Many security professionals have heard about Command & Control botnets, even more have been infected by them. Very few have had the opportunity to actually look inside the server control panel of a C&…
Continue reading here:
Video: DIY Command & Control for fun and no profit
Not everyone despaired over the Distributed Denial of Service (DDoS) attacks that hit some of the Web’s biggest e-commerce sites in February. Security consultants and developers of security tools seized the opportunity to spotlight their solutions. Simple DoS attacks are not new. During one, a hacker floods a system with packets of useless requests, making the system so busy it denies access to legitimate users. What’s new are the hacker tools that enable DDoS attacks, in which a hacker uses dozens or hundreds of machines to worsen the attack. The hacker uses client software on one PC to install ‘zombie’ or ‘back door’ programs on other servers, which then flood a target system with useless packets. Zombie programs, including TFN (Tribal Flood Network), Trin00, TFN2K (Tribal Flood Network 2K) and Stacheldraht (Barbed Wire), arrived last fall destined for Solaris, Linux and Windows NT servers. Until recently, most security packages designed to thwart such attacks were aimed at the Unix environment. Now, however, hundreds of programs are being designed for Windows NT, ranging from Internet Security Systems’ (ISS) award-winning SAFEsuite software to BindView Corp.’s free and downloadable Zombie Zapper. Some programs scan the addresses of outgoing messages, intercepting wayward messages before they swamp a potential victim. Others allow administrators to block fake messages from entering a system, or stop the echo functions that help create the constant data flood in a DoS attack. While the programs for NT are good news, the task of evaluating them can easily overwhelm an IS staff, according to Aberdeen Group, a consultancy in Boston. Adding pressure are unresolved issues of liability when one’s computers have been compromised because of lax security. To organize efforts and provide a modicum of legal defense, leading security practitioners suggest these guidelines: Perform a security audit or risk assessment of critical systems using system- and network-based vulnerability tools. Identify and empower an Incident Response Team. Establish an Emergency Response and Escalation Plan. Install Intrusion Detection and Response systems. Examine legal liability exposure. If systems are under attack: Alert your Incident Response Team. Contact your ISP; often, hosts can shut down your access line, stopping the attack. Notify CERT/CC. Notify law enforcement authorities at the FBI and the National Infrastructure Protection Center (NIPC). Monitor systems during the attack using network and host-based intrusion detection systems. Enable detailed firewall logging. Collect forensics to prosecute hackers later. Source: http://networksasia.net/article/preparing-ddos-attacks-960134400
Read the article:
Preparing for DDoS attacks
The U.S. has brought criminal charges against 13 persons, said to be members of the hacker group Anonymous, for their alleged participation in cyberattacks as part of a campaign called Operation Payback.The defendants and other members of Anonymous allegedly launched or attempted to launch cyberattacks against government entities, trade associations, individuals, law firms and financial institutions, according to a federal grand jury indictment released Thursday in the U.S. District Court for the Eastern District of Virginia, Alexandria division. Among the organizations targeted were the Recording Industry Association of America, the Motion Picture Association of America, the United States Copyright Office of the Library of Congress, Visa, MasterCard, and Bank of America. The method of attack was DDoS (distributed denial of service) which floods web sites with spurious Internet traffic so that they become unavailable, and the weapon of choice was the freely-available and downloadable network stress testing program known as the Low Orbit Ion Cannon or LOIC, according to the indictment. The 13 persons have been charged with one count of “conspiracy to intentionally cause damage to a protected computer” from about Sept. 16, 2010 to at least Jan. 2, 2011. All are from the U.S. and in their 20s with the exception of Geoffrey Kenneth Commander, a 65-year-old man from Hancock, New Hampshire, and Dennis Owen Collins, a man from Toledo, Ohio born in 1960. Members of Anonymous launched Operation Payback on about September 2010 to retaliate against the discontinuation of The Pirate Bay, a controversial file-sharing website in Sweden, according to the indictment. On December 