Category Archives: DDoS Criminals

The New Wave of Distributed Denial of Service ‘DDoS’ attacks: How to Prepare and Respond

What will you do if your organization is the next target of a distributed denial of service attack? Hacktivists recently launched DDoS attacks that caused online outages at several major U.S. banks. Each institution was warned in advance; none were able to prevent disruptions. And while banks are the current targets, any organization could be next. Join this panel for expert insight on: Why these recent DDoS attacks elude traditional defenses; New security solutions to help detect and respond to DDoS attacks; How to respond if you are attacked – from ramping up fraud prevention in other channels to what to tell customers about the attacks. Background Beginning in mid-September, hacktivists initiated a series of sophisticated DDoS attacks against major U.S. banks, including Bank of America, Chase and Wells Fargo. The attackers claim to be waging a cyber war against top-tier banking institutions because of outrage over a YouTube movie trailer believed by the hacktivists to be anti-Islam. In each instance, the group has given at least 24 hours notice before launching the DDoS attacks. But no institution so far has successfully avoided online outages resulting from the attacks. These incidents send two clear messages to security leaders: The sophistication and strength of the DDoS attacks are greater than organizations have seen before. One industry expert measured the DDoS traffic flow at one institution to be 65 gigabytes per second – roughly 65 times heavier than previous DDoS attacks. Any organization is susceptible. Banks are today’s DDoS target, but tomorrow it could be a government agency, merchant or healthcare entity that offends a hacktivist group with the resources to launch an attack. If banks, with their mature security programs and state-of-the-art defenses, cannot ward off these attacks, then what other organization can? In this panel webinar, industry leaders with expertise in DDoS defense will present the unique qualities of these latest attacks, why no organization should feel immune, then discuss successful solutions that can empower organizations to detect, prevent and respond to attacks. Leading the discussion is Matthew Speare, SVP of IT at M&T Bancorp. He will set the stage by discussing how his institution responded to the attacks against other banks, including preparation, security controls and customer communication strategies. Speare then will be joined by thought-leaders from Akamai, Fortinet and Neustar, who will discuss a range of DDoS-related topics, including: Sophistication of Attacks – In the past, DDoS meant brute-force network attacks. Now, experts say, they are not only stronger, but also morphing into application layer attack, which makes them harder to detect and block. What have we learned from these attacks, and which new solutions are best for identifying and rerouting the DDoS traffic? A Cover for Fraud? – Sometimes DDoS attacks are meant as a distraction – to keep security personnel focused online while the fraudsters turn to other channels, such as the call center, to commit fraud. What are the account anomalies you need to be equipped to detect? Incident Response – Not only does your organization need to be prepared to respond internally to DDoS attacks, but you also need to know how to communicate externally to customers. What’s your message, and how can you take this opportunity to better explain your security posture? Source: http://www.bankinfosecurity.com/webinars/new-wave-ddos-attacks-how-to-prepare-respond-w-308

Read the article:
The New Wave of Distributed Denial of Service ‘DDoS’ attacks: How to Prepare and Respond

65% Of Organizations Experience Three Distributed Denial of Service ‘DDoS’ Attacks A Year

