Category Archives: Security Websies

Thai govt website DDoSed as CAT customer data leaked

Faced with a wave of DDoS attacks, a horde of hackers claiming to be Anonymous and major data leaks from state-owned CAT Telecom all in protest of Thailand’s Single Gateway surveillance program, ICT Minister Uttama Savanayana took to Twitter to reassure people that everything was in order and that we had nothing to fear because we have regular data backups. Yes, apparently regular backups and standards in data storage are the answer to a hack and data leak. The tweet was up for most of the weekend before he deleted it to save himself further embarrassment. To recap, a group claiming to be Anonymous issued a statement in the wee hours of Thursday morning to attack the Thai Government and in particular CAT Telecom for refusing to back down on Single Gateway internet super censorship and surveillance project which, despite promises from the Prime Minister that it was just a clerical error never existed, is forging ahead full steam. Since then at various moments, hackers have managed to temporarily take down an obscure army internal accounting website, the ICT Ministry and CAT Telecom. The Anons also posted screenshots of what they claimed was CAT customer data with names blanked out, taunting the ICT Minister by asking what data standard allows for plaintext storage of passwords. CAT Telecom initially responded by saying the information posted was false and that the hackers only tried to infiltrate CAT’s dealer network and did so unsuccessfully at that. The Anons responded with more CAT customer data and a screenshot of a login in CAT’s CRM module. One would have thought that this would have caused the junta to think twice about centralizing everything but no. The ICT Minister had the stage in the weekly two-minutes of hate propaganda show, sorry, I meant Thailand Moves Forward propaganda show, in which he extolled the virtues of a single Geoment Service Chanel [sic] which called for even more centralization. Half the jokes were of using designer clothing to serve the people the other, well, let’s just say that geo in Thai is a anatomical word that would not befit the pages of this publication. So apparently not only he totally clueless as to what a modern day hack is (by saying that he had backup) but he cannot use a spell checker. By Sunday, CAT’s My 3G self-service portal was still down, though whether it was from the attack or if someone pulled the plug as a precaution was anyone’s guess. However, that hardly made the social media circles. Why? Well, because despite oodles of taxpayer cash (roughly $1 billion each for CAT and TOT for their 3G networks, plus who knows how much more to run the network), CAT and TOT have between them less than 100,000 subscribers, none of which bothered to check their balance or top up over the weekend, it seemed. Also noteworthy was how servers in CAT’s data center had their latency and jitter both jump but again, that could be a routing issue rather than someone installing deep-packet-inspection gear. But was the hack actually from a real Anon? Anonymous is more of a state of mind that a club with a for formal job interview and membership cards. Anyone can claim to be an Anon. Their key tenets are anti-surveillance and anti-censorship, both of which the Thai Single Gateway are aimed at imposing. One developer who did not want to be identified told TelecomAsia that the hacks on Thai government websites were simply too easy. He sent a screenshot with a page of .go.th sites with old, unpatched mysql servers that were ripe for taking over. His point being, a script kiddie noob could have carried out hacks on these government websites and it did not require the skills of a true Anon. Source: http://www.telecomasia.net/blog/content/thai-govt-website-ddosed-cat-customer-data-leaked DDoS? Well, considering that Thai government websites cannot even stand up to use on a busy day without crashing, again, that hardly requires serious firepower. The CAT data breach also happened about a month ago if the rumors in the underground are to be believed. Talking about the underground, none of my shadier contacts know who did it the attack. Considering the rather small size of the Thai hacking community, this is odd. To further throw doubt on everything, the F5 hackers dared me over Twitter to double check a phone number in the CAT data breach to see if the data was real or made up. I did call up the number and he had no clue about being hacked and said he was not a CAT customer. Not looking good for the hackers then. To be fair I did try to ask if he was working at the company he was listed as working for but the chap hung up on me first, obviously annoyed at my questions. But perhaps the number had been reused (the phone line application with CAT was way back in August 2014), perhaps he never got the phone line and had totally forgot about it. Or maybe it was made-up data and the hacker thought I would not call to fact-check. At this juncture, my gut feeling is leaning towards this entire episode being a honey trap to lure out dissenters and convince the undecided of the need to give up further liberties so that the government can protect us from Anonymous. If so, that has worked wonders. Then there is the separate matter of the 231 pages of leaked documents that are a headache just to try and read through. Who leaked them and why? It is a curious mix of army and MICT secret documents which begs the question, who would even have access to both sets of documents in the first place? Very few. But regardless as to whether this initial hack was real or staged, the matter of the Thailand’s Single Gateway has now reached the eyes of Anons the world over. One wonders if they are planning a real attack soon.

