Tag Archives: var-username

Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Event ticket seller Ticketmaster experiences the traffic equivalent of a huge DDoS attack every time a major gig or show goes on sale, necessitating a steady migration to the cloud. That’s according to Simon Tarry, director of engineering strategy at the firm, speaking to V3 ahead of the V3 Cloud and Infrastructure Live event on 20 and 21 April 2015. “Ticketmaster’s been handling web traffic for almost two decades now, so we’ve built up our own infrastructure, and part of the problem with that, as a US company, is we’ve grown through acquisition and bought up a lot of ticketing businesses round the world – as well as all the infrastructure that comes with it,” Tarry explained. With ticketing platforms scaling, and a growing audience increasingly consisting not just of fans “but automated bots as well”, Tarry said Ticketmaster’s existing infrastructure was reaching critical mass. Ticketmaster currently handles around 1,300 users per second at peak times. “We basically suffer huge DDoS attacks from a large on-sale, so we try to separate our human traffic from bot traffic,” Tarry told V3 . Having already been using a private cloud for the past three years, Ticketmaster is now going through a “strategic push” to AWS. “We’re assessing at the moment that kind of journey – how to move what we have into an AWS architecture. So a lot of planning and training is going on right now,” Tarry said. The initial migration to private cloud was an e-commerce stack for a one-off event. “We tried that first, as a short project, as it was limited in scope to a certain degree,” said Tarry. “But we made a lot of assumptions about the infrastructure that weren’t true,” he added. “So we had to challenge a lot of our thinking about the infrastructure and how it would perform. The key criteria for us is to handle a very large on-sale on any platform.” Keeping the lights on and maintaining the ability to cope with a punishing level of traffic was achieved by “strong tooling”, said Tarry, including load testing products from SOASTA. Mechanisms to interrogate the traffic in order to block out traffic Ticketmaster doesn’t want also help in this. “Part of our DevOps culture is a kind of ‘swat team’ of guys who play ‘hunt the bottleneck’, spending time diagnosing, testing, and finding the next problem,” Tarry said. “Ultimately, when we’re cloud based we want that capacity on-tap – it’s not something you can just do,” he said. “You need to configure your systems to use that capability.” Source: http://www.v3.co.uk/v3-uk/news/2451092/ticketmaster-turns-to-the-cloud-to-handle-ddos-level-traffic-during-big-event-launches

More here:
Ticketmaster turns to the cloud to handle ‘DDoS-level’ traffic during big event launches

Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Staminus, a California-based internet hosting provider that specializes in helping sites stay online when distributed denial of service (DDoS) attackers try to elbow them off, was itself the target of a cyber broadside last week. At any rate, it started last week, with reports of the company’s site being down as of Thursday. But as of Monday, it was again, or maybe still, sucking wind. Staminus on Friday put out a statement confirming that its network security had been popped and invaded, systems had been “temporarily” taken offline, and customer data had been published online. The company posted a series of updates on Twitter and Facebook while its website was down, explaining that this was a “rare event.” But even while Staminus techs were scrambling to drag the company’s site back online, whoever mugged it was dumping its private data online in what security journalist Brian Krebs called a “classic ‘hacker e-zine’ format” called “F**k ’em all.” Krebs reports that the page included links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The huge data dump included customer names and email addresses, database table structures, routing tables, support tickets, credit card numbers (according to Krebs, at any rate; Ars Technica’s Sean Gallagher didn’t see any when he viewed the dump), and other sensitive data. A Staminus customer who requested anonymity confirmed to Ars that his data was part of the dump. Those behind the dump claimed to have gained control of Staminus’s routers and to have reset them to factory settings. The hacker “e-zine” that contained all the sensitive data began with a note from the attacker titled “TIPS WHEN RUNNING A SECURITY COMPANY.” Then, it went on to list tips for what were supposedly the security holes found during the breach: Use one root password for all the boxes Expose PDU’s [power distribution units in server racks] to WAN with telnet auth Never patch, upgrade or audit the stack Disregard PDO [PHP Data Objects] as inconvenient Hedge entire business on security theatre Store full credit card info in plaintext Write all code with wreckless [sic] abandon On Thursday, Staminus reported that some services were back online or in the process of being brought back and that “We expect full service restoration soon.” Then, another message posted on Friday pointed to the statement from the company’s CEO. That was the last message. What followed was radio silence, unbroken as of Monday evening. Krebs pointed out that the attack isn’t surprising: anti-DDoS providers are a common target for attackers. Source: https://nakedsecurity.sophos.com/2016/03/15/attacker-leaves-security-tips-after-invading-anti-ddos-firm-staminus/

