Category Archives: Security Websies

Mascow protest against President Vladimir Putin led to indeptendent Russian websites hit with distributed denial-of-service ‘DDoS’ attack

More than 100,000 protesters on Tuesday joined a march against President Vladimir Putin in central Moscow, organizer and radical left-wing activist Sergei Udaltsov told AFP news agency. “There are more than 100,000 people,” Udaltsov said at the rally, called the March of Millions, which police said had drawn 18,000 people. City authorities allowed up to 50,000 to take part in Tuesday’s event, which coincides with the patriotic Russia Day holiday marking the country’s 1990 declaration of independence from Soviet rule. Moscow police said they were sending 12,000 riot officers and interior ministry troops onto the streets of the capital to keep order. The march will take protesters down Moscow’s Boulevard Ring toward Sakharov Avenue, scene of a dramatic demonstration last December against the outcome of disputed parliamentary elections that month. Meanwhile, independent Russian news websites went offline on Tuesday in a suspected attack by pro-government groups, as protesters gathered in Moscow for a march against President Vladimir Putin’s third Kremlin term. The site of the Moscow Echo radio station went down about a half hour before protesters started to gather on central Pushkin Square. The Dozhd (Rain) TV website and that of the prominent opposition Novaya Gazeta twice-weekly newspaper also could not be accessed as the event officially got under way at 0800 GMT. But the websites of Russia’s main media sources ? including Kremlin-allied papers and state-controlled television stations ? were all accessible and operating without delay. A Dozhd newscaster said their station’s website was the victim of a distributed denial-of-service (DDoS) attack of unknown origin. Opposition leaders have been previously blamed attacks on Russian independent media sources on pro-Putin youth groups. A similar attack, which included the inaccessibility of the same websites during the disputed December parliamentary election, was reported but no one claimed responsibility for that attack, AFP reported. The United States on Monday voiced concern after Russian police raided the homes of top protest leaders ahead of the planned mass rally in Moscow. “The United States is deeply concerned by the apparent harassment of Russian political opposition figures on the eve of the planned demonstrations on June 12,” State Department spokeswoman Victoria Nuland told reporters. Police armed with assault rifles carried out a coordinated sweep of the homes of young Russian politicians, who analysts believe represent the biggest threat to ex-KGB spy Putin’s 12-year rule. Nuland also criticized a new law in Russia that imposes “disproportionate penalties” for violating rules on public demonstrations. Russian police were calling in opposition leaders for questioning one hour prior to the planned rally time on Tuesday in a move “clearly designed to take them off the streets during the demonstration,” she said. “Taken together, these measures raise serious questions about the arbitrary use of law enforcement to stifle free speech and free assembly,” she said. Source: http://english.alarabiya.net/articles/2012/06/12/220172.html

See the original article here:
Mascow protest against President Vladimir Putin led to indeptendent Russian websites hit with distributed denial-of-service ‘DDoS’ attack

Wawa’s website under suddle DDoS attack

Hackers caused problems for Wawa’s website, www.wawa.com, late Friday, although it appeared to be back to normal by Saturday. Some visitors to the convenience retailer’s site did not see the usual images of hoagies and smoothies and gasoline promotions. Instead, those images were replaced with a cartoon of Adolf Hitler and the name of the group claiming responsibility, UGNazi. According to a report by The Daily Times, Wawa.com visitors were met with a black screen reading “Welcome Nazis, Targets & Reasons” and the drawing of Hitler. Beneath the group’s name was a list of individuals who allegedly hacked the site: Arya Ebrahimi, Justin Martin, Alex Irvin and Thomas Ryan. The group included a link to follow it on Twitter. UGNazi tweeted about high gasoline prices and plans to also hack the convenience store’s gasoline pumps, reported CBS Philly. According to a Courier Post report, the group tweeted, “How much ?#havoc would be caused by shutting down all of the Wawa gas pumps? Love having access to the gas control relay centers .” In a statement provided to CSP Daily News on Saturday, Wawa public relations director Lori Bruce said, “Please be assured that we have no evidence to indicate our website has been breached. Images on our website were not replaced;  however, a domain name server is being intermittently redirected to a nonlegitimate webpage. We have rectified the situation with our domain registrar, but it may take another 24 hours to propagate to all domain name servers. Until then, people trying to visit Wawa.com may see a page other than Wawa.com.” (The website seemed to be displaying normally by Saturday, with no trace of the bogus page evident.) “Unfortunately, today, many well-known brands have become targets for online mischief or worse. We will continue to actively monitor and report this to the proper authorities,” Bruce added. “This obviously had nothing to do with Wawa and it is certainly not something we condone,” she told the Courier-Post. “We will be working with authorities to get to the bottom of this.” Pennsylvania State Police told the paper that the hacking would fall under the purview of the Internet Crimes Task Force. “We did this not only for the fame but for the ‘lulz’ [“laugh out louds”] and the fact that Wawa has scorching high gas prices and receives many complaints daily,” Cosmo, one of the UGNazi hackers, told technology website Softpedia.com. He claimed that the group has gained access to the websites entire database, but that it has not found anything valuable to leak. According to Wikipedia, UGNazi, also known as the Underground Nazi Hacktivist Group, is a computer hacker group that has claimed responsibility for several attacks conducted over the Internet. It is best known for its “Tango Down” distributed denial of service (DDoS) attacks on U.S. government websites and for leaking the personal information of government officials. The Wawa, Pa.-based c-store chain operates 594 stores in Pennsylvania, New Jersey, Delaware, Maryland and Virginia, of which 311 sell fuel. Source: http://www.cspnet.com/news/technology/articles/wawas-website-hacked