Despite the increasing sophistication and severity of cyber attacks, a survey of more than 700 senior IT professionals reveals that organizations are surprisingly unarmed to deal with today’s threat landscape. In a new report titled “Cyber Security on the Offense: A Study of IT Security Experts,” the Ponemon Institute and Radware®, (NASDAQ: RDWR), a leading provider of application delivery and application security solutions for virtual and cloud data centers, found that while 65% of organizations experienced an average of three distributed denial-of-service (DDoS) attacks in the past 12 months, less than half reported being vigilant in monitoring for attacks – much less putting into practice proactive and preventative measures to protect their organizations. “The reality is that cyber threats are outpacing security professionals, leaving most organizations vulnerable and unprepared,” said Avi Chesla, chief technology officer, Radware. “From hacktivists to cyber criminals, companies live under the constant threat of assaults that contribute to lost revenue and serious reputational damage. It’s critical that organizations take immediate action after reading this report. IT managers have to advocate for a multi-layered approach that also takes in account countermeasures to prevent threats before they inflict significant damage.” Key findings from the report include: Availability is the top cyber security priority for organizations today. Gone are the days where companies could solely concern themselves with data leakage and integrity based attacks. Unlike the past few years, where many organizations focused on confidentiality and integrity-based attacks, respondents noted a major shift in their security objectives, ranking denial-of-service (DoS) and DDoS as two of the top three threats their organizations face today. DDoS attacks cost companies 3.5 million dollars every year. Although respondents cited a lack of budget as one of the major impediments to shoring up cyber security, it’s clear that organizations will pay a much higher price for their lack of preparedness. 65% reported experiencing an average of three DDoS attacks in the past 12 months, with an average downtime of 54 minutes per attack. With the cost for each minute of downtime amounting to as much as $100,000 per minute – including lost traffic, diminished end-user productivity and lost revenues – it is no surprise that respondents ranked availability as their top cyber security priority. 63% rate their organization’s offensive countermeasure capabilities as below average. While 60% say they want technology that slows down or even halts an attacker’s computer, the majority of respondents give their organizations an average or below average rating when it comes to their ability to launch counter measures. With 75% of organizations still relying on anti-virus and anti-malware to protect themselves from attacks, it’s clear that the old adage, “the best defense is a good offense” is not being practiced by most firms. Organizations are more vulnerable than ever before. With respondents ranking lack of system visibility (34 percent), mobile/remote employees (32 percent) and negligent insiders (31 percent) as their top three areas of greatest cyber security risk, it’s clear that threats can come from a number of new sources including the Bring Your Own Device (BYOD) movement. Even more frightening, today’s threats are multi-layered, targeting not only networks but the data and application levels as well. “There is a frightening gap that exists between the increasing severity of cyber attacks and the level of preparedness that exists in the industry,” said Larry Ponemon, chairman and founder of the Ponemon Institute. “The report’s findings make clear that now is the time for organizations to begin making critical changes to their security approaches in order to stave off the potentially devastating costs associated with a lack of preparedness and adequate defenses.” To access a complete version of the report, please visit www.ddoswarriors.com, Radware’s in-depth resource for information security professionals. In addition, Radware will host a webinar on November 14 to discuss the report’s findings and provide actionable insights to help any organization properly mitigate attacks in an increasingly hostile threat landscape. Sign up here. About Cyber Security on the Offense: A Study of IT Security Experts The research for Cyber Security on the Offense: A Study of IT Security Experts was co-authored by the Ponemon Institute and Radware. The report surveyed 705 U.S. based IT and IT security practitioners responsible for managing their organization’s cyber security activities. 62% of the respondents surveyed were at the supervisor level or higher with an average of more than 11 years of experience. 65% of respondents were from organizations with a global headcount of more than one thousand and the primary industry segments for the report included financial services and the public sector as well as healthcare and pharmaceuticals. The survey consisted of 35 questions on respondents’ perceptions of and experiences with their organization’s cyber security infrastructure and the types of threats they now face. In addition to the report’s key findings, Cyber Security on the Offense includes: The top ranked negative consequences of cyber attacks Barriers to achieving a strong cyber security posture The technologies most favored by IT security professionals Top methods for performing counter techniques A comparison of attacks across the financial services, healthcare and public sectors About the Ponemon Institute The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries. Source: http://www.darkreading.com/insider-threat/167801100/security/news/240124966/65-of-organizations-experience-three-ddos-attacks-a-year.html

Follow this link:
65% Of Organizations Experience Three Distributed Denial of Service ‘DDoS’ Attacks A Year