Original post:
Attacker leaves “SECURITY TIPS” after invading anti-DDoS firm

Anonymous Declares War On Donald Trump

Notorious hacking team set to launch DDoS attacks on Trump websites on April 1 Donald Trump’s seemingly inevitable rise to power in the United States may be about to hit a fairly major obstacle in the form of an Anonymous cyber-attack. The hacking collective, which has been behind a number of major attacks against individuals or companies it considers to have done wrong to the public, has said it is preparing a DDoS attack against Trump’s campaign website. The “declaration of war” was set out in a video posted to YouTube which says that the attacks, dubbed #OpTrump, will take place on April 1, targeting websites including trump.com, donaldjtrump.com andtrumphotelcollection.com. “Hateful campaign” “Dear Donald Trump, we have been watching you for a long time and what we see is deeply disturbing,” the video says. “Your inconsistent and hateful campaign has not only shocked the United States of America [but] you have shocked the entire planet with your appalling actions and ideas. You say what your audience wants to hear but in reality you don’t stand for anything except for your personal greed and power.” “We need you to shut down his websites, to research and expose what he doesn’t want the public to know. We need to dismantle his campaign and sabotage his brand. We are encouraging every able person with a computer to participate in this operation. This is not a warning, this is a declaration of total war. Donald Trump – it is too late to expect us.” In a separate written message posted online to accompany the video, Anonymous also listed what is claims are personal details belonging to Donald Trump, including his social security number, personal phone number and the contact details of his agent and legal representation. The animosity between Anonymous and Trump dates back to December 2015, when the former officially ‘declared war’ on Trump after a radical speech in which he said Muslims should be banned from entering the United States, which saw a number of Trumps’ websites taken offline. Anonymous has not been shy to wage war on opponents in the past, most famously attacking terrorist group Isis last December following the terrorist attacks in Paris that left 130 people dead. Earlier that month, the group also published the details of a thousand alleged KKK sympathisers as part of its #HoodsOff campaign, which it described as “a form of resistance” against racial violence, following earlier major cyberattacks which included posting several messages on the KKK’s official Twitter feed, and taking control of another account affiliated with the Klan. Source: http://www.techweekeurope.co.uk/security/cyberwar/anonymous-declares-war-donald-trump-187898

View original post here:
Anonymous Declares War On Donald Trump

Altcoin exchange Poloniex affected by DDoS attack

Until last night, it had been a while until DDoS attacks affected any of the popular bitcoin and altcoin exchanges. The latest reports now indicate that a couple of hours ago, popular bitcoin exchange Poloniex was the target of a strong DDoS attack, which not only took the site offline, but it also affected the API, and therefore forced the exchange to stop carrying out transactions. The announcement was made via a Twitter post, which read: ‘It appears we’re under a DDoS attack. We’re investigating and working on getting the site back online as quickly as we can’. Luckily, the security team behind the company managed to quickly mitigate the attack, and restore service. However, it is believed that the attack was in fact a stress test, meant to differently target the attack next time, or even force the exchange to make a security mistake. This strategy has been put to use before, so Poloniex will have to be particularly careful in the near future. For those who do not know, Poloniex can be considered one of the best altcoin exchanges, as it works hard to introduce as many coins as possible, while also keeping the services up and running at all times. In our review of the exchange, The Merkle also noted its friendly customer support, trading fee structure and more. Based on everything that has been outlined so far, what do you think about the DDoS attack carried out on Poloniex? Was it the full attack, or just a simple stress test? Let us know your thoughts in the comment section below. Source: http://themerkle.com/altcoin-exchange-poloniex-affected-by-ddos-attack/

