Category Archives: Security Websies

Anti-Piracy Outfit Denies launching DDoS attacks on Anime Sites

The effects of a DDoS attack that crippled NYAA, one of the largest anime torrent sites, continue today with fingers being pointed at everyone from the Japanese government to an anti-piracy group working with anime distributors. Subtitling site HorribleSubs, which was also affected, has its own ideas. Distributed Denial of Service or DDoS attacks are a relatively common occurrence in the file-sharing community and something that many sites are subjected to throughout the course of a year. They disrupt service and can often cost money to mitigate. Those carrying out the attacks have a variety of motives, from extortion and blackmail to “the lulz“, and a dozen reasons in between. Often the reasons are never discovered. During the past few days several sites involved in the unauthorized sharing of anime have been targeted by DDoS-style attacks. Swaps24 reported that Haruhichan, Tokyo Toshokan and AnimeTake were under assault from assailants unknown, although all now appear to be back online. A far more serious situation has played out at NYAA.se, however. The site is probably the largest public dedicated anime torrent index around and after being hit with an attack last weekend it remains offline today. The attack on NYAA had wider effects too. NYAA and leading fan-subbing site HorribleSubs reportedly shared the same hosting infrastructure so the DDoS attack took down both sites. That’s significant, not least since at the end of August HorribleSubs reported that their titles had been downloaded half a billion times. As the image above shows it now appears that HorribleSubs has recovered (and added torrent magnet links) but the same cannot be said about NYAA. The site’s extended downtime continues with no apparent end in sight. This has resulted in a backlash from the site’s fans and somewhat inevitably accusatory fingers are being pointed at potential DDoS suspects. As far-fetched as it might sound, one of the early suspects was the Japanese government itself. The launch of a brand new anti-piracy campaign last month in partnership with 15 producers certainly provided a motive, but a nation carrying out this kind of assault seems unlikely in the extreme. Quickly, however, an announcement from HorribleSubs turned attentions elsewhere. “Chill down. It’s not just us. Every famous anime sites [are] getting DDoS attacks, but that doesn’t mean this is the end,” the site’s operator wrote on Facebook. “We have located where DDoS are coming from. It’s from ?#?Crunchyroll? and ?#?Funimation? Employees.” Funimation is an US television and film production company best known for its distribution of anime while Crunchyroll is a website and community focused on, among other things, Asian anime and manga. While both could at least have a motive to carry out a DDoS, no evidence has been produced to back up the HorribleSubs claims. That said, HorribleSubs admits that its key motivation is to annoy Crunchyroll. “We do not translate our own shows because we rip from Crunchyroll, FUNimation, Hulu, The Anime Network, Niconico, and Daisuki,” the site’s about page reads, adding: “We aren’t doing this for e-penis but for the sole reason of pissing off Crunchyroll.” Shortly after, attention turned to anti-piracy outfit Remove Your Media (RYM). The company works with anime companies Funimation and Viz Media, which includes the sending of millions of DMCA notices to Google. The spark came when the company published a tweet (now removed) which threatened to send “thousands” of warning letters to NYAA users once the site was back online. This doesn’t seem like an idle threat. A few weeks ago the company posted a screenshot on Twitter containing an unredacted list of Comcast, Charter and CenturyLink IP addresses said to have been monitored infringing copyright. Due to the NYAA downtime, RYM later indicated it had switched to warning users of Kickass.to. This involvement with anime companies combined with the warning notice statement led to DDoS accusations being directed at RYM. TorrentFreak spoke to the company’s Eric Green and asked if they knew anything about the attacks. “The short answer is No. In fact we were waiting for [NYAA] to go back online to begin monitoring illegal transfers again. Sorry to disappoint but we had no involvement,” Green told TF. Just a couple of hours ago RYM made a new announcement on Twitter, stating that the original tweet had been removed due to false accusations. “Nyaa post deleted due to all the Ddos libel directed at this account. Infringement notices continue to ISPs, for piracy, regardless of tracker,” they conclude. Although it’s impossible to say who is behind the attacks, it does seem improbable that an anti-piracy company getting paid to send notices would do something that is a) seriously illegal and b) counter-productive to getting paid for sending notices. That said, it seems likely that someone who doesn’t appreciate unofficial anime sites operating smoothly is behind the attack. Who that might be will remain a mystery, at least for now. Source: http://torrentfreak.com/anti-piracy-outfit-denies-ddosing-anime-sites-140904/

Semalt botnet hijacked nearly 300k computers

The “Semalt” botnet is quickly spreading across the Internet, Incapsula researchers warn. The botnet is named after a Ukrainian startup that poses as a legitimate online SEO service, and it current…

