connection between hackers and the regime in an interview with the Journal . The officials who spoke to The Wall Street Journal did not name any of the energy companies targeted in the attacks. But two former officials said oil and gas companies located along the Canadian border were among those hit. Word of the attacks comes a week after Charles Edwards, deputy inspector general at the U.S. Department of Homeland Security, told members of a Senate subcommittee that industrial control systems were increasingly coming under attack in cyber-space in ways that could potentially cause “large-scale power outages or man-made environmental disasters.” Securing these systems is complicated, as many are more interconnected with the Internet than people realize, explained Tom Cross, director of security research at network security vendor Lancope. “It is also difficult to fix security flaws with these systems because they aren’t designed to be patched and restarted frequently,” he said. “It is extremely important,” he continued, “that operators of industrial control networks monitor those networks with systems that can identify anomalous activity that might be associated with an attack. Because of the relatively homogenous nature of network activity on many control systems networks, anomaly detection can be can be a powerful tool in an environment where other kinds of security approaches fall flat.” Much of the talk about improving the security of critical infrastructure companies has focused on information sharing between the government and private sector. Improving communication between government and business figured prominently in the executive order on cyber-security that President Barack Obama issued in February. However, many officials and security experts have said that the order does not undo the need for legislation. “The increases in cyber-assaults on our energy systems from Iranian-backed hackers are another signal to the government and the industry that measures must be taken to fortify the security of our critical infrastructure,” said Lila Kee, chief product and marketing officer at GlobalSign and a North American Energy Standards Board (NAESB) board member. “However, there is a fine line between cyber-security regulation and voluntary standards,” she said. “Regulations cannot be so rigid so as to prevent protection from today’s evolving advanced persistent threats, and voluntary standards cannot be so loose so as to provide no purpose. In today’s modern world of malware, solutions must be fluid and scalable to battle aggressive cyber-attacks.” Source: http://www.eweek.com/security/iranian-hackers-launching-cyber-attacks-on-us-energy-firms-report/
Read More:
Iranian Hackers Launching Cyber-Attacks on U.S. Energy Firms: Report
DDoS Attacks – Understanding the Dangers
If you’re a small business owner, or if you own Web space for any reason, one of the new threats that have no doubt begun to appear on your horizon is the potential of being attacked online. Fortunately for the hackers, not a lot of people understand what online attacks really are, how they pull them off, or how to effectively protect from it. Most computer repair experts agree it is hard to guarantee 100 percent security, but you can take the necessary precautions to minimize damages if your security is ever compromised. Taking precautions starts by understanding the dangers: One of the most common types of attack that takes place these days is a DDOS, or Distributed Denial of Service attack. This type of attack is particularly effective because it doesn’t require an intimate knowledge of your security to be deployed. It just takes brute force. Prior to the scheduled attack, the hacker will create a swarm of “zombie” computers — computers infected by the hacker’s software. This software allows the hacker to use the processing power of thousands of computers belonging to other people to bring down your server. When the attack commences, the hacker tells the zombie computers to simultaneously and continually load information from your Web server. If the attack is powerful enough, your server will stop serving. It will become unreachable so even legitimate visitors can’t access the site. While this intense strain is taking over your server, the hacker can try to slip into the back door unnoticed. This is where a lot of the actual financial loss associated with DDOS attacks come from. Scared yet? Don’t be…too scared. Most DDOS attacks happen to high-profile sites that make a lot of money online and that have a lot to lose from even a temporary outage. But there’s still a chance it could happen to you for reasons beyond your control. So how do you protect against such a large-scale attack? The easiest way is to talk to your in-house IT Department and have them work through the nine steps that help defend against a DDOS attack. No IT onsite? Then call your trusted IT or computer repair professionals and tell them you want to prepare for a DDOS attack. They can best help you and recommend plans to upgrade your servers or to install special software that can determine legitimate traffic from DDOS attacks. They might also want to talk with you about the current security software you’re using. An off-the-shelf program probably won’t defend very well against this new type of attack, so talk with your IT professional about the options available to you. As always, the best defense is vigilance. As you’re managing your website, be sure to note any suspicious traffic, educate your staff on safe practices and call your computer repair professionals as soon as you note suspicious activity. Most likely it won’t be anything, but it never hurts to ask. For protection against your eCommerce site click here . Source: http://www.sitepronews.com/2013/05/22/ddos-attacks-understanding-the-dangers/
Read more here:
DDoS Attacks – Understanding the Dangers
Legitimate online services enable DDoS-attacks-for-hire sites