Original post:
Altcoin exchange Poloniex affected by DDoS attack

Hackers Target Anti-DDoS Firm Staminus

Staminus Communications Inc ., a California-based Internet hosting provider that specializes in protecting customers from massive “distributed denial of service” (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked. Staminus’s entire network was down for more than 20 hours until Thursday evening, leaving customers to vent their rage on the company’s Facebook and Twitter pages. In the midst of the outage, someone posted online download links for what appear to be Staminus’s customer credentials, support tickets, credit card numbers and other sensitive data. Newport Beach, Calif.-based Staminus first acknowledged an issue on its social media pages because the company’s Web site was unavailable much of Thursday. “Around 5am PST today, a rare event cascaded across multiple routers in a system wide event, making our backbone unavailable,” Staminus wrote to its customers. “Our technicians quickly began working to identify the problem. We understand and share your frustration. We currently have all hands on deck working to restore service but have no ETA for full recovery.” Staminus now says its global services are back online, and that ancillary services are being brought back online. However, the company’s Web site still displays a black page with a short message directing customers to Staminus’s social media pages. Meanwhile, a huge trove of data appeared online Thursday, in a classic “hacker e-zine” format entitled, “Fuck ’em all.” The page includes links to download databases reportedly stolen from Staminus and from Intreppid, another Staminus project that targets customers looking for protection against large DDoS attacks. The authors of this particular e-zine indicated that they seized control over most or all of Staminus’s Internet routers and reset the devices to their factory settings. They also accuse Staminus of “using one root password for all the boxes,” and of storing customer credit card data in plain text, which is violation of payment card industry standards. Staminus so far has not offered any additional details about what may have caused the outage, nor has it acknowledged any kind of intrusion. Several Twitter accounts associated with people who claim to be Staminus customers frustrated by the outage say they have confirmed seeing their own account credentials in the trove of data dumped online. I’ve sent multiple requests for comment to Staminus, which is no doubt busy with more pressing matters at the moment. I’ll update this post in the event I hear back from them. It is not unusual for attackers to target Anti-DDoS providers. After all, they typically host many customers whose content or message might be offensive — even hateful — speech to many. For example, among the company’s many other clients is kkk-dot-com, the official home page of the Ku Klux Klan (KKK) white supremacist group. In addition, Staminus appears to be hosting a large number of internet relay chat (IRC) networks, text-based communities that are often the staging grounds for large-scale DDoS attack services. Source: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/

More:
Hackers Target Anti-DDoS Firm Staminus

Brief Downtime Disrupts Bitcoin Exchange Trading

Another day in the Bitcoin world and another crisis has been averted, even though plenty of users were worried when several exchanges experienced the same issue at the same time. Incapsula, the DDoS protection provider for several major Bitcoin exchanges, was experiencing some issues earlier today. As a result, trading was temporarily unavailable, although the issue was rectified rather quickly. However, this “centralized” form of protection is an annoyance for a decentralized ecosystem. While it is of the utmost important for Bitcoin exchanges to have some form of DDoS protection, it is not helpful if all of these platforms use one and the same provider. Bitcoin and digital currency are all about decentralization, yet companies seem to be using one centralized security solution. Granted, Incapsula is one of the market leaders when it comes to DDoS and platform protection services. It only makes sense when companies such as BTCC , Bitstamp , BitFinex , Vaultoro , and others have taken a liking to this company. Not that there is anything wrong with that, as long as there is no outage as Incapsula itself. There is no mention on the Incapsula Twitter account as to what went wrong exactly, or how the matter was resolved in the end. Whichever way the company handled this issue, the issue was sorted in a matter of minutes, which is commendable. Nor do any of the affected Bitcoin exchanges posted any messages on social media either, which is quite disconcerting. Security is the top priority for any Bitcoin exchange platform, as most companies act as a custodian while watching over customer funds. DDoS attacks, hacking attempts, and database breaches need to be avoided at all costs.Incapsula is a well-respected company capable of delivering such a service. But at the same time, this situation begs the question if there are no other companies who can provide this service as well. Granted, security is an innovative business in the online world right now, and there are hundreds of companies in existence who want to be market leaders. Incapsula has secured their spot already– for now – but other players need to emerge and collaborate with Bitcoin platforms to create more decentralization in the security department. Source: http://themerkle.com/news/brief-incapsula-downtime-disrupts-bitcoin-exchange-trading/