4, 2010, Operation Payback planned DDoS attacks on the websites of entities that were either critical of whistle-blower website WikiLeaks or had refused to process payments for WikiLeaks, including Amazon and U.S. Senator Joseph Lieberman. The hacker group thereafter launched attacks on the website of PostFinance, a Swiss payments, e-finance, and electronic account management organization, the Swedish prosecutor’s office and a Swedish law firm. This was followed by an attack on the website of MasterCard, which cost the payment firm at least US$5,000 in losses during a one-year period, according to the indictment. Anonymous has attacked sites in the U.S. and abroad for a number of ideological reasons ranging from censorship of the Internet, the takedown of file-sharing site Megaupload, and Israel military action against Hamas. Source: http://www.pcworld.com/article/2052360/us-indicts-13-anonymous-members-for-ddos-attacks.html
Read the original:
US charges 13 Anonymous members for DDoS attacks
An analyst has confirmed that several, unnamed financial institutions have suffered losses in the “millions” owing to distributed denial-of-service (DDoS) attacks. According to Avivah Litan , VP and distinguished analyst at research firm Gartner , three U.S. banks were hit by short-lived DDoS attacks in recent months after fraudsters targeted a wire payment switch, a central wire system at banks, to transfer funds. » A phishing attack enabled hackers to modify the DNS records for several domains of media sites, including those run by The New York Times , Twitter and the Huffington Post U.K. Investigations revealed that the companies were not even the ones targeted by the attackers, who claimed to be the Syrian Electronic Army , a band of pro-Assad hacktivists responsible for a number of IT takedowns in recent months. In order to commandeer the major media sites, intruders compromised a reseller account that had access to the IT systems of Melbourne IT , an Australian registrar, and targeted an employee using an emailed spear phishing ruse. » The PCI Security Standards Council gave merchants a first look at changes to its credit card data and payment application security guidelines that could be introduced later this year. In mid-August, the council released the “3.0 Change Highlights” document, a preview to the updated PCI Data Security Standard (PCI DSS) and Payment Application Data Security Standard (PA DSS), which are set to be published Nov. 7. Expected changes in version 3.0 include a new requirement that merchants draw up a current diagram showing how cardholder data flows through organizations’ systems, and added guidance on protecting point-of-sale (POS) terminals from attacks, as well as educational explanations of why the 12 core security requirements have been included in the standard. » Saboteurs have introduced a rare breed of banking trojan capable of infecting Linux users. The malware, called Hand of Thief, is being sold on Russian underground forums and will soon offer a “full-blown” suite of malicious features, making it comparable to other major, commercially available financial malware, RSA researchers discovered. Hand of Thief’s price tag could reach $3,000 once criminals add a suite of web injections to its existing form grabber and backdoor infection vectors. » Around 14,000 former and present employees at the U.S. Department of Energy (DOE) had their personally identifiable information (PII) accessed by an unauthorized party who gained access to the agency’s network. The breach, which may have happened in late July, did not impact classified data, the DOE revealed. But, the incident could mean that sensitive data linkable to an individual was exposed. » In late August, the National Institute of Standards and Technology (NIST) released a preliminary draft framework in support of President Obama ‘s executive order, “Improving Critical Infrastructure Cybersecurity.” Earlier in August, NIST also released revisions to two of its security-related manuals, the first amendments since NIST released them in 2005, reflecting evolving malware threats and the trend of organizations using automated patch management. » Errata : Our apologies to Steve Lee , who we quoted in an insider threats story in August, for erroneously placing the office of his company, Steve Lee and Associates, in Texas, rather than Los Angeles. Source: http://www.scmagazine.com/news-briefs-the-latest-on-major-ddos-and-phishing-attacks-and-more/article/311635/
See more here:
The latest on major DDoS and phishing attacks, and more
Almost 500,000 zombie machines have been taken out of the ZeroAccess botnet, one of the world’s largest networks of infected computers.
