FortiGuard Labs observed that the Bitcoin mining botnet, ZeroAccess, was the number one threat last quarter. Their report also reveals new analysis of the South Korea cyberattacks and two new Android …
View article:
ZeroAccess Bitcoin botnet shows no signs of slowing
Increasingly, U.S. banking institutions are reluctant to acknowledge – much less discuss – the ongoing distributed-denial-of-service attacks against their online services. Perhaps that’s because they’re concerned that consumers will panic or that revealing too much about the attacks could give hacktivists information they could use to enhance their DDoS abilities. But in recent regulatory statements, the nation’s largest banks are candid about DDoS attacks and their impact. In their annual 10-K earnings reports, filed with the Securities and Exchange Commission, seven of the nation’s top 10 financial services institutions provide new details about the DDoS attacks they suffered in 2012. In its report, Citigroup even acknowledges that DDoS attacks have led to unspecified losses. Citigroup , which filed its 10-K report March 1, notes: “In 2012, Citi and other U.S. financial institutions experienced distributed-denial-of-service attacks which were intended to disrupt consumer online banking services. While Citi’s monitoring and protection services were able to detect and respond to these incidents before they became significant, they still resulted in certain limited losses in some instances as well as increases in expenditures to monitor against the threat of similar future cyber-incidents.” The bank also points out that these attacks are being waged by powerful adversaries. “Citi’s computer systems, software and networks are subject to ongoing cyber-incidents, such as unauthorized access; loss or destruction of data (including confidential client information); account takeovers; unavailability of service; computer viruses or other malicious code; cyber-attacks; and other events,” Citi states. “Additional challenges are posed by external extremist parties, including foreign state actors, in some circumstances as a means to promote political ends.” When contacted by BankInfoSecurity , Citi and other institutions did not comment further about DDoS attacks or the information in the 10-K reports. These banks, as well as other U.S. financial institutions, are now in the midst of the third wave of DDoS attacks attributed to the hacktivist group Izz ad-Din al-Qassam Cyber Fighters – a group that has claimed since September that its attacks are being waged to protest a YouTube movie trailer deemed offensive to Muslims. ‘Technically Sophisticated’ In their 10-K reports, Citi, as well as JPMorgan Chase & Co. , Bank of America , Goldman Sachs Group , U.S. Bancorp , HSBC North America and Capital One acknowledge suffering from increased cyber-activity, with some specifically calling out DDoS as an emerging and ongoing threat. HSBC North America, in its 10-K report filed March 4, notes the global impact of DDoS on its customer base. “During 2012, HSBC was subjected to several ‘denial of service’ attacks on our external facing websites across Latin America, Asia and North America,” the bank states. “One of these attacks affected several geographical regions for a number of hours; there was limited effect from the other attacks with services maintained. We did not experience any loss of data as a result of these attacks.” And U.S. Bank, in its 10-K filed Jan. 15, describes DDoS attacks as “technically sophisticated and well-resourced.” “The company and several other financial institutions in the United States have recently experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods,” U.S. Bank reports. “These ‘denial-of-service’ attacks have not breached the company’s data security systems, but require substantial resources to defend and may affect customer satisfaction and behavior.” U.S. Bank reports no specific losses attributed to DDoS, but it states: “Attack attempts on the company’s computer systems are increasing, and the company continues to develop and enhance its controls and processes to protect against these attempts.” Other DDoS Comments Here is what the other institutions reported about DDoS attacks suffered in 2012: Chase: “The firm and several other U.S. financial institutions continue to experience significant distributed denial-of-service attacks from technically sophisticated and well-resourced third parties which are intended to disrupt consumer online banking services. The firm has also experienced other attempts to breach the security of the firm’s systems and data. These cyber-attacks have not, to date, resulted in any material disruption of the firm’s operations, material harm to the firm’s customers, and have not had a material adverse effect on the firm’s results of operations.” BofA: “Our websites have been subject to a series of distributed denial of service cybersecurity incidents. Although these incidents have not had a material impact on Bank of America, nor have they resulted in unauthorized access to our or our customers’ confidential, proprietary or other information, because of our prominence, we believe that such incidents may continue. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that we will not suffer such losses in the future.” CapOne: “Capital One and other U.S. financial services providers were targeted recently on several occasions with distributed denial-of-service attacks from sophisticated third parties. On at least one occasion, these attacks successfully disrupted consumer online banking services for a period of time. If these attacks are successful, or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services online. In addition, a breach or attack affecting one of our third-party service providers or partners could impact us through no fault of our own. Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently and often are not fully recognized or understood until after they have been launched, we and our third-party service providers and partners may be unable to anticipate certain attack methods in order to implement effective preventative measures. Should a cyber-attack against us succeed on any material scale, market perception of the effectiveness of our security measures could be harmed, and we could face the aforementioned risks. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.” No Mentions of Attacks Among the top 10, the only institutions that do not specifically reference DDoS in their 10-K reports are Morgan Stanley, Bank of NY Mellon and Wells Fargo , a bank that has recently suffered significant online outages. Wells Fargo spokeswoman Sara Hawkins tells BankInfoSecurity that the bank’s online and mobile-banking channels were inaccessible for portions of the day on April 4, when it saw “an unusually high volume of website and mobile traffic … which we believe is a denial of service attack.” Reporting Protocol Doug Johnson , who oversees risk management policy for the American Bankers Association, says banking institutions are required to report all suspicious cyber-activity either through their filings with the SEC or in the Suspicious Activity Reports to the Financial Crimes Enforcement Network , a bureau of the U.S. Department of the Treasury. All financial institutions, regardless of size, must report SARs to FinCEN, an agency that collects, analyzes and shares financial intelligence. However, only companies with more than $10 million in assets are required to file reports with the SEC. Banking institutions are required to report cyber-attacks in their SEC filings, Johnson says. “Online banking platforms, obviously, are extremely important to banking retail consumers, and so that would be one of those systems which would be very important to report on a suspicious activity report,” Johnson says. “One thing that is also very important to do is to go and have that conversation with your primary federal regulator, at the field level, to find out what you would do, as an institution, for generalized security breach reporting.” Breach reporting requirements vary from state to state, Johnson adds. For protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/top-banks-offer-new-ddos-details-a-5667/p-3
See more here:
Top Banks Offer New DDoS Attack Details
Successful malware peddlers are always thinking up new ways of delivering malware to unsuspecting users. In the past Android malware was mostly served on third-party online marketplaces, but accor…
Follow this link:
Cutwail botnet now spreads Android malware
The DNS amplification vulnerability, which was exploited to the fullest in the attacks on Spamhaus, return incoming requests to a DNS server with as much as 100 times as much data. When the attackers have faked the source address for those incoming requests, the responses can overwhelm the victims’ servers — and possibly spill over and clog the Net. What is the aftermath of the massive Distributed Denial of Service attacks recently on the anti-spam Spamhaus organization? As the largest such attack in history, the digital assault on Spamhaus slowed network performance in some regions of Europe and elsewhere, raised alarms about whether the Net could reach a breaking point, and has become a historic event that could mark a turning point. According to reports in The New York Times and elsewhere, a key figure in the attacks appears to be Sven Olaf Kamphuis, who is associated with CyberBunker, the Dutch hosting facility where the attacks originated. After the Europe-based Spamhaus put CyberBunker on its spam blacklist, because of what Spamhaus said were substantial streams of spam e-mails coming from that hosting facility, the DDoS attacks began. Kamphuis maintains a Facebook page, in which he champions hosting services such as CyberBunker for providing open Net access, and he rails against Spamhaus for acting like an arbitrary authority. Like ‘The Mafia’ CyberBunker has said it will allow customers to host anything except “child porn and anything related to terrorism.” Spamhaus is backed by a variety of e-mail services, and experts have testified in court that many e-mail services would be rendered useless by the flood of spam if not for the organization’s efforts. But this massive wave of DDoS attacks — in which Web servers are overwhelmed by a flood of bogus traffic — broke some boundaries, according to Garth Bruen, an adviser to the consumer-oriented Digital Citizens Alliance. Bruen told USA Today that the attacks from CyberBunker were like “the kind of things we saw the mafia do to take control of neighborhoods 50 years ago.” He added that what was particularly “troubling” is that CyberBunker is a commercial ISP “working with shadowy figures in undisclosed locations.” Open DNS Resolvers The attacks have highlighted some ongoing weaknesses in the Internet’s infrastructure . Key among these are open Domain Name System resolvers, which allow attackers to engage in so-called DNS amplification. One of the weaknesses of open resolvers is that they do not authenticate a sender’s address before replying. This vulnerability, which was exploited to the fullest in the attacks on Spamhaus, return incoming requests to a DNS server with as much as 100 times as much data . When the attackers have faked the source address for those incoming requests, the responses can overwhelm the victims’ servers — and possibly spill over and clog other parts of the Net. DNS servers are critical to the Internet as they translate alphanumeric-based Web addresses like “www.google.com” into the numeric IP addresses that computers can understand. The Spamhaus attacks reportedly utilized more than 30,000 unique DNS resolvers. There are efforts, such as the Open DNS Resolver Project, to convince DNS administrators to implement source address validation, among other actions, to eliminate open DNS resolvers as a Net-wide weakness. There are also calls for IT departments and individual PC owners to make a greater effort to scan their computers for signs of malware that could be hijacking their machines into becoming part of a botnet. Additionally, the Electronic Frontier Foundation and others have offered tips to small businesses on how to cope with DDoS attacks, if their sites become one of the direct or indirect targets. For DDoS protection click here . http://www.cio-today.com/story.xhtml?story_id=0020002HERPO&page=2
