Tag Archives: defend against ddos

Hackers Target NASA with DDoS Attack, Claim to Shutdown Email Servers

Anonymous-linked Hackers Attack NASA’s System for Allegedly Keeping a Huge Secret Anonymous is a loosely connected group of hacktivists that doesn’t appreciate governments keeping secrets or conducting operations that somehow violate user privacy. So, to register their resentment what they do is attack the agency’s systems and hack critically important data. The same modus operandi was employed by an Anonymous-linked team of hackers called New World Hacking  and AnonCorruption when they learned that NASA was “holding back information on many things, not just one.” NASA’s computer systems, allegedly, were attacked by New World Hacking team’s hacktivists and their supporters on Sunday night as part of a bigger campaign against government cover-ups called Operation Censorship or #OPCensorship. The hackers claimed that they have managed to shut down the space agency’s primary website and email servers. The attack was materialized through the most commonly used weapon called DDoS attack . However, NASA’s website was still found to be operational instead of being down as per the claims from the hacker group. But, the New World Hacking team provided proof, which suggested that some of the space agency’s systems were suffering from the aftershocks of what is termed as a digital blitzkrieg. Remember, the NWH is the same group who claimed responsibility for shutting down Xbox online service , BBC news servers , HSBC UK’s online banking, the official website for Donald Trump’s election campaign, Salt Lake city Police and airport websites . “NWH hackers vow to target Trump in their next cyber attack” While talking to HackRead, the group stated that NASA was attacked because they were convinced that the agency has important information about the extremist organization ISIS but it is withholding the information. The group also refused to reveal the secret information about ISIS. The attack hasn’t been confirmed or denied by NASA and we cannot possibly verify if the hacktivists’ claims are true or not since the site is working. Hackers also shared an inside screenshot and claimed that they could access the NASA’s Internet email server: Hackers claim they were able to get into the NASA server, however, the security implemented on the server didn’t let them go any further “We believe NASA is holding back information on many things, not just one. The main thing we suspect they are holding back some more information on ISIS that the public needs to know.We won’t tell the public what we think they are hiding – we will let NASA explain.” They also added that this attack is more like a practice run for the most important campaign against Donald Trump, which they plan to execute on April Fool’s day. “We want Trump to know that he is next,” the hackers added. Source: https://www.hackread.com/hackers-ddos-shutdown-nasa-website-email-server/

View article:
Hackers Target NASA with DDoS Attack, Claim to Shutdown Email Servers

DDoS Attacks Cripple Swedish News Sites Amid Russia Tension

A number of Swedish government websites and major media outlets were knocked offline for hours over the weekend, police say. No one has taken responsibility for the cyberattacks, which silenced at least seven of Sweden’s most prominent news organizations for hours amid growing tension with Russia. A flood of web traffic Saturday night either crippled or totally shut down the news sites Dagens Nyheter, Svenska Dagbladet, Expressen, Aftonbladet, Dagens Industri, Sydsvenskan and Helsingborgs Dagblad for roughly three hours. Police launched an investigation Sunday, Agence France-Presse reported, with investigators telling many of the same sites the traffic appears to have originated in Russia. Cyberattackers, ranging from Anonymous to state hacking groups, often use distributed denial of service, or DDoS, attacks to direct a wave of falsified web traffic at a single or small number of sites, overwhelming them with traffic for hours or days. This attack was “extremely dangerous and serious,” Jeannette Gustafsdotter, the head of the Swedish Media Publishers’ Association, told the news agency TT, as quoted by the Local.se. “To threaten access to news coverage is a threat to democracy.” The onslaught came after an anonymous Twitter account, using the handle @_notJ, warned of imminent attacks against sites that posted “propaganda.” Aftonbladet, one of the sites mentioned in the tweets, has published a number of stories on the Russian plane crash that killed 62 people and other topics that don’t portray Russia in a positive light. This is what happends when you spread false propaganda. Aftonbladet.se #offline@Aftonbladet — J (@_notJ) March 19, 2016 The following days attacks against the Swedish goverment and media spreading false propaganda will be targetted. — J (@_notJ) March 19, 2016 The attacks also came after a Swedish government report cited Russian “extreme movements, information operations and misinformation campaigns” aimed at Swedish lawmakers and the public as Sweden’s most formidable intelligence threat. The Swedish government asked Russian Embassy staff to leave Sweden in 2015, though the report noted that suspected spies were still working as diplomats, airline employees and business executives. Source: http://m.ibtimes.com/ddos-attacks-cripple-swedish-news-sites-amid-russia-tension-2340079

