Category Archives: DDoS Vendors

Irish Domains hit with denial of service attack

Web-hosting company Irish Domains was the target of a distributed denial of service (DDoS) attack on Friday, incapacitating numerous websites of its client companies. The company said that it had seen “a significant slowdown” on several services following the DDoS attack, whereby an online service is made unavailable by overwhelming it with traffic from multiple sources. The company said the slowdown was affecting email and web for some sites, adding that it “had experienced a 30x increase in inbound network connections”. “We are implementing some countermeasures to divert unwanted traffic but we expect disruption to service to continue for another while,” Irish Domains said. Brightwater Recruitment and Sherry Fitzgerald were among the companies that use the web hosting services services of Irish Domains and thus experienced issues with their sites. There are two types of DDoS attacks: a network-centric attack which overloads a service by using up bandwidth and an application-layer attack which overloads a service or database with application calls. Source: http://www.irishtimes.com/business/sectors/technology/irish-domains-hit-with-denial-of-service-attack-1.1891838

Continue reading here:
Irish Domains hit with denial of service attack

DDoS attack volumes plummet as NTP servers got patched

Wise to attackers’ exploitation of the Network Time Protocol (NTP) vulnerability to create distributed reflection denial of service (DrDoS) attacks, information security executives thwarted these type…

More here:
DDoS attack volumes plummet as NTP servers got patched

RIA Novosti Website Hit by DDoS Attack

RIA Novosti’s website has fallen foul of a distributed denial-of-service (DDoS) attack by hackers, the agency’s IT specialists reported on Sunday. The mobile version of the website is currently inaccessible. Problems with the website’s full version were also reported for a short period of time. The agency’s terminal for clients has not been hampered. Unidentified hackers first attacked the website of InoSMI. When the attack was neutralized, they attempted to disrupt the work of RIA Novosti’s website. IT specialists are now working to eliminate the disruption that has caused by the attack. This is not the first cyber attack on the news agency. In May 2012, the RIA Novosti website was hit by a DDoS attack from some 2,500 IP-addresses. Another DDoS attack on the agency’s website was carried out in July 2013. Source: http://en.ria.ru/russia/20140803/191676816/RIA-Novosti-Website-Hit-by-Cyber-Attack.html

View the original here:
RIA Novosti Website Hit by DDoS Attack

Amazon cloud infested with DDoS botnets

Security researchers have found yet another exploit on the Amazon cloud computing platform through the Elasticsearch distributed search engine tool. According to analysis, hackers are able to gain access to the search engine to deploy a battalion of botnets on Amazon cloud. The vulnerability should be a cause of alarm and, therefore, merits the attention of enterprises because it could manipulate Amazon cloud platforms in an attempt to launch distributed denial of service attacks against hundreds of thousands of websites. Amazon cloud users can a representational state transfer API to search various documents through Elasticsearch, an open-source search engine server built based on Java. It is more popular among cloud environments for its distributed architecture that enables multiple nodes. Researchers found security issues on the versions 1.1.x of Elasticsearch because its API scripting lacks a mechanism to authenticate access and a sandbox security infrastructure. Therefore, anyone, including hackers, can penetrate Elasticsearch just so easy. After that, attackers could carry out several malicious activities using Elasticsearch’s scripting capability such as carrying out arbitrary code on the server. As of now there is no patch coming from the developers of Elasticsearch. Nonetheless, versions 1.2.0 and up are safe from being exploited by hackers. New offshoots of Mayday Trojan for Linux has been spotted over the past week and the malware already launched DDoS attacks against targets DNS amplification. A Mayday variant was reported to be running on an Amazon server that has been compromised through the Elasticsearch exploit, though there are other platforms that could have been potentially manipulated. However, the Mayday variant did not resort to DNS amplification on the compromised EC2 instances. Instead it was used to launch attacks by flooding several websites with UDP traffic. As a result, many regional banking institutions in the United States and electronics companies in Japan had to transfer their IP addresses to DDoS mitigation service vendors. The Amazon EC2-run virtual machines were also reported to have been attacked by hackers through a CVE-2014-3120 exploit in the 1.1.x versions of Elasticsearch. Researchers observed that many commercial enterprises still use those versions. According also to security researchers, attackers have changed proof-of-concept exploit code for CVE-2014-3120 to install a Web shell developed based on Perl. A Web shell is a script that enables hackers to deploy Linux shell commands backdoor through the Web. The script was then further manipulated to download a fresh variant of the Mayday DDoS botnet. Amazon has already notified its customers about the issue. Source: http://www.techwalls.com/amazon-cloud-infested-ddos-botnets/

