Researcher allegedly blocked after he went public A security consultant who works for Telefonica has turned up a bug in how Snapchat handles authentication tokens, which enables a denial-of-service attack against users’ phones.…
Read More:
Snapchat bug lets hackers aim DENIAL of SERVICE attacks at YOUR MOBE
JTRIG active intelligence unit boasts of bugging and burgling At the start of this week, documents released by whistleblower Edward Snowden detailed DDOS attacks on chatrooms by a British online intelligence unit dubbed the Joint Threat Research Intelligence Group (JTRIG). Now he has released a new trove showing that JTRIG is about much more than purely online annoyances.…
View article:
Snowden documents show British digital spies use viruses and ‘honey traps’
What’s new in the threat of DDoS attacks? This year there are a new kind of tactics, and I think we’ll see a rise in the new kinds of DDoS. The conventional understanding of DDos is one that involves volume and capacity. You’ll see massive waves of attackers coming at you. But what we’re starting to see is that while that’s still in play, there’s a much more sophisticated kind of attack starting to become more common – and that’s application layer attacks. You don’t need as much volume, and it’s very very hard to detect. DDoS attackers are now expending quite a lot of effort to spoof legitimate sessions. They’ll do a fair amount of reconnaissance on their target, identify where the weakness or vulnerabilities are – say, a login page. And they know that if they run 20, or 50 or maybe 100 concurrent sessions that login, it’ll lock up the backend database, rendering the site down. Ultimately that’s what the DDoS attacker wants to do. It’s a very crude intention, and in this way it’s relatively easy to do with a small amount of bandwidth. This method is much more sophisticated, it takes a lot more expertise, but you know how it is: once it becomes commonplace, it’ll be easy to access these tools and botnets, and these kinds of attacks will proliferate. Right now in the mitigation industry, a lot of companies are offering platforms that can deal with the traditional interpretation of DDoS, but I think the industry’s going to be challenged quite a bit to deal with the more sophisticated and more targeted kind of attacks. Why are some sites more vulnerable than others? Ultimately every website is designed differently. If you talk to designers, you’ll find each of your guys has their own style, which can lead to a number of vulnerabilities, depending on the code, and how the php code has been implemented in the background. If you look at some of the website designs, they start off with the baseline config, they build up over time and don’t change the baseline coding. Then all of a sudden it’s like a Jenga tower. You hit the one holding up the bottom, and it’s all going to fall over. For instance one of the most common problems is when the way you entire data into the database isn’t sanitised well enough, you can throw in a whole series of commands that literally lock up the database. It’s a much smarter way of doing this, and it’s much harder to track. So how are security companies going to deal with that? The strategy right now is less preventing an attack, and more: how quickly can you respond? You need to analyse, parse, and create a quick, customised ruleset that’s very granular and can be applied to specific parts of the website – an element, or a UI for instance. Are they managing to keep ahead of the threat? Well this is the problem: in any security initiative, be it DDoS, or the guys doing data theft, they have the upper hand. All they need is the one strike, and boom – the rest of the industry has to catch up. I think as a whole, the security industry is pretty good at catching up. But we’ll always be reacting. It’s easy to get into. DDoS is still the easiest way to cause havoc and attack an organisation. You can go and rent a botnet for a hundred bucks an hour or even less, now, and just fill a pipe as a crude way of trying to take a site down. It’s still effective, based on where the solution is hosted. It’s far easier than learning the skills necessary to pull off a data theft or something like that. Source: http://www.itproportal.com/2014/02/04/the-future-of-ddos-and-how-to-stay-ahead-of-attacks/
Visit link:
The future of DDoS, and how to stay ahead of attacks
Distributed denial-of-service (DDoS) attacks against mobile networks and data centers are increasing significantly: mobile DDoS attacks alone have more than doubled last year, with nearly a quarter of respondents in a new study indicating that they have seen attacks impacting their mobile Internet infrastructure. In addition, more than 70% operating data centers reported DDoS attacks over the last year, up dramatically from the year before. According to Arbor Networks’ 9th Annual Worldwide Infrastructure Security Report (WISR), more than a third of responding data centers experienced attacks that exceeded total available internet connectivity, nearly double from the previous year. Staggeringly, about 10% saw more than 100 attacks per month. The report also found that DNS infrastructure remains vulnerable. Just over one-third experienced customer-impacting DDoS attacks on DNS infrastructure – an increase of a quarter over the previous year. “Despite a really high-profile year for DNS amplification attacks, including the largest attack ever monitored (Spamhaus), there are still a significant number of open DNS resolvers out there within the survey base,” said Andrew Cockburn, consulting engineer for Arbor’s carrier group, in a blog. “Fully 20% of our respondents do not restrict recursive lookups, which when extrapolated to the entire base of DNS resolvers, makes for rich pickings among those that are interested in launching this kind of attack.” He added that after the Spamhaus attack, which was very well-publicized, Arbor saw a large number of copycat attacks in the months following. “And despite this, the number of open resolvers stayed pretty consistent with last year’s survey,” he said. “I think that the increase in lack