See more here:
Symantec disables ZeroAccess bots
Following the massive DDoS attack against anti-spam outfit Spamhaus earlier this year, a 35-year-old Dutch citizen believed to be Sven Kamphuis, the owner and manager of Dutch hosting firm Cyberbunker…
Bet his parents wish he’d been playing computer games A British police investigation into the massive DDoS attack against internet watchdog Spamhaus has led to the arrest of a 16-year-old London schoolboy who, it is claimed, is part of an international gang of cyber-crooks.…
Read More:
London schoolboy cuffed for BIGGEST DDOS ATTACK IN HISTORY
In March 2013, a distributed denial of service (DDoS) attack of unprecedented ferocity was launched against the servers of Spamhaus, an international non-profit dedicated to battling spam. A DDoS is an attack wherein the servers of a targeted online service are slowed to a crawl with loads of pointless email or file uploads that clog up their processing ability. The March Spamhaus attack peaked at 300 gigabits per second, Spamhaus CEO Steve Linford told the BBC at the time – the largest ever recorded, with enough force to cause worldwide disruption of the internet. In April, one suspect was arrested in Spain. Now, it’s come to light, another suspect was also secretly arrested in April – this one being a London schoolboy. The 16-year-old was arrested as part of an international dragnet against a suspected organised crime gang, reports the London Evening Standard. Detectives from the National Cyber Crime Unit detained the unnamed teenager at his home in southwest London. The newspaper quotes a briefing document on the British investigation, codenamed Operation Rashlike, about the arrest: The suspect was found with his computer systems open and logged on to various virtual systems and forums. The subject has a significant amount of money flowing through his bank account. Financial investigators are in the process of restraining monies. Officers seized his computers and mobile devices. The boy’s arrest, by detectives from the National Cyber Crime Unit, followed an international police operation against those suspected of carrying out the massive cyber attack, which slowed down the internet worldwide. The briefing document says that the DDoS affected services that included the London Internet Exchange. The boy has been released on bail until later this year, the London Evening Standard reports. The arrest follows close on the heels of two other London-based arrests resulting from international cyber-policing: Last week’s arrest of eight men in connection with a £1.3 million ($2.08 million) bank heist carried out with a remote-control device they had the brass to plug into a Barclays branch computer, and The arrest of 12 men in connection with a scheme to boobytrap computers at Santander, one of the UK’s largest banks, by rigging the same type of remote-control device found in Barclays – devices that enable remote bank robbery. Truly, the UK isn’t fooling around when it comes to cybercrime – a fact it’s making clear with the robust work of the National Cyber Crime Unit, which itself will soon be rolled into the even more cybercrime-comprehensive arms of the National Crime Agency. The National Crime Agency, due to launch 7 October, is going to comprise a number of distinct divisions: Organised Crime, Border Policing, Economic Crime, and the Child Exploitation and Online Protection Centre, on top of also housing the National Cyber Crime Unit. If the recent arrests are any indication, it would seem that the UK’s on the right track with cyber crime. May cyber crooks, both the seasoned and the schoolboys, take heed. Source: http://nakedsecurity.sophos.com/2013/09/27/schoolboy-arrested-over-spamhaus-ddos-worlds-biggest-cyber-attack/
See the article here:
Schoolboy arrested over Spamhaus DDoS, world’s biggest cyber attack
A distributed denial-of-service (DDoS) attack occurs every two minutes, and the number of victims that suffered from more than one attack has risen substantially, according to a new report released by security firm NSFOCUS in SecurityWeek. These attacks are not just high profile any longer, and that is a wake-up call to midsize firms, which are a key target for hackers for many reasons. DDoS Too Often NSFOCUS’s research found that 1.29 DDoS attacks strike somewhere online every two minutes. More than 90 percent of the attacks last less than half an hour. NSFOCUS ascertained that attacks generally remained short and did not go past the rate of 50 Mbps. The number of victims suffering more than one DDoS attack went up 30 percent in just a year, rising to 70 percent. Victims who suffered from only one attack went down from 51 percent last year to 31 percent this year. Interestingly, the study found that hacktivism was the key driver