Tag Archives: stop ddos attacks

DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

A group known as New World Hackers says it targeted the websites of Salt Lake City police, Salt Lake International Airport, the Downtown Alliance and First Utah Bank in response to the Feb. 27 officer-involved shooting of teenager Abdullahi Omar Mohamed. The distributed denial of service attacks, first reported Monday by HackRead, appear to have had little impact on the sites’ function. Nick Como, communication and marketing director for the Downtown Alliance, said he heard about the attacks but that the nonprofit’s website analytics were normal. City deputy director of communications Holly Mullen said an attack on the SLCPD site was “unsuccessful.” Airport public relations director Nancy Volmer was unaware of any problems. First Utah Bank CIO Amy Foulks said the bank shut down its website for a few hours Sunday morning after it received an alert, which “allowed ourselves some time to implement a tool that would thwart the denial of service package.” Bank president Brad Baldwin emphasized that the DDoS attacks were not a “hack.” The group did not gain access to the bank’s system or any customer information, he said. A Twitter account associated with the group, @NewWorldHacking, told The Tribune the attacks were in response to the shooting of Mohamed, 17, who was shot and wounded near 250 S. Rio Grande Street after police say he was one of two people attacking a male victim with metal objects. “We want justice for that poor kid who got shot 3 times in the chest for no accurate reason,” it said in a direct message. That the group would target a bank with no apparent role in Mohamed’s shooting is “a mystery to us,” Baldwin said. First Utah reported the attack to authorities, he said. The FBI did not immediately return a request for comment Tuesday. Source: http://www.sltrib.com/news/3665236-155/ddos-attacks-aimed-at-salt-lake

Taken from:
DDoS attacks aimed at Salt Lake City websites in apparent protest of officer-involved shooting

Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Event ticket seller Ticketmaster experiences the traffic equivalent of a huge DDoS attack every time a major gig or show goes on sale, necessitating a steady migration to the cloud. That’s according to Simon Tarry, director of engineering strategy at the firm, speaking to V3 ahead of the V3 Cloud and Infrastructure Live event on 20 and 21 April 2015. “Ticketmaster’s been handling web traffic for almost two decades now, so we’ve built up our own infrastructure, and part of the problem with that, as a US company, is we’ve grown through acquisition and bought up a lot of ticketing businesses round the world – as well as all the infrastructure that comes with it,” Tarry explained. With ticketing platforms scaling, and a growing audience increasingly consisting not just of fans “but automated bots as well”, Tarry said Ticketmaster’s existing infrastructure was reaching critical mass. Ticketmaster currently handles around 1,300 users per second at peak times. “We basically suffer huge DDoS attacks from a large on-sale, so we try to separate our human traffic from bot traffic,” Tarry told V3 . Having already been using a private cloud for the past three years, Ticketmaster is now going through a “strategic push” to AWS. “We’re assessing at the moment that kind of journey – how to move what we have into an AWS architecture. So a lot of planning and training is going on right now,” Tarry said. The initial migration to private cloud was an e-commerce stack for a one-off event. “We tried that first, as a short project, as it was limited in scope to a certain degree,” said Tarry. “But we made a lot of assumptions about the infrastructure that weren’t true,” he added. “So we had to challenge a lot of our thinking about the infrastructure and how it would perform. The key criteria for us is to handle a very large on-sale on any platform.” Keeping the lights on and maintaining the ability to cope with a punishing level of traffic was achieved by “strong tooling”, said Tarry, including load testing products from SOASTA. Mechanisms to interrogate the traffic in order to block out traffic Ticketmaster doesn’t want also help in this. “Part of our DevOps culture is a kind of ‘swat team’ of guys who play ‘hunt the bottleneck’, spending time diagnosing, testing, and finding the next problem,” Tarry said. “Ultimately, when we’re cloud based we want that capacity on-tap – it’s not something you can just do,” he said. “You need to configure your systems to use that capability.” Source: http://www.v3.co.uk/v3-uk/news/2451092/ticketmaster-turns-to-the-cloud-to-handle-ddos-level-traffic-during-big-event-launches

