Tag Archives: ddos-defense

University of Georgia hit by DDoS Attack

The University of Georgia was the victim of a cyberattack Sunday night which blocked all Internet access for everyone on campus using the school’s network. The DDoS — distributed denial of service — attack came from outside UGA’s network, and began about 6:10 p.m., according to an email sent Monday by Timothy Chester, UGA’s vice president for information technology. A DDoS attack floods a target’s computer network with traffic, leaving the victim’s use of its websites and computer systems unavailable. During the incident, the university’s entire 20 gigabytes per second of Internet capacity was saturated with outside network traffic, which blocked access campus users.   UGA purchases its Internet connectivity through a nonprofit consortium, called Southern Crossroads, which is operated by Georgia Tech. School officials worked with Southern Crossroads to isolate the attack and began blocking it about 10 p.m., Chester’s message said. The attack ended shortly after that. As of Monday morning, officials had found no evidence that systems or data maintained by UGA had been compromised. Colleges and universities have increasingly been the target of these types of cyberattacks. Last year, Rutgers University students requested tuition refunds after the school experienced its fifth DDoS attack in a year. Arizona State University was also hit by a DDoS attack in April, blocking access to its Internet network a week before final exams. Some campuses are not currently equipped to identify DDoS attacks, and may not have a method for effectively mitigating them, industry experts say. “I personally regret that many of you experienced a disruption as you were preparing homework, getting ready for class or doing other University work and I offer my apologies,” Chester said to the campus community in the message. UGA plans to review the incident with federal, state and local law enforcement, and work with the University System of Georgia on reducing the risks of these types of attacks in the future.   Source: http://www.ajc.com/news/news/local-education/university-of-georgia-hit-by-cyberattack/nqtN9/

Read the original post:
University of Georgia hit by DDoS Attack

D.O.J. Charges Iran-Sponsored Hackers with Dozens of DDoS Attacks on Major Financial Institutions

No less than 46 U.S. financial institutions, as well as a dam in New York, were allegedly targeted. On Thursday morning, the Department of Justice unsealed an indictment against seven Iranian citizens allegedly funded by the Islamic Revolutionary Guard Corps, accusing them of launching a coordinated cyber-attack against a minimum of 46 American financial institutions, as well as a major New York dam. In a press conference with some of American law enforcement’s heaviest hitters, including F.B.I. director James Comey and U.S. district attorney Preet Bharara , Attorney General Loretta Lynch announced that members of two Iran-based computer companies, ITSecTeam and the Mersad Company, had launched coordinated distributed denial of service (DDoS) attacks against the Web sites of dozens of financial institutions, including the New York Stock Exchange, Bank of America, Capital One, ING, and AT&T, disabling them and preventing their customers from accessing their accounts. In addition, one of the alleged hackers, Hamid Firoozi , was said to have illegally accessed a computer in charge of the Bowman Dam in Rye, New York, giving him the ability to remotely control its operations and potentially cause “a threat to public health or safety.” According to the Department of Justice, the two groups received funding from the Islamic Revolutionary Guard, the elite government militia tasked with defending Islamic law in Iran. Lynch said in a statement that the attacks not only cost these companies “tens of millions of dollars” to restore their Web sites, but highlighted how foreign cyber-attacks have become a major threat to U.S. national security. “In unsealing this indictment, the Department of Justice is sending a powerful message: that we will not allow any individual, group, or nation to sabotage American financial institutions or undermine the integrity of fair competition in the operation of the free market,” she said in the prepared statement. According to the indictment, the DDoS attacks took place over 176 days between 2011 and 2013. The attacks on U.S. targets took place after Iran’s nuclear capabilities were sabotaged by the Stuxnet virus, believed to have been a joint effort between the U.S. and Israeli governments, in mid-2010.   The indictment also comes after a series of high-profile cyber-attacks on the United States government. In 2014 alone, the government experienced more than 61,000 attacks on their computer systems, affecting several administrative agencies such as the State Department, the Energy Department, and the White House. Last year, the Office of Personnel Management (O.P.M.) was the target of the largest attack to date, in which Chinese hackers stole sensitive personal information from 21.5 million past and present government employees. During the press conference Thursday morning, Comey said that the indictment was meant to show the world that the U.S. government was ready to respond to foreign-based cyber-attacks, no matter where they came from or the scale of the attack. “By calling out the individuals and nations who use cyber-attacks to threaten American enterprise, as we have done in this indictment, we will change behavior,” he said.   Source: http://www.vanityfair.com/news/2016/03/doj-iran-hacker-indictment