of internal organizations with specific responsibility for DNS infrastructure is partly to blame. Without a targeted and holistic approach to security, such organizations have no way to connect the dots between their decisions to leave a resolver open, and the associated security risks.” The report found that more than a quarter of respondents indicated that there is no security group within their organizations with formal responsibility for DNS security, up 19% from the previous report. Also, there’s been a dramatic rise in DDoS attack size in general. In all previous years of the survey, the largest reported attack was 100Gbps. This year, attacks peaked at 309Gbps, and multiple respondents reported attacks larger than 100Gbps. “Last year we saw eight times the number of attacks over 20Gbps when compared to 2012,” said Darren Anstee, solutions architect for EMEA at Arbor. “In short, attackers seem to have re-focused on utilizing large volumetric attacks to achieve their goals and this illustrates why layered DDoS defense is such an important message. “ Meanwhile, internal network, advanced persistent threats (APTs) and ubiquitous application-layer attacks continue to be everyday reality for IT departments too. The proportion of respondents seeing APTs on their networks has increased from 22% to 30% year over year – and respondents ranked botted hosts as their No. 1 concern. “The other key aspect of the results this year, from my perspective, relates to internal network threats,” Anstee said. “Over half of respondents this year indicated that they had seen botted/compromised hosts and or APTs on their internal networks during the survey period. This clearly shows that threats are getting inside networks, either around or through perimeter defenses. Organizations need to augment their security postures so that they can identify suspicious or malicious activities wherever they might occur on their networks.” The report also found that application-layer attacks are now common, with nearly all respondents indicating they have seen them during this survey period. There has also been continued strong growth in application-layer attacks targeting encrypted web services (HTTPS): these are up 17% over the previous year’s report. Source: http://www.infosecurity-magazine.com/view/36687/ddos-surges-in-mobile-and-data-centers/
Read the article:
DDoS Surges in Mobile and Data Centers
FBI went down to Georgia Russian national Aleksandr Andreevich Panin has pleaded guilty to charges of banking and wire fraud for his role in developing the SpyEye Trojan, which used botnets of enslaved computers to harvest financial credentials from internet users around the world.…
See more here:
Russian SpyEye author pleads guilty to starting malware onslaught
DDoS attacks will continue to be a serious issue in 2014 – as attackers become more agile and their tools become more sophisticated, according to Radware. Their report was compiled using data from ove…
Read the original post:
DDoS attacks become smarter, faster and more severe
In 2006, Mitchell Frost, then a 19-year-old college student at the University of Akron, used the school’s computer network to control the botnets he had created. Authorities say between August 2006 and March 2007, Frost launched a series of denial of service (DDOS) attacks against several conservative web sites, including Billoreilly.com, Anncoulter.com and Rudy Giuliani’s campaign site, Joinrudy2008.com. He is accused of taking down the O’Reilly site five times, as well as disrupting the University of Akron’s network during a DDOS attack Frost allegedly launched on a gaming server hosted by the university. Frost’s dorm room at the university was raided in March 2007. What followed, according to Frost, was a long, complicated legal battle that ultimately lead to him spending over two years behind bars and owing thousands of dollars in legal and restitution fees for his crimes. Frost was released from prison in 2012 and is now serving probation. Frost took the time to talk to CSO about his experience and delves into the reasons why he did it, his thoughts on the punishment he received and his plans for the future. Tell us about your background. How did you become so knowledgeable about computers and when did hacking become something that interested you? I started on computers around a young age and I have always had a mind that wants to keep exploring and learning. Hacking didn’t start overnight, it all started by networking really. First I wanted to be able to have music without paying for it, so I joined some chat rooms on IRC (Internet Relay Chat). IRC is not used much, it’s typically used only by smaller groups of hackers and gamers. When I was younger I would spend many hours in a row on the computer, and when I woke up or had free time, just continue on with what I was working on. You build skills and make connections with others and keep moving up until you have background in hacking. Let’s just say I built my way up over the years 2000-2007. What inspired you to do the kind of hacking you did in 2006 and 2007 to those conservative web sites? What were you hoping to accomplish by hacking those particular sites? How did you choose your targets and why? In 2006, I was young and, even at that age, I could see there was a lot of corruption and media propaganda going on in newspapers and on television. At that time, I had a rather large and complicated botnet. With the botnet, I was able to use the compromised computers for almost anything; key strokes, DDOS, servers, passwords, pranks. I had several botnets over the years from a few to thousands and didn’t do a whole lot of DDOS on servers because I had no need to. I decided that I had to do something about what I was seeing in the world around me, so I knocked a couple of websites offline at the time thinking it will prevent the hate and conflict and fear mongering from being seen by people. When it became clear you were going to face punishment for the attacks, did you think it would mean jail time? They raided me in March of 2007 right after spring break. They took some computer stuff and