Original post:
DDoS Attacks Cripple Swedish News Sites Amid Russia Tension

Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks can have an amplification factor of 26.5 An independent security researcher that goes by the name of MalwareTech has discovered a way in which he could abuse the ZeroAccess malware’s botnet to launch reflection DDoS attacks with an above-average amplification factor. ZeroAccess is a trojan that infects Windows computers and then starts communication with a C&C (command and control), which in turn tells the trojan to download various types of other, more dangerous malware, usually clickfraud bots or Bitcoin mining software, operating hidden from the user’s view. The ZeroAccess botnet appeared in 2011, and because of an effective rootkit component and P2P-like structure, it even managed to survive a takedown attempt orchestrated by Microsoft in December 2013. ZeroAccess botnet used for amplifying DDoS attacks MalwareTech discovered that ZeroAccess allowed its bots to relay messages from one to another, some acting like smaller servers (supernodes) while the rest were just end-points (workers). To relay orders from the C&C server to supernodes and workers, ZeroAccess used simple UDP packets. Because of its complex mesh structure, when a UDP packet arrived at a supernode, the bot would add more information to the packet, containing various details about the network’s structure. The supernode would add 408 bytes on top of the original 16, for a total of 242 bytes. Since UDP packets can have their destination address spoofed, an attacker that managed to map ZeroAccess’ bot network would be able to send UDP packets to its bots, some of which would then amplify the traffic by 26.5, sending it back to the spoofed destination (the victim’s IP). This scenario is your typical reflection DDoS attack , carrying a 26.5 amplification factor, which is more than double the typical 2-10 amplification factor seen in other types of reflection DDoS attacks. DDoS attacks worked even if bots were behind NATs Theoretically, this wouldn’t have been a problem, since most bots infect users that are sitting behind NATs (Network Address Translation), software programs that translate public IPs to private IP addresses, in order to maximize IPv4 address space usage. That meant that a vast majority of the ZeroAccess botnet wouldn’t have been accessible to a person carrying DDoS attacks via this technique. Unfortunately, MalwareTech found a way around this issue as well, allowing him to involve ZeroAccess supernode bots into DDoS attacks even if sitting behind a router. All of this is only theoretical since the researcher did not want to commit a crime just to test out his theory. Source: http://news.softpedia.com/news/malware-botnet-can-be-abused-to-launch-ddos-attacks-501869.shtml

See the original post:
Malware Botnet Can Be Abused to Launch DDoS Attacks

DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

A group known as New World Hackers says it targeted the websites of Salt Lake City police, Salt Lake International Airport, the Downtown Alliance and First Utah Bank in response to the Feb. 27 officer-involved shooting of teenager Abdullahi Omar Mohamed. The distributed denial of service attacks, first reported Monday by HackRead, appear to have had little impact on the sites’ function. Nick Como, communication and marketing director for the Downtown Alliance, said he heard about the attacks but that the nonprofit’s website analytics were normal. City deputy director of communications Holly Mullen said an attack on the SLCPD site was “unsuccessful.” Airport public relations director Nancy Volmer was unaware of any problems. First Utah Bank CIO Amy Foulks said the bank shut down its website for a few hours Sunday morning after it received an alert, which “allowed ourselves some time to implement a tool that would thwart the denial of service package.” Bank president Brad Baldwin emphasized that the DDoS attacks were not a “hack.” The group did not gain access to the bank’s system or any customer information, he said. A Twitter account associated with the group, @NewWorldHacking, told The Tribune the attacks were in response to the shooting of Mohamed, 17, who was shot and wounded near 250 S. Rio Grande Street after police say he was one of two people attacking a male victim with metal objects. “We want justice for that poor kid who got shot 3 times in the chest for no accurate reason,” it said in a direct message. That the group would target a bank with no apparent role in Mohamed’s shooting is “a mystery to us,” Baldwin said. First Utah reported the attack to authorities, he said. The FBI did not immediately return a request for comment Tuesday. Source: http://www.sltrib.com/news/3665236-155/ddos-attacks-aimed-at-salt-lake