behind more than 91 percent of attacks. Also, online gaming communities and financial services are often targets. What Fuels It The survey also found that a lack of sufficient security, including poor passwords, has fueled the success of DDoS attacks. IT professionals at midsize firms have DDoS attacks on their radar screens since reports in the past few years have shown that the attacks are not just for high-profile purposes. Easily executed attacks that can do the most damage are ideal for today’s cybercriminals; that means midsize firms are at risk. Midsize firms are constantly concerned about having sufficient resources, personnel, money and time to remain competitive, so security must be a top priority for IT professionals, and those who work with third-party data centers should inquire what kind of DDoS protection is provided. Those that manage their own data centers must take the right precautions against botnets and application-layer DDoS attacks on the premises of the network. Also, by working with trusted and experienced security vendors, midsize firms can bring their own security to the next level. When all is said and done, firewalls no longer provide enough protection. A Worthy Investment Distributed denial-of-service attacks are growing, and midsize companies are falling victim. Cybercriminals know that they can successfully hit a lot of growing firms at once and make easy money. They know that some midsize firms do not take security seriously because it might be too costly or time-consuming to consider. In the end, the unprepared midsize firm loses resources, time and money to the costly consequences of a DDoS attack. IT professionals must prioritize security to maintain their company’s competitive edge. Source: http://midsizeinsider.com/en-us/article/distributed-denial-of-service-attacks-an
Originally posted here:
Distributed Denial-of-Service Attacks and Midsize Firms
Now that the banking industry has gone through four rounds of very public DDoS attacks, experts are looking at what happened to extract some “lessons learned” to turn this negative into a positive. Even if your business isn’t a financial institution, there’s good advice here that’s certainly worth heeding. Lesson One: No matter what industry or business you’re in, you need to have a plan in place to defend your business. DDoS attacks are not just hitting the banking industry. If your business has competitors that would benefit from your website being down, then you are vulnerable. Since it’s possible to buy DDoS as a service, anyone can launch an attack against you for as little as $10. Lesson Two: Don’t wait for an attack to put a solution in place to defend your company. Once an attack starts – and it could happen at any time – your organization’s website could be completely out of commission for an extended period. Why risk downtime when it’s easy enough to put a solution in place today? The solution could be on premise, in the cloud, or a hybrid combination. Lesson Three: Get a dedicated DDoS solution. Don’t count on traditional security devices like firewalls and IDS/IPS to protect your business because they just aren’t designed to handle modern DDoS attacks. When you choose a solution, consider that the volume level of attacks has been getting bigger, and the attacks have grown more sophisticated. Get a solution that meets today’s needs. Lesson Four: Create a detailed incident response plan. Know what to do if/when an attack occurs and assign tasks to specific people to avoid delays in responding. Lesson Five: If your organization is hit by an attack, closely monitor for indicators of compromise (IOCs). Many experts believe that DDoS attacks are smoke screens for fraud and other types of attacks that are designed to steal money or intellectual property. Lesson Six: Be willing to share information. DDoS attacks have been widespread and businesses, solution vendors and law enforcement agencies are better together than individually. If we look at what happened with the banking industry attacks, it got easier to defend against them once all types of organizations collaborated with each other to share intelligence, profiles of the attacks and mitigation strategies. Lesson Seven: This is more of a prediction than a lesson learned. Experts predict that critical infrastructure such as utilities, transportation systems, pipelines, the electrical grid, etc., will be targeted for DDoS attacks at some point. Attackers have the ability to target industrial controls as well as business websites. Administrators who control critical infrastructure need to re-read lessons one through six and take them to heart. Source: http://www.securitybistro.com/?p=8023
See original article:
Lessons Learned From the Banking Industry DDoS Attacks: Good Advice Worth Heeding