A recent expose shines a light onto the strange world of “booter” or “stressor” web sites which offer DDoS-attacks-for-hire Is an online payment giant Paypal unwittingly enabling DDoS attacks? That’s the question posed by security researchers who have studied a small, weird corner of the market for distributed denial of service (DDoS) services: so-called “booter” or “stressor” web sites. Speaking at The Security B-Sides Boston security conference on Saturday, independent researchers Allison Nixon and Brandon Levene said that their investigation of booter sites found that many rely on legitimate online services, including Paypal to accept payment on behalf of customers interested in attacking web sites they do not own, and Cloudflare, a DDoS prevention service. The presentation was just the latest to peek into the strange world of “booter” or “stressor” web sites, which offer DDoS attacks for hire, often targeted at online gaming services popular with teenagers. In the past week, the web site krebsonsecurity.com published exposes on two such sites: assylumstressor.net and Ragebooter.net, both booter services for hire. In the process, Krebs revealed the identities of the purported owners of the sites and details of conversations he had with them about their services. In their presentation Saturday, Levene and Nixon, who assisted Krebs in his research, said that the booter sites were common online, but wholly different from the massive, 300Gbps attacks directed at Spamhaus, or the site-crippling DDoS attacks on leading banks and financial services firms like Citi, Chase, Wells Fargo and others in recent months. Rather, the services use mostly simple, reflected DNS and UDP flood attacks to knock small sites and residential home routers offline, the two researchers said. Many of the features of sites like Ragebooter.net are poorly designed or don’t work at all, said Nixon. Most victims are very often small websites hosting online gaming servers. In fact, the most reliable customers of booter sites are often other booter sites, said Nixon. The sites are not hugely profitable, but do generate some income. An analysis of data on the site Asylumstressor.com by Nixon and Levene suggest that site operators made, at most, $23,000 in 2012 – though probably much less. The sites operate more or less in the open. Speaking with Brian Krebs last week, a Tennessee man named Justin Poland, the operator of ragebooter.net, argued that the services were legal. “Since it is a public service on a public connection to other public servers this is not illegal,” Poland told Krebs in a Facebook chat. Poland even claimed to be working on behalf of the local FBI, turning over information gleaned from his service to law enforcement as needed. The Memphis FBI would not confirm or deny that Poland’s claims were true. Legal or not, most booter sites operate more or less in the open and with impunity, Nixon told an audience at B-Sides Boston, which was held at Microsoft’s New England Research and Development Center (NERD) in Cambridge. Site operators – many teenagers and 20-somethings with little technical sophistication – make little effort to conceal their identities. Paypal payments are often sent to e-mail accounts that are also associated with public Facebook profiles, making it easy to link booter sites to real world identities like Poland’s, she said. Law enforcement seems unconcerned with small scale attack sites like Ragebooter.net, or those who operate them, meaning that booter site operators continue to operate despite ample evidence about who they are and the illegal nature of their business, Nixon said. Similarly, services like PayPal and Cloudflare enable small-scale DDoS operations to continue, by turning a blind eye to the true nature of their businesses. Nixon said as many as 70 percent of booter sites use Cloudflare, a DDoS protection site. The service mainly protects booter sites from other booter sites, she said. Paypal isn’t the only online payment service, but it is easy and convenient to use and widely respected. Inexperienced booters who had to go through the trouble of setting up an account at a site like LibertyReserve might think twice, Nixon argued. In an e-mail statement to ITworld and other news outlets, Paypal said that it couldn’t discuss the specifics of customer accounts but that it “will review suspicious accounts for malicious activity and work with law enforcement to ensure cyber criminals are reported properly.” “We take security very seriously at PayPal,” the statement continued. “We do not condone the use of our site in the sale or dissemination of tools, which have the sole purpose to attack customers and illegally take down web sites.” Cloudflare CEO Matthew Prince said that his company protects millions of web sites – most of them legitimate private and public sector entities. However, his company doesn’t discriminate, and Prince admits that some sites protected by Cloudflare are troubling, including the booter and stressor sites. Cloudflare works closely with law enforcement and always responds promptly to requests for information from the courts or law enforcement offiicals. However, in the absence of any action by law enforcement, Prince said that it isn’t for him or his company to decide who to work with. “I do find it troubling when there are extralegal measures taken to determine what is and is not going on,” he said, in an apparent reference to the investigation by Krebs, Nixon and Levene. “How far do you go with that, if someone assumes XYZ shouldn’t be on the Internet? Should Google remove them from their search index?” he asked. “We believe in due process,” said Prince. Source: http://www.itworld.com/it-management/357306/legitimate-online-services-enabling-ddos-attacks-hire-sites
Read this article:
Legitimate online services enable DDoS-attacks-for-hire sites
Barracuda updates web application firewall
Barracuda Networks announced Barracuda Web Application Firewall 7.8, specifically aimed at reducing the impact of automated attack attempts from botnets. Automated botnet attacks recently have gain…
See more here:
Barracuda updates web application firewall
Saudi Web Sites Under DDoS Attack