65% of organizations experience three DDoS attacks a year

More:
65% of organizations experience three DDoS attacks a year

Man arrested for Distributed Denial of Service ‘DDoS’ attack on Theresa May

A MAN HAS BEEN ARRESTED on suspicion of launching and promoting a denial of service attack on the website of UK Home Secretary Theresa May. The man is unnamed, but is said to be 41 years old and from Stoke on Trent, He is accused of mounting an attack on May’s website and others, and of inciting other people to participate. “The activity this morning demonstrates the commitment of the PCeU (Police Central e-Crime Unit) and our colleagues to combat cyber criminality anywhere within the UK and take action against those responsible,” said detective inspector Jason Tunn of the Metropolitan Police. “Assisting and encouraging cyber crime is a serious matter and I would advise all persons to consider their actions and any possible future consequences prior to posting any material online.” May’s website was attacked earlier this year as part of Operation Trial At Home, an Anonymous backed effort to raise awareness about ongoing extradition controversies, including those affecting Richard O’Dwyer and Gary McKinnon. Optrial At Home, as it was called on Twitter, was announced by an account called AnonopUK. “#OpTrialAtHome We will be firing our Laz0rs at GCHQ.gov.uk 8pm GMT 14th April, We invite all #Anons again to join,” it said in a tweeted message that has now apparently been deleted. That account was still sending out messages late last night. Whoever was arrested was nicked on suspicion of assisting or encouraging crime contrary to the Serious Crime Act 2007. The man has been bailed until mid-December. Source: http://www.theinquirer.net/inquirer/news/2222942/man-arrested-for-denial-of-service-attack-on-theresa-may

Follow this link:
Man arrested for Distributed Denial of Service ‘DDoS’ attack on Theresa May

Life cycle and detection of an exploit kit

As the process of owning systems and dragging them into botnets becomes ever more commercialized, exploit kits have emerged as a favorite of attackers. Their point-click-own nature means even non-tech…

See the original article here:
Life cycle and detection of an exploit kit

Defending Against The Next Generation Distributed Denial of Service DDoS Attacks

Here is a great post from Joey Muniz at www.thesecurityblogger.com Press around the DDoS attack Operation Ababil has caught the attention of many of our customers. This sophisticated cyber strike used a combination of three separate rootkits targeting webservers, which produced a very high upstream attack method on multiple companies simultaneously. The scary part about Operation Ababil was it was designed to bypass standard DDoS defense methods. This clearly demonstrates there isn’t a silver bullet for addressing advanced DDoS attacks. Distributed Denial of Service DDoS, web application and DNS infrastructure attacks represent some of the most critical threats to enterprises today. Here is some suggestions for a reference architecture to defend against these an other advanced threats. The best approach for defending against advanced DDoS as well as other cyber attacks is having multiple security solutions using different methods to detect malicious activity for both internal and external threats. For internal threats, it’s critical to have a well-designed and mature security infrastructure that includes components such as firewalls, IPS/IDS, email and content / application security solutions. Similar security standards need to be applied to endpoints as well as in the datacenter such as proper patch management, anti-virus and anti-malware. It’s important to enable DDoS defense features for these tools. For example, some best practices are leveraging ACLs for ingress and egress filtering, rate limiting ICMP and SYN packets as well as verifying if the source IP of packets have a route from where they arrived. Standard internal security solutions are important however will not completely protect you from advanced DDoS and other cyber threats. Security administrators need full network visibility to quickly identify anomalies regardless of their location or form of communication. Best practice to identify malicious activity inside your network is monitoring the wire using a Netflow or Packet capture approach (more can be found HERE and HERE). It’s also important to match identity to devices found. An example is how Cisco offers integration with its flagship access control solution, Identity Services Engine ISE, to network forensic tools such as LanCope, NetWitness and most major SIEMs. Having a tuned monitoring solution will dramatically improve reaction time to internal cyber threats. Most administrators associate DDoS as an outsider attack. We hear customers claim their service provider is responsible for providing DDoS defense however a service providers mission of delivering service will always outweigh concerns for security. For this reason, it’s critical to invest in an external DDoS defense solution as well as verify what security tools are included with your service provider contract. The two large players for external DDoS defense are Akamai and Arbor networks. Akamai’s Kona Site Defender provides DDoS mitigation and Application Layer Protection for most service providers. If your service provider uses Akamai, verify if they invested in the additional Kona suite. The leader for enterprise DDoS defense is Arbor (more can be found HERE). Arbor’s Peakflow, Prevail and cloud subscription services are the defacto standard for DDoS defense at the vast majority of our Tier-1 and Tier 2 ISPs as well as enterprise customers. Online DDoS monitoring services are also an option offered by companies such as Prolexic which are an alternative to purchasing equipment. To summarize the DDoS defense architecture, an enterprise should focus on both internal and external defense. The internal network should have a solid security foundation, monitor the wire for devices that access the network and match identity to those devices to distinguish what is permitted from rouge devices. Investments should be made in external defenses that offer the ability deflect DDoS traffic such as SYN Floods or UDP Floods as well as authenticating valid traffic at the network edge. Best practice is using DDoS solutions that leverage a large customer base via cloud services to improve reaction time as a community. Its also wise to question your service provider for what security solutions are included with your service package. Having this blend of internal and external security solutions will dramatically improve your chances against todays advanced persistent threats such as Operation Ababil. For DDoS protection for your eCommerce site click here to learn more. Source: http://www.cloudcentrics.com/?p=2293

