DNS and NTP servers are not the only publicly accessible resources that can be misused to amplify DDoS attacks. Sucuri CTO Daniel Cid revealed details of a recent incident in which they received a …
Original post:
Over 162,000 WordPress sites exploited in DDoS attack
Distributed Denial of Service (DDoS) attacks aren’t new and 2013 was one of the worst years when it comes to such attacks that too through the use of large botnets and / or specialised DDoS tools; however, use of legitimate WordPress blogs and sites to carry out such attacks is something that isn’t widespread, but is becoming a trend lately. According to Sucuri Research over 162,000 legitimate WordPress blogs and sites were a part of huge DDoS attacks on one of its client’s website. The attacker(s) used WordPress websites as indirect amplification vectors through a simple one line command. “Any WordPress site with XML-RPC enabled (which is on by default) can be used in DDOS attacks against other sites”, notes Sucuri CTO and OSSEC Founder Daniel Cid in a blog post. Cid explained that the DDoS attack was a large layer 7 HTTP-based distributed flood attack through which the perpetrators forced legit WordPress sites to send out thousands of requests per second to the victim’s servers. All the GET requests being sent to victim’s servers had a random value that bypassed their caching mechanism thereby forcing to load the whole page on every request, which killed the server quickly. “One attacker can use thousands of popular and clean WordPress sites to perform their DDOS attack, while being hidden in the shadows, and that all happens with a simple ping back request to the XML-RPC file” revealed Cid. Cid provides a couple of workarounds to ensure that your WordPress site isn’t DDoSing someone else’s site. First is to disable the XML-RPC (pingback) functionality from your site. This can be done by removing the xmlrpc.php or disabling the notifications in your blog’s settings. However, the thing is as soon as you upgrade your WordPress, the file come right back. Another solution is that users use some cloud based security solution or proxy site that will ensure that such misuse is prohibited. “This is a well known issue within WordPress and the core team is aware of it, it’s not something that will be patched though. In many cases this same issue is categorized as a feature, one that many plugins use, so in there lies the dilemma”, concludes Cid. Source: http://www.techienews.co.uk/977737/160000-legitimate-wordpress-sites-used-ddos/
Read this article:
Over 160,000 legitimate WordPress sites used for DDoS attack
It seems cybercriminals are no longer content just to bring down Web sites with their distributed denial-of-service (DDoS) attacks. Now, these cybercrooks are demanding ransom from Web site owners to call off their DDoS assaults, leaving victims between a rock and a hard place — either pay up or watch their sites go dark. Distributed denial-of-service (DDoS) attacks are booming, and may be reaching new levels that include more blackmail. According to recent reports, we could be entering a new phase of site attacks. Prolexic, a security firm, issued a report this month that said attacks in general, in particular DDoS, were up 32 percent in the last year over 2012. DDoS attacks generally utilize networks of hijacked computers, which then bombard targeted Web sites with requests that overwhelm them, causing the sites to crash. While such attacks have been common for years, new benchmarks are appearing. In February, security firm Cloudfare reported that it recently helped protect one of its clients against the largest DDoS attack on record. The unnamed Web site, according to Cloudfare, was subjected to 400 gigabytes per second, nearly a third larger than the 2013 attack on antispam Web site Spamhaus. The Spamhaus attack, also fended off by Cloudfare, had been the largest on record to that point. $300 Ransom Last month, domain registration company Namecheap reported it had been assaulted by a coordinated attack on 300 of its registered sites. This week, social networker Meetup.com said attackers demanded a $300 ransom in exchange for calling off a DDoS attack. The site refused, and was brought down for several days, including over the Oscars weekend when many Meetup users scheduled get-togethers. In a blog post, CEO Scott Heiferman said that his company did not want to negotiate with criminals, especially since the low ransom demand apparently meant the attackers were amateurs who might be encouraged to engage in more such efforts. Reportedly, such ransom demands, especially when no user confidential data is involved, are not uncommon but are not frequently made public. A New Era Has Dawned Lawrence Orans, research vice president at industry research firm Gartner, told us that we may indeed be in a new era. He