View article:
Thai govt website DDoSed as CAT customer data leaked

TalkTalk DDoS Attack: Website hit by ‘significant’ breach

Police are investigating a “significant and sustained cyber-attack” on the TalkTalk website, the UK company says. The phone and broadband provider, which has over four million UK customers, said banking details and personal information could have been accessed. TalkTalk said potentially all customers could be affected but it was too early to know what data had been stolen. The Metropolitan Police said no-one had been arrested over Wednesday’s attack but enquiries were ongoing. TalkTalk said in a statement that a criminal investigation had been launched on Thursday. It said there was a chance that some of the following customer data, not all of which was encrypted, had been accessed: Names and addresses Dates of birth Email addresses Telephone numbers TalkTalk account information Credit card and bank details In the wake of the news, the company’s share price dropped by 10% in the first few hours after the London stock exchange opened at 08:00 BST. Cyber security consultant and former Scotland Yard detective Adrian Culley told BBC Radio 4’s Today programme that a Russian Islamist group had posted online to claim responsibility for the attacks. He said hackers claiming to be a cyber-jihadi group had posted data which appeared to be TalkTalk customers’ private information – although he stressed their claim was yet to be verified or investigated. Dido Harding, chief executive of the TalkTalk group, told BBC News the authorities were investigating and she could not comment on the claims. Cyber-attacks on consumer companies happen with mounting frequency, but TalkTalk’s speedy decision to warn all of its customers that their vital data is at risk suggests that this one is very serious indeed. We are being told that this was what’s called a DDoS – a distributed denial of service attack – where a website is hit by waves of traffic so intense that it cannot cope. What is not clear is why this would result in the loss of data rather than just the site going down. One suggestion is that the DDoS was a means of distracting TalkTalk’s defence team while the criminals went about their work. I’m assured that TalkTalk customers’ details, including banking information, were all being held in the UK rather than in some overseas data centre. What is less clear is the extent to which that data was encrypted. For TalkTalk, the cost to its reputation is likely to be very serious. Now it is going to have to reassure its customers that its security practices are robust enough to regain their trust. The TalkTalk website was now secure again and TV, broadband, mobile and phone services had not been affected by the attack, she added. The sales website and the “My account” services are still down but the company hopes to restore them on Friday. Ms Harding added: “It’s too early to know exactly what data has been attacked and what has been stolen,” she said. “Potentially it could affect all of our customers, which is why we are contacting them all by email and we will also write to them as well.” However, customers have expressed their frustration with what is the third cyber-attack to affect TalkTalk over the past 12 months. Sara Jones, from East Sussex, said she found out about the breach in the news. “I have not received a single piece of correspondence. The level of information is lacking. And to think this is Get Safe Online Week! “TalkTalk’s online advice is not proportionate to what has happened. Telling customers to “keep an eye on accounts” just does not cut it in terms of advice.” Daniel Musgrove, from Powys, said he had been unable to get through to TalkTalk customer services. “They may not get a payment for my next bill if they don’t get this sorted,” he added. In August, the company revealed its mobile sales site had been targeted and personal data breached. And in February, TalkTalk customers were warned about scammers who had managed to steal thousands of account numbers and names. The biggest risk is that customers’ details have been stolen and criminals try to impersonate them Dido Harding, TalkTalk group chief executive Ms Harding said: “Unfortunately cybercrime is the crime of our generation. Can our defences be stronger? Absolutely. Can every company’s defences be stronger? “I’m a customer myself of Talk Talk, I’ve been a victim of this attack.” What should you do if you think you’re at risk? Report any unusual activity on your accounts to your bank and the UK’s national fraud and internet crime reporting centre Action Fraud on 0300 123 2040 or www.actionfraud.police.uk TalkTalk is advising customers to change their account password as soon as its website is back up and running – expected to be later on Friday – and any other accounts for which you use the same password Beware of scams: TalkTalk will not call or email customers asking for bank details or for you to download software to your computer, or send emails asking for you to provide your password TalkTalk said it had contacted the major banks asking them to look out for any suspicious activity on customers’ accounts. It added that every customer would be getting a year’s free credit monitoring. Ms Harding said: “The biggest risk is that customers’ details have been stolen and criminals try to impersonate them.” Professor Peter Sommer, an expert an cyber security, said TalkTalk’s rapid growth could be to blame for the breaches. “They are acquiring more customers and each of those customers wants to do more things and so they have to increase their capacity… but that’s an expensive exercise,” he told the BBC. Source: http://www.bbc.com/news/uk-34611857