Taken from:
DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Event ticket seller Ticketmaster experiences the traffic equivalent of a huge DDoS attack every time a major gig or show goes on sale, necessitating a steady migration to the cloud. That’s according to Simon Tarry, director of engineering strategy at the firm, speaking to V3 ahead of the V3 Cloud and Infrastructure Live event on 20 and 21 April 2015. “Ticketmaster’s been handling web traffic for almost two decades now, so we’ve built up our own infrastructure, and part of the problem with that, as a US company, is we’ve grown through acquisition and bought up a lot of ticketing businesses round the world – as well as all the infrastructure that comes with it,” Tarry explained. With ticketing platforms scaling, and a growing audience increasingly consisting not just of fans “but automated bots as well”, Tarry said Ticketmaster’s existing infrastructure was reaching critical mass. Ticketmaster currently handles around 1,300 users per second at peak times. “We basically suffer huge DDoS attacks from a large on-sale, so we try to separate our human traffic from bot traffic,” Tarry told V3 . Having already been using a private cloud for the past three years, Ticketmaster is now going through a “strategic push” to AWS. “We’re assessing at the moment that kind of journey – how to move what we have into an AWS architecture. So a lot of planning and training is going on right now,” Tarry said. The initial migration to private cloud was an e-commerce stack for a one-off event. “We tried that first, as a short project, as it was limited in scope to a certain degree,” said Tarry. “But we made a lot of assumptions about the infrastructure that weren’t true,” he added. “So we had to challenge a lot of our thinking about the infrastructure and how it would perform. The key criteria for us is to handle a very large on-sale on any platform.” Keeping the lights on and maintaining the ability to cope with a punishing level of traffic was achieved by “strong tooling”, said Tarry, including load testing products from SOASTA. Mechanisms to interrogate the traffic in order to block out traffic Ticketmaster doesn’t want also help in this. “Part of our DevOps culture is a kind of ‘swat team’ of guys who play ‘hunt the bottleneck’, spending time diagnosing, testing, and finding the next problem,” Tarry said. “Ultimately, when we’re cloud based we want that capacity on-tap – it’s not something you can just do,” he said. “You need to configure your systems to use that capability.” Source: http://www.v3.co.uk/v3-uk/news/2451092/ticketmaster-turns-to-the-cloud-to-handle-ddos-level-traffic-during-big-event-launches

More here:
Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Staminus, a California-based internet hosting provider that specializes in helping sites stay online when distributed denial of service (DDoS) attackers try to elbow them off, was itself the target of a cyber broadside last week. At any rate, it started last week, with reports of the company’s site being down as of Thursday. But as of Monday, it was again, or maybe still, sucking wind. Staminus on Friday put out a statement confirming that its network security had been popped and invaded, systems had been “temporarily” taken offline, and customer data had been published online. The company posted a series of updates on Twitter and Facebook while its website was down, explaining that this was a “rare event.” But even while Staminus techs were scrambling to drag the company’s site back online, whoever mugged it was dumping its private data online in what security journalist Brian Krebs called a “classic ‘hacker e-zine’ format” called “F**k ’em all.” Krebs reports that the page included links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The huge data dump included customer names and email addresses, database table structures, routing tables, support tickets, credit card numbers (according to Krebs, at any rate; Ars Technica’s Sean Gallagher didn’t see any when he viewed the dump), and other sensitive data. A Staminus customer who requested anonymity confirmed to Ars that his data was part of the dump. Those behind the dump claimed to have gained control of Staminus’s routers and to have reset them to factory settings. The hacker “e-zine” that contained all the sensitive data began with a note from the attacker titled “TIPS WHEN RUNNING A SECURITY COMPANY.” Then, it went on to list tips for what were supposedly the security holes found during the breach: Use one root password for all the boxes Expose PDU’s [power distribution units in server racks] to WAN with telnet auth Never patch, upgrade or audit the stack Disregard PDO [PHP Data Objects] as inconvenient Hedge entire business on security theatre Store full credit card info in plaintext Write all code with wreckless [sic] abandon On Thursday, Staminus reported that some services were back online or in the process of being brought back and that “We expect full service restoration soon.” Then, another message posted on Friday pointed to the statement from the company’s CEO. That was the last message. What followed was radio silence, unbroken as of Monday evening. Krebs pointed out that the attack isn’t surprising: anti-DDoS providers are a common target for attackers. Source: https://nakedsecurity.sophos.com/2016/03/15/attacker-leaves-security-tips-after-invading-anti-ddos-firm-staminus/

