Category Archives: DDoS Criminals

Popular Bitcoin forum targeted in DNS and DDoS attack

Roughly 175,000 members registered on bitcointalk.org are being discouraged from logging into their accounts following attacks against the popular Bitcoin forum, according to an advisory on the top of the main page. “If you used your password to login between 06:00 Dec 1 UTC and 20:00 Dec 2 UTC, then your password may have been captured in a man-in-the-middle attack, and you should change your password here and wherever else you used it,” according to the advisory. On Monday, a bitcointalk.org administrator named ‘theymos’ wrote that what likely happened is an attacker took advantage of a vulnerability in the forum’s registrar, Anonymous Speech, to redirect the domain name system (DNS) to a different point. Bitcointalk.org was promptly transferred to a different registrar as a result, theymos explained, but the administrator added that those types of changes take time and that users should avoid logging into the website for about 20 hours. “Because the HTTPS protocol is pretty terrible [on the forum], this alone could have allowed the attacker to intercept and modify encrypted forum transmissions, allowing them to see passwords sent during login, authentication cookies, PMs, etc.,” theymos wrote. “Your password only could have been intercepted if you actually entered it while the forum was affected.” The administrator added, “I invalidated all security codes, so you’re not at risk of having your account stolen if you logged in using the “remember me” feature without actually entering your password.” Meanwhile, the Bitcoin forum is concurrently the target of a massive distributed denial-of-service (DDoS) attack, theymos wrote, adding that while the two events are probably linked, it is unclear why the attacker is doing both at once. Source: http://www.scmagazine.com/popular-bitcoin-forum-targeted-in-dns-and-ddos-attack/article/323311/

Read More:
Popular Bitcoin forum targeted in DNS and DDoS attack

Google Nexus 5 vulnerable to DDoS attack

Google Nexus smartphones including the latest Google Nexus 5 running Android 4.4 KitKat are vulnerable to denial-of-service attack via Flash SMS messages; it has been revealed on Friday during DefCamp security conference in Bucharest, Romania. Bogdan Alecu, a system administrator working with Levi9 – an IT services company, performed a live test during the conference on a Nexus 4 phone running Android 4.3. Alecu showed through the test that after receiving 30 odd Flash messages, the smartphone became unresponsive. During this state the phone neither responded to screen taps nor was it able to receive any phone calls and had to be rebooted manually to get it in functional order. Flash messages are Class 0 SMS that gets displayed on phones’ screen directly without getting stored on the device. Users have the option to saving the message or dismissing it. According to Alecu, there have been instances during this tests that the phone behaves in a different manner at times and loses mobile network connectivity temporarily. The connectivity is restored in a short while with ability to place and receive phone calls, but internet connectivity is lost up until the phone is manually restarted. There are instances when the messaging app crashes and the Nexus smartphone reboots. The issue has been discovered over a year ago revealed Alecu and has been tested on all Google Galaxy Nexus smartphones running Android 4.x including the recently released Nexus 5. Alecu revealed that he has contacted Google multiple times just to receive automated response. Some one did respond that the issue will be resolved in Android 4.3, but unfortunately it still persists and has been passed onto Android 4.4 KitKat. There is no official fix for the vulnerability and till then the only workaround is an app named Class0Firewall (https://play.google.com/store/apps/details?id=com.silentservices.class0firewall&hl=en) developed by Michael Mueller, an IT security consultant from Germany in collaboration with Alecu. Source: http://www.techienews.co.uk/973439/google-nexus-5-vulnerable-denial-service-attack/

