Category Archives: DDoS Criminals

Thai govt website DDoSed as CAT customer data leaked

Faced with a wave of DDoS attacks, a horde of hackers claiming to be Anonymous and major data leaks from state-owned CAT Telecom all in protest of Thailand’s Single Gateway surveillance program, ICT Minister Uttama Savanayana took to Twitter to reassure people that everything was in order and that we had nothing to fear because we have regular data backups. Yes, apparently regular backups and standards in data storage are the answer to a hack and data leak. The tweet was up for most of the weekend before he deleted it to save himself further embarrassment. To recap, a group claiming to be Anonymous issued a statement in the wee hours of Thursday morning to attack the Thai Government and in particular CAT Telecom for refusing to back down on Single Gateway internet super censorship and surveillance project which, despite promises from the Prime Minister that it was just a clerical error never existed, is forging ahead full steam. Since then at various moments, hackers have managed to temporarily take down an obscure army internal accounting website, the ICT Ministry and CAT Telecom. The Anons also posted screenshots of what they claimed was CAT customer data with names blanked out, taunting the ICT Minister by asking what data standard allows for plaintext storage of passwords. CAT Telecom initially responded by saying the information posted was false and that the hackers only tried to infiltrate CAT’s dealer network and did so unsuccessfully at that. The Anons responded with more CAT customer data and a screenshot of a login in CAT’s CRM module. One would have thought that this would have caused the junta to think twice about centralizing everything but no. The ICT Minister had the stage in the weekly two-minutes of hate propaganda show, sorry, I meant Thailand Moves Forward propaganda show, in which he extolled the virtues of a single Geoment Service Chanel [sic] which called for even more centralization. Half the jokes were of using designer clothing to serve the people the other, well, let’s just say that geo in Thai is a anatomical word that would not befit the pages of this publication. So apparently not only he totally clueless as to what a modern day hack is (by saying that he had backup) but he cannot use a spell checker. By Sunday, CAT’s My 3G self-service portal was still down, though whether it was from the attack or if someone pulled the plug as a precaution was anyone’s guess. However, that hardly made the social media circles. Why? Well, because despite oodles of taxpayer cash (roughly $1 billion each for CAT and TOT for their 3G networks, plus who knows how much more to run the network), CAT and TOT have between them less than 100,000 subscribers, none of which bothered to check their balance or top up over the weekend, it seemed. Also noteworthy was how servers in CAT’s data center had their latency and jitter both jump but again, that could be a routing issue rather than someone installing deep-packet-inspection gear. But was the hack actually from a real Anon? Anonymous is more of a state of mind that a club with a for formal job interview and membership cards. Anyone can claim to be an Anon. Their key tenets are anti-surveillance and anti-censorship, both of which the Thai Single Gateway are aimed at imposing. One developer who did not want to be identified told TelecomAsia that the hacks on Thai government websites were simply too easy. He sent a screenshot with a page of .go.th sites with old, unpatched mysql servers that were ripe for taking over. His point being, a script kiddie noob could have carried out hacks on these government websites and it did not require the skills of a true Anon. Source: http://www.telecomasia.net/blog/content/thai-govt-website-ddosed-cat-customer-data-leaked DDoS? Well, considering that Thai government websites cannot even stand up to use on a busy day without crashing, again, that hardly requires serious firepower. The CAT data breach also happened about a month ago if the rumors in the underground are to be believed. Talking about the underground, none of my shadier contacts know who did it the attack. Considering the rather small size of the Thai hacking community, this is odd. To further throw doubt on everything, the F5 hackers dared me over Twitter to double check a phone number in the CAT data breach to see if the data was real or made up. I did call up the number and he had no clue about being hacked and said he was not a CAT customer. Not looking good for the hackers then. To be fair I did try to ask if he was working at the company he was listed as working for but the chap hung up on me first, obviously annoyed at my questions. But perhaps the number had been reused (the phone line application with CAT was way back in August 2014), perhaps he never got the phone line and had totally forgot about it. Or maybe it was made-up data and the hacker thought I would not call to fact-check. At this juncture, my gut feeling is leaning towards this entire episode being a honey trap to lure out dissenters and convince the undecided of the need to give up further liberties so that the government can protect us from Anonymous. If so, that has worked wonders. Then there is the separate matter of the 231 pages of leaked documents that are a headache just to try and read through. Who leaked them and why? It is a curious mix of army and MICT secret documents which begs the question, who would even have access to both sets of documents in the first place? Very few. But regardless as to whether this initial hack was real or staged, the matter of the Thailand’s Single Gateway has now reached the eyes of Anons the world over. One wonders if they are planning a real attack soon.