took my roommate’s stuff and had three agencies do the raid (FBI, Secret Service, Homeland Security) all with guns pointed right at my head. They brought me into a room and said “if you help yourself now it will be easier at sentencing.” I didn’t answer any questions. They released me and didn’t say much. I was scared shitless after that. I didn’t know what to do. I remember now going to a class after the raid to take a math test and was shaking so bad. About one day later, they expelled me from the school, even though I was not charged with anything yet. I moved back home and then contacted the Federal Public Defenders office in Cleveland and was assigned a lawyer. He said cases like mine take time and to stay out of trouble and he would get back to me. I moved back home and got a job working as a carpet-cleaning technician. From 2007 and on, I tried to live a normal life but had that fear that something was coming. I ended up meeting my wife. We fell in love and she got pregnant in December of 2009. Around May of 2010, my lawyer said I randomly received a judge and that it didn’t look good because of her previous sentencing history. I was hoping for maybe a small amount of time or probation, considering I did not get arrested at the time of the raid in March 2007 and had not yet. I was living in fear for almost 4 years, not going to friends or out to parties and all that. The judge ended up giving me 30 months and tried to place me under arrest right at the sentencing hearing. When she did this, it took the prosecutor and my lawyer to walk up to the bench and say I am not a flight risk with a newborn on the way and I knew about these potential charges for three years, so why couldn’t I self-report? She finally agreed to let me self-report so I can tie up some things with my family before my time. There was some debate after your sentencing about whether or not the penalty was too harsh. Do you think it was too extreme? Way too extreme. Who was the victim? Yes, a couple of people had their servers down for a small period of time, but the jacked-up estimates of the damages were over inflated. Example: they said it took $10,000 for them to press one button on one switch to get access back to the network. The reasoning for the sentence has to do with amount of money lost, etc. Bill O’Reilly said he needed to spend $300,000 to upgrade his systems. My lawyer did not fight or really look into their claims of money loss. I think they should of come to some plea with me within a year of the initial raid so I could of dealt with this problem and moved on with my life. Maybe do 3-4 months in some low-security prison and some intensive probation would have been the same. Now it will end up costing me about 10 years of my life — 2006 started it and by the time I’m off probation it will be 2016. All for taking some servers offline. You tell me: is that fair? What has this experience taught you? The experience is not over yet and is far from. I have learned to keep to myself when I see something unjust or unfair or unbalanced all I can do is stay clear of it and talk to people I know or influence and explain my point of view without any damages, physical or monetary. Last year, there was a lot of sadness and discussion around the suicide of Reddit co-founder Aaron Schwartz. As you know, Schwartz was facing a trial after being arrested on allegations of breaching a computer network to download millions of pages of documents kept at MIT. Many feel he was being too harshly prosecuted for the crime and it drove him to suicide. What are your thoughts on that, having faced a sentence yourself? I am very familar with Aaron Schwartz. Did you know he chose to take his case to trial because he was not guilty? He was murdered and it was made to look like a suicide. Who would ignore a plea deal with no jail time, wait for trial and then commit suicide? All he did was download some stuff from the MIT library — most of it was like 30 years old. He was prosecuted because of his ties to a grassroots movement for Internet freedom. What’s next for you? What are you plans for the future? I am rebuilding my life the best I can for having limited resources. I was released Election Day 2012. I was stuck living in a halfway house in the slums of Toledo, Ohio. Then I had to go up the chain of the BOP and the halfway house to get released to home detention. That took about 2.5 months. I started probation on March 8th, 2013. I work at a small store in a town where my wife’s parents let us live in a rental, so we pay them what we can. I pretty much cannot go to school because I owe so much to U of Akron and I have $50,000 in fines and restitution. They take a percentage of my pay each check to give to Bill O’Reilly. I guess when you’re worth $50 million, why not ruin some guy’s life and future and suck every check he makes? I guess my life is not going anywhere until I am off probation. I would like to be a wireless network security consultant, or a real news reporter for the independent media. I will continue to try and make my son and wife’s life the best I can for the position I am in. Source: http://www.computerworld.com/s/article/9245624/Why_I_did_it_Former_hacker_Mitchell_Frost_explains_his_motivation?source=rss_latest_content
View article:
Former hacker Mitchell Frost explains his motivation for launching a DDoS attack
Scheiße! Überprüfen Sie Ihre Angaben in neuen Datenbank Officials in Germany have warned that large networks of hijacked, hacker-controlled PCs – aka botnets – have harvested 16 million email address and password combinations for websites and other online services.…
See more here:
Botnet PC armies gulp down 16 MILLION logins from around the web: Find out if you’re a victim
The cyber crime networks that refuse to die
Read More:
Why zombie botnets refuse to die
Internet of Things security scares already need to take a chill pill It’s still silly season, it seems. Tell the world that a bunch of small business broadband routers have been compromised and recruited into botnets, and the world yawns.…
Continue reading here:
SPAM supposedly spotted leaving the fridge