The Saudi Interior Ministry said Friday that several government Web sites have come under attack in a campaign hackers are calling #OpSaudi. Hackers who identify with the loose hacking collective Anonymous have aimed at several government Web sites, including the Saudi Ministry of Finance, General Intelligence Presidency, the Ministry of Foreign Affairs, and the Directorate General of Passports, as well as sites for several major Saudi provinces, including Makkah and Jeddah. Most of the sites are facing distributed denial of service, or DDoS, attacks, in which hackers flood each site with traffic until they collapse under the load. But hackers claimed to have also broken into some sites through a so-called SQL injection, in which attackers exploit a software vulnerability and enter commands that cause a database to produce its contents. In one case, the Twitter account for @AnonySaudi claimed to delete the database of a Saudi Web server. Hackers say their motive is twofold. On Twitter, some claim the #OpSaudi campaign is in retaliation for unconfirmed reports of a rape and murder in Saudi Arabia. Some Tweets include links to YouTube videos which show images of a naked body dumped on the side of a road. The attacks also followed an announcement by Matthew Rosenfield, the well-known security researcher who goes by the hacker handle Moxie Marlinspike, that Mobily, a major Saudi telecommunications company, approached him about assisting in a continuing Saudi surveillance project. In a widely circulated blog post Monday, Mr. Marlinspike said he learned that on behalf of a Saudi “regulator,” Mobily is working to intercept mobile app data for communication tools including Twitter and free mobile messaging apps like Viber, Line and WhatsApp that send messages over the Web. He published his e-mail correspondence with an executive at Mobily, which showed the company is developing the ability to monitor mobile data communication and already has the ability to block it. Mr. Marlinspike told Yasser D. Alruhaily, a Mobily security executive, that he declined the job for privacy reasons. Mr. Alruhaily replied, “I know that already and I have same thoughts like you freedom and respecting privacy, actually Saudi has a big terrorist problem and they are misusing these services for spreading terrorism and contacting and spreading their cause that’s why I took this and I seek your help,” he wrote. “If you are not interested than maybe you are on indirectly helping those who curb the freedom with their brutal activities.” Mobily spokesman denied contacting Mr. Marlinspike. ”Mobily or its employees never communicated with the author of this blog,” the company told Reuters. “Mobily communicates with information security companies only based on legal and lawful requirements. We never communicate with hackers. Moreover, it is not our job to spy on customers.” On Friday, the Mobily Web site was among the growing number of Saudi Web sites that #OpSaudi had taken offline. Source: http://bits.blogs.nytimes.com/2013/05/17/saudi-web-sites-under-attack-following-surveillance-accusations/
LulzSec Hackers Get Years Of Prison Time
Four men who took part in a significant number of cyber attacks on the likes of the NHS, Sony and the CIA received stern sentences today, following a lengthy trial into the activities of hacktivist crew LulzSec. News International and the UK Serious Organised Crime Agency (SOCA) were also hit by the hackers, who thought they were “latter-day pirates”, according to prosecutors speaking yesterday. Tough sentences for LulzSec Ryan Cleary, who was affiliated with LulzSec but not believed to be a leader, received the toughest sentence, with 32 months in prison. He let LulzSec members use his botnet to carry out distributed denial of service (DDoS) attacks. Cleary is also due to be sentenced over indecent images of children found on his computer at a later date. Ryan Ackroyd received a 30-month sentence for his part in researching and executing many attacks. Jake Davis, the spokesperson of LulzSec, is to serve 24 months in young offenders’ institution, whilst Mustafa Al-Bassamwas, who researched vulnerabilities for the attacks, was handed a 20-month suspended sentence of two years and 300 hours unpaid work. It is believed US law enforcement are keen to have some of the men extradited to face charges on US soil. However, Cleary’s legal team issued the following statement: “We believe the pleas that were entered today do cover all aspects of Mr Cleary’s criminality and therefore we do not anticipate that he will be in receipt of an application for extradition from the United States of America.” The notice, from Karen Todner Solicitors, also noted Cleary suffered from Aspergers Syndrome, but added he “does not seek to excuse his behaviour”. No laughing matter Charlie McMurdie, head of the Police Central e-Crime Unit, which carried out the investigation into the hackers alongside the FBI, said LulzSec had been “running riot, causing significant harm to businesses and people”. “Theirs was an unusual campaign in that it was more about promoting their own criminal behaviour than any form of personal financial profit,” added McMurdie, who is soon to retire from the force. “In essence, they were the worst sort of vandal – acting without care of cost or harm to those they affected, whether that was to cause a company to fold and so costing people their jobs, or to put at threat the thousands of innocent Internet users whose logins and passwords they made public. “They claimed to be doing it for ‘a laugh’ but real people were affected by their actions. Today’s convictions should serve as a deterrent to others who use the Internet to commit cyber attacks.” This might not be the denouement to the LulzSec saga, however, as hackers are threatening to take revenge. According to Sophos’ Graham Cluley, before the sentences were announced today, a group using the Twitter handle @LulzSecWiki said courts “could be in for ‘fun’” depending on their decision. Source: http://www.techweekeurope.co.uk/news/lulzsec-hackers-jailed-uk-116507
Taken from:
LulzSec Hackers Get Years Of Prison Time