More:
Google Nexus 5 vulnerable to DDoS attack

DDos Is Hot, Planning Is Not

Distributed denial-of-service (DDoS) attacks continue to plague major corporations today, but half of organizations don’t have a plan or defense against DDoS attacks, a new survey found. Nearly 45 percent of organizations surveyed by Corero have no DDoS response plan, while some 21 percent don’t have a response team set up in the case of a DDoS attack targeting their networks. Around 60 percent say they don’t have a designated DDoS response team, and 40 percent say they don’t have a point of contact within their organizations when a DDoS hits, according to the survey of some 100 respondents. “Half of them aren’t really doing anything about DDoS. They’re just hoping nothing will happen to them, or they [will just be] putting up with inconvenience it’s causing in the meantime,” says Ashley Stephenson, CEO of Corero, which will release full data from the survey next month. Stephenson says he has seen cases where corporations had no idea that their own computing resources were being used in DDoS attacks against them. “A lot of people are not really paying attention to what’s going on, and that’s facilitating the malicious activity going on out there,” he says. More than 54 percent of the organizations surveyed say they have either an out-of-date network diagram of their infrastructures or no diagram at all. Some 66 percent don’t have statistics on network traffic patterns and traffic volume baselines to help identify when a DDoS is brewing. One of the reasons DDoS attacks have become so popular is that they are relatively inexpensive to pull off. “It’s a cheap resource being used to launch the attacks,” Stephenson says. “And the more we invest in good Internet [technology], the greater power is available for third parties to leverage it and do these attacks … [The attackers] are just cataloging all of these vulnerabilities and exploitable resources and calling on them when necessary to affect the attack.” Compromised desktop machines traditionally have been the most popular weapons for DDoSing a target, but, increasingly, attackers are deploying servers for more firepower. “That takes fewer bots but much more powerful [ones],” Stephenson says. A recent report by Dell SecureWorks revealed just how much DDoS-for-hire services cost in the cyberunderground. Those services cost only $3 to $5 per hour and $90 to $100 per day, Dell SecureWorks found. And a weeklong attack goes for $400 to $600. Source: http://www.darkreading.com/attacks-breaches/survey-ddos-is-hot-planning-is-not/240164306?utm_source=twitterfeed&utm_medium=twitter

Read this article:
DDos Is Hot, Planning Is Not

$1M lost in attack against Bitcoin Internet Payment Services

Copenhagen-based Bitcoin Internet Payment Services (BIPS) has been hit with a DDoS attack and has had 1,295 BTC stolen (a little over $1M) mostly from the company’s own holdings, but some from their c…

See the article here:
$1M lost in attack against Bitcoin Internet Payment Services

Bitcoin Payment Processor BIPS under DDoS Attack, Over $1m Stolen

Europe’s primary bitcoin payment processor for merchants and free online wallet service, BIPS, was the target of a major DDoS attack and subsequent theft in the past few days that saw 1,295 BTC (just over $1m on CoinDesk’s BPI) stolen. Kris Henriksen, BIPS’ CEO, said most of the missing funds were “from the company’s own holdings”. BIPS uses an algorithm, based on supply and demand, to work out the amount of bitcoins it needs to keep it in a ‘hot wallet’. The heist, however, was apparently not due to any vulnerability in the code itself. He also said merchants who had chosen to instantly convert their bitcoin to fiat currency bank accounts were not affected. Theft The Copenhagen, Denmark-based company was targeted on 15th November by a massive DDoS attack. Then on 17th November, it was followed up by a subsequent attack that disabled the site and “overloaded our managed switches and disconnected the iSCSI connection to the SAN on BIPS servers”. “Regrettably, despite several layers of protection, the attack caused vulnerability to the system, which has then enabled the attacker/s to gain access and compromise several wallets,” the company said in a written statement. BIPS believes the two attacks were connected, and at least the initial DDoS attack was “found to originate from Russia and neighboring countries”. The company moved fast to restore full merchant payment and transfer services by 19th November, but disabled all wallet functions in order to complete a full forensic analysis. Its help desk also went down for a few days, but was restored on 22nd November. Investigation Under BIPS’ privacy policy, it is not allowed to disclose users’ information to anyone, even the authorities. They will now set up a system for affected wallet users to voluntarily sign the required permission documents, to engage in a more thorough investigation with law enforcement to track down the culprits. Henriksen stressed that merchant processing “was restored very quickly, and if you had auto-convert on, there is nothing to worry about”. BIPS’ official statement on its site read: To protect the successful merchant processing business, BIPS has decided to temporarily close down its consumer wallet initiative. BIPS has been a target of a coordinated attack and subsequent security breached. Several consumer wallets have been compromised and BIPS will be contacting the affected users. As a consequence BIPS will temporarily close down the wallet initiative to focus on real-time merchant processing business which does not include storing of bitcoins. Subsequently BIPS will consider to reintroduce the wallet initiative with a re-architected security model. The consumer wallet initiative has not been BIPS’ core business and, as such, regrettably affecting several users has not affected BIPS merchant acquiring. All existing users will be asked to transfer bitcoins to other wallet solutions, and users affected by the security breach will be contacted. Restoration of merchant services did little to comfort individual wallet owners, though. On the Bitcoin Talk forum, several users voiced anger at the prospect of losing their funds, and what they saw as unclear statements from BIPS about exactly what had been stolen, from whom, and how much. One member even created a ‘bips.me potential lawsuit signup form’ for users to input their contact details and number of bitcoins missing, in an effort to prompt a negotiated solution. Though the attack and theft highlights problems that some online wallet services have faced with security, it is significant given BIPS’ comparatively large user base and prominence in the market. As well as online accounts, BIPS had also offered a paper wallet function for those wishing for a safer long-term storage solution. Source: http://www.coindesk.com/bitcoin-payment-processor-bips-attacked-1m-stolen/