said, “[The] DDoS attack landscape changed in September, 2012, when attackers began to launch attacks using botnets of compromised servers, instead of botnets of compromised PCs.” He added that these server botnets enabled attackers to launch more powerful attacks, and the key event in that month occurred when cyberattacker group Izz Ad-Din Al Qassam “started to launch attacks, using botnets of servers, against major North American banks.” A report late last year from the Ponemon Institute said that nearly 20 percent of U.S. data center outages resulted from organized attacks on Web sites. Orans noted that DDoS attacks can span from several hours to several days, and ISPs are currently charging “a 15 percent premium over bandwidth costs to offer a ‘clean pipe’ service to monitor and mitigate against DDoS attacks.” Some estimates peg the average cost of a DDoS outage at about $630,000. To counter this, Orans said that enterprises in verticals commonly targeted for DDoS attacks “should consider specialty DDoS mitigation providers,” or DDoS mitigation services provided by ISPs. Source: http://www.toptechnews.com/news/DDoS-Attacks-Entering-a-New-Era/story.xhtml?story_id=0120013PJXVC
Original post:
DDoS Attacks May Be Entering a New Era
The Meetup site is down after a hacker attempted to extort $300 from the site’s CEO Scott Heiferman. The social networking site was the victim of a DDoS attack that was allegedly paid for by one of Meetup’s competitors. The attack began on Thursday when CEO Scott Heiferman received an email that reads: Date: Thu, Feb 27, 2014 at 10:26 AM Subject: DDoS attack, warning A competitor asked me to perform a DDoS attack on your website. I can stop the attack for $300 USD. Let me know if you are interested in my offer. As soon as Heiferman received the email, the attack began and overwhelmed Meetup’s servers. The site went down and stayed that way for nearly 24 hours. The success of the site being back up was short-lived as Meetup was hit again and again with numerous DDoS attacks over the course of the weekend. Why is Meetup Site Down? Hacker Attempts to Extort $300 From CEO Scott Heiferman – photo from Twitter Stating his reasons for not paying the hacker behind the attack, Heiferman wrote on Meetup’s blog: We chose not to pay because: 1. We made a decision not to negotiate with criminals. 2. The extortion dollar amount suggests this to be the work of amateurs, but the attack is sophisticated. We believe this lowball amount is a trick to see if we are the kind of target who would pay. We believe if we pay, the criminals would simply demand much more. 3. Payment could make us (and all well-meaning organizations like us) a target for further extortion demands as word spreads in the criminal world. 4. We are confident we can protect Meetup from this aggressive attack, even if it will take time. As of right now, the site is still down as the Meetup team continues to secure its servers. When users attempt to log onto the site, they are met with the following error message: Over the past several days, Meetup has suffered a prolonged denial of service (DDoS) attack, resulting in intermittent service outages for our website and apps. We’re working urgently to bring Meetup back and restore full functionality. We appreciate your patience. Heiferman encourages all Meetup users to stay informed by receiving updates via Twitter, Facebook or the company’s blog. Why is Meetup Site Down? Hacker Attempts to Extort $300 From CEO Scott Heiferman. Source: http://americanlivewire.com/2014-03-03-meetup-site-down/
Taken from:
Why is Meetup Site Down? Hacker Attempts to Extort $300 From CEO Scott Heiferman
$300 or the trendy website gets it … and the website got it Meetup.com has gone public with one of the most paltry ransom demands The Register has seen – but rather than pay up to end a distributed denial-of-service (DDoS) attack, the klatch organizer instead put up with its site being repeatedly hosed offline, we’re told.…
Read the original:
Miscreant menaces Meetup, minuscule money mania mashed
The DDoS war is ramping up with the use of network time protocol (NTP) amplification to paralyse, not just individual organisation’s networks, but potentially large proportions of general internet traffic. The largest ever DDoS attack to date with a DNS amplification hit the anti-spam company, Spamhaus last year. This attack reached 300 Gbps, taking Spamhaus offline and also affecting the DDoS mitigation firm, CloudFare. With the volume of traffic that was going through peering exchanges and transit providers, the attack also slowed down internet traffic for everyone else. However, in the last couple of months these UDP amplification attacks seem to have moved on to NTP, taking advantage of an exploit available in older, unpatched NTP systems. These servers are usually