Category Archives: DDoS Criminals

DDoS Attacks: What They Are, and How to Defend Against Them

You may have heard of a DDoS (distributed denial-of-service) attack in the news as a method used by malicious hackers to attack a website. It’s possible you’ve even experienced the effects of a DDoS attack yourself. If you host a website or other online service, being aware of the dangers of a DDoS attack can help you prevent one, or mitigate the damage they can incur. Here’s a brief explanation of what a DDoS attack is, what it accomplishes and how to avoid one. How does a DDoS attack work? Denial of service through server flooding can be thought of as simply filling up a pipe with enough material to prevent anything else from getting through. Denial of service may occur unintentionally if a server receives more traffic than it was designed to handle. This happens frequently, such as when a low-trafficked website suddenly becomes popular. In this case, the server is still functioning, and is not damaged, but is unreachable from the Internet. It’s been effectively knocked offline, and will be until the DDoS attack either stops or is outgunned by more servers being brought online. Malicious denial of service involves deliberately flooding a server with traffic. The easiest way to do so is to distribute the attacking computers among hundreds, even thousands of computers, which simultaneously bombard the target server with (often useless) requests for information. Think of multiple pipes from various locations eventually connecting into one large pipe, and massive volumes of material eventually colliding from the origin points into the main pipe. While the electronic connections that make up the Internet are not technically “pipes,” there is a limit to the amount of data that can be transferred through any given network.  Put enough in there, and a server’s pipes will be clogged. Cybercriminals use large systems of “zombie” computers, or computers infected with malware that allow a central controller to use them, in DDoS attacks. Hacktivist groups like Anonymous, on the other hand, recruit volunteers who install software on their own machines to take part in DDoS attacks. Anonymous has used DDoS attacks against the websites of credit-card companies, dictatorial foreign governments and even the CIA, FBI and U.S. Department of Justice. What does a DDoS attack accomplish? Unlike other forms of malicious computer activity, there is usually no immediate or direct gain for the attacker. The primary goal of a DDoS attack is simply to disrupt a service. A DDoS attack will not in itself allow hackers to access any secure information on its own. There is no network penetration or database breach involved. A DDoS attack can result in a loss of income for a company that does business online. Most of the large online retailers and social networks have hardened their servers to resist DDoS attacks. DDoS attacks by Anonymous and other hacktivist groups are often intended to be a form of protest. In January 2012, attacks on several government agencies and recording labels were staged by hacktivist groups as a form of protest against the Stop Online Piracy Act (SOPA) and the seizure of the file-sharing site MegaUpload by the FBI. Over the past decade, hundreds of DDos attacks have been performed by independent activists, political groups and even government agencies. How can you avoid or mitigate a DDoS attack? Unfortunately, there is little that can be done to avoid becoming the victim of a DDoS attack. Unlike other attacks, it is a brute-force strike that uses a public utility — the Internet itself — to overwhelm a system. Anti-virus software and filtering tools such as firewalls will not stop the effectiveness of the attack. The primary method of dealing with these attacks from the perspective of a host is to increase the capability of the system. Load-balancing tools can distribute requests among many servers scattered across a wide geographical area, and as the system grows to handle more requests, the attackers will need to use a stronger attack to overwhelm it. Methods to limit the amount of traffic allowed to and from the server can be enabled in some routers and switches, and some responsive systems can disconnect a network from the Internet before the attack brings the entire system down. The latter method will still result in the network being inaccessible from the Internet, but will generally result in a faster return to service. Source: http://www.tomsguide.com/us/ddos-attack-definition,news-18079.html

Read More:
DDoS Attacks: What They Are, and How to Defend Against Them

WoW gamers targeted with trojanized Curse client

The DDoS attacks that temporarily took down Blizzard's Battle.net and Valve's Steam online gaming services over the end of the year holidays have undoubtedly annoyed players, but posed no danger to th…

Read More:
WoW gamers targeted with trojanized Curse client

Slovenian jailed for creating code behind 12 MILLION strong ‘Mariposa’ botnet army

Butterfly flapped its wings and caused internet hurricane A Slovenian virus writer who created an infamous strain of malware used to infect an estimated 12 million computers worldwide has been jailed for almost five years.…

See more here:
Slovenian jailed for creating code behind 12 MILLION strong ‘Mariposa’ botnet army