The botnets driving the recent distributed denial of service attacks are powered by millions of infected computers. Their coordinated flood of requests overwhelms the Internet’s DNS servers, slowing them down and even knocking the servers offline. The long-term solution for site operators and visitors alike may rely on reluctant ISPs working together. The risk that an Internet-connected computer is infected with malware will never be reducible to zero. It’s just the nature of software that errors happen. Where there are software-design errors, there are people who will exploit those errors to their advantage. The best PC users can hope for is to minimize the chances of an infection and to mitigate the damage a piece of malware can inflict — whether it intends to steal a user’s sensitive data or to commandeer the machine as part of a cyber attack on servers thousands of miles away. Last week, Internet users were caught in the crossfire of an online battle. On one side were spammers and other nefarious types who send malware via e-mail. On the other was the spam-fighting organization Spamhaus. As Don Reisinger reported last Wednesday, several European sites experienced significant slow-downs as a result of the attack, which may have also involved criminal gangs in Russia and Eastern Europe. In a post last Friday, Declan McCullagh explained that the technology to defeat such attacks has been known for more than a decade, although implementing the technology Internet-wide is difficult and, practically speaking, may be impossible. So where does that leave your average, everyday Internet user? Our ability to prevent our machines from being hijacked by malware will always be limited by our innate susceptibility. We’re simply too likely to be tricked into opening a file or Web page we shouldn’t. PC infection rates hold steady despite the prevalence of free antivirus software. Even the best security programs fail to spot some malware, as test results by A-V Comparatives indicate (PDF). For example, in tests conducted in August 2011, Microsoft Security Essentials was rated as Advanced (the second-highest scoring level) with a detection rate of 92.1 percent and “very few” false positives. Since we’ll never eliminate PC infections, the best defense against botnets is not at the source but rather at the point of entry to the ISP’s network. In July of last year the Internet Engineering Task Force released a draft of the Recommendations for the Remediation of Bots in ISP Networks that points out the challenges presented by bot detection and removal. Unfortunately, detecting and removing botnets isn’t much easier for ISPs. When ISPs scan their customers’ computers, the PC may perceive the scan as an attack and generate a security alert. Many people are concerned about the privacy implications of ISPs scanning the content of their customers’ machines. Then there’s the basic reluctance of ISPs to share data and work together in general. Much of the IETF’s suggested remediation comes down to educating users about the need to scan their PCs for infections and remove those they discover. While most virus infections make their presence known by slowing down the system and otherwise causing problems, the stealth nature of many bots means users may not be aware of them at all. If the bot is designed not to steal the user’s data but only to participate in a DDoS attack, users may feel no need to detect and delete the bot. One of the IETF report’s suggestions is that ISPs share “selective” data with third parties, including competitors, to facilitate traffic analysis. In March of last year the Communications Security, Reliability and Interoperability Council released its voluntary Anti-Bot Code of Conduct for ISPs (PDF). In addition to being voluntary, three of the four recommendations in the “ABCs for ISPs” rely on end users: Educate end-users of the threat posed by bots and of actions end-users can take to help prevent bot infections; Detect bot activities or obtain information, including from credible third parties, on bot infections among their end-user base; Notify end-users of suspected bot infections or help enable end-users to determine if they are potentially infected by bots; and Provide information and resources, directly or by reference to other sources, to end-users to assist them in remediating bot infections. A paper titled “Modeling Internet-Scale Policies for Cleaning up Malware” (PDF) written by Lawrence Berkeley National Laboratory’s Stephen Hofmeyr and others suggests that having large ISPs working together to analyze traffic at points of entry to their network is more effective than bot detection on end-user machines. But that doesn’t get us off the hook entirely. If every Windows PC were scanned for malware once a month, there would be far fewer bots available for the next DDoS attack. Since CNET readers tend to be more tech-savvy than average, I