See more here:
D.O.J. Charges Iran-Sponsored Hackers with Dozens of DDoS Attacks on Major Financial Institutions

Change.org Victim of DDoS Attack From China

Change.org, an online petitioning platform, has appear beneath an advancing broadcast abnegation of account (DDoS) advance basic from China afterwards the website hosted a alarm advancement Chinese authorities to absolution artisan Ai Weiwei from custody. The attacks, which started backward Sunday, accept about brought down the site, according to Change.org architect Ben Rattray. DDoS attacks plan by application hundreds or bags of afraid computers to forward cartage to a website, cutting it with abstracts so it becomes aloof to accustomed users. Change.org said the accepted advance originates from an accretion accumulation of computers primarily based in China, and has yet to stop. This is the aboriginal time the website has been hit with a DDoS attack. Change.org has been hosting a online address calling for the absolution of Chinese artisan Ai Weiwei, who is currently beneath arrest. The address has admiring about 100,000 humans from 175 countries, authoritative it one of Change.org’s a lot of acknowledged all-embracing campaigns, Rattray said. “It’s appealing bright the advance is in acknowledgment to the campaign,” he added. “It’s amazing that somebody in China with a high-level of abstruse composure can appulse the adeptness for humans about the apple to organize.” The online alarm coincided with demonstrations beyond the apple this accomplished Sunday, which aswell alleged for the artist’s release. Ai, who is aswell accepted for his activism, has been bedfast as allotment of a Chinese government crackdown on political dissidents in the country. Authorities in the country accept arrested added animal rights activists and clamped down on the advice flow, afterward antecedent online postings that began in February calling for a “Jasmine revolution” adjoin the Chinese government. Change.org is currently blocked in China. Internet censors in the country consistently block sites that are accounted to politically sensitive. Despite the block, the computers complex in the DDoS advance are managing to acquisition a way about the country’s civic Internet firewall, said Rattray. In the past, added sites accept been the victims of cyber attacks advancing from China. This March, blog publishing belvedere WordPress.com aswell reported getting hit with a DDoS attack basic from China. Chinese hackers accept aswell allegedly launched cyber attacks to steal abstracts from adopted activity accompanies, according to aegis bell-ringer McAfee. In 2009, Google was aswell the victim of an advance basic from China that was aimed at accessing the Gmail accounts of animal rights activists The Chinese government has ahead responded to these letters by abstinent it is complex in any cyberattacks, abacus that China has aswell been a victim of hacking attempts. The accurate antecedent of DDoS attacks is generally unclear. Although Change.org has traced the accepted advance to servers in China, it is aswell accessible the computers are beneath the ascendancy of hackers based in addition country. Change.org letters that both the FBI and U.S. State Department are searching into the DDoS attack. “We will not stop or yield down annihilation because of this DDoS attack,” Rattray said. “We accept in the axiological appropriate of the humans to adapt about issues they affliction about it.” Source: http://webtechreview.com/change-org-victim-of-ddos-attack-from-china/

Continue reading here:
Change.org Victim of DDoS Attack From China

Swedish newspaper websites shut down in DDoS attack

The online editions of Sweden’s main newspapers were knocked out for several hours by unidentified hackers at the weekend, police said Sunday as they launched an investigation. The attack was “extremely dangerous and serious,” the head of the Swedish Media Publishers’ Association, Jeanette Gustafsdotter, told Swedish news agency TT. “To threaten access to news coverage is a threat to democracy,” she said. No one has claimed responsibility for the attacks, which either partially or totally shut down the sites of Dagens Nyheter, Svenska Dagbladet, Expressen, Aftonbladet, Dagens Industri, Sydsvenskan and Helsingborgs Dagblad on Saturday evening from about 8:00 pm (1900 GMT) until about 11:00 pm (2200 GMT). Several experts quoted in the media suggested the sites were subjected to distributed denial-of-services (DDoS) attacks, in which hackers hijack multiple computers to send a flood of data to the target, crippling its computer system. Police said in a statement they had launched an investigation, and Swedish intelligence was also being kept abreast of developments. An anonymous threat was issued on a Twitter account shortly before the attack. The account was attributed to J@_notJ. “The following days attacks against the Swedish government and media spreading false propaganda will be targeted,” the first tweet read. An hour later, a second tweet read: “This is what happens when you spread false propaganda. Aftonbladet.se #offline”. Source: https://www.enca.com/technology/swedish-newspaper-websites-shut-down-hacker-attack    