More here:
Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Anonymous Declares War On Donald Trump

Notorious hacking team set to launch DDoS attacks on Trump websites on April 1 Donald Trump’s seemingly inevitable rise to power in the United States may be about to hit a fairly major obstacle in the form of an Anonymous cyber-attack. The hacking collective, which has been behind a number of major attacks against individuals or companies it considers to have done wrong to the public, has said it is preparing a DDoS attack against Trump’s campaign website. The “declaration of war” was set out in a video posted to YouTube which says that the attacks, dubbed #OpTrump, will take place on April 1, targeting websites including trump.com, donaldjtrump.com andtrumphotelcollection.com. “Hateful campaign” “Dear Donald Trump, we have been watching you for a long time and what we see is deeply disturbing,” the video says. “Your inconsistent and hateful campaign has not only shocked the United States of America [but] you have shocked the entire planet with your appalling actions and ideas. You say what your audience wants to hear but in reality you don’t stand for anything except for your personal greed and power.” “We need you to shut down his websites, to research and expose what he doesn’t want the public to know. We need to dismantle his campaign and sabotage his brand. We are encouraging every able person with a computer to participate in this operation. This is not a warning, this is a declaration of total war. Donald Trump – it is too late to expect us.” In a separate written message posted online to accompany the video, Anonymous also listed what is claims are personal details belonging to Donald Trump, including his social security number, personal phone number and the contact details of his agent and legal representation. The animosity between Anonymous and Trump dates back to December 2015, when the former officially ‘declared war’ on Trump after a radical speech in which he said Muslims should be banned from entering the United States, which saw a number of Trumps’ websites taken offline. Anonymous has not been shy to wage war on opponents in the past, most famously attacking terrorist group Isis last December following the terrorist attacks in Paris that left 130 people dead. Earlier that month, the group also published the details of a thousand alleged KKK sympathisers as part of its #HoodsOff campaign, which it described as “a form of resistance” against racial violence, following earlier major cyberattacks which included posting several messages on the KKK’s official Twitter feed, and taking control of another account affiliated with the Klan. Source: http://www.techweekeurope.co.uk/security/cyberwar/anonymous-declares-war-donald-trump-187898

View original post here:
Anonymous Declares War On Donald Trump

Altcoin exchange Poloniex affected by DDoS attack

Until last night, it had been a while until DDoS attacks affected any of the popular bitcoin and altcoin exchanges. The latest reports now indicate that a couple of hours ago, popular bitcoin exchange Poloniex was the target of a strong DDoS attack, which not only took the site offline, but it also affected the API, and therefore forced the exchange to stop carrying out transactions. The announcement was made via a Twitter post, which read: ‘It appears we’re under a DDoS attack. We’re investigating and working on getting the site back online as quickly as we can’. Luckily, the security team behind the company managed to quickly mitigate the attack, and restore service. However, it is believed that the attack was in fact a stress test, meant to differently target the attack next time, or even force the exchange to make a security mistake. This strategy has been put to use before, so Poloniex will have to be particularly careful in the near future. For those who do not know, Poloniex can be considered one of the best altcoin exchanges, as it works hard to introduce as many coins as possible, while also keeping the services up and running at all times. In our review of the exchange, The Merkle also noted its friendly customer support, trading fee structure and more. Based on everything that has been outlined so far, what do you think about the DDoS attack carried out on Poloniex? Was it the full attack, or just a simple stress test? Let us know your thoughts in the comment section below. Source: http://themerkle.com/altcoin-exchange-poloniex-affected-by-ddos-attack/