See the original post:
TalkTalk DDoS Attack: Website hit by ‘significant’ breach

UK e-tailers hit by suspected DDoS barrage

Scan Computers, Novatech and Aria Technology all encountered website disruption yesterday, with the latter confirming a Bitcoin-based DDoS attack was to blame. Aria Taheri, Aria’s eponymous boss, told CRN the firm’s website went down yesterday afternoon for a couple of hours as hackers sent an email demanding the payment of 16.66 Bitcoins (£2,871.43), otherwise they would try to bring the site down for the whole of Wednesday. Fellow e-tailers Novatech and Scan also took to Twitter to inform their customers that there had been problems with their sites, while CCL is another thought to have encountered issues. Scan Computers, Novatech and Aria Technology all encountered website disruption yesterday, with the latter confirming a Bitcoin-based DDoS attack was to blame. Aria Taheri, Aria’s eponymous boss, told CRN the firm’s website went down yesterday afternoon for a couple of hours as hackers sent an email demanding the payment of 16.66 Bitcoins (£2,871.43), otherwise they would try to bring the site down for the whole of Wednesday. Fellow e-tailers Novatech and Scan also took to Twitter to inform their customers that there had been problems with their sites, while CCL is another thought to have encountered issues. Novatech and CCL were unavailable for comment at the time of publication. Elan Raja III, Scan’s director, said: “Scan are aware there has been some disruption in traffic and is investigating the cause.” Taheri said he understood that the website disruption suffered by his competitors was caused by the same DDoS attack and believes other companies in his industry have also received ransoms for Bitcoins this week. Aria’s website was hit in a hack in February 2013 but caught the perpetrators last year after putting up a reward. Taheri is adopting the same tactic on this occasion, posting a £15,000 bounty ( pictured above ) for anyone who provides information to help police catch the hackers. He said the reward is much higher than the Bitcoin ransom because he wants to send a message to the hackers and due to the “principle” of the attack. He said he is not going to pay the ransom demanded as it would send out the wrong message. “These kinds of attacks are only designed to affect our website and make it inaccessible. However, [our customers’] information is 100 per cent secure as we are PCI DSS compliant which is quite a strict web-security protocol. Also, the website unavailability will last for only a short period – a matter of hours – so the customers can always come back at a later time. “We are not going to encourage more of these hackers by giving them Bitcoins, because that would only encourage others to come to us and blackmail us more. The message to the hackers is that I will spend a significant amount of money to bring them to justice. Our track record shows that we have done that before, and based on that track record I am fairly confident we can do that [again].” The attack the cybercriminals have threatened to carry out on Aria’s website tomorrow coincides with a “prime day” on which low prices are offered to customers, Taheri added. On the rise There has been a rise in the number of DDOS attacks demanding Bitcoin ransoms in recent months, with Bloomberg reporting that a cybercriminal group called DDoS for Bitcoin (Distributed Denial of Service for Bitcoin) – or DD4BC – blackmailed financial institutions by threatening to disrupt websites last month unless they paid Bitcoin ransoms. Taheri said the internet datacentre informed him that these kinds of attacks are “on the increase, and the frequency of it is going up at an alarming rate”. One source, who wished to remain anonymous, said the attack is similar to those launched by DD4BC, and could be from a group which is trying to emulate DD4BC. Source: http://www.channelweb.co.uk/crn-uk/news/2431257/uk-e-tailers-hit-by-ddos-barrage

Follow this link:
UK e-tailers hit by suspected DDoS barrage

Infosec workers swipe Q-tip across ‘net: Ew, there’s Dridex on it

Zombie botnet found in sample despite server takedown The Dridex banking botnet is continuing to show some signs of life even after a high-profile FBI-led disruption operation earlier this month.…

More:
Infosec workers swipe Q-tip across ‘net: Ew, there’s Dridex on it

Android Devices Affected By LTE Security Flaw, Could Result in DDoS Attacks

Android users running AT&T and Verizon networks may be susceptible to distributed denial of service (DDoS) attacks. The alert comes from a new advisory posted by Carnegie Mellon University CERT database, which shows that the vulnerability allows hackers to target LTE networks and users. The reason for this vulnerability is primarily due to the way LTE works. Unlike conventional data transfer methods of circuit switching, LTE uses packet switching. The research says that this new method allows hackers to use the SIP protocol to enable a new set of attack vectors via wireless networks. If this loophole is exploited, denial of service attacks can be carried out on these networks and data exploitation along with ‘silent calls’ can be executed, allowing for unlimited phone calls and use of large amounts of data without any records of them in bills. According to the researchers, every Android OS version released to date could be affected by this vulnerability. Google has already been notified about this massive flaw, and has been advised to escalate its permissions on Android. Apple on the other hand has said that its phones aren’t affected by this LTE security flaw. Google itself is likely to release a security update very quickly for its supported Nexus devices to take counter-measurements against the issue. If you have a carrier-provided phone from LG, Samsung, or other brands however, chances are you’ll have to wait a while. Carriers are notorious for releasing updates on snail-like pace. Source: http://techfrag.com/2015/10/17/android-devices-affected-by-lte-security-flaw-could-result-in-ddos-attacks/