used for time synchronisation and utilise the UDP protocol on port 123. Like DNS, they will respond to commands issued by any client to query certain information, unless they are properly secured. These attack styles are not new, but their historically infrequent usage and the potential for mass disruption means they warrant more attention. Coverage of these attack styles in both industry and mainstream press is to be welcomed in my opinion, because these attacks are relatively defensible and coverage will hopefully get more administrators to secure or patch their NTP servers. What is all the fuss about? DNS amplification attacks ramp up the power of a botnet when targeting a victim. The basic technique of a DNS amplification attack is to spoof the IP address of the intended target and send a request for large DNS zone files to any number of open recursive DNS servers. The DNS server then responds to the request, sending the large DNS zone answer to the attack target rather than the attacker, because the source IP was spoofed. The DNS amplification attack on Spamhaus saw request data (the data the attacker sent to the DNS servers) of roughly 36 bytes in length, while the response data (the data from the DNS server to the attack target) was around 3000 bytes, meaning the attackers increased the bandwidth used by 100x. Not only is that a large increase in attack bandwidth, but these packets from the DNS servers arrive at the target in a fragmented state due to their large size and have to be reassembled, which ties up the routing resources as well. NTP amplification attacks work by spoofing the IP of the attack target and sending a ’monlist’ command request to the NTP servers. This command will return the IP addresses of the last 600 clients that have used the NTP server to synchronise time. By issuing this command a small request packet can trigger much larger UDP response packets containing active IP addresses and other data. The volume of the response data is related to the number of clients that communicate with any particular NTP server. This means that a single request which consists of a single 64-byte UDP packet can be increased to 100 responses each, which contain the last 600 client IP addresses that have synchronised with the server. Each of those 100 responses will be a UDP packet of around 482 bytes which gives the attacker a bandwidth amplification of around 700x [482 bytes x 100 responses = 48200 bytes / 64 bytes = 753.125]. With this level of amplification available and several popular DDoS attack tools already including a module for abusing ’monlist’ we could be on for a new record in DDoS attack size this year unless the vulnerabilities are patched soon. For example, if DNS amplification created a 300 Gbps, then NTP amplification means we could potentially see a 2.1 Tbps (21,000 Gbps) attack. There is no network that could absorb an attack of that size; it would have an enormous knock-on effect on general Internet traffic as the Spamhaus attack did with peering points, transit providers and content delivery networks being overloaded. This isn’t to say that DNS and NTP are the only amplification attack methods. There are other amplification and reflection-style tactics as well and, while not as popular as more tried-and-true DDoS methods, they represent a real threat if you are not prepared for them. Fixing the problem The easiest way to fix this and remove your NTP servers from being an attack vector for a DDoS is to update your NTP servers to version 4.2.7 which removes the ‘monlist’ command. Otherwise you can disable query within your NTP server via a configuration change: nano /etc/ntp.conf [Your configuration file might be located elsewhere] #Restrict general access to this device Restrict default ignore Restrict xxx.xxx.xxx.xxx mask 255.255.255.255 nomodify notrap Noquery This change will prevent your NTP server from being used to launch DDoS attacks against other networks, but an update to the latest version is still recommended. Conclusion DDoS attacks have been around in one form or another since the very beginnings of the internet, but the motivations, as well as the scale of these attacks seem to have grown significantly. In the early days it was just extortion; a hacker would ask for payment to stop the attacks. Nowadays, some businesses may pay for competitors to be attacked, as a few hours offline could be worth millions. You also have DDoS being used as a method of political activism by groups such as Anonymous, as well as the potential for a government to use DDoS to disrupt another country’s infrastructure. Systems administrators need to ensure their systems are reviewed regularly for patches and known vulnerabilities. If systems are left unpatched then at best you can be used as a vector to attack another network or organisation, but at worst those vulnerabilities could be exploited to take your systems offline or steal your data. Source: http://blogs.techworld.com/industry-insight/2014/02/the-rise-of-udp-based-ddos-attacks/index.htm