Original post:
Altcoin exchange Poloniex affected by DDoS attack

Hackers Target Anti-DDoS Firm Staminus

Staminus Communications Inc ., a California-based Internet hosting provider that specializes in protecting customers from massive “distributed denial of service” (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked. Staminus’s entire network was down for more than 20 hours until Thursday evening, leaving customers to vent their rage on the company’s Facebook and Twitter pages. In the midst of the outage, someone posted online download links for what appear to be Staminus’s customer credentials, support tickets, credit card numbers and other sensitive data. Newport Beach, Calif.-based Staminus first acknowledged an issue on its social media pages because the company’s Web site was unavailable much of Thursday. “Around 5am PST today, a rare event cascaded across multiple routers in a system wide event, making our backbone unavailable,” Staminus wrote to its customers. “Our technicians quickly began working to identify the problem. We understand and share your frustration. We currently have all hands on deck working to restore service but have no ETA for full recovery.” Staminus now says its global services are back online, and that ancillary services are being brought back online. However, the company’s Web site still displays a black page with a short message directing customers to Staminus’s social media pages. Meanwhile, a huge trove of data appeared online Thursday, in a classic “hacker e-zine” format entitled, “Fuck ’em all.” The page includes links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The authors of this particular e-zine indicated that they seized control over most or all of Staminus’s Internet routers and reset the devices to their factory settings. They also accuse Staminus of “using one root password for all the boxes,” and of storing customer credit card data in plain text, which is violation of payment card industry standards. Staminus so far has not offered any additional details about what may have caused the outage, nor has it acknowledged any kind of intrusion. Several Twitter accounts associated with people who claim to be Staminus customers frustrated by the outage say they have confirmed seeing their own account credentials in the trove of data dumped online. I’ve sent multiple requests for comment to Staminus, which is no doubt busy with more pressing matters at the moment. I’ll update this post in the event I hear back from them. It is not unusual for attackers to target Anti-DDoS providers. After all, they typically host many customers whose content or message might be offensive — even hateful — speech to many. For example, among the company’s many other clients is kkk-dot-com, the official home page of the Ku Klux Klan (KKK) white supremacist group. In addition, Staminus appears to be hosting a large number of internet relay chat (IRC) networks, text-based communities that are often the staging grounds for large-scale DDoS attack services. Source: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/

More:
Hackers Target Anti-DDoS Firm Staminus

Health orgs hit with cyberattacks every month

Healthcare organizations “are in the crosshairs” of cyber attackers, suffering one hack per month over the last year, with about half experiencing an incident involving the loss or exposure of patient information and another third unsure whether or not data was exposed, according to a new report. Conducted by the Ponemon Institute for security software company ESET, the report questioned 535 IT security practitioners from a variety of healthcare organizations, including private and public providers as well as government agencies, and found an industry beset by security breaches of all kinds. “With cyber attacks against healthcare organizations growing increasingly frequent and complex, there is more pressure to refine cybersecurity strategies,” the report’s authors wrote. “The State of Cybersecurity in Healthcare Organizations” also found that organizations struggle to deal with a variety of threats, including system failures (79 percent), unsecure medical devices (77 percent), cyberattackers (77 percent), employee-owned mobile devices or BYOD (76 percent), identity thieves (73 percent) and unsecure mobile devices (72 percent). Despite citing unsecure medical devices as a top security threat, only 27 percent of respondents said their organization has guidelines for medical devices as part of its cybersecurity strategy. The most common security incident sited was the exploitation of existing software vulnerabilities greater than three months old, according to 78 percent of respondents. Web-borne malware attacks were named by 75 percent of respondents. Following next were exploits of existing software vulnerability less than three months old (70 percent), spear phishing (69 percent) and lost or stolen devices (61 percent), according to the study. What’s more, participating organizations were only partly effective at preventing attacks. Almost half (49 percent) said their organizations experienced situations when cyberattacks have evaded their intrusion prevention systems (IPS), but many respondents (27 percent) were unsure.  Another 37 percent said their organizations have experienced cyber attacks that evaded their anti-virus (AV) solutions or traditional security controls but 25 percent were unsure. On average, organizations have an APT incident every three months. Only 26 percent of respondents say their organizations have systems and controls in place to detect and stop advanced persistent threats (APTs) and 21 percent are unsure. On average, over a 12-month period, organizations had an APT attack about every 3 months (3.46 APT-related incidents in one year), the survey said. As for the consequences of theses breaches, 63 percent of respondents said the primary consequences of APTs and zero day attacks were IT downtime, followed by the inability to provide services (46 percent), while 44 percent said these incidents resulted in the theft of personal information. In addition, DDoS attacks have cost organizations on average $1.32 million in the past 12 months, the survey said. Healthcare organizations in the report spend an average of $23 million on IT and approximately 12 percent is allocated to information security. “Since an average of $1.3 million is spent annually just to deal with DDoS attacks, the business case can be made to increase technology investments to reduce the frequency of successful attacks,” the report said. Source: http://www.govhealthit.com/news/ponemon-health-orgs-hit-cyberattacks-every-month