Read More:
Android Devices Affected By LTE Security Flaw, Could Result in DDoS Attacks

UK, US law enforcement agencies disrupt Dridex botnet

The UK's National Crime Agency is spearheading an onslaught against the Dridex (aka Bugat, aka Cridex) banking malware and the criminals that wield it. “Dridex malware, also known as Bugat and Crid…

More:
UK, US law enforcement agencies disrupt Dridex botnet

Gamers DDoS Thai government sites to protest “Great Firewall of Thailand”

Gamers and privacy campaigners in Thailand have claimed responsibility for the recent take down of several government websites in a coordinated DDoS attack last week. The attacks were in protest at government plans to route the entire country’s Internet through a single gateway, creating what has become known as “The Great Firewall of Thailand” in a nod to China’s strict control over Internet services. According to Al Jazeera, the Anti-CAT Tower Mob—which includes e-sports gamers amongst its ranks—along with the Citizens Against Single Gateway Facebook groups called upon their hundreds of thousands of Facebook fans to execute a simple DDoS attack. The fans were instructed to visit official government websites while constantly refreshing the page, causing them to crash. Over half a dozen government sites, including the Ministry of Defence, and the main government website, were taken down. In response, Thai Police announced that those targeting government sites could be charged under Article 10 of the Computer Crimes Act of 2007, and face up to five years in prison. While the controversial act has resulted in some amusing law enforcement moments in the past—including Thai military leaders warning against “underboob selfies,” it has also been used to ban Bitcoin, Uber, and dictator-simulation game Tropico 5. An estimated 110,000 websites were blocked as of 2010. With e-sports rapidly growing in popularity across Thailand, gamers have been one of the bigger online groups to oppose the single gateway. They have even personified the gateway plans themselves in the form of an anime-style villain called Nong Kalaland, who’s said to hold “the power to control the internet in her fist.” Her namesake headpiece, a coconut shell (kala), is meant to represent Thailand’s self-obsession and wilful ignorance of the larger world, according to Thai site Khaosod. The Thai government has since backed down from its single gateway plans, with the Minister of Information and Communication Technology, Uttama Savanayana, saying that the plans were simply intended to increase Thailand’s competitive edge in the online economic sector. He added that the single-gateway concept was the prime minister’s idea, and would ensure that young people who used the Internet were shielded from abuse. He also promised that the government would not infringe on the public’s right to privacy and freedom of expression. Source: http://arstechnica.co.uk/tech-policy/2015/10/gamers-ddos-thai-government-sites-to-protest-great-firewall-of-thailand/

Follow this link:
Gamers DDoS Thai government sites to protest “Great Firewall of Thailand”

Attackers prefer lower-bandwidth DDoS attacks

Analyzing customer data, Corero found that attackers are continuing to leverage sub-saturating DDoS attacks with increasing frequency, using shorter attack durations to evade legacy cloud DDoS scrubbi…

Excerpt from:
Attackers prefer lower-bandwidth DDoS attacks

Early warning helped five Russian banks ward off DDoS attacks

Five Russian banks that experienced a distributed denial of service (DDoS) attack Sept. 26 believed to have been aimed at starting a bitcoin-related panic had been warned in advance by the General Directorate of Security and Information Protection of the country’s Central Bank. The regulatory body’s deputy director, Artyom Sychev, was quoted by The CoinTelegraph as saying the attackers were likely trying to cause panic and destabilization rather than collect a bitcoin ransom. The early warning helped the banks fend off the attack, although they did receive threatening letters in the aftermath. The CoinTelegraph also quoted a Central Bank official saying that the letters said, “To prevent such acts in the future, the attackers are asking to send only 50 BTC to their Bitcoin wallet.” Source: http://www.scmagazine.com/ddos-attacks-on-russian-banks-reportedly-aimed-at-causing-bitcoin-panic/article/442842/

View article:
Early warning helped five Russian banks ward off DDoS attacks