See the original post:
Semalt botnet hijacked nearly 300k computers

DDoS Attacks: Increasingly the Weapon of Choice

Distributed denial of service (DDoS) attacks are a method attackers favor for disrupting an organization’s operations by flooding the network with traffic, overwhelming available bandwidth, and making network resources unavailable. According to research from the Ponemon Institute, DDoS attacks accounted for 18 percent of data center outages in 2013, up from 2 percent in 2010. They found that such attacks are the most costly data-center attacks to mitigate, costing an average of $822,000 per outage, leading to problems such as business disruption, loss of revenues, and reduced productivity. However, the costs can be even higher for organizations that rely on their websites as their main sales vehicle, since the unavailability of those websites can lead to those organizations losing multiple millions of dollars in sales. According to Forrester Research, the average organization loses $27 million for a 24-hour outage, with business services and financial services institutions faring the worst. Despite the damage that DDoS attacks can do in and of themselves, they are often used as a smoke screen to divert resources into clearing up the disruption, leaving organizations unaware of other attacks happening simultaneously. Often, the real motivations are financial manipulation or a competitive takeout. In other cases, the motivations are ideological, looking to hurt or embarrass organizations. For example, in late 2012 to early 2013, 46 financial institutions in the United States were hit with over 200 coordinated and timed DDoS attacks. It is believed that the motivation for this campaign of attacks was to cause consumers to lose their trust in the retail banking system. However, organizations in any walk of life can be impacted, both in the private and public sector, and such attacks should be considered a top concern by any organization, especially as DDoS attacks are increasingly becoming a weapon of choice. Not only are DDoS attacks growing in number and affecting a wider range of organizations, but more tools are becoming available that make them easier to pull off. Whereas previously an attacker would have had to possess a fair degree of skill and recruit an army of computers into a botnet in order to create enough computing power to launch an attack, new attack methods require considerably fewer resources and less skill. DDoS attack kits are now readily available on the Internet for low prices, making the job of a relatively unskilled hacktivist much easier, and DDoS-as-a-service attacks are an increasingly common phenomenon, whereby attackers hire themselves and their botnets out to those wishing to launch attacks. Another recent development is the use of network time protocol amplification attacks, which use publicly available network time protocol servers, the real purpose of which is to provide clock-synchronization services over public networks. Using this method means that attackers no longer need to go through the effort of putting together a botnet to launch their attacks. Recently, there has also been a dramatic rise in mobile applications used in DDoS attacks, driven by the ease with which mobile apps can be downloaded. These apps allow any mobile user to join a DDoS attack if he or she wishes—for example, for an ideological cause with which he or she sympathizes. It is predicted that such attacks will increase dramatically. The tremendous growth in DDoS attacks in 2013 that continued, if not accelerated, in 2014 means that all organizations should beware of the consequences. Where they do not have the resources in-house to defend themselves, organizations should investigate the use of services that can divert traffic away from their networks while remediation measures are taken. While, on the one hand, there is a trend toward increasing complexity and sophistication of attacks, on the other hand, attacks are becoming easier to pull off by an ever-wider range of criminal actors. The DDoS attack landscape is set to become much more complicated, and many more organizations will become victims. All organizations should beware. Source: https://blogs.rsa.com/ddos-attacks-increasingly-weapon-choice/

More here:
DDoS Attacks: Increasingly the Weapon of Choice

Gang behind ‘1.2 billion’ megahack ransack is pwning our customers – hosting firm

CyberVor, huh, yeah. What is it good for? Anecdotal evidence is emerging that the Russian botnet raiders behind the “biggest-ever” password theft have begun attacks against web services using stolen login credentials.…

More here:
Gang behind ‘1.2 billion’ megahack ransack is pwning our customers – hosting firm

FBI probe into hack and DDoS attacks on banks

THE Federal Bureau of Investigation is probing a computer-hacking attack on JPMorgan Chase and as many as four other banks, in what people familiar with the probe described as a significant breach of corporate computer security. The timing and extent of the hacking attacks wasn’t immediately clear, though cybersecurity experts began probing the possible JPMorgan breach earlier this month, according to people familiar with the investigation. Source: http://www.theaustralian.com.au/business/wall-street-journal/fbi-probe-into-hack-attacks-on-banks/story-fnay3ubk-1227040501221?nk=a9c75ab55e6d5171cc79455c78c5564d#

Link:
FBI probe into hack and DDoS attacks on banks

Anonymous Hacked Ferguson Police Servers and Launched a DDOS Attack

Police officers in Ferguson, Missouri have been forced to communicate via text message after Anonymous launched a DDOS attack against the city’s servers shutting them down, following the murder of Michael Brown. On top of that, private servers of the Ferguson police department were hacked to get personal information. Both peaceful and violent protests have taken place in response to the atrocity in Ferguson. Last Thursday, anonymous performed a DDoS attack on Ferguson servers. The attack was in reaction to the murder of 18 year old, Michael Brown, an African American teenager who was killed unjustly by white policemen. Law enforcement officials said recently that the FBI has taken an immense interest in the investigation of hacking attempts directed at the personal computers and online accounts of police officers who are part of the department responsible for the murder. CNN and other mainstream media outlets, in affiliation with three policeman, who’s names are undisclosed, have reported the police as victims of a ‘cyber attack’, suggesting that anonymous is to blame for the violent demonstrations that took place in Ferguson, avoiding the clear fact that the PD of Ferguson are responsible, and a reaction like this is to be expected in result to the killing of an innocent person. This is of no surprise that corporately funded news outlets would be hesitant to speak negatively of the police. In reality, despite the propaganda that the 1% will spew forth, it is organizations like Anonymous that are fighting for freedom, unrestricted by the fascist regulations of a fear-mongering governing body, we can fight for peace using whatever means possible. Source: http://anonopsofficial.blogspot.ca/2014/08/anonymous-hacked-ferguson-police.html