See more here:
Amazon cloud infested with DDoS botnets

DDoS attack takes down Cirrus Communications

Fixed wireless broadband provider Cirrus Communications has experienced a distributed denial of service (DDoS) attack that incapacitated half its network. Cirrus provides wireless networks to business, apartment complexes, residential colleges and military bases. The company says it is a last mile provider and prides itself on “competitive pricing … in metropolitan data centres to remote or broadband constrained areas,” an “ability to deliver high bandwidth where organisations need it” and an “Its ability to connect multiple locations for organisations on a breakthrough economic basis.” But over the last day, those services have not been available to all customers, as CEO Eric Heyde told The Register the company yesterday experienced a DDoS attack that took down “more than 50 per cent” of its network and that it experienced “struggles” in the wake of the event. “We are very close to full recovery,” Heyde told The Reg . “We’ve only got a couple of per cent of the network down at present.” [15:30 AEST – Ed} Heyde said the attack hit Cirrus’ core network, rather than the radio equipment on the edge. “It’s too early to say where the attack came from,” he added, and declined to offer further comment on the attack’s origins. Reg readers have suggested the attack has disrupted communications to other carriers that use Cirrus’ services. Source: http://www.theregister.co.uk/2014/07/30/ddos_takes_down_cirrus_communications/

Continued here:
DDoS attack takes down Cirrus Communications

Attackers install DDoS bots on Amazon cloud, exploiting Elasticsearch weakness

Attackers are exploiting a vulnerability in distributed search engine software Elasticsearch to install DDoS malware on Amazon and possibly other cloud servers.   Elasticsearch is an increasingly popular open-source search engine server developed in Java that allows applications to perform full-text search for various types of documents through a REST API (representational state transfer application programming interface). Because it has a distributed architecture that allows for multiple nodes, Elasticsearch is commonly used in cloud environments. It can be deployed on Amazon Elastic Compute Cloud (EC2), Microsoft Azure, Google Compute Engine and other cloud platforms. Versions 1.1.x of Elasticsearch have support for active scripting through API calls in their default configuration. This feature poses a security risk because it doesn’t require authentication and the script code is not sandboxed. Security researchers reported earlier this year that attackers can exploit Elasticsearch’s scripting capability to execute arbitrary code on the underlying server, the issue being tracked as CVE-2014-3120 in the Common Vulnerabilities and Exposures (CVE) database. Elasticsearch’s developers haven’t released a patch for the 1.1.x branch, but starting with version 1.2.0, released on May 22, dynamic scripting is disabled by default. Last week security researchers from Kaspersky Lab found new variants of Mayday, a Trojan program for Linux that’s used to launch distributed denial-of-service (DDoS) attacks. The malware supports several DDoS techniques, including DNS amplification. One of the new Mayday variants was found running on compromised Amazon EC2 server instances, but this is not the only platform being misused, said Kaspersky Lab researcher Kurt Baumgartner Friday in a blog post. The attackers break into EC2 instances—virtual machines run by Amazon EC2 customers—by exploiting the CVE-2014-3120 vulnerability in Elasticsearch 1.1.x, which is still being used by some organizations in active commercial deployments despite being superseded by Elasticsearch 1.2.x and 1.3.x, Baumgartner said.   The Kaspersky researchers managed to observe the early stages of the Elasticsearch attacks on EC2. They said that the attackers modified publicly available proof-of-concept exploit code for CVE-2014-3120 and used it to install a Perl-based Web shell—a backdoor script that allows remote attackers to execute Linux shell commands over the Web. The script, detected by Kaspersky products as Backdoor.Perl.RShell.c, is then used to download the new version of the Mayday DDoS bot, detected as Backdoor.Linux.Mayday.g. The Mayday variant seen on compromised EC2 instances didn’t use DNS amplification and only flooded sites with UDP traffic. Nevertheless, the attacks forced targets, which included a large regional bank in the U.S. and a large electronics maker and service provider from Japan, to switch their IP (Internet Protocol) addresses to those of a DDoS mitigation provider, Baumgartner said. “The flow is also strong enough that Amazon is now notifying their customers, probably because of potential for unexpected accumulation of excessive resource charges for their customers,” he said. “The situation is probably similar at other cloud providers.” Users of Elasticsearch 1.1.x should upgrade to a newer version and those who require the scripting functionality should follow the security recommendations made by the software’s developers in a blog post on July 9. Source: http://www.networkworld.com/article/2458741/attackers-install-ddos-bots-on-amazon-cloud-exploiting-elasticsearch-weakness.html#tk.rss_all

Continue Reading:
Attackers install DDoS bots on Amazon cloud, exploiting Elasticsearch weakness