View article:
Thai govt website DDoSed as CAT customer data leaked

Attackers hijack CCTV cameras to launch DDoS attacks

Default and weak credentials on embedded devices can lead to powerful botnets We’ve reached a point that security researchers have long warned is coming: Insecure embedded devices connected to the Internet are routinely being hacked and used in attacks. Want to add a bunch of users without going out of your mind? We show you how to do that, and more. The latest example is a distributed denial-of-service (DDoS) attack detected recently by security firm Imperva. It was a traditional HTTP flood aimed at overloading a resource on a cloud service, but the malicious requests came from surveillance cameras protecting businesses around the world instead of a typical computer botnet. The attack peaked at 20,000 requests per second and originated from around 900 closed-circuit television (CCTV) cameras running embedded versions of Linux and the BusyBox toolkit, researchers from Imperva’s Incapsula team said in a blog post Wednesday. When analyzing one of the hijacked cameras that happened to be located in a store close to the team’s office, the researchers found that it was infected with a variant of a known malware program designed for ARM versions of Linux that’s known as Bashlite, Lightaidra or GayFgt. While infecting computers with malware these days requires software exploits and social engineering, compromising the CCTV cameras that were used in this attack was very easy as they were all accessible over the Internet via Telnet or SSH with default or weak credentials. Insecure out-of-the-box configurations are a common issue in the embedded device world and have been for a long time. In 2013, an anonymous researcher hijacked 420,000 Internet-accessible embedded devices that had default or no login passwords and used them in an experiment to map the whole Internet. However, the problem is getting worse. The push by device manufacturers to connect things such as refrigerators or “smart” light bulbs to the Internet is largely done without consideration for security implications or an overhaul of outdated practices. As a result, the number of easily hackable embedded devices is growing fast. Shortly after the CCTV camera-based attack was mitigated, a separate DDoS attack was detected that originated from a botnet of network-attached storage (NAS) devices, the Imperva researchers said. “And yes, you guessed it, those were also compromised by brute-force dictionary attacks.” Source: http://www.computerworld.com/article/2996079/internet-of-things/attackers-hijack-cctv-cameras-to-launch-ddos-attacks.html

Continue Reading:
Attackers hijack CCTV cameras to launch DDoS attacks

Cyber-miscreants use Brit e-tailers as personal cash machines

Bunch of online resellers hit by serious issues this week British e-tailers are trying to manage website disruption after they were systematically targeted this week by DDoS extortionists.…

See more here:
Cyber-miscreants use Brit e-tailers as personal cash machines

Rossiya Segodnya Information Agency Suffers Major DDoS Attack

There was a major distributed-denial-of-service (DDoS) attack on Rossiya Segodnya International Information Agency resources, including the Sputnik website and newswire, the company’s IT department said Saturday. The attack restricted access to desktop and mobile versions of the Sputnik website. IT specialists managed to ensure the timely release of news pieces to the newswire clients. The agency’s press service said that IT specialists were working to establish the details of the attack that restricted access to desktop and mobile versions of the Sputnik website. “Rossiya Segodnya websites and mailing services were unavailable to users for two hours starting at 7:00 p.m. Moscow time [16:00 GMT],” the press service said. DDoS attacks are caused by a large number of Internet users or software simultaneously sending requests to a website until it exceeds its capacity to handle Internet traffic. The Sputnik site was unavailable for almost two hours. Source: http://sputniknews.com/art_living/20151017/1028682238/sputnik-ddos-attack.html