More:
Swedish newspaper websites shut down in DDoS attack

Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks can have an amplification factor of 26.5 An independent security researcher that goes by the name of MalwareTech has discovered a way in which he could abuse the ZeroAccess malware’s botnet to launch reflection DDoS attacks with an above-average amplification factor. ZeroAccess is a trojan that infects Windows computers and then starts communication with a C&C (command and control), which in turn tells the trojan to download various types of other, more dangerous malware, usually clickfraud bots or Bitcoin mining software, operating hidden from the user’s view. The ZeroAccess botnet appeared in 2011, and because of an effective rootkit component and P2P-like structure, it even managed to survive a takedown attempt orchestrated by Microsoft in December 2013. ZeroAccess botnet used for amplifying DDoS attacks MalwareTech discovered that ZeroAccess allowed its bots to relay messages from one to another, some acting like smaller servers (supernodes) while the rest were just end-points (workers). To relay orders from the C&C server to supernodes and workers, ZeroAccess used simple UDP packets. Because of its complex mesh structure, when a UDP packet arrived at a supernode, the bot would add more information to the packet, containing various details about the network’s structure. The supernode would add 408 bytes on top of the original 16, for a total of 242 bytes. Since UDP packets can have their destination address spoofed, an attacker that managed to map ZeroAccess’ bot network would be able to send UDP packets to its bots, some of which would then amplify the traffic by 26.5, sending it back to the spoofed destination (the victim’s IP). This scenario is your typical reflection DDoS attack , carrying a 26.5 amplification factor, which is more than double the typical 2-10 amplification factor seen in other types of reflection DDoS attacks. DDoS attacks worked even if bots were behind NATs Theoretically, this wouldn’t have been a problem, since most bots infect users that are sitting behind NATs (Network Address Translation), software programs that translate public IPs to private IP addresses, in order to maximize IPv4 address space usage. That meant that a vast majority of the ZeroAccess botnet wouldn’t have been accessible to a person carrying DDoS attacks via this technique. Unfortunately, MalwareTech found a way around this issue as well, allowing him to involve ZeroAccess supernode bots into DDoS attacks even if sitting behind a router. All of this is only theoretical since the researcher did not want to commit a crime just to test out his theory. Source: http://news.softpedia.com/news/malware-botnet-can-be-abused-to-launch-ddos-attacks-501869.shtml

See the original post:
Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

A group known as New World Hackers says it targeted the websites of Salt Lake City police, Salt Lake International Airport, the Downtown Alliance and First Utah Bank in response to the Feb. 27 officer-involved shooting of teenager Abdullahi Omar Mohamed. The distributed denial of service attacks, first reported Monday by HackRead, appear to have had little impact on the sites’ function. Nick Como, communication and marketing director for the Downtown Alliance, said he heard about the attacks but that the nonprofit’s website analytics were normal. City deputy director of communications Holly Mullen said an attack on the SLCPD site was “unsuccessful.” Airport public relations director Nancy Volmer was unaware of any problems. First Utah Bank CIO Amy Foulks said the bank shut down its website for a few hours Sunday morning after it received an alert, which “allowed ourselves some time to implement a tool that would thwart the denial of service package.” Bank president Brad Baldwin emphasized that the DDoS attacks were not a “hack.” The group did not gain access to the bank’s system or any customer information, he said. A Twitter account associated with the group, @NewWorldHacking, told The Tribune the attacks were in response to the shooting of Mohamed, 17, who was shot and wounded near 250 S. Rio Grande Street after police say he was one of two people attacking a male victim with metal objects. “We want justice for that poor kid who got shot 3 times in the chest for no accurate reason,” it said in a direct message. That the group would target a bank with no apparent role in Mohamed’s shooting is “a mystery to us,” Baldwin said. First Utah reported the attack to authorities, he said. The FBI did not immediately return a request for comment Tuesday. Source: http://www.sltrib.com/news/3665236-155/ddos-attacks-aimed-at-salt-lake

