Category Archives: DDoS Criminals

Reddit Is Targeted with a DDoS Attack

The challenge with DDoS attacks like the one that hit Reddit is separating malicious traffic from legitimate, said security analyst Alex Horan. “If you wait until the traffic hits your site to make that distinction, it is too late. You are wasting processing time and bandwidth making that determination,” he said. Reddit got a black eye this week after being hit with a distributed denial of service (DDoS) attack Friday morning. The attacks left the site dark for a while and with spotty service well into the afternoon. “Having some technical difficulties right now. We’ll be back ASAP,” the @redditstatus Twitter feed reported before sunrise on the East Coast Friday morning. About 6:30 a.m., the site noted it was “working on mitigating a malicious DDoS attack.” Within 30 minutes, the site seemed to be up and running again but some of the functions were still hurting from the fallout. The Whys and Hows Alex Horan, senior product manager at Core Security, said the important point about DDoS is the initial ‘D’ for Distributed. In other words, Reddit could not easily distinguish between legitimate traffic and attack traffic. “If you wait until the traffic hits your site to make that distinction, it is too late. You are wasting processing time and bandwidth making that determination,” he said. “You need to work with the downstream Internet providers to make that distinction as close to the source of each of the nodes participating in the attack and drop the traffic there. This, in theory, could make the whole Internet faster, as less of this malicious traffic would make it to the shared information superhighway.” Horan said understanding the motive of the attackers is useful for the general community. Of course, he added, consumers shouldn’t necessarily change our behavior because of the threat of a DDoS. “It is important to learn the whys and the hows of these attacks and attackers so we can better anticipate what actions might provoke them,” he said, “so we can be forewarned — and technically what actions they will take so we can apply the right defenses — be forearmed.” Sending a Message? Richard Westmoreland, lead security analyst for the Security Operations Group at SilverSky, said DDoS attacks are normally launched to send some form of a message and can vary greatly in terms of their sophistication. “It has been widely speculated in federal circles that due to the sheer mass and complexity of these recent attacks that they are the result of an escalating cyber war with Iran. DDoS attacks have become the preferred and paid weapon for many politically motivated groups,” Westmoreland said. “This is both a scary and positive aspect to these types of attacks. The negatives are that they are perpetrated by professionals who have the skills and resources to effectively launch these attacks, and there is little that can be done to stop them. The consolation is that these attacks are generally shorter in duration before moving on to other targets.” For protection against your eCommerce site click here . Source: http://www.sci-tech-today.com/news/Reddit-Is-Targeted-with-a-DDoS-Attack/story.xhtml?story_id=10300BI2ZXIA&full_skip=1

View original post here:
Reddit Is Targeted with a DDoS Attack

DDoS Attack Bandwidth Jumps 718%

Distributed denial-of-service study finds increase in attack quantity and severity, while most attacks continue to originate from China. The average bandwidth seen in distributed denial-of-service (DDoS) attacks has recently increased by a factor of seven, jumping from 6 Gbps to 48 Gbps. Furthermore, 10% of DDoS attacks now exceed 60 Gbps. Those findings come from a new report released Wednesday by DDoS mitigation service provider Prolexic Technologies, which saw across-the-board increases in DDoS attack metrics involving the company’s customers. “Average packet-per-second rate and average bit rate spiked in the first quarter and both are growing at a fast clip,” said Prolexic president Stuart Scholly in a statement. “When you have average — not peak — rates in excess of 45 Gbps and 30 million packets per second, even the largest enterprises, carriers and, quite frankly, most mitigation providers, are going to face significant challenges.” In the first three months of 2013, 77% of DDoS attacks targeted bandwidth capacity and routing infrastructure, while 23% were application-level attacks that didn’t overwhelm targeted networks through packet quantity, but rather by disrupting critical applications or processes running on a server. The report also found that between the fourth quarter of 2012 and the first quarter of 2013, the total number of attacks increased marginally — by only 2% — while attack duration increased by 7%, from 32.2 hours to 34.5 hours. But the greatest number of DDoS attacks continue to be launched from China, although the volume of such attacks has recently declined. While 55% of all attacks came from China at the end of last year, by March 2013 that had dropped to 41%, followed by the United States (22%), Germany (11%), Iran (6%) and India (5%). The source of attacks doesn’t mean that a country’s government or even criminal gangs are directly responsible for launching DDoS campaigns. For example, the Operation Ababil bank disruption campaign being run by al-Qassam Cyber Fighters relies in part on hacking into vulnerable WordPress servers and installing such DDoS toolkits as “itsoknoproblembro” — aka Brobot. Attackers then use command-and-control servers to issue attack instructions to the toolkits, thus transforming legitimate websites into DDoS launch platforms. Given that situation, it’s no surprise that China, the United States and Germany — which all sport a relatively large Internet infrastructure — are also tops for DDoS attack origin. But Prolexic’s report said it’s odd that Iran, which has a very small Internet architecture by comparison, should be the source of so many attacks. “This is very interesting because Iran enforces strict browsing policies similar to Cuba and North Korea,” according to Prolexic’s report. As DDoS attack sizes increase, so do fears of an Armageddon scenario, in which the attack not only disrupts a targeted site, but every site or service provider in between. According to Prolexic’s report, the largest single attack it’s mitigated to date occurred in March, when an “enterprise customer” was hit with an attack that peaked at 130 Gbps. While that wasn’t equal to the 300 Gbps attack experienced by Spamhaus, it still represents well more than most businesses can handle, unless they work with their service provider or third parties to build a better DDoS mitigation defense. On that front, some businesses tap dedicated DDoS mitigation services from the likes of Arbor Networks, CloudFlare, Prolexic and Verisign. “There are a number of DDoS mitigation technologies out there, and we see organizations that are deploying the technologies in their own infrastructure and in their own environments,” as well as working with service providers, said Chris Novak, managing principal of the RISK Team at Verizon Enterprise Solutions, speaking recently by phone. “Like so many things in the security space, the layered approach is the most effective for most organizations,” he said. For protection against your eCommerce site click here . Source: http://www.informationweek.com/security/attacks/ddos-attack-bandwidth-jumps-718/240153084