Read more here:
The rise of UDP-based DDoS attacks
Brazilian hackers have issued threats to disrupt this summer’s FIFA World Cup and there are worries that the telecommunications infrastructure won’t be able to cope with the attacks. Reuters spoke to hacking groups headquartered in Brazil that are planning to attack the event due to the global exposure it will give them and they are confident of bringing down some of the largest sites involved with the tournament. “We are already making plans,” said an alleged hacker who goes by the name Eduarda Dioratto. “I don’t think there is much they can do to stop us.” Distributed denial of service [DDoS] attacks are reportedly the weapon of choice for Brazil’s hackers to target sites operated by FIFA and the Brazilian government as well as other sponsors and organisers. “The attacks will be directed against official websites and those of companies sponsoring the Cup,” a hacker known as Che Commodore told Reuters over Skype.Some of the problems that could be exploited include overstrained networks, widespread use of pirated programming and little care taken to invest in online security. The same report also states that one of the “world’s most sophisticated cyber criminal communities” already operates in the country and it has already started to scupper ticket sales through phishing. “It’s not a question of whether the Cup will be targeted, but when,” said William Beer, a cybersecurity expert with the consultancy firm Alvarez & Marsal. “So resilience and response become extremely important.” FIFA has yet to comment on the issue and the country itself is confident that it is at least some way prepared for any attacks that are launched. “It would be reckless for any nation to say it’s 100 percent prepared for a threat,” said General José Carlos dos Santos, the head of the cyber command for Brazil’s army. “But Brazil is prepared to respond to the most likely cyber threats.” During the Confederations Cup 2013, the traditional dress rehearsal for the World Cup, the cyber command stopped over 300 cyber attacks and dos Santos added that the number will be “much higher” during the tournament proper. Source: http://www.itproportal.com/2014/02/26/cyber-attacks-ready-to-lay-siege-to-2014-world-cup/#ixzz2uZ9neK9Q
Read More:
Cyber attacks ready to lay siege to 2014 World Cup
Online URL shortening services provided by Bitly are down due to a DDoS attack and engineers were trying to solve the issues at the time of publishing Online URL shortening service provided by Bitly was under a major DDoS (distributed denial-of-service attack) on Wednesday. The website states the problem on a banner on their site and a tweet was put out by the company that its services would be restored eventually. Bitly’s internal team of engineers are working on fixing the problem. We are currently working to mitigate a DDoS attack. Some of our site may be unavailable, but we’re working to restore full functionality. — Bitly (@Bitly) February 26, 2014 Services to the links was resumed a little later, however damage from the attack was still being worked on at the time of publishing this article. Bitly, informs on their website, “All links are working after mitigating an earlier DDOS attack. Some link metrics may still be delayed.” Update: All links are working after mitigating an earlier DDOS attack. Some link metrics may still be delayed. — Bitly (@Bitly) February 26, 2014 What is DDoS attack? – Distributed denial-of-service (DDoS) attack is an attempt to make a machine or network resource unavailable to its intended users. – Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. – As clarification, DDoS (Distributed Denial of Service) attacks are sent by two or more persons, or bots. – DoS (Denial of Service) attacks are sent by one person or system. The company Bitly, Inc. was established in 2008 and is privately held and based in New York City. Bitly shortens more than one billion links per month, for use in social networking, SMS, and email services and is relied for accuracy and reliability. No doubt, this caused some what of a furor online with people even going so far as to refer to this attack as the ‘death of the internet’. #bitly is down. The internet is dying — iwyg (@_iwyg_) February 26, 2014 Why are so many #Bitly links failing to open today?? What’s up @hootsuite ?? — Slaweezy (@Slaweezy) February 26, 2014 On no #bitly is down and I haven’t had my fix of web based stats yet for the day #marketingbreakdown — Steve Scheja-Terry (@Von_Steve) February 26, 2014 The web is collapsing! #bitly is down! — Ben R. Hodges (@BenHodgesH2O) February 26, 2014