Read the article:
Brief Downtime Disrupts Bitcoin Exchange Trading

Health orgs hit with cyberattacks every month

Healthcare organizations “are in the crosshairs” of cyber attackers, suffering one hack per month over the last year, with about half experiencing an incident involving the loss or exposure of patient information and another third unsure whether or not data was exposed, according to a new report. Conducted by the Ponemon Institute for security software company ESET, the report questioned 535 IT security practitioners from a variety of healthcare organizations, including private and public providers as well as government agencies, and found an industry beset by security breaches of all kinds. “With cyber attacks against healthcare organizations growing increasingly frequent and complex, there is more pressure to refine cybersecurity strategies,” the report’s authors wrote. “The State of Cybersecurity in Healthcare Organizations” also found that organizations struggle to deal with a variety of threats, including system failures (79 percent), unsecure medical devices (77 percent), cyberattackers (77 percent), employee-owned mobile devices or BYOD (76 percent), identity thieves (73 percent) and unsecure mobile devices (72 percent). Despite citing unsecure medical devices as a top security threat, only 27 percent of respondents said their organization has guidelines for medical devices as part of its cybersecurity strategy. The most common security incident sited was the exploitation of existing software vulnerabilities greater than three months old, according to 78 percent of respondents. Web-borne malware attacks were named by 75 percent of respondents. Following next were exploits of existing software vulnerability less than three months old (70 percent), spear phishing (69 percent) and lost or stolen devices (61 percent), according to the study. What’s more, participating organizations were only partly effective at preventing attacks. Almost half (49 percent) said their organizations experienced situations when cyberattacks have evaded their intrusion prevention systems (IPS), but many respondents (27 percent) were unsure.  Another 37 percent said their organizations have experienced cyber attacks that evaded their anti-virus (AV) solutions or traditional security controls but 25 percent were unsure. On average, organizations have an APT incident every three months. Only 26 percent of respondents say their organizations have systems and controls in place to detect and stop advanced persistent threats (APTs) and 21 percent are unsure. On average, over a 12-month period, organizations had an APT attack about every 3 months (3.46 APT-related incidents in one year), the survey said. As for the consequences of theses breaches, 63 percent of respondents said the primary consequences of APTs and zero day attacks were IT downtime, followed by the inability to provide services (46 percent), while 44 percent said these incidents resulted in the theft of personal information. In addition, DDoS attacks have cost organizations on average $1.32 million in the past 12 months, the survey said. Healthcare organizations in the report spend an average of $23 million on IT and approximately 12 percent is allocated to information security. “Since an average of $1.3 million is spent annually just to deal with DDoS attacks, the business case can be made to increase technology investments to reduce the frequency of successful attacks,” the report said. Source: http://www.govhealthit.com/news/ponemon-health-orgs-hit-cyberattacks-every-month

More:
Health orgs hit with cyberattacks every month

Customers of large NZ website company Zeald have been hit by DDoS attack

Customers of a large New Zealand website design company have had their websites shut down due to a cyber attack believed to target one or more of the company’s customers. Customers of Zeald were informed on Thursday that some clients had experienced outages with their websites in recent weeks. The company, formed in 2001, with thousands of customers in New Zealand and Australia, has told clients the outages were caused by Distributed Denial of Service (DDoS) attacks. These attacks attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. They present a major challenge to making sure people can publish and access important information. “Simply put, a DDoS attack simulates millions of computers trying to access a website at the same time. This puts tremendous stress on the online infrastructure, and can make access to a website difficult, or impossible,” the company said in its email. “We believe these attacks are targeted at one of our customers,” it said. It said the attacks were difficult to resolve and were a rapidly expanding class of security attack. They did not involve ‘hacking’ and did not lead to the loss of confidential information, but they made it impossible to access a site. “They can be created by attackers with limited technical skill but options for dealing with them are extremely limited”. “Working with our upstream providers, we have been able to stop these attacks temporarily by blocking international traffic. Unfortunately, these attacks keep resuming and are no longer isolated to international traffic alone. These attacks are also causing major issues for our upstream providers as well as the other websites and services that they provide,” it said. “If you have experienced any kind of extortion attempt or communication threatening an attack like this please let us know. Any feedback regarding recent threats will be treated in the strictest confidence. If we know the target of the attack there are measures we can put in place to eliminate the problem”. Source: http://www.stuff.co.nz/technology/77539929/customers-of-large-nz-website-company-zeald-have-been-hit-by-cyber-attack

Excerpt from:
Customers of large NZ website company Zeald have been hit by DDoS attack