Follow this link:
DDoS Attack Bandwidth Jumps 718%

Average DDoS attack bandwidth up 718 percent

The average DDoS attack bandwidth in Q1 2013 totaled 48.25 Gbps, which is a 718 percent increase over last quarter, and the average packet-per-second rate reached 32.4 million, says Prolexic. Ea…

Follow this link:
Average DDoS attack bandwidth up 718 percent

WordPress Websites Target of Hacker Attack

Many websites built on the blogging and content management system WordPress are currently under attack by a group of hackers attempting to gain access to the sites to use them in Distributed Denial of Service (DDOS) attacks. The infected machines are then, in turn, attempting to gain access to other WordPress installations, to quickly grow the size of the botnet. Security experts say this is one of the most robust WordPress attacks to date, and the hackers have succeeded in building a very strong botnet of infected systems. There are currently nearly 100,000 IP addresses in use by the infected systems, and this could grow as the hackers turn additional WordPress installations into subservient systems. Two popular managed hosting services, HostGator and Resellers Panel are undergoing a very heavy attack by the botnet right now – both services specialize in WordPress hosting packages. Hackers are bute-force punching their way into the WordPress backend by trying 1,000 – 2,000 password combinations against the “admin” username on WordPress systems. WordPress users with easy-to-guess passwords are at the most risk for having their systems compromised. To avoid having your WordPress instances violated, John Dolan, a freelance security expert, suggests that users go into their WordPress settings “right now, as soon as possible, and update their passwords,” he said. “It should be changed to a complex password, not a dictionary word, and it should use a mixture of capital and lowercase letters, as well as numbers and another character, like a question mark, for example.” In addition to making sure your password is secure, Dolan also recommends that WordPress users look into a service like CloudFlare, an online security vendor that monitors your website’s incoming traffic and deflects attacks from known bots and spammers. What to do if your WordPress instance has been hijacked? “Talk to your hosting provider,” says Dolan. “They most likely have experience with this, and can help you wipe your WordPress install and restore your latest backup.” Source: http://www.szsu.com/2013/04/13/wordpress-websites-target-of-hacker-attack/

View article:
WordPress Websites Target of Hacker Attack

ZeroAccess Bitcoin botnet shows no signs of slowing

FortiGuard Labs observed that the Bitcoin mining botnet, ZeroAccess, was the number one threat last quarter. Their report also reveals new analysis of the South Korea cyberattacks and two new Android …