The Changing Trends of DDoS Attacks

Distributed denial-of-service (DDoS) attacks certainly aren’t new. I’ve been talking about them for years. However, they have been changing. The traditional style of attack, the flood-the-target type that crashes a website, is still going strong. But now we are seeing an increase in application-layer attacks that have the same goal: Systems go down, resources are unavailable and the victim is scrambling to fix everything. Recently, Vann Abernethy, senior product manager for NSFOCUS, talked to me about the changing DDoS landscape. Something he has noticed is how DDoS attacks are being used as smokescreens to cover up other criminal activity. He said: In fact, the FBI warned of one such attack type back in November of 2011, which relies upon the insertion of some form of malware. When the attacker is ready to activate the malware, a DDoS attack is launched to occupy defenders. In this case, the DDoS attack is really nothing more than a smokescreen used to confuse the defenses and allow the real attack to go unnoticed – at least initially.  Considering that most malware goes undetected for long periods of time, even a small DDoS attack should be a huge red flag that something else may be going on. Abernethy adds that another trend he’s seeing is that the DDoS attack itself may be a bit more sinister. For example, a DDoS attack could be masking a simultaneous attack that is probing for vulnerabilities. He said: It’s like a recon team sent to look at an enemy’s position while they’re under some sort of long-range barrage. In general, basic probing will likely be caught if the victim has even modest security protections. But while under the duress of a DDoS attack, the very systems charged with either blocking or alerting suspicious activity might be under too much strain. Abernethy provides several solutions to protect against these emerging DDoS attack styles. One way is to have multiple teams set up to respond to DDoS attacks. One team would work on the DDoS attacks themselves; another team would be responsible for searching for other possible, hidden attacks. For the trend that involves probing, IT and security departments may want to deploy application security testing, and all applications used by the company should be subjected to the testing. DDoS attacks can be devastating to a company , interrupting vital customer interactions and ruining company reputations. The more we know about them, the better chance we have at protecting the company from any serious damage, if not preventing them altogether. Source: http://www.itbusinessedge.com/blogs/data-security/the-changing-trends-of-ddos-attacks.html

Read More:
The Changing Trends of DDoS Attacks

DDoS trojan ferrets SMB data

A new distributed-denial-of-service (DDoS) bot has been discovered targeting real estate companies and other small and medium-sized businesses. Arbor Networks researcher Dennis Schwarz found the malware after receiving a tip-off from a Twitter user. A relatively small number of unique samples and command and control servers were uncovered, making it difficult to judge just how dangerous the new threat could be. These samples are written in the Delphi programming language but most likely originate from Russia, said Schwarz, who added that the bot’s self-preservation tools include UPX packing, string obfuscation, anti-virtual machine, anti-bugging measures, self-modifying code and process hollowing. Command and control is done over HTTP. The analyst firm has a ‘fairly complete picture’ of what the bot represents, but admitted concerns on how Trojan.Ferret is being distributed. “Trojan.Ferret is a new Russian DDoS bot.  It stood out to me due to the silly ferret theme and that we have a fairly complete picture of it,” said Schwarz, adding that the company had tracked a sample of bot, the C&C panel view and live C&C traffic. “It is a traditional DDoS bot focusing on the ‘core’ set of DDoS attacks, such as HTTP, UDP and TCP. It lacks the common application layer attacks such as Slowloris, Apache Killer, and RUDY. “A major missing component that we’re unsure of is how this particular Trojan is being distributed–whether by exploit kit, malware-laced spam, or via one of the many ‘dropper/downloader’ networks.” Schwarz said that the Trojan is targeting the UK, the US, Germany, Russia and the Netherlands, as well as Kazakhstan, and said that attacks have hit property companies, an electronics shop, a wedding dress shop and even a politician in Panama. Malwarebytes malware intelligence analyst Adam Kujawa said the information security industry is still coming to grips with the threat posed by the new DDoS bot. “It is likely of Russian origin, uses an array of specialised malware tricks to hide it from detection and of course is used as a DDOS bot,” said Kujawa.  “Ferret will infect as many systems as it can to recruit them into the Botnet and then use each of those systems to attack a single server at the same time,” he added, commenting, “A single system cannot perform a successful DDOS attack but a botnet of thousands can.” Source: http://www.scmagazine.com.au/News/368168,ddos-trojan-ferrets-smb-data.aspx

Continue Reading:
DDoS trojan ferrets SMB data

Casino DDoS duo caged for five years after blackmail buyout threat

Polish crims demanded 50% of gambling biz, on pain of firm-killing cyber attacks A pair of cyber-extortionists who attempted to blackmail a Manchester-based online casino with threats of unleashing a debilitating denial of service attack have been jailed for five years and four months.…

See more here:
Casino DDoS duo caged for five years after blackmail buyout threat