Taken from:
DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Staminus, a California-based internet hosting provider that specializes in helping sites stay online when distributed denial of service (DDoS) attackers try to elbow them off, was itself the target of a cyber broadside last week. At any rate, it started last week, with reports of the company’s site being down as of Thursday. But as of Monday, it was again, or maybe still, sucking wind. Staminus on Friday put out a statement confirming that its network security had been popped and invaded, systems had been “temporarily” taken offline, and customer data had been published online. The company posted a series of updates on Twitter and Facebook while its website was down, explaining that this was a “rare event.” But even while Staminus techs were scrambling to drag the company’s site back online, whoever mugged it was dumping its private data online in what security journalist Brian Krebs called a “classic ‘hacker e-zine’ format” called “F**k ’em all.” Krebs reports that the page included links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The huge data dump included customer names and email addresses, database table structures, routing tables, support tickets, credit card numbers (according to Krebs, at any rate; Ars Technica’s Sean Gallagher didn’t see any when he viewed the dump), and other sensitive data. A Staminus customer who requested anonymity confirmed to Ars that his data was part of the dump. Those behind the dump claimed to have gained control of Staminus’s routers and to have reset them to factory settings. The hacker “e-zine” that contained all the sensitive data began with a note from the attacker titled “TIPS WHEN RUNNING A SECURITY COMPANY.” Then, it went on to list tips for what were supposedly the security holes found during the breach: Use one root password for all the boxes Expose PDU’s [power distribution units in server racks] to WAN with telnet auth Never patch, upgrade or audit the stack Disregard PDO [PHP Data Objects] as inconvenient Hedge entire business on security theatre Store full credit card info in plaintext Write all code with wreckless [sic] abandon On Thursday, Staminus reported that some services were back online or in the process of being brought back and that “We expect full service restoration soon.” Then, another message posted on Friday pointed to the statement from the company’s CEO. That was the last message. What followed was radio silence, unbroken as of Monday evening. Krebs pointed out that the attack isn’t surprising: anti-DDoS providers are a common target for attackers. Source: https://nakedsecurity.sophos.com/2016/03/15/attacker-leaves-security-tips-after-invading-anti-ddos-firm-staminus/

Original post:
Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Anonymous Declares War On Donald Trump

Notorious hacking team set to launch DDoS attacks on Trump websites on April 1 Donald Trump’s seemingly inevitable rise to power in the United States may be about to hit a fairly major obstacle in the form of an Anonymous cyber-attack. The hacking collective, which has been behind a number of major attacks against individuals or companies it considers to have done wrong to the public, has said it is preparing a DDoS attack against Trump’s campaign website. The “declaration of war” was set out in a video posted to YouTube which says that the attacks, dubbed #OpTrump, will take place on April 1, targeting websites including trump.com, donaldjtrump.com andtrumphotelcollection.com. “Hateful campaign” “Dear Donald Trump, we have been watching you for a long time and what we see is deeply disturbing,” the video says. “Your inconsistent and hateful campaign has not only shocked the United States of America [but] you have shocked the entire planet with your appalling actions and ideas. You say what your audience wants to hear but in reality you don’t stand for anything except for your personal greed and power.” “We need you to shut down his websites, to research and expose what he doesn’t want the public to know. We need to dismantle his campaign and sabotage his brand. We are encouraging every able person with a computer to participate in this operation. This is not a warning, this is a declaration of total war. Donald Trump – it is too late to expect us.” In a separate written message posted online to accompany the video, Anonymous also listed what is claims are personal details belonging to Donald Trump, including his social security number, personal phone number and the contact details of his agent and legal representation. The animosity between Anonymous and Trump dates back to December 2015, when the former officially ‘declared war’ on Trump after a radical speech in which he said Muslims should be banned from entering the United States, which saw a number of Trumps’ websites taken offline. Anonymous has not been shy to wage war on opponents in the past, most famously attacking terrorist group Isis last December following the terrorist attacks in Paris that left 130 people dead. Earlier that month, the group also published the details of a thousand alleged KKK sympathisers as part of its #HoodsOff campaign, which it described as “a form of resistance” against racial violence, following earlier major cyberattacks which included posting several messages on the KKK’s official Twitter feed, and taking control of another account affiliated with the Klan. Source: http://www.techweekeurope.co.uk/security/cyberwar/anonymous-declares-war-donald-trump-187898