View article:
ZeroAccess Bitcoin botnet shows no signs of slowing

Top Banks Offer New DDoS Attack Details

Increasingly, U.S. banking institutions are reluctant to acknowledge – much less discuss – the ongoing distributed-denial-of-service attacks against their online services. Perhaps that’s because they’re concerned that consumers will panic or that revealing too much about the attacks could give hacktivists information they could use to enhance their DDoS abilities. But in recent regulatory statements, the nation’s largest banks are candid about DDoS attacks and their impact. In their annual 10-K earnings reports, filed with the Securities and Exchange Commission, seven of the nation’s top 10 financial services institutions provide new details about the DDoS attacks they suffered in 2012. In its report, Citigroup even acknowledges that DDoS attacks have led to unspecified losses. Citigroup , which filed its 10-K report March 1, notes: “In 2012, Citi and other U.S. financial institutions experienced distributed-denial-of-service attacks which were intended to disrupt consumer online banking services. While Citi’s monitoring and protection services were able to detect and respond to these incidents before they became significant, they still resulted in certain limited losses in some instances as well as increases in expenditures to monitor against the threat of similar future cyber-incidents.” The bank also points out that these attacks are being waged by powerful adversaries. “Citi’s computer systems, software and networks are subject to ongoing cyber-incidents, such as unauthorized access; loss or destruction of data (including confidential client information); account takeovers; unavailability of service; computer viruses or other malicious code; cyber-attacks; and other events,” Citi states. “Additional challenges are posed by external extremist parties, including foreign state actors, in some circumstances as a means to promote political ends.” When contacted by BankInfoSecurity , Citi and other institutions did not comment further about DDoS attacks or the information in the 10-K reports. These banks, as well as other U.S. financial institutions, are now in the midst of the third wave of DDoS attacks attributed to the hacktivist group Izz ad-Din al-Qassam Cyber Fighters – a group that has claimed since September that its attacks are being waged to protest a YouTube movie trailer deemed offensive to Muslims. ‘Technically Sophisticated’ In their 10-K reports, Citi, as well as JPMorgan Chase & Co. , Bank of America , Goldman Sachs Group , U.S. Bancorp , HSBC North America and Capital One acknowledge suffering from increased cyber-activity, with some specifically calling out DDoS as an emerging and ongoing threat. HSBC North America, in its 10-K report filed March 4, notes the global impact of DDoS on its customer base. “During 2012, HSBC was subjected to several ‘denial of service’ attacks on our external facing websites across Latin America, Asia and North America,” the bank states. “One of these attacks affected several geographical regions for a number of hours; there was limited effect from the other attacks with services maintained. We did not experience any loss of data as a result of these attacks.” And U.S. Bank, in its 10-K filed Jan. 15, describes DDoS attacks as “technically sophisticated and well-resourced.” “The company and several other financial institutions in the United States have recently experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to customers for extended periods,” U.S. Bank reports. “These ‘denial-of-service’ attacks have not breached the company’s data security systems, but require substantial resources to defend and may affect customer satisfaction and behavior.” U.S. Bank reports no specific losses attributed to DDoS, but it states: “Attack attempts on the company’s computer systems are increasing, and the company continues to develop and enhance its controls and processes to protect against these attempts.” Other DDoS Comments Here is what the other institutions reported about DDoS attacks suffered in 2012: Chase: “The firm and several other U.S. financial institutions continue to experience significant distributed denial-of-service attacks from technically sophisticated and well-resourced third parties which are intended to disrupt consumer online banking services. The firm has also experienced other attempts to breach the security of the firm’s systems and data. These cyber-attacks have not, to date, resulted in any material disruption of the firm’s operations, material harm to the firm’s customers, and have not had a material adverse effect on the firm’s results of operations.” BofA: “Our websites have been subject to a series of distributed denial of service cybersecurity incidents. Although these incidents have not had a material impact on Bank of America, nor have they resulted in unauthorized access to our or our customers’ confidential, proprietary or other information, because of our prominence, we believe that such incidents may continue. Although to date we have not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that we will not suffer such losses in the future.” CapOne: “Capital One and other U.S. financial services providers were targeted recently on several occasions with distributed denial-of-service attacks from sophisticated third parties. On at least one occasion, these attacks successfully disrupted consumer online banking services for a period of time. If these attacks are successful, or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services online. In addition, a breach or attack affecting one of our third-party service providers or partners could impact us through no fault of our own. Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently and often are not fully recognized or understood until after they have been launched, we and our third-party service providers and partners may be unable to anticipate certain attack methods in order to implement effective preventative measures. Should a cyber-attack against us succeed on any material scale, market perception of the effectiveness of our security measures could be harmed, and we could face the aforementioned risks. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.”   No Mentions of Attacks Among the top 10, the only institutions that do not specifically reference DDoS in their 10-K reports are Morgan Stanley, Bank of NY Mellon and Wells Fargo , a bank that has recently suffered significant online outages. Wells Fargo spokeswoman Sara Hawkins tells BankInfoSecurity that the bank’s online and mobile-banking channels were inaccessible for portions of the day on April 4, when it saw “an unusually high volume of website and mobile traffic … which we believe is a denial of service attack.” Reporting Protocol Doug Johnson , who oversees risk management policy for the American Bankers Association, says banking institutions are required to report all suspicious cyber-activity either through their filings with the SEC or in the Suspicious Activity Reports to the Financial Crimes Enforcement Network , a bureau of the U.S. Department of the Treasury. All financial institutions, regardless of size, must report SARs to FinCEN, an agency that collects, analyzes and shares financial intelligence. However, only companies with more than $10 million in assets are required to file reports with the SEC. Banking institutions are required to report cyber-attacks in their SEC filings, Johnson says. “Online banking platforms, obviously, are extremely important to banking retail consumers, and so that would be one of those systems which would be very important to report on a suspicious activity report,” Johnson says. “One thing that is also very important to do is to go and have that conversation with your primary federal regulator, at the field level, to find out what you would do, as an institution, for generalized security breach reporting.” Breach reporting requirements vary from state to state, Johnson adds. For protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/top-banks-offer-new-ddos-details-a-5667/p-3  