suggest a computer-adoption program: everyone scan two or three PCs they suspect aren’t regularly maintained by their owners (such as relatives) on a pro bono basis. Here are three steps you can take to minimize the possibility that a Windows PC will be drafted into a botnet army. Don’t use a Windows administrator account The vast majority of malware targets Windows systems. In large part it’s simply due to numbers: there are so many more installations of Windows than any other operating system that leveraging Windows maximizes a piece of malware’s effectiveness. Many people have no choice but to use Windows, most likely because their employer requires it. For many others, using an OS other than Windows is impractical. But very few people need to use a Windows administrator account on a daily basis. In the past two years I’ve used only a standard Windows account on my everyday PC, with one or two exceptions. In fact, I often forget the account lacks administrator privileges until a software installation or update requires that I enter an administrator password. Using a standard account doesn’t make your PC malware-proof, but doing so certainly adds a level of protection. Set your software to update automatically Not many years ago, experts advised PC users to wait a day or two before applying patches for Windows, media players, and other applications to ensure the patches didn’t cause more problems than they prevented. Now the risk posed by unpatched software is far greater than any potential glitches resulting from the update. In May 2011 I compared three free scanners that spot outdated, insecure software. My favorite of the three at the time was CNET’s own TechTracker for its simplicity, but now I rely on Secunia’s Personal Software Inspector, which tracks your past updates and provides an overall System Score. The default setting in Windows Update is to download and install updates automatically. Also selected by default are the options to receive recommended updates as well as those labeled important, and to update other Microsoft products automatically. Use a second anti-malware program to scan the system Since no security program detects every potential threat, it makes sense to have a second malware scanner installed for the occasional manual system scan. My two favorite manual virus-scanning programs are Malwarebytes Anti-Malware and Microsoft’s Malicious Software Removal Tool, both of which are free. I wasn’t particularly surprised when Malwarebytes found three instances of the PUP.FaceThemes virus in Registry keys of my everyday Windows 7 PC (shown below), but I didn’t expect the program to detect four different viruses in old Windows system folders on a test system with a default configuration of Windows 7 Pro (as shown on the screen at the top of this post). An unexpected benefit of the malware removal was a reduction in boot time for the Windows 7 machine from more than two minutes to just over one minute. Help for site operators who come under attack DDoS attacks are motivated primarily by financial gain, such as the incident last December that emptied a Bank of the West online account of $900,000, as Brian Krebs reported. The attacks may also be an attempt to exact revenge, which many analysts believe was implicated in last week’s DDoS onslaught against Spamhaus. The government of Iran was blamed for a recent series of DDoS attacks against U.S. banks, as the New York Times reported last January. Increasingly, botnets are being directed by political activists against their opposition, such as the wave of hacktivist attacks against banks reported by Tracy Kitten on the BankInfoSecurity.com site. While large sites such as Google and Microsoft have the resources to absorb DDoS attacks without a hiccup, independent site operators are much more vulnerable. The Electronic Frontier Foundation offers a guide for small site owners to help them cope with DDoS attacks and other threats. The Keep Your Site Alive program covers aspects to consider when choosing a Web host, backup alternatives, and site mirroring. The increasing impact of DDoS attacks is one of the topics of the 2013 Global Threat Intelligence Report released by security firm Solutionary. Downloading the report requires registration, but if you’re in a hurry, Bill Brenner offers a synopsis of the report on CSO’s Salted Hash blog. As Brenner reports, two trends identified by Solutionary are that malware is increasingly adept at avoiding detection, and Java is the favorite target of malware exploit kits, supplanting Adobe PDFs at the top of the list. The DNS server ‘vulnerability’ behind the DDoS attacks The innate openness of the Internet makes DDoS attacks possible. DNS software vendor JH Software explains how DNS’s recursion setting allows a flood of botnet requests to swamp a DNS server. CloudShield Technologies’ Patrick Lynch looks at the “open resolvers” problem from an enterprise and ISP perspective. Paul Vixie looks at the dangers of blocking DNS on the Internet Systems Consortium site. Vixie contrasts blocking with the Secure DNS proposal for proving a site’s authenticity or inauthenticity. Finally, if you’ve got two-and-a-half hours to kill, watch the interesting panel discussion held in New York City last December entitled Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape. The panel was moderated by Public Interest Registry CEO Brian Cute and included executives from Verisign, Google, and Symantec. I was struck by one recurring theme among the panel participants: we need to educate end users, but it’s really not their fault, and also not entirely their problem. To me, it sounded more than a little bit like ISPs passing the buck. For DDoS protection click here . Source: http://howto.cnet.com/8301-11310_39-57577349-285/how-you-may-have-inadvertently-participated-in-recent-ddos-attacks/