Read the original:
Defending Against The Next Generation Distributed Denial of Service DDoS Attacks

Distributed Denial of Service ‘DDoS’ attack and SQL injection are the most popular attack subjects

An analysis of conversations in one of the largest known hacker forums – with around 250,000 members – has revealed that SQL-injection and DDoS are the subjects of most interest to up-and-coming wannabe hackers. In its analysis of the forum (together with 17 other, smaller forums) to be published today, Imperva notes that this “is not a hardcore crime site, but it’s not entirely softcore. New hackers come to this site to learn and, on the other hand, more experienced hackers teach to gain ‘street cred’ and recognition… Typically, once hackers have gained enough of a reputation, they go to a more hardcore, invitation-only forum.” The real value of the analysis is that it shows what tomorrow’s hackers are learning today. “By examining what information hackers seek out or share in these forums, we can better understand where they are focusing their efforts,” explained Amichai Shulman, Imperva’s CTO. It seems that DDoS and SQL injection attacks are the current focus. Each tied at 19% of all discussed attack methodologies. DDoS is rarely out of the news, with hacktivists using it to make political protests, criminals using it to disguise other attacks, and (potentially) nation states using it to disrupt critical infrastructures. The recent spate of attacks against American banks is thought by many to be a politically-inspired attack by Iranian attackers. SQL injection attacks have a slightly lower profile but are similarly popular with criminals – and the same US banks have recently been warned about Havij, an automated SQL injection attack tool (itself a common subject of discussion in the chat forums). Such attacks can be mitigated (and Imperva has discussed this in an earlier blog this month). Nevertheless, the company believes that only 5% of industry’s current security budget is spent on defeating this type of attack; which may help explain why it is so popular. Other subjects disclosed by the Imperva analysis include the growing black market for social media endorsements, especially likes on Facebook and followers on Twitter. Since the social media sites are becoming better at recognizing and excluding automated bots that accrue such ‘currency’, the underground is providing it as a service, with numerous advertisements for buying or selling “illegitimate social network likes, followers, and endorsements” appearing on the forums. But there are also many discussion threads, says Imperva, that include “requests to hack someone’s Facebook profile, usually to settle personal matters. Common examples are spying on one’s girlfriend/ex, taking revenge, and just for lulz.” E-whoring has also become rampant. “With more than 13,000 threads in the dedicated forum we monitor, e-whoring is surely becoming one of the most common methods for beginner cyber criminals to gain easy money.” It’s basically social engineering where an attacker of either sex pretends to be a ‘hot gal with pics’. Dj Co2 posted an explanation on Black Hat World last month: “So what you will be doing is making a girls profile, add some hot pictures and make it look real. You will then be sending messages to different guys (there’s no limit on that). You will then chat with them, make them a little horny and desperate and then get them to sign up through your affiliate link to some webcam site. Tell them that if they buy tokens they can have a private chat with you on the website… 20 Instagram accounts with profile picture for $10.” “The victim,” says Imperva, “is paying for the illusion of a brief relationship.” Men “would be better off getting to know the girl next door,” it suggests. For more information on SQL injection click here . Source: http://www.infosecurity-magazine.com/view/29033/ddos-and-sql-injection-are-the-most-popular-attack-subjects

Online DDoS downtime calculator

Prolexic has released a DDoS downtime cost calculator (registration required) which takes into consideration the many DDoS attack variables that can affect revenue. Using this calculator, businesse…

See more here:
Online DDoS downtime calculator

HSBC Falls in Latest Bank DDoS Attacks, What’s Next?