China’s central bank hit by DDoS after Bitcoin blitz

Reports claim revenge attack after digi-currency restrictions Angry Bitcoin users are suspected of DDoS-ing the website of China’s central bank following tough new restrictions it levied this week which appear to have forced the world’s biggest Bitcoin exchange into meltdown.…

See the original article here:
China’s central bank hit by DDoS after Bitcoin blitz

7 Security Trends to Expect in 2014

Computer systems, in many peoples’ eyes, are there to be hacked — and that means fraudsters are always working on new ways to exploit vulnerabilities. So what does 2014 have in store? Here are seven security predictions for the New Year. DDoS Attacks Get Sneaky DDoS attackers will go from simple volumetric attacks to ones which take advantage of a site’s specific performance characteristics. That’s the prediction of security researchers at Neohapsis, a security and risk management consulting company. DDoS attacks that intelligently target bottlenecks in performance, such as pages with a high server load (like database writes) or specific network bottlenecks (like login and session management), can magnify the impact over attacks which are simply volume-based and request the homepage of a site. So it’s likely that we will begin to see the spread of tools which profile specific targets. The result? DDoS attacks that have more impact, and involve less network traffic, than the ones enterprises have become accustomed to mitigating against. Insider Threats Remain Major Security Problem According to a CyberSecurity Watch survey insiders were found to be the cause in 21 percent of security breaches, and a further 21 percent may have been due to the actions of insiders. More than half of respondents to another recent survey said it’s more difficult today to detect and prevent insider attacks than it was in 2011, and 53 percent were increasing their security budgets in response to insider threats. While a significant number of breaches are caused by malicious or disgruntled employees – or former employees – many are caused by well-meaning employees who are simply trying to do their job. BYOD programs and file sharing and collaboration services like Dropbox mean that it will be harder than ever to keep corporate data under corporate control in the face of these well-meaning but irresponsible employees. Defending against insider threats requires a multi-layered use of technological controls, including system-wide use of data encryption and establishment of policies stressing prevention of data loss. Security Worries Drive Cloud Consolidation Organizations will look to buy more solutions from a single vendor and demand greater integration between solutions to automate security, according to Eric Chiu, president of HyTrust, a cloud security company. The fact that securing cloud environments is very different from securing traditional physical environments will drive greater consolidation in the market, he says. Legacy Systems Cause More Security Headaches The spate of IT failures in banks and other high profile companies highlights a simple fact: Many of them are running legacy systems which are so old and out of date that they are becoming almost impossible to maintain. That’s because there are few people with the skills and expert knowledge that would be needed to run them securely – even if they were updated to eliminate know vulnerabilities, which they frequently are not. They often aren’t updated because no-one knows what impact that would have. It’s inevitable that we’ll see hackers going after such systems, exploiting vulnerabilities that can’t easily be fixed. Encryption Will Be Revisited In the wake of revelations about the NSA, many companies are realizing that encryption many be the only thing that is protecting their data, and it may not be as strong as they imagined. What’s more, if hackers are led to believe there is a weakness in a particular system – either accidental or intentional – they will pound on it until they find it. As a result, many companies will look to improve the way they use encryption. Look for particular attention to be paid to cryptographic block modes like CBC and OFB, and authenticated modes like EAX, CCM and GCM, advise the experts at Neohapsis. In addition to the encryption methods themselves, look for insights and innovations around key management and forward security. ‘Stuxnets’ Become More Common State-sponsored malware like Stuxnet – which is widely attributed to the United States, Israel or both – has proved to be far more sophisticated and effective than anything that a couple of hackers can develop. Expect more of this type of malware from the likes of China, Russia, Iran, India, Brazil and Pakistan. It’s probably already out there, even if it hasn’t yet been detected. 2014 could be the year that its prevalence becomes apparent. Bitcoin Drives New Malware The Bitcoin virtual currency is growing in popularity with legitimate businesses, and that’s likely to continue. That’s because Bitcoin payments offer significant attractions: They are quick and cheap, and there is no possibility of a chargeback. But Bitcoin wallets make attractive targets for criminals, because stolen coins can be cashed out instantly, without a middleman or launderer taking a cut. And many Bitcoin users are relatively unsophisticated, protecting their wallets with very little security. So expect Trojans and other malware that specifically look for and target Bitcoin stashes, as well as ransomware that demands Bitcoins in return for decrypting data. Source: http://www.esecurityplanet.com/network-security/7-security-trends-to-expect-in-2014.html

View article:
7 Security Trends to Expect in 2014