See more here:
Top Banks Offer New DDoS Attack Details

Lessons Learned in Historic DDoS Attack on Spamhaus

The DNS amplification vulnerability, which was exploited to the fullest in the attacks on Spamhaus, return incoming requests to a DNS server with as much as 100 times as much data. When the attackers have faked the source address for those incoming requests, the responses can overwhelm the victims’ servers — and possibly spill over and clog the Net. What is the aftermath of the massive Distributed Denial of Service attacks recently on the anti-spam Spamhaus organization? As the largest such attack in history, the digital assault on Spamhaus slowed network performance in some regions of Europe and elsewhere, raised alarms about whether the Net could reach a breaking point, and has become a historic event that could mark a turning point. According to reports in The New York Times and elsewhere, a key figure in the attacks appears to be Sven Olaf Kamphuis, who is associated with CyberBunker, the Dutch hosting facility where the attacks originated. After the Europe-based Spamhaus put CyberBunker on its spam blacklist, because of what Spamhaus said were substantial streams of spam e-mails coming from that hosting facility, the DDoS attacks began. Kamphuis maintains a Facebook page, in which he champions hosting services such as CyberBunker for providing open Net access, and he rails against Spamhaus for acting like an arbitrary authority. Like ‘The Mafia’ CyberBunker has said it will allow customers to host anything except “child porn and anything related to terrorism.” Spamhaus is backed by a variety of e-mail services, and experts have testified in court that many e-mail services would be rendered useless by the flood of spam if not for the organization’s efforts. But this massive wave of DDoS attacks — in which Web servers are overwhelmed by a flood of bogus traffic — broke some boundaries, according to Garth Bruen, an adviser to the consumer-oriented Digital Citizens Alliance. Bruen told USA Today that the attacks from CyberBunker were like “the kind of things we saw the mafia do to take control of neighborhoods 50 years ago.” He added that what was particularly “troubling” is that CyberBunker is a commercial ISP “working with shadowy figures in undisclosed locations.” Open DNS Resolvers The attacks have highlighted some ongoing weaknesses in the Internet’s infrastructure . Key among these are open Domain Name System resolvers, which allow attackers to engage in so-called DNS amplification. One of the weaknesses of open resolvers is that they do not authenticate a sender’s address before replying. This vulnerability, which was exploited to the fullest in the attacks on Spamhaus, return incoming requests to a DNS server with as much as 100 times as much data . When the attackers have faked the source address for those incoming requests, the responses can overwhelm the victims’ servers — and possibly spill over and clog other parts of the Net. DNS servers are critical to the Internet as they translate alphanumeric-based Web addresses like “www.google.com” into the numeric IP addresses that computers can understand. The Spamhaus attacks reportedly utilized more than 30,000 unique DNS resolvers. There are efforts, such as the Open DNS Resolver Project, to convince DNS administrators to implement source address validation, among other actions, to eliminate open DNS resolvers as a Net-wide weakness. There are also calls for IT departments and individual PC owners to make a greater effort to scan their computers for signs of malware that could be hijacking their machines into becoming part of a botnet. Additionally, the Electronic Frontier Foundation and others have offered tips to small businesses on how to cope with DDoS attacks, if their sites become one of the direct or indirect targets. For DDoS protection click here . http://www.cio-today.com/story.xhtml?story_id=0020002HERPO&page=2

More:
Lessons Learned in Historic DDoS Attack on Spamhaus

Airlock launches secure cloud hosting

Airlock launched its Secure Cloud Platform which offers enterprise-level security features like intrusion detection, hardware and web application firewalls, DDoS mitigation and malware scanning. Airlo…

Read More:
Airlock launches secure cloud hosting

BIGGEST DDoS in history FAILS to slash interweb arteries

Bombardment without collateral damage – amazing Analysis   The massive 300Gbit-a-second DDoS attack against anti-spam non-profit Spamhaus this week didn’t actually break the internet’s backbone, contrary to many early reports.…

More here:
BIGGEST DDoS in history FAILS to slash interweb arteries