Capital One, HSBC, Bank of America, Wells Fargo are among the near-dozen financial Websites hit by distributed denial-of-service attacks over the past few weeks. These attacks have disrupted daily operations for banks and made it difficult for customers to take advantage of online banking services. A group calling itself Izz ad-Din al-Qassam Cyber Fighters has claimed credits for most of the incidents and has named the institutions it will target a few days before launching the attacks. Even with the prior warning, Websites of some of the country’s largest firms have been affected: Bank of America, JPMorgan Chase, PNC, U.S. Bank, Wells Fargo, Sun Trust, Regions Financial, Capital One, and BB&T. Capital One Bank was hit with two separate attacks, occurring on Oct. 9 and Oct. 16. HSBC was the latest one to be hit, as its Websites suffered online outages on Thursday. A different group, Fawkes Security, claimed credit, but it’s not clear at this point whether the HSBC incident was different from the attacks against other banks or not. “This denial of service attack did not affect any customer data, but did prevent customers using HSBC online services, including internet banking,” the bank said in a statement on its Website. What are DDoS Attacks? A group of computers send larger than usual volume of traffic data to Websites to tie up server resources. Websites can’t handle the high volume, either knocking it offline entirely or being available only sporadically. “You can picture a distributed denial-of-service attack as being something like 15 fat men trying to get through a revolving door at the same time. Nothing moves,” said Graham Cluley, senior technology consultant at Sophos. Often in DDoS attacks, the computers used to bombard the targeted Websites with traffic have actually been hijacked. The computers are often infected with malware that give attackers control over the computer, usually without the owner’s knowledge. In these banking attacks, however, it appears that the perpetrators have hijacked servers instead of client machines, according to recent analysis by Radware. Difficult to Repel For banking customers, these DDoS attacks are just more annoying than damaging, While online systems have been intermittently unavailable, to date, it doesn’t appear that any customer or account information at any of the banks have been exposed because of the attacks. For financial institutions, they’ve been highly disruptive, as IT departments have to deal with significantly large attacks. “These are big, but we’ve seen this big before,” said Neal Quinn, chief operating officer of Prolexic, told Wired last week. “We’ve seen events this big in the past.” Even knowing that the attacks were coming, financial institutions have been unable to keep the attacks from knocking the sites offline. Each of the targeted banks experienced several hours of downtime, although Wells Fargo seemed to have weathered the crisis a little better than others. “I don’t want to minimize the potential damage it could cause to the industry,” Wells Fargo CFO Tim Sloan told Reuters, “But in terms of how the industry performed and how Wells Fargo performed in reaction to the recent efforts, we actually performed very well.” The bank will continue to invest in ways to defend against future DDoS attacks, according to Sloan, who called it as “a cost of doing business today.” Stay On Guard Even though each of the affected institutions have assured customers that no customer or account data has been compromised, security experts warn that it’s still too early to get complacent. DDoS attacks can often be a diversion so that IT teams don’t notice other malicious activity that may be happening at the same time. Gartner’s Avivah Litan told Government Info Security that she had anecdotal accounts of fraud slipping through banks’ overloaded call centers while the online channels are under attack. It wouldn’t be the first time DDoS attacks were used to distract overloaded administrators. Back in April 2011, Sony didn’t notice the attackers breaking into Sony servers to compromise over 100 million user accounts from the PlayStation Network, Sony Online Entertainment, and Qriocity music service because it was distracted by large-scale DDoS attacks overwhelming its servers, the company said in a letter to Congress. “We are assuming that the attackers are doing this to perpetrate fraud,” Mike Smith, a security evangelist with online security provider Akamai Technologies, told Bank Info Security . Smith was specifically referring to the fact that Capital One was targeted for a second time, which may mean that attackers are looking for different ways to try to compromise employees and get access to customer accounts. “That’s the assumption we are operating under at this point,” Smith said. Source: http://securitywatch.pcmag.com/none/304145-hsbc-falls-in-latest-bank-ddos-attacks-what-s-next

See the original article here:
HSBC Falls in Latest Bank DDoS Attacks, What’s Next?

Microsoft concludes Russian programmer didn't operate Kelihos botnet

Following the settling of the Nitol botnet lawsuit earlier this month, Microsoft has announced on Friday that it has reached a settlement with Russian software programmer Andrey N. Sabelnikov, who was…

Visit site:
Microsoft concludes Russian programmer didn't operate Kelihos botnet