Read the original:
Bitcoin Payment Processor BIPS under DDoS Attack, Over $1m Stolen

Just one NSA operation created a 50,000-strong botnet last year

Government tools penetrated many a Brazilian, apparently The U.S. National Security Agency (NSA) had established 50,000-drone botnet by the middle of 2012, according to the latest Snowden leaks.…

Read More:
Just one NSA operation created a 50,000-strong botnet last year

What e-commerce companies think about DDoS protection

Prolexic announced the results of a survey of global e-commerce companies who were asked about DDoS protection and the effectiveness of different types of DDoS mitigation services. A cross-sectio…

Read the original:
What e-commerce companies think about DDoS protection

Bitstamp Suffers Banking Software Issue and DDoS Attack

Bitstamp’s website has been experiencing a number of difficulties over the past couple of days. Yesterday, the Slovenia-based company experienced problems with the banking software it uses. A statement on the company’s blog and Facebook page reads: Dear Bitstamp clients, We are currently experiencing some problems with our banking software. As a result, deposits and withdrawals may be delayed. We expect this issue to be solved be resolved tomorrow or the next day. We kindly ask our customers with pending transfers to remain patient and refrain from submitting additional support tickets on the matter. We will announce as soon as this issue gets resolved. Thank you for your understanding. Best regards, The Bitstamp team With a tweet 19 hours ago stating: Bitstamp CEO Nejc Kodri? said the issue related to the company’s transaction log: “We were missing bank transaction log from Friday. Also sending transfers out was disrupted, but it now works.” This afternoon, the site suffered a DDoS attack. The last time CoinDesk was successfully able to access price data from Bitstamp was 14:05 (GMT). The site is still experiencing problems. Kodri? said his team is “still working on this” issue. Kodri? said the site hasn’t experienced any difficulties because of increased user traffic over the past couple of days, during which the bitcoin price has increased sharply. In fact, the entrepreneur said the site experienced a record number of visits yesterday with no problems. Source: http://www.coindesk.com/bitstamp-suffers-banking-software-issue-ddos-attack/

See the article here:
Bitstamp Suffers Banking Software Issue and DDoS Attack

Radio Free Europe/Radio Liberty (RFE/RL) Targeted for DDoS attack

Radio Free Europe/Radio Liberty has been targeted in an Internet attack known as a distributed denial of service (DDoS). The attack has disrupted RFE/RL’s global multimedia news and information services intermittently since November 14. Nonetheless, its computer network was working on November 18 and broadcasts have continued normally. The attack has not prevented the public from accessing RFE/RL’s web pages. But it has slowed the ability of RFE/RL’s broadcasting services to upload fresh news stories, photographs, and video to the Internet. RFE/RL President Kevin Klose said information is still being gathered about the attack, but he confirmed that it is believed to be “targeted.” Klose said a decision was taken on November 18 to report on the attack in response to the needs of the broadcasters’ audiences, “who rely on RFE/RL reporting, and who themselves contend with countless obstacles to connect with us every day.” RFE/RL’s content-management system also supports Voice of America, Middle East Broadcasting, and the Office of Cuba Broadcasting. Those U.S. international media networks also have been adversely affected by the attacks but continue to operate. Klose described the attack as “stark evidence of the challenges that confront the free dissemination and exchange of information in this age.” A DDoS attack floods the target with fake requests that come from thousands or even millions of computers that have been compromised or infected with viruses or malware. RFE/RL experienced a more limited DDoS attack against its Belarusian language service in 2008. RFE/RL Director of Technology Luke Springer said the latest attack was discovered on November 14 when hardware for the international media organization’s computer network began receiving many times more requests than normal. At the peak of the attack, the RFE/RL network was receiving requests for data from hundreds of thousands of computers every second. Springer said that means there are probably more than 1 million malware-infected computers being directed by the attackers — most likely without the knowledge of the computer owners. Technical investigations show that nearly 80 percent of the computers sending out requests for data as part of the DDoS attack are in China and nearly 20 percent are in Russia. But Springer said those findings do not indicate who is responsible for the attack. Attempts to make technical changes that counter the attack have temporarily alleviated the problem. But Springer said the attackers also have been changing their methods, allowing them to continue disrupting services intermittently. Springer said the DDoS attack has not damaged RFE/RL’s network equipment. But he says that “filling up the Internet pipeline with so many bogus requests has caused a traffic jam.” RFE/RL is a private, nonprofit organization funded by a grant from the U.S. Congress.

Read the article:
Radio Free Europe/Radio Liberty (RFE/RL) Targeted for DDoS attack