View original post here:
Anonymous Declares War On Donald Trump

Hackers Target Anti-DDoS Firm Staminus

Staminus Communications Inc ., a California-based Internet hosting provider that specializes in protecting customers from massive “distributed denial of service” (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked. Staminus’s entire network was down for more than 20 hours until Thursday evening, leaving customers to vent their rage on the company’s Facebook and Twitter pages. In the midst of the outage, someone posted online download links for what appear to be Staminus’s customer credentials, support tickets, credit card numbers and other sensitive data. Newport Beach, Calif.-based Staminus first acknowledged an issue on its social media pages because the company’s Web site was unavailable much of Thursday. “Around 5am PST today, a rare event cascaded across multiple routers in a system wide event, making our backbone unavailable,” Staminus wrote to its customers. “Our technicians quickly began working to identify the problem. We understand and share your frustration. We currently have all hands on deck working to restore service but have no ETA for full recovery.” Staminus now says its global services are back online, and that ancillary services are being brought back online. However, the company’s Web site still displays a black page with a short message directing customers to Staminus’s social media pages. Meanwhile, a huge trove of data appeared online Thursday, in a classic “hacker e-zine” format entitled, “Fuck ’em all.” The page includes links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The authors of this particular e-zine indicated that they seized control over most or all of Staminus’s Internet routers and reset the devices to their factory settings. They also accuse Staminus of “using one root password for all the boxes,” and of storing customer credit card data in plain text, which is violation of payment card industry standards. Staminus so far has not offered any additional details about what may have caused the outage, nor has it acknowledged any kind of intrusion. Several Twitter accounts associated with people who claim to be Staminus customers frustrated by the outage say they have confirmed seeing their own account credentials in the trove of data dumped online. I’ve sent multiple requests for comment to Staminus, which is no doubt busy with more pressing matters at the moment. I’ll update this post in the event I hear back from them. It is not unusual for attackers to target Anti-DDoS providers. After all, they typically host many customers whose content or message might be offensive — even hateful — speech to many. For example, among the company’s many other clients is kkk-dot-com, the official home page of the Ku Klux Klan (KKK) white supremacist group. In addition, Staminus appears to be hosting a large number of internet relay chat (IRC) networks, text-based communities that are often the staging grounds for large-scale DDoS attack services. Source: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/

More:
Hackers Target Anti-DDoS Firm Staminus

Brief Downtime Disrupts Bitcoin Exchange Trading

Another day in the Bitcoin world and another crisis has been averted, even though plenty of users were worried when several exchanges experienced the same issue at the same time. Incapsula, the DDoS protection provider for several major Bitcoin exchanges, was experiencing some issues earlier today. As a result, trading was temporarily unavailable, although the issue was rectified rather quickly. However, this “centralized” form of protection is an annoyance for a decentralized ecosystem. While it is of the utmost important for Bitcoin exchanges to have some form of DDoS protection, it is not helpful if all of these platforms use one and the same provider. Bitcoin and digital currency are all about decentralization, yet companies seem to be using one centralized security solution. Granted, Incapsula is one of the market leaders when it comes to DDoS and platform protection services. It only makes sense when companies such as BTCC , Bitstamp , BitFinex , Vaultoro , and others have taken a liking to this company. Not that there is anything wrong with that, as long as there is no outage as Incapsula itself. There is no mention on the Incapsula Twitter account as to what went wrong exactly, or how the matter was resolved in the end. Whichever way the company handled this issue, the issue was sorted in a matter of minutes, which is commendable. Nor do any of the affected Bitcoin exchanges posted any messages on social media either, which is quite disconcerting. Security is the top priority for any Bitcoin exchange platform, as most companies act as a custodian while watching over customer funds. DDoS attacks, hacking attempts, and database breaches need to be avoided at all costs.Incapsula is a well-respected company capable of delivering such a service. But at the same time, this situation begs the question if there are no other companies who can provide this service as well. Granted, security is an innovative business in the online world right now, and there are hundreds of companies in existence who want to be market leaders. Incapsula has secured their spot already– for now – but other players need to emerge and collaborate with Bitcoin platforms to create more decentralization in the security department. Source: http://themerkle.com/news/brief-incapsula-downtime-disrupts-bitcoin-exchange-trading/

Read the article:
Brief Downtime Disrupts Bitcoin Exchange Trading