View article:
Bitly faces complete shutdown of services due to DDoS attack
A man is being charged with attacking websites belonging to the Home Office and the Home Secretary Theresa May. Mark Lynden Johnson, 43, from Stoke-on-Trent, is being charged with encouraging or assisting an offence under the Computer Misuse Act. He is due to appear at Birmingham Magistrates’ Court on 12 March. Both websites were taken offline during attacks between 15 and 18 June 2012, the Crown Prosecution Service (CPS) said. The websites were subjected to a Distributed Denial Of Service attack, also known as a DDoS attack, which prevented visitors accessing them, a CPS spokesperson said. A DDoS attack floods a webserver with so many requests that it can no longer respond to legitimate users. Source: http://www.bbc.co.uk/news/uk-england-stoke-staffordshire-26341874
Continue reading here:
Theresa May Home Office website DDoS attack: Man charged
One of the largest ever cyber attacks took place this month and it has been cited that it was the shape of things to come. But it is not all doom and gloom – there is plenty that businesses can do to prepare for the future. Start by thinking about the impact of your website being down for a day to three days and how it would affect current and prospective clients and the reputation of your brand. Google is usually the first port of call when checking out products and services, so chances are high that any disruption to your web experience won’t be favourably looked upon by prospects. Cyber criminals will often inject malware into legitimate websites with the goal of getting innocent users to click on it, which will automatically trigger a download and can lead to all sorts of problems for the user. As the website owner, you may be completely unaware, but this is something that Google is cracking down on. If a website is spotted hosting malicious links, Google can blacklist it, meaning it will not show up in searches and it will temporarily remove it from the Google index, which badly affects SEO. Browsers, such as Chrome, Firefox etc will also flag insecure or risky websites and that may scare away potential customers. It may take weeks of effort to get removed from blacklists and re-indexed. If this wasn’t bad enough, the risk is actually two-fold. There are some would-be attackers that will threaten to hold your website to ransom. In this case, they will identify the holes in your website and blackmail you into paying them in order for them not to get your website blacklisted. The best way to avoid getting blacklisted, or indeed blackmailed, is to have the website checked for malware and other infections. And it is also highly recommended to have your website scanned for known vulnerabilities. This will ensure that there are no “holes” that attackers can exploit to install malware or create watering holes for unsuspecting customers. Another issue to avoid falling victim to is a DDoS attack. DDoS attacks bombard a website with so many external communication requests that it floods the system and overloads the server to such a point that it can no longer function, leaving the website paralysed and unable to transact business. Attacks of this nature are on the rise and it’s fair to predict that this year will be no exception to this trend. The best start is to have a plan in place- whether it is a hardware solution that takes days to install and requires a higher up-front cost; or a provider who offers DDoS protection services that can be up and running in as little as a few hours for a monthly cost. In addition, it’s worth noting that some good DDoS protection services will offer a caching component that will allow bursts of legitimate traffic to your website without negatively impacting on the server. Because it will automatically balance the load coming in, it keeps the website available to handle large amounts of requests with no disruption to your user base. So, make sure you do your research when choosing the best option for your website. Bear in mind that, while you can get a protection service in an emergency situation, as with so many things, the best offense is a good defence, so businesses should make sure that they have a proactive DDoS solution in place to avoid disruption to your web presence. Top tips: 1) Run malware detection and anti-virus on your website to spot and clear any existing infections 2) Enlist the services of a vulnerability scanner to identify and fix any exploits in your website 3) Have proactive DDoS protection in place; either in the form of hardware or a managed service 4) Have load balancing in place to ensure your website can handle increases in transactions Source: http://www.itproportal.com/2014/02/21/cyber-attacks-preventing-disruption-your-website/
Read More:
Cyber attacks: preventing disruption to your website