View article:
Wawa’s website under suddle DDoS attack

Security fears for ACT’s govt files

The ACT government’s computer systems fought off more than a million attempts to compromise their security in the nine months to April, the territory’s auditor-general has found. And despite a ”denial of service” attack on a key government website just as the audit was coming to an end, auditor Maxine Cooper has found the territory’s information security system is ”robust”. But Dr Cooper’s report found 95 per cent of the 1025 information management systems in the government’s sprawling network were not complying with the requirement to have a security plan and even fewer had undertaken a threat-and-risk assessment. Advertisement: Story continues below Dr Cooper’s office audited the government’s computer network nine months before March, but as the audit period came to a close, the Justice and Community Safety Directorate’s website came under successful attack. The department, which holds sensitive information from the city’s justice agencies, was targeted by the Anonymous group in what is believed to be a case of mistaken identity. The hackers appeared to believe they were attacking the Australian ”justice department”, protesting the federal government’s attitude toward WikiLeaks founder Julian Assange. Dr Cooper warned that unauthorised accessing of information held by the government, including health and medical records, criminal records, case management records and sensitive government documents could cause strategic damage. But Dr Cooper found successful attacks were externally exceptional in an otherwise good security record for the territory but which could be improved if all government websites were internally hosted. ”The protection of the ACT government network is robust,” the Auditor-General said yesterday. ”Shared Services ICT Security Section’s security regime has successfully defended against over one million attempts to access the ACT government’s network in the nine-month period to 31 March, 2012. ”Future similar breaches could be minimised if all directorate and agency websites were hosted on the ACT government network ran ACT government endorsed supplier.” Dr Cooper also wants to see improvements, including more IT bureaucrats reading up on the essential documents governing security. ”While the administrative structures and processes that support whole and procedures are overall satisfactory there are some shortcomings,” Dr Cooper said. ”ICT security governance is based on the Protective Security Policy and Guidelines which is the ACT government’s pre-eminent protective security document. ”However it is unclear if the status of this document is well understood or if adequate processes exist to ensure that directorates and agencies are complying with it.” The auditor was also unhappy with a failure to put plans in place to secure information management systems in the government network ”Despite it being a requirement, only 5 per cent of the ACT government’s 1025 information management systems have a system security plan; and even fewer, some 2.24 per cent have a threat-and-risk assessment,” she said. Source: http://www.canberratimes.com.au/act-news/security-fears-for-acts-govt-files-20120608-201v5.html

See the original article here:
Security fears for ACT’s govt files

North Korea ships malware-infected games to South Korean users, uses them to launch DDoS attacks

According to an independent report published in Korea’s JoongAng Daily, Seoul’s Metropolitan Police Agency has intercepted a cyber attack plot orchestrated by North Korea’s Reconnaissance General Bureau, which successfully shipped malware-infected games to South Korean users which were later on used to launch a DDoS attack against the web site of Incheon Airport. More details: According to the police, the South Korean man, identified by the surname Jo, traveled to Shenyang, northeastern China, starting in September 2009 and met agents of an alleged North Korean trading company. He allegedly asked them to develop game software to be used in the South. Jo purchased dozens of computer game software for tens of millions of won, which was a third the cost of the same kind of software in the South. The games were infected with malignant viruses, of which Jo knew, an official at the police agency said. Jo sold the games to South Korean operators of online games. When people played the games, the viruses used their computers as zombies, through which the cyberattack was launched. This is the second attempt by North Korea in recent months to engage in electronic warfare with South Korea, following the use of GPS jammers causing difficulties in air and marine traffic controls. What’s particularly interesting about North Korea’s infection vector in this campaign, is that it’s not a novel approach to spread malware. Instead, it relies on a chain of trust, from the unknown origin of the produced games, to the sellers claims that they are malware-free, and ultimately targets bargain hunters. In the past, software piracy has proven to be a key driving force behind the growth of malware campaigns internationally. Distribution of malware-infected games greatly reminds me of a case which happened in Eastern Europe in the 90s where a malware coder participating in a popular IT magazine’s coding contest, on purposely backdoored his game, which ended being shipped to thousands of subscribers on a magazine-branded CD. Although a good example of a flawed QA (Quality Assurance) on behalf of the magazine, South Korean authorities claim that the person who purchased the games actually knew that they were infected with malware, hence the lower price for purchasing them. Just how big of a cyber threat is North Korea? It’s an emerging market player, having actively invested in the concept over the years, that’s for sure. In my recent conversation with cyber warfare expert Jeffrey Carr, he pointed out that he doubts Russia or China will knowingly supply the irrational North Korea with cyber warfare ‘know how’. However, Russia or China’s chain of command doesn’t need to know that this outsourcing will ever take place, as North Korea could easily outsource to sophisticated cybercriminals doing it for the money, not for the fame. Summary: Seoul’s Metropolitan Police Agency has intercepted a cyber attack plot orchestrated by North Korea’s Reconnaissance General Bureau, which successfully shipped malware-infected games to South Korean users. Source: http://www.zdnet.com/blog/security/north-korea-ships-malware-infected-games-to-south-korean-users-uses-them-to-launch-ddos-attacks/12383