Original post:
Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Altcoin exchange Poloniex affected by DDoS attack

Until last night, it had been a while until DDoS attacks affected any of the popular bitcoin and altcoin exchanges. The latest reports now indicate that a couple of hours ago, popular bitcoin exchange Poloniex was the target of a strong DDoS attack, which not only took the site offline, but it also affected the API, and therefore forced the exchange to stop carrying out transactions. The announcement was made via a Twitter post, which read: ‘It appears we’re under a DDoS attack. We’re investigating and working on getting the site back online as quickly as we can’. Luckily, the security team behind the company managed to quickly mitigate the attack, and restore service. However, it is believed that the attack was in fact a stress test, meant to differently target the attack next time, or even force the exchange to make a security mistake. This strategy has been put to use before, so Poloniex will have to be particularly careful in the near future. For those who do not know, Poloniex can be considered one of the best altcoin exchanges, as it works hard to introduce as many coins as possible, while also keeping the services up and running at all times. In our review of the exchange, The Merkle also noted its friendly customer support, trading fee structure and more. Based on everything that has been outlined so far, what do you think about the DDoS attack carried out on Poloniex? Was it the full attack, or just a simple stress test? Let us know your thoughts in the comment section below. Source: http://themerkle.com/altcoin-exchange-poloniex-affected-by-ddos-attack/

Original post:
Altcoin exchange Poloniex affected by DDoS attack

Hackers Target Anti-DDoS Firm Staminus

Staminus Communications Inc ., a California-based Internet hosting provider that specializes in protecting customers from massive “distributed denial of service” (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked. Staminus’s entire network was down for more than 20 hours until Thursday evening, leaving customers to vent their rage on the company’s Facebook and Twitter pages. In the midst of the outage, someone posted online download links for what appear to be Staminus’s customer credentials, support tickets, credit card numbers and other sensitive data. Newport Beach, Calif.-based Staminus first acknowledged an issue on its social media pages because the company’s Web site was unavailable much of Thursday. “Around 5am PST today, a rare event cascaded across multiple routers in a system wide event, making our backbone unavailable,” Staminus wrote to its customers. “Our technicians quickly began working to identify the problem. We understand and share your frustration. We currently have all hands on deck working to restore service but have no ETA for full recovery.” Staminus now says its global services are back online, and that ancillary services are being brought back online. However, the company’s Web site still displays a black page with a short message directing customers to Staminus’s social media pages. Meanwhile, a huge trove of data appeared online Thursday, in a classic “hacker e-zine” format entitled, “Fuck ’em all.” The page includes links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The authors of this particular e-zine indicated that they seized control over most or all of Staminus’s Internet routers and reset the devices to their factory settings. They also accuse Staminus of “using one root password for all the boxes,” and of storing customer credit card data in plain text, which is violation of payment card industry standards. Staminus so far has not offered any additional details about what may have caused the outage, nor has it acknowledged any kind of intrusion. Several Twitter accounts associated with people who claim to be Staminus customers frustrated by the outage say they have confirmed seeing their own account credentials in the trove of data dumped online. I’ve sent multiple requests for comment to Staminus, which is no doubt busy with more pressing matters at the moment. I’ll update this post in the event I hear back from them. It is not unusual for attackers to target Anti-DDoS providers. After all, they typically host many customers whose content or message might be offensive — even hateful — speech to many. For example, among the company’s many other clients is kkk-dot-com, the official home page of the Ku Klux Klan (KKK) white supremacist group. In addition, Staminus appears to be hosting a large number of internet relay chat (IRC) networks, text-based communities that are often the staging grounds for large-scale DDoS attack services. Source: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/