More:
Rossiya Segodnya Information Agency Suffers Major DDoS Attack

Android Devices Affected By LTE Security Flaw, Could Result in DDoS Attacks

Android users running AT&T and Verizon networks may be susceptible to distributed denial of service (DDoS) attacks. The alert comes from a new advisory posted by Carnegie Mellon University CERT database, which shows that the vulnerability allows hackers to target LTE networks and users. The reason for this vulnerability is primarily due to the way LTE works. Unlike conventional data transfer methods of circuit switching, LTE uses packet switching. The research says that this new method allows hackers to use the SIP protocol to enable a new set of attack vectors via wireless networks. If this loophole is exploited, denial of service attacks can be carried out on these networks and data exploitation along with ‘silent calls’ can be executed, allowing for unlimited phone calls and use of large amounts of data without any records of them in bills. According to the researchers, every Android OS version released to date could be affected by this vulnerability. Google has already been notified about this massive flaw, and has been advised to escalate its permissions on Android. Apple on the other hand has said that its phones aren’t affected by this LTE security flaw. Google itself is likely to release a security update very quickly for its supported Nexus devices to take counter-measurements against the issue. If you have a carrier-provided phone from LG, Samsung, or other brands however, chances are you’ll have to wait a while. Carriers are notorious for releasing updates on snail-like pace. Source: http://techfrag.com/2015/10/17/android-devices-affected-by-lte-security-flaw-could-result-in-ddos-attacks/

oneZero outages the result of Chinese DDoS attacks

Continuing our exclusive coverage of the events unfolding at forex solutions provider oneZero, LeapRate has learned that the outages hitting oneZero and thereby some of its hosted clients over the past week are the result of distributed denial-of-service (DDoS) attacks being made against the company. After engaging multiple security contractors, the company has isolated the attacks and has determined that they originate out of China. A distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users. It is the result of multiple compromised systems (for example a botnet) flooding the targeted system – usually one or more web servers – with traffic. The most serious attacks are distributed, meaning that the attack source is more than one (and often thousands) of unique IP addresses. Many of the cases involve forging of IP sender addresses (IP address spoofing) so that the location of the attacking machines cannot easily be identified, nor can filtering be done based on the source address. For these and other reasons, DDoS attacks are typically very effective and difficult to mitigate. oneZero management indicated to LeapRate that the attack against them has been made with a very high level of sophistication, but that the company is working very closely with security contractors and with its clients and expects the situation to be resolved. The attack against oneZero appears to be solely targeting connectivity, and has not at all affected the company’s own systems, so that no company or client data has been compromised. And so far, there has been no attempt to exploit the attack – DDoS hackers often try to blackmail their targets, requiring some sort of ransom to be paid in order to remove the attacks. Source: http://leaprate.com/2015/10/onezero-outages-the-result-of-chinese-ddos-attacks-leaprate-exclusive/