See more here:
North Korea ships malware-infected games to South Korean users, uses them to launch DDoS attacks

Counting the cost of a DDoS attack

In the past month, the Information Commissioner’s Office (ICO), the Leveson inquiry website, Visa and Virgin Media have all been hit by distributed denial of service (DDoS) attacks. Much had been made of the motives for such attacks, and the methods that attackers use, but what impact do they have on the victim’s finances? John Pescatore, analyst at research firm Gartner, told Computing that there were three main costs associated with attacks. “There is the cost of the outage, as it means that a business’s customers cannot reach them through the internet. Then there is the cost of making the attack stop – and, often, a third cost in the form of a potential extortion fee,” he said. Obviously losses vary, depending on how much revenue is generated directly from a company’s web presence. John Roberts, head of managed services at MSP Redstone, said: “If a betting organisation trades £600m a year – or £2m a day in revenue terms – and 50 per cent of that comes from the web, then they are losing £1m a day.” Any web-dependent organisation within the global 1,000 might incur similar losses, he added. But there are some less obvious victims of these blunt-instrument attacks. “A Scottish football club who were playing in a European match had its website taken down by the opposing teams’ fans with a DDoS attack. The club was not able to generate significant revenue, because a number of its customers were signed up to stream live games on a monthly fee basis. So an organisation as innocuous as a football club can lose hundreds of thousands of pounds as well,” Roberts said. Public-sector bodies can also suffer substantial financial damage through loss of productivity. “There is a cost implication for local government as people will be looking to procure services over the internet. If those services are unavailable, public-sector staff will receive a lot more incoming phone calls,” he said. Other repercussions are harder to assess and quantify. For example, businesses can suffer reputational damage from DDoS attacks, said Andrew Kellett, analyst at research firm Ovum. “With [the attack on] the Serious Organised Crime Authority [SOCA], the issue was that this was not the first time it had been exposed to a DDoS attack. You would have thought that enough resilience would have been built after the first attack to deal with something similar a year later,” he said. But Gartner’s Pescatore said that reputational damage is often less severe than many organisations fear; customers are used to websites not working for any number of other reasons that are not related to DDoS attacks. “There is reputational damage if the website is defaced or if the website is attacked and customers’ financial information is disclosed, but DDoS generally does not have much of a reputational impact,” he argued. Kellett disagreed and emphasised that reputational damage can itself cause financial loss to enterprises, as their customers opt for an alternative service from a similar provider. He warned that DDoS attacks could also be used as cover for a simultaneous assault on the targeted business. “The noise around  DDoS attacks can be used to hide another backdoor-style assault, such as data being stolen from within the organisation. “There is an example of clerical records, including credit card information, being stolen from an organisation when a DDoS attack was taking place. It was a hacktivist attack where the credit card details were used to make donations to a charity. For any organisation protecting those details it would be both embarrassing and expensive, as they could lose customers and have to repay anyone who has had money taken from their accounts,” he said. Pescatore said that, of the three costs typically associated with DDoS attacks, extortion attempts have reduced significantly. “In the last two years, businesses have not paid off extortion attempts and are focusing on putting in place services to mitigate DDoS attacks. Several years ago there were incidents where it was deemed less expensive to pay off the attackers as they would only be asking for €5,000,” he said. Source: http://www.computing.co.uk/ctg/analysis/2181680/analysis-counting-cost-ddos-attack

More:
Counting the cost of a DDoS attack

Flashback botmasters earned less than $15K

It has already been established that the criminals behind the Flashback botnet were after money, but according to Symantec researchers, their plan was foiled by the attention that the first massive Ma…

Read the original:
Flashback botmasters earned less than $15K

Dedicated appliances for protection against DDoS

Fortinet introduced the FortiDDoS product family for enterprises, Web hosting and cloud service providers. The new FortiDDoS-100A, FortiDDoS-200A and FortiDDoS-300A are dedicated appliances that a…

Continue reading here:
Dedicated appliances for protection against DDoS

SpyEye botnet for sale at bottom price

A drop in the price asked for the latest version of the SpyEye botnet has security researchers worrying that users might soon be targeted with an increasing amount of infection attempts. A Pastebin…

Read more here:
SpyEye botnet for sale at bottom price