DDoS attacks grow as first DIY kits emerge

Alongside the report, Trustwave is reporting the discovery of DIY DDoS kits for sale from just US$ 200 (£118) and which give users – apart from a high bandwidth connection – all they need to stage a wide-scale attack. The analysis – from Prolexic Technologies, now part of Akamai – claims to show that distributed denial of service activity has surged by 22 percent over the last quarter, putting levels close to those seen in Q1 of this year, when existing DDoS volume and allied records were broken. Delving into the report reveals there was a 72 percent increase in the average bandwidth of attacks during the second quarter, along with a shift to reflection-based attacks that undermine common web protocols, as well as the arrival of server-side botnets that exploit web vulnerabilities in Windows and Linux-based systems. The analysis concludes that there have been shifts in the industry targets compared with last quarter’s DDOS activity. The difference in these numbers, says the report, may be due to the different types of malicious actors on the Internet that may be active at any particular time. “It is clear that the majority of malicious actors preferred to use of volumetric attacks in Q2 – this trend was seen across all verticals. A significant variant in attack vectors by industry was the use of a very sophisticated botnets against financial and media sites,” notes the report, adding that these attacks do not seem to fit the previous patterns and motives of the DDoS criminal ecosystem. According to Trustwave, meanwhile, its research has revealed that hackers are now selling the Neutrino Bot malware kit, which it can be used to infect a large number of computers, create a botnet, and launch DDoS attacks against websites and services at will. For US$ 500 (£294), meanwhile, hackers will sell all comers BetaBot 1.6, which Trustwave says is a remote access Trojan that can run DDoS attacks, and steal sensitive data, passwords and files from infected systems. Karl Sigler, Trustwave’s threat intelligence manager, said he was unsurprised by the findings. “Supply and demand affects malware markets like they do any market. Even though demand is high, there is an increasing amount of malware competing with each other and this helps drive down the cost. There is also a cost-benefit issue. Criminals look at how much they can make by selling stolen data acquired using the malware. Finally, age plays a role. The longer malware is on the market, the cheaper it tends to get,” he said. Rob Bamforth, a principal analyst with Quocirca, the business analysis and research house, said that the surge in volumes and incidences of DDoS attacks in the second quarter identified by Akamai suggests a larger number of servers being infected by cyber-criminals – coupled with the fact that that many systems `out there’ are Windows XP-based, which has become a legacy operating system since it reached end-of-life with Microsoft back in April. “It also suggests there is a degree of complacency in the business sector, with many managers saying they do not want to invest extra money in IT security, as they do not see a return. Many businesses are suffering an ongoing squeeze on costs, so a failure to invest in security is understandable, even if it is not the correct approach to take,” he told SCMagazineUK.com . Nick Mazitelli, a senior consultant with Context Information Security, meanwhile, said that Akamai’s analysis that the widespread dissemination of increasingly capable attacker toolsets is a trend we see right across the threat landscape, from cyber-crime through to state-sponsored attacks and everything in between. “On the one hand this trend is fuelled by the on-going professionalisation and commoditisation of criminal marketplaces, and on the other by increasing levels of interconnection between threat groups of all stripes. Not only does this mean that existing threat groups have access to improved capability, but it also lowers the barrier of entry for newcomers thereby increasing the number of malicious parties active in the landscape – both factors that unavoidably increase the tempo of what is effectively an arms race between attacker and defender,” he said. “With this increased tempo as background it is important to highlight the necessity of a flexible and adaptable approach to security based on a sound understanding of the threat landscape. In particular those aspects of security concerned with network security monitoring as well as incident response are areas that have often been overlooked in the past, but are critical components of effectively managing the risk and minimising the potential impact of these constantly evolving threats,” he added. Source: http://www.scmagazineuk.com/ddos-attacks-grow-as-first-diy-kits-emerge/article/362573/

Excerpt from:
DDoS attacks grow as first DIY kits emerge

Four fake Google haxbots hit YOUR WEBSITE every day

Goog the perfect ruse to slip into SEO orfice One in every 24 Googlebots is a imitation spam-flinging denial of service villain that masquerades as Mountain View to sneak past web perimeter defences, according to security chaps at Incapsula.…

Read this article:
Four fake Google haxbots hit YOUR WEBSITE every day

Mayhem malware ropes Linux, UNIX servers into botnets

A new malware that researchers have dubbed Mayhem is being used to target Linux and Unix web servers and has so far compromised over 1,400 Linux and FreeBSD servers around the world, warn researchers …

Read the article:
Mayhem malware ropes Linux, UNIX servers into botnets