More:
Health orgs hit with cyberattacks every month

You don’t need a website to get hit by DDoS

Just because your business doesn’t have a website, that doesn’t mean it can’t be a victim of a DDoS (distributed denial of service) attack. This sentence might not make much sense at this point, but keep reading. Security firm Kaspersky Lab and researchers B2B International looked at what cyber-crooks go for when attacking businesses and enterprises, and here’s what they came up with: Last year, 16 per cent of companies (globally), were victims of a DDoS attack. Among enterprises, the percentage jumps up to 24. For most, external activities, such as websites, were targeted. Among half, websites had been hit, logins and portals were attacked in 38 per cent of cases, while communications services were attacked 37 per cent of times. Transactional systems had been affected in 25 per cent of cases. But also, in 25 per cent of cases, file servers had been hit, and 15 per cent said their operational systems were targeted. Another 15 per cent said a DDoS attack hit their ISP network connectivity. “It’s important to take a DDoS attack seriously. It’s a relatively easy crime to perpetrate, but the effect on business continuity can be far-reaching. Our study found that alongside the well-publicised impact of an attack, such as website downtime, reputational damage and unhappy customers, DDoS hits can reach deep into a company’s internal systems. It doesn’t matter how small the company is, or whether or not it has a website; if you’re online, you’re a potential target. Unprotected operational systems are just as vulnerable to a DDoS attack as the external website, and any disruption can stop a business in its tracks,” said Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab. Source: http://www.itproportal.com/2016/02/29/you-dont-need-a-website-to-get-hit-by-ddos/  

See the original article here:
You don’t need a website to get hit by DDoS

Project Shield: Latest Google product could protect start-up websites from hacker DDoS attacks

On 24 February, Google and its parent company Alphabet opened the doors to Project Shield, a service designed to protect independent news websites with controversial geopolitical messages from distributed denial-of-service (DDoS) attacks. The project, which originates from the Google Ideas branch that was recently extended and rebranded as Jigsaw, has come out of an invite-only beta and is now freely available to any website not owned by a government or political party that passes through the application process. According to a Wired report, sites that have successful applications to the project will then be able to change their site’s domain name configuration which so that it redirects to a Google server. This server effectively creates a “reverse-proxy”, which then filters out malicious traffic. Google claims in an accompanying video (below) that decision to help independent websites from suffering the wrath of hackers is to reduce forced censorship, via online blackouts, for those sites that are delivering sensitive news in regions of political turmoil and/or upheaval. An example given for an early case of Project Shield’s use covers how Yahyanejad, the editor-in-chief of Balatarian.com , managed to take advantage of Google’s system to effectively null a swathe of DDoS digital strikes presumed to be intended to suppress the site’s coverage of the 2009 Iranian presidential election. “Just about anyone who’s published anything interesting has come under an attack at some point,” said Project Shield lead George Conard. “The smaller and more independent voices often don’t have the resources, whether technical or financial, to really put good protections in place…That’s where we come into the picture.” The catch, however, could be a deal breaker for some, despite the obvious positives of the service. While Alphabet executive director Eric Schmidt talks of using Jigsaw-produced schemes as being purpose-built to enable “technology to tackle the toughest geopolitical challenges,” any website making use of Project Shield is required to give Google access to its raw data logs on who is accessing the site itself. While this may cause privacy concerns, the company confirmed to Wired that the data logs will only be kept for a maximum of two weeks. Project Shield product manager CJ Adams said: “We’ve made it very explicit we don’t have the rights to commercialise anything that comes through.” Source: http://www.ibtimes.co.uk/project-shield-latest-google-product-could-protect-start-websites-hacker-ddos-attacks-1546036