More:
Hackers Target Anti-DDoS Firm Staminus

Brief Downtime Disrupts Bitcoin Exchange Trading

Another day in the Bitcoin world and another crisis has been averted, even though plenty of users were worried when several exchanges experienced the same issue at the same time. Incapsula, the DDoS protection provider for several major Bitcoin exchanges, was experiencing some issues earlier today. As a result, trading was temporarily unavailable, although the issue was rectified rather quickly. However, this “centralized” form of protection is an annoyance for a decentralized ecosystem. While it is of the utmost important for Bitcoin exchanges to have some form of DDoS protection, it is not helpful if all of these platforms use one and the same provider. Bitcoin and digital currency are all about decentralization, yet companies seem to be using one centralized security solution. Granted, Incapsula is one of the market leaders when it comes to DDoS and platform protection services. It only makes sense when companies such as BTCC , Bitstamp , BitFinex , Vaultoro , and others have taken a liking to this company. Not that there is anything wrong with that, as long as there is no outage as Incapsula itself. There is no mention on the Incapsula Twitter account as to what went wrong exactly, or how the matter was resolved in the end. Whichever way the company handled this issue, the issue was sorted in a matter of minutes, which is commendable. Nor do any of the affected Bitcoin exchanges posted any messages on social media either, which is quite disconcerting. Security is the top priority for any Bitcoin exchange platform, as most companies act as a custodian while watching over customer funds. DDoS attacks, hacking attempts, and database breaches need to be avoided at all costs.Incapsula is a well-respected company capable of delivering such a service. But at the same time, this situation begs the question if there are no other companies who can provide this service as well. Granted, security is an innovative business in the online world right now, and there are hundreds of companies in existence who want to be market leaders. Incapsula has secured their spot already– for now – but other players need to emerge and collaborate with Bitcoin platforms to create more decentralization in the security department. Source: http://themerkle.com/news/brief-incapsula-downtime-disrupts-bitcoin-exchange-trading/

Read the article:
Brief Downtime Disrupts Bitcoin Exchange Trading

Customers of large NZ website company Zeald have been hit by DDoS attack

Customers of a large New Zealand website design company have had their websites shut down due to a cyber attack believed to target one or more of the company’s customers. Customers of Zeald were informed on Thursday that some clients had experienced outages with their websites in recent weeks. The company, formed in 2001, with thousands of customers in New Zealand and Australia, has told clients the outages were caused by Distributed Denial of Service (DDoS) attacks. These attacks attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. They present a major challenge to making sure people can publish and access important information. “Simply put, a DDoS attack simulates millions of computers trying to access a website at the same time. This puts tremendous stress on the online infrastructure, and can make access to a website difficult, or impossible,” the company said in its email. “We believe these attacks are targeted at one of our customers,” it said. It said the attacks were difficult to resolve and were a rapidly expanding class of security attack. They did not involve ‘hacking’ and did not lead to the loss of confidential information, but they made it impossible to access a site. “They can be created by attackers with limited technical skill but options for dealing with them are extremely limited”. “Working with our upstream providers, we have been able to stop these attacks temporarily by blocking international traffic. Unfortunately, these attacks keep resuming and are no longer isolated to international traffic alone. These attacks are also causing major issues for our upstream providers as well as the other websites and services that they provide,” it said. “If you have experienced any kind of extortion attempt or communication threatening an attack like this please let us know. Any feedback regarding recent threats will be treated in the strictest confidence. If we know the target of the attack there are measures we can put in place to eliminate the problem”. Source: http://www.stuff.co.nz/technology/77539929/customers-of-large-nz-website-company-zeald-have-been-hit-by-cyber-attack

Excerpt from:
Customers of large NZ website company Zeald have been hit by DDoS attack