F2Pool Suffers from Series of DDoS Attacks

F2Pool, a Chinese mining pool also referred to as Discus Fish, which holds the largest share of the Bitcoin network’s hashrate at 26%, has been experiencing a series of extreme DDoS attacks. The attacks began to target the F2Pool Bitcoin mining pool almost immediately after the F2Pool team announced their decision to “test” Bitcoin Classic by launching a subpool in which miners can mine Bitcoin Classic blocks. Peter Todd and other Bitcoin experts requested the hackers and the individuals behind the series of DDoS attacks to terminate them immediately, as they are delaying the mining pools and companies to reach a consensus on the block size debate. Whomever is DoS attacking f2pool please stop. You’re only making it harder to come to consensus.https://t.co/GoicJNhcMY — Peter Todd (@petertoddbtc) February 25, 2016 Behind the DDoS attack Some bitcoin enthusiasts and supporters of Bitcoin Classic claim that the attacks have been directed and paid for by Bitcoin Core supporters, and its developers, to forcefully cause Bitcoin Classic nodes to become inoperable. A hacker, or a hacking group, that goes by the online alias botneko-chan stated on a forum that they have been paid to launch professional DDoS attacks on F2Pool’s Bitcoin Classic subpools. “Just paid, I’m professional ddoser lol. Don’t know why someone want to bring it down. Maybe increasing block size will decrease miners profit? I’m using bitcoin a lot but don’t care about it’s politics too much, XT had too fast block size grow rate which looks unrealistic to me. I think BIP100 is okay since it allows voting and also bitcoin unlimited also seems like good idea and looks simpler for me. If classic will fork to 2mb blocksize and it would be not enough then what? Next hard fork? I think protocol should support miner voting by design,” the hacker himself said on Reddit. Jonathan Toomim, the leading developer and founder of Bitcoin Classic, further explained that Chinese miners and mining pools are quite skeptical towards Bitcoin Classic as they prefer not to change pool information on their hardware to adopt the 2 megabyte hard fork. “Actual miners are lazy,” said Toomim. “They don’t like to change pool information on their hardware very often, because that would require logging into each of your machines and copy-pasting in new data to a web form and clicking submit. A typical mining farm will have hundreds to tens of thousands of these machines. The approach that Slush is taking is different. Rather than requiring users to reconfigure each machine, Slush is giving users a way to switch all of their hardware between Classic and Core by clicking on one button on Slush’s website. This should result in much faster changes.” As of now, leading bitcoin mining pools, including Antpool, F2Pool and BitFury, are supporting the roadmap and development of the Bitcoin Core development team. Source: http://cointelegraph.com/news/f2pool-suffers-from-series-of-ddos-attacks

View post:
F2Pool Suffers from Series of DDoS Attacks

Project Shield: Latest Google product could protect start-up websites from hacker DDoS attacks

On 24 February, Google and its parent company Alphabet opened the doors to Project Shield, a service designed to protect independent news websites with controversial geopolitical messages from distributed denial-of-service (DDoS) attacks. The project, which originates from the Google Ideas branch that was recently extended and rebranded as Jigsaw, has come out of an invite-only beta and is now freely available to any website not owned by a government or political party that passes through the application process. According to a Wired report, sites that have successful applications to the project will then be able to change their site’s domain name configuration which so that it redirects to a Google server. This server effectively creates a “reverse-proxy”, which then filters out malicious traffic. Google claims in an accompanying video (below) that decision to help independent websites from suffering the wrath of hackers is to reduce forced censorship, via online blackouts, for those sites that are delivering sensitive news in regions of political turmoil and/or upheaval. An example given for an early case of Project Shield’s use covers how Yahyanejad, the editor-in-chief of Balatarian.com , managed to take advantage of Google’s system to effectively null a swathe of DDoS digital strikes presumed to be intended to suppress the site’s coverage of the 2009 Iranian presidential election. “Just about anyone who’s published anything interesting has come under an attack at some point,” said Project Shield lead George Conard. “The smaller and more independent voices often don’t have the resources, whether technical or financial, to really put good protections in place…That’s where we come into the picture.” The catch, however, could be a deal breaker for some, despite the obvious positives of the service. While Alphabet executive director Eric Schmidt talks of using Jigsaw-produced schemes as being purpose-built to enable “technology to tackle the toughest geopolitical challenges,” any website making use of Project Shield is required to give Google access to its raw data logs on who is accessing the site itself. While this may cause privacy concerns, the company confirmed to Wired that the data logs will only be kept for a maximum of two weeks. Project Shield product manager CJ Adams said: “We’ve made it very explicit we don’t have the rights to commercialise anything that comes through.” Source: http://www.ibtimes.co.uk/project-shield-latest-google-product-could-protect-start-websites-hacker-ddos-attacks-1546036

Originally posted here:
Project Shield: Latest Google product could protect start-up websites from hacker DDoS attacks