Read this article:
oneZero outages the result of Chinese DDoS attacks

Star Trek Online, Neverwinter Online struck by DDoS attacks twice in one day

Over the weekend video gamers who enjoy exploring the galaxy in Star Trek Online and fighting orcs with swords in Neverwinter Online found themselves briefly unable to do so. Some players described lag spiking so high that characters began “rubber banding”–or repeatedly teleporting back every time a player tries to move somewhere else. Cryptic Studios, Inc., the developer of Star Trek Online and Neverwinter quickly tweeted about the problem. The attack, a distributed denial of service (DDoS) attack hit the servers affecting both games and caused the network supporting them to crumble. The first hit the servers at approximately noon PST on Sunday and the second at 8pm PST on the same day. These sorts of attacks are commonly used by Internet trolls and rabble rousers to attract attention such as the likes of Lizard Squad, DerpTrolling, and LulzSec. Gaming networks are particularly susceptible to DDoS attacks with potentially thousands (or hundreds of thousands) of players expecting a flawless experience that requires the quick response of networks and servers. The attacker who claimed responsibility in the case of the Cryptic Studio’s properties is named NeverGodz (@NeverWinterGod) and may have only targeted Neverwinter Online –the effect on Star Trek Online ’s servers mere collateral damage in the attack. Due to the nature of DDoS, the damage rarely affects just one service, and can disrupt the entire data center or network node adjacent to the target. There were two separate attacks committed by @NeverwinterGod. Both attacks lasted long enough to bring both games down and make it difficult for players to log in or play. Players of both games went to Reddit ( Neverwinter Online , Star Trek Online ) and Twitter to voice their confusion as to the server issues and cited the tweets from Cryptic when they did. Some, such as STO commentator Lootcritter expressed curiosity over the reason for the attacks. So far, most attackers who hit online games have appeared to claim they do it “for the lulz,” or because the attacker is having fun. Although some, like Lizard Squad, claimed to do it to show how security at these sites is lax and unable to withstand attacks. Surviving DDoS attacks has nothing to do with traditional cybersecurity, however, and everything to do with the power and reaction time of network engineers. Most of the Internet mayhem crews and DDoS attackers to hit online games have been young, male and out to make names for themselves by causing disruption. The claims and trumpets of @NeverWinterGod looks no different. DDoS attacks easier, on the rise and a constant threat to online games In 2013, CloudFlare, Inc. CEO Matthew Prince predicted that DDoS attacks would only expand in scope and ease in 2014 and this has remained true for 2015. In April of this year, Arbor Networks, Inc. reported one of the largest DDoS attacks ever detected at 334Gbps. Akamai Technologies Limited backed up these figures stating that attacks had increased in volume and quality, the report stated that the total number of DDoS attacks increased 132.43 percent compared to Q2 2014. As for ease, one of the takeaways from Lizard Squad’s arrival was the launch of the Lizard Stresser DDoS-for-hire service, it is still online today. Although few would be foolish enough to use it after it’s previous hacks. According to Nexusguard Inc. there is a thriving market in DDoS-for-hire services even before Lizard Squad came on the scene, but if an ad hoc Internet mayhem crew could build one it shows how easily such a setup can be built. DDoS attacks are not easy to stop. Due to their distributed nature it’s impossible to squash them at the source, since the attack uses thousands to millions of computers across the globe to produce garbage connections and data directed at the target. Halting the attack at the target is difficult because all that garbage traffic can saturate the network across multiple tiers. Network engineers from anti-DDoS outfits such as Nexusguard need to work with upstream providers to filter out the garbage traffic before it reaches the smaller networks. Stopping a DDoS attack takes a lot of coordinated effort across region-spanning networks and affects more properties than just the intended target. Much in the same way a traffic jam in a city can make multiple exits from a freeway inaccessible. Efforts continue to attempt to thwart DDoS attacks, but it looks as if 2015 will continue to be a year when the volume and capabilities of attacks will rise. Update 09/14/2015 2:25pm PST: Star Trek Online and Neverwinter Online are under DDoS attack again today starting at approximately 1:45pm PST. Tweets suggest that the attacker is targeting Cryptic Studio’s Boston datacenters but did not last long, a mere 20 minutes. The attacker has shown an interest in knocking the servers offline repeatedly so there may be further attempts today. Source: http://siliconangle.com/blog/2015/09/14/star-trek-online-neverwinter-online-struck-by-ddos-attacks-twice-in-one-day/

Visit site:
Star Trek Online, Neverwinter Online struck by DDoS attacks twice in one day

Poker Players Behind DDoS Attacks?

Have you ever wondered who exactly is responsible for the rash of Distributed Denial of Service (DDoS) attacks being aimed at online poker sites ? Such attacks have hit a number of poker rooms in recent months, including the big boys such as PokerStars and Partypoker . Even the regulated poker sites in New Jersey faced a DDoS incident over the summer, with the attackers demanding a ransom be paid in Bitcoin. Of course, the ransom was not paid, and likely never will be whenever computer miscreants attempt such schemes now or in the future. The DDoS attackers must know that taking poker sites hostage won’t result in a big payday via extortion. But could their motive be the possibility of a large payday in some other fashion? WPN a Frequent Victim Take, for instance, the case of the Winning Poker Network . WPN’s Million Dollar Sunday tournaments that guarantee a $1 million prize pool and $200,000 to the winner have repeatedly fallen victim to DDoS attacks. As I understand it, last Sunday’s event was hit once again, although WPN was apparently able to mitigate the damage and keep the tournament rolling. That was not the case last year, when WPN had to cancel such an event after several hours of play, much to the chagrin of players who were stoked and ready to take a shot at that huge prize money. It seems that someone out there has a real vendetta against WPN , targeting those $1 million guaranteed tourneys in particular. Sheldon Adelson Cleared Who could hate online poker so much to want to snuff out the only million-dollar guaranteed tournaments available to U.S. players? Ah, Sheldon Adelson certainly comes to mind. He of the Coalition to Stop Internet Gambling who has vowed to spend whatever it takes to do so. But we can likely rule out the billionaire octogenarian. His knowledge of computers and how they work is obviously lacking. Anyone who believes that youngsters can lose their parents’ house with the click of a mouse certainly wouldn’t understand the finer points of a DDoS attack and how it might be carried out. Poker Players to Blame? Which leads us to what might be the real motive behind the DDoS attacks at WPN. Many believe that the culprits are computer hackers bent on creating havoc and destruction. But could it be that poker players hoping to scare other players away from the Million Dollar Sundays are taking aim at the network? After all, the last two events featured overlays of over $200,000 . Those are nice-sized overlays, which may be the result of players avoiding Million Dollar Sundays due to the cancellation of a $1 million guaranteed event last year and the repeated DDoS attacks that WPN has been subjected to on Sundays this year. Would poker players do such a thing? Nah, they are all upstanding citizens who don’t need to resort to such tactics for monetary gain Source: http://www.pokerupdate.com/news/industry-and-market-analysis/poker-players-behind-ddos-attacks/

View the original here:
Poker Players Behind DDoS Attacks?