Originally posted here:
Anonymous Hacked Ferguson Police Servers and Launched a DDOS Attack

Kelihos botmasters target Russian patriots to expand botnet

The cyber crooks behind the Kelihos botnet are, once again, trying to swell the number of computers included in it. They are trying a novel approach: posing as a “community Russian programmers,” …

See the original article here:
Kelihos botmasters target Russian patriots to expand botnet

Eve Online Servers Knocked Offline Due to DDoS Attacks

Eve Online, the space-based videogame with over half a million active players, has been forced offline for more than 12 hours due to a series of cyber attacks against a cluster of its servers located in London. According to the Eve Online Status Twitter account, the first signs of trouble were seen at around 8pm on Thursday, 21 August, and by 11pm the Icelandic-based CCP Games which develops the game had confirmed the problem was due to a series of distributed denial of service (DDoS) attacks. DDoS attacks are a common tool used by criminals to flood servers with traffic in order to knock them offline and unavailable to anyone trying to access them. Some had apparently linked the offline status of the game to the recent activity of the Bardarbunga volcano in Iceland which is on the verge of erupting, however CCP Games explicitly ruled this out. The problem is affecting the Tranquility server cluster, which all Eve Online players connect to in order to play the game. This cluster of servers is based in London. Even the Eve Online wiki is inaccessible as it too is seemingly hosted on the Tranquility server. An update from CCP Games on Twitter at 8am on Friday, 22 August, simply saying: “Tranquility is currently under heavy load again” and pointing player to a forum thread. However this thread also appears to be offline at the time of publication. DDoS attacks are often used by unscrupulous companies in order to knock rivals offline for a sustained period of time, with many cyber-criminals renting out DDoS services for as little as £5-an-hour. Eve Online is a massively multiplayer online game set in the fictional world of New Eden where players pilot customisable spaceships through a galaxy of over 7,500 star systems. The game is also unique in that its developers create the structure of New Eden but then handed over control of what happens in the game to the players. The rest is a virtual world where corporations and alliances hold huge power and where huge battles can cost the equivalent of over $300,000 in real world money. Source: http://www.ibtimes.co.uk/eve-online-servers-knocked-offline-due-ddos-attacks-1462180

Continue Reading:
Eve Online Servers Knocked Offline Due to DDoS Attacks

Chinese Linux Trojan makes the jump to Windows – DDoS attacks largely aimed within China

A CHINESE TROJAN , one of the few to be written for the Linux operating system, has seemingly made the jump to Windows. First reported in May by Russian anti-malware software house Dr Web, the original malware known as “Linux.Dnsamp” is a Distributed Denial of Service (DDoS) Trojan, which, according to the company blog, transfers between Linux machines, altering the startup scripts, collecting and sending machine configuration data to the hackers’ server and then running silently waiting for orders. Now it appears that the same hackers have ported the Trojan to run in Windows as “Trojan.Dnsamp.1? The Windows version gains entry to the system under the guise of a Windows Service Test called “My Test 1?. It is then saved in the system folder of the infected machine under the name “vmware-vmx.exe”. When triggered, just like its Linux counterpart, the Trojan sends system information back to the hackers’ central server and then awaits the signal to start a DDoS attack or start downloading other malicious programs. Fortunately, the vast majority of the attacks using this method were aimed at other Chinese websites, which were attacked 28,093 times, but Dr Web warns that US websites came second with nine percent of attacks. Although the threat of malware is an everyday hazard to most computer users, to find an attack on Linux is much rarer, and to find any kind of malware that has been ported from one operating system to another is almost unheard of. In June, RSS reader service Feedly, note app Evernote and streaming music service Deezer all suffered DDoS attacks. Google is working on Project Shield, an initative designed to help smaller web servers fight off DDoS attacks. Source: http://www.theinquirer.net/inquirer/news/2361245/chinese-linux-trojan-makes-the-jump-to-windows

Follow this link:
Chinese Linux Trojan makes the jump to Windows – DDoS attacks largely aimed within China

ZeroLocker ransomware "helps" you get your files back

In early June, the FBI has lead a rather successful multi-national effort to disrupt the GameOver Zeus botnet which was also responsible for delivering Cryptolocker. Unfortunately, that doesn't mean t…