Link:
How you may have inadvertently participated in recent DDoS attacks
The Cyber fighters of Izz Ad-Din Al Qassam hacker group – also known as Qassam Cyber Fighters – are at it again. For the third time in the last half year or so, they have mounted DDoS attacks agai…
See the article here:
Hackers attacking US banks are well-funded, expert says
Lurking in the shadows for nearly a decade, DoS and DDoS attacks are making a resurgence. Several high-profile assaults on the world's leading financial firms and other industries have recently been e…
Read More:
DoS attacks expose enterprise infrastructure vulnerabilities
Crooks blasting public-safety phone lines with calls The US Department of Homeland Security (DHS) has cautioned public-safety call centers against the rise of so-called telephony denial of service (TDoS) attacks, which it says have the potential to cripple local telephone exchanges.…
Read the article:
Call centers under attack in targeted cyber-blackmail scheme
Over the last couple of days, a group of iOS developers has been targeted with a series of rapid-fire texts sent over Apple’s iMessage system. The messages, likely transmitted via the OS X Messages app using a simple AppleScript, rapidly fill up the Messages app on iOS or the Mac with text, forcing a user to constantly clear both notifications and messages. In some instances, the messages can be so large that they completely lock up the Messages app on iOS, constituting a ‘denial of service’ (DoS) attack of sorts, even though in this case they appear to be a prank. Obviously, if the messages are repeated an annoyingly large volume but don’t actually crash the app, they’re still limiting the use you’ll get out of the service. But if a string that’s complex enough to crash the app is sent through, that’s a more serious issue. The attacks hit at least a half-dozen iOS developer and hacker community members that we know of now, and appear to have originated with a Twitter account involved in selling UDIDs, provisioning profiles and more that facilitate in the installation of pirated App Store apps which are re-signed and distributed. The information about the source of the attacks was shared by one of the victims, iOS jailbreak tool and app developer iH8sn0w. “On Wednesday night my private iMessage handle got flooded with “Hi” and “We are anonymous” bulls**t,” iH8sn0w tells us. He immediately disabled that iMessage email and began tracking the sending email domain’s current ownership. iH8sn0w shared a proof-of-concept AppleScript with us that demonstrates just how easy it is to set up a recurring message that could saturate a person’s iMessage queue with items that would need to be cleared or read before any actions could be taken. Another iOS developer targeted, Grant Paul, shared some additional details about the attacks. “What’s happening is a simple flood: Apple doesn’t seem to limit how fast messages can be sent, so the attacker is able to send thousands of messages very quickly,” Paul says. The second part of that, he explains, is that if a user sends a ‘complex’ text message using unicode characters that force a browser to render ‘Zalgo’ text, or simply uses a message that is enormous in size, them the Messages app will eventually crash as it fails to display it properly. This will effectively ‘break’ the Messages app on iOS by forcing it to close and stop it from re-opening because it can’t render that text.” The ‘send a big message to crash the app’ method has been known for a while, as we were able to locate a month-old public posting that detailed an accidental triggering of this. The solutions involve playing around with sending a regular message, then locking the phone and activating the message notification until you’re able to time it right to delete the message thread that’s causing the problem. This is the way that Paul was able to finally delete the complex text that was causing him problems. Several of the developers we spoke to noted that multiple ‘throwaway’ emails were being used to send the spam, so while a simple ‘block’ option might work for a casual spammer, they wouldn’t work for a determined harasser. iH8sn0w notes that there is a possibility that Apple will notice these bursts of messages and block the repetitive spamming. This appears to be the only real solution as Apple does not currently allow you to block a specific iMessage sender. Once your iMessage ID is out there, you’re unable to stop people from using it. And since the latest version of iOS unifies your phone number and emails, there’s a strong possibility that if a person can ferret out your email, they can spam you with this annoying or disruptive technique. The only recourse right now is to disable that iMessage handle entirely. And if they get your phone number, it’s likely you’ll have to turn off iMessage entirely, because you can’t just change your phone number at the drop of a hat. Thankfully, this doesn’t seem to be a widespread practice, but it’s not that hard to figure out, and the only real solution will be the introduction of a block setting for Messages and better spam detection by Apple. We have informed Apple about the technique used in these cases but it has not responded with more information. We will update the article if it does so. Source: http://thenextweb.com/apple/2013/03/29/imessage-denial-of-service-prank-spams-users-rapidly-with-messages-crashes-ios-messages-app/
Continued here:
iMessage DDoS attacks foreshadow a bigger threat
Here's an overview of some of last week's most interesting news, podcasts, videos and articles: What do users look for in a security solution? Users are aware of the dangers in the Internet and …