Five detained in KPN, Ziggo DDoS cyberattack

Four underage boys and one man were arrested for cyberattacks on the internet service providers Ziggo and KPN. The five were interrogated by the police department’s High Tech Crime Team (THTC) throughout Tuesday following the arrest for Distributed Denial-of-Service (DDoS) attacks on both companies. All suspects were released Tuesday night after questioning. Two attacks on Ziggo in August left internet and email users without services for days, affecting a recorded 1.8 million of the company’s customers, including hospitals and medical facilities. Ziggo previously said they would not be refunding customers for their time without service. The quintet is also accused of posting videos that threatened DDoS attacks against both KPN and Ziggo, although they tried to remain unidentifiable in the video threat. Journalists at the NL Times viewed the videos at the time of the attacks on YouTube. At the time of the cyberattacks, videos surfaced online claiming responsibility, and an allegiance to hacktivist collective Anonymous. Police reported that their impression was that “The boys wanted to show that they were capable of great things.” The three youths aged between 14 and 17 years and the 21-year-old man hail from the Gelderland towns of Berkelland and Lochem, the Noord-Holland municipalities Den Helder and Schoorl, and Vinkeveen in Utrecht. Their computers, mobile phones, external hard drives and USB memory sticks were all seized from their families’ homes. The prosecutor assigned to the case decided they will wait to proceed further until investigators conclude their analysis. Police and the Public Prosecutor have urged that this is not a game and carries a criminal prosecution with up to 10 years imprisonment and the possibility of financial compensation for the damage done. Source: http://www.nltimes.nl/2015/10/07/five-detained-in-kpn-ziggo-ddos-cyberattack/

View article:
Five detained in KPN, Ziggo DDoS cyberattack

Gamers DDoS Thai government sites to protest “Great Firewall of Thailand”

Gamers and privacy campaigners in Thailand have claimed responsibility for the recent take down of several government websites in a coordinated DDoS attack last week. The attacks were in protest at government plans to route the entire country’s Internet through a single gateway, creating what has become known as “The Great Firewall of Thailand” in a nod to China’s strict control over Internet services. According to Al Jazeera, the Anti-CAT Tower Mob—which includes e-sports gamers amongst its ranks—along with the Citizens Against Single Gateway Facebook groups called upon their hundreds of thousands of Facebook fans to execute a simple DDoS attack. The fans were instructed to visit official government websites while constantly refreshing the page, causing them to crash. Over half a dozen government sites, including the Ministry of Defence, and the main government website, were taken down. In response, Thai Police announced that those targeting government sites could be charged under Article 10 of the Computer Crimes Act of 2007, and face up to five years in prison. While the controversial act has resulted in some amusing law enforcement moments in the past—including Thai military leaders warning against “underboob selfies,” it has also been used to ban Bitcoin, Uber, and dictator-simulation game Tropico 5. An estimated 110,000 websites were blocked as of 2010. With e-sports rapidly growing in popularity across Thailand, gamers have been one of the bigger online groups to oppose the single gateway. They have even personified the gateway plans themselves in the form of an anime-style villain called Nong Kalaland, who’s said to hold “the power to control the internet in her fist.” Her namesake headpiece, a coconut shell (kala), is meant to represent Thailand’s self-obsession and wilful ignorance of the larger world, according to Thai site Khaosod. The Thai government has since backed down from its single gateway plans, with the Minister of Information and Communication Technology, Uttama Savanayana, saying that the plans were simply intended to increase Thailand’s competitive edge in the online economic sector. He added that the single-gateway concept was the prime minister’s idea, and would ensure that young people who used the Internet were shielded from abuse. He also promised that the government would not infringe on the public’s right to privacy and freedom of expression. Source: http://arstechnica.co.uk/tech-policy/2015/10/gamers-ddos-thai-government-sites-to-protest-great-firewall-of-thailand/

Follow this link:
Gamers DDoS Thai government sites to protest “Great Firewall of Thailand”