Originally posted here:
Project Shield: Latest Google product could protect start-up websites from hacker DDoS attacks

Serbian President’s website comes under DDoS attack

The Serbian president’s website faced a large-scale “hacking” attack on Monday, which brought it down for several hours, his press office said. A statement carried by Tanjug explained that the distributed denial-of-service attack (SYN flood) targeted www.predsednik.rs, and that the president’s website is “subject to daily hacking attacks.” In a SYN flood attack, the server is overwhelmed by a large number of legitimate and false connections requests which consume its resources and render it unresponsive or difficult to access. “The hosting and security of the president’s website falls within the competence of the Defense Ministry. In cooperation with Telekom Srbija, the ministry blocked and prevented further attacks and possible damage to the computer equipment and services,” the statement said. Source:http://www.b92.net/eng/news/crimes.php?yyyy=2016&mm=02&dd=23&nav_id=97147

Read this article:
Serbian President’s website comes under DDoS attack

HSBC Calls In Cops To Chase DDoS Attackers Who Took Online Banking Down

HSBC said today it was working with local police to find those who disrupted its online banking services with a denial of service attack, as customers complained of not being able to access their accounts. The attack was made even more painful for customers as the last Friday of the month is a traditional payday in the UK, the home of HSBC. Little information was provided by HSBC other than a terse statement over Twitter: “HSBC UK internet banking was attacked this morning. We successfully defended our systems. “We are working hard to restore services, and normal service is now being resumed. We apologise for any inconvenience.” A spokesperson told the BBC a denial of service attack was the cause of the downtime. A subsequent tweet revealed the police had been contacted: “HSBC is working closely with law enforcement authorities to pursue the criminals responsible for today’s attack on our Internet banking.” HSBC was hit by a distributed denial of service (DDoS), where infected machines fire an overwhelming number of data packets at a server to stop it working, most recently in 2012. That time the Anonymous hacktivist crew was believed to have carried out the hit. DDoS attacks in general have been causing havoc in recent months, as criminals have tried to extort targets, threatening to knock businesses offline unless a ransom was paid. Encrypted email provider ProtonMail was criticised for paying a ransom of $6,000 in Bitcoin at the end of 2015 to a DDoS extortionist crew called the Armada Collective. That group targeted other secure email providers Hushmail, Runbox and VFEMail. Anti-DDoS provider Arbor Networks reported earlier this month that the record for DDoS power hit a new peak in 2015, hitting 500Gbps. Numerous organizations had reported attacks in the 400Gbps-500Gbps range throughout 2015, Arbor noted. With so much power, and such easy money to be made with extortion attacks, no business appears immune from DDoS downtime. Professor Alan Woodward, a security expert from the University of Surrey, said an attack capable of taking down an entity like HSBC would need to be big. “In addition we’re seeing the emergence of techniques that mean that these attacks are circumventing some of the systems put in place to mitigate agains these attacks,” Woodward said. He also warned DDoS has been used as a “smokescreen” for other malicious activity in the past. “They want to tie up the technical departments, of which there is obviously a finite number, so that they might miss some unusual activity that would give away the fact that the hackers are breaches the corporate boundary.” Source: http://www.forbes.com/sites/thomasbrewster/2016/01/29/hsbc-ddos-downtime/2/#4eea0f825126 http://www.forbes.com/sites/thomasbrewster/2016/01/29/hsbc-ddos-downtime/#109a8cc451c2

Taken from:
HSBC Calls In Cops To Chase DDoS Attackers Who Took Online Banking Down