SOHOpeless CCTVs and video recorders It shouldn’t surprise anyone that closed circuit television (CCTV) rigs are becoming the world’s favourite botnet hosts: pretty much any time a security researcher looks at a camera, it turns out to be a buggy mess.…
Taken from:
Hungarian bug-hunters spot 130,000 vulnerable Avtech vid systems on Shodan
The Government is taking decisive steps to tackle cyber threats – including almost doubling the proportion of its technology budget dedicated to plugging security gaps in critical infrastructure. The matter, said Prime Minister Lee Hsien Loong yesterday, is one of “national importance” as the country becomes more connected in its mission to become a smart nation. At the opening of the inaugural Singapore International Cyber Week, he announced a high-level national strategy that includes strengthening international partnerships. One key prong will be to direct more funds into defence against attacks. These have ranged from malware infection to the defacing of government websites. About 8 per cent of the infocomm technology (ICT) budget will now be set aside for cyber security spending, up from about 5 per cent before. In fiscal 2014, Singapore spent $408.6 million on cyber security. The new proportion is similar to what other countries spend; Israel stipulates that 8 per cent of its total government IT budget must go to cyber security, while South Korea channels as much as 10 per cent. “We are investing more to strengthen government systems and networks, especially those that handle sensitive data, and protect them from cyber attacks,” said Mr Lee. “Singapore aspires to be a smart nation. But to be one, we must also be a safe nation,” he told more than 3,000 public servants and technology professionals from 30 countries who were also attending the 25th GovernmentWare Conference. Singapore’s cyber security strategy is developed by the Cyber Security Agency (CSA). Central to the strategy is the introduction of a new Cybersecurity Act in the middle of next year after public consultations, expected to be held after the draft legislation is tabled in Parliament next year. There is currently no over-arching cyber security legislation in Singapore. The current system of working with various sector regulators is “patchy”, said CSA chief executive David Koh, as the requirement to tighten gaps in critical infrastructure has not been worked into licensing conditions in some sectors. Mr Lee said that, while ICT creates business opportunities and boosts productivity, it also makes its users vulnerable. Globally, cyber threats and attacks are becoming more frequent and sophisticated, with more severe consequences, he added. Last December, a successful attack on the power grid in Ukraine left many Ukrainians without electricity for hours. This year, thieves siphoned US$81 million (S$111.3 million) from the Bangladesh Bank, the central bank of Bangladesh, in a sophisticated cyber heist. Singapore has not been spared. “Our government networks are regularly probed and attacked,” said Mr Lee, adding that attacks included “phishing” attempts and malware infection. “From time to time, government systems have been compromised; websites have been defaced. We also suffered concerted DDOS (distributed denial of service) attacks that sought to bring our systems down,” he said. The financial sector, for instance, has suffered DDOS attacks and leaks of data. Individuals, too, have become victims of scams. Fake websites of the Singapore Police Force, Manpower Ministry, Central Provident Fund Board, and the Immigration and Checkpoints Authority have been set up overseas to “phish” for personal information or trick people into sending money. Mr Lee said the country must get cyber security right. “Only then can IT deliver innovation, growth and prosperity for our businesses and citizens.” Source: http://www.straitstimes.com/singapore/spore-rolls-out-high-level-cyber-security-strategy
Visit site:
Singapore rolls out high-level cyber security strategy
A new report from analytics firm Neustar has brought to light the amount of companies around the world who have suffered a DDoS attack, and how they are working to mitigate them. Nearly three-quarters (73 percent) of organisations worldwide have suffered a DDoS attack and 76 percent are investing more in response to the threat of such attacks. For its new global report, Neustar studied 1,002 directors, managers, CISOs, CSOs, CTOs and other C-suite executives to discover how DDoS attacks are affecting them and what they’re doing to mitigate the threat. Respondents represent diverse industries such as technology (18 percent), finance (14 percent), retail (12 percent) and government (seven percent) in North America, EMEA, and Asia Pacific. In EMEA, 75 percent of organisations were attacked. Nearly half (48 percent) were attacked six or more time and 32 percent encountered malware after a DDoS attack. Almost a quarter (21 percent) of attacked organisations reported customer data theft and 70 percent of those specific respondents said they learned of the attack from outside sources, such as social media. Globally, 30 percent of organisations took less than an hour to detect a DDoS attacks. In EMEA, 37 percent of organisations took three or more hours to detect attacks. Despite only two percent of reported attacks exceeding 100+ GBPS, recent DDoS attacks have reached over 620 Gbps and up to almost 1 Tbps in attack size. Organisations are seeking to stay one step ahead of the game and protect against DDoS attacks. To prevent and protect against future attacks, organisations are using: Traditional firewall ISP based prevention (53 percent) Cloud service provider (47 percent) On-premise DDoS appliance and a DDoS mitigation service (36 percent) DDoS mitigation service (29 percent) DDoS mitigation appliance (27 percent) CDN (14 percent) WAF (13 percent) No DDoS protection is used in four percent of organisations. Nearly two-thirds (61 percent) have adopted and actively use IoT devices. In all, 82 percent of IoT adopters experienced an attack compared to just 58 percent of those who have not yet done so. Moreover, 43 percent of IoT adopters that were attacked are investing more than they did a year ago. In emailed commentary to SCMagazineUK .com, Paul McEvatt, senior cyber-threat intelligence manager, UK & Ireland at Fujitsu said, “This latest report revealing the different levels of DDoS attacks has really highlighted the issues with the security of Internet of Things devices, with 82 percent of IoT adopters having experienced an attack compared with just 58 percent of those who have not yet done so. When internet-connected devices are hacked, it again brings to the surface the security risks we face as technology touches every aspect of daily life. McEvatt added, “The issue is that businesses are failing to understand what is needed for a robust application of security from the outset, whether that’s for routers, smart devices or connected cars. Various attackers use online services to look for vulnerable IoT devices, making organisations an easy target for low-level cyber-criminals. The worrying reality is that security is often an afterthought and security fundamentals are still not being followed such as changing default passwords. Many of the cameras used in the recent DDoS attacks were shipped and left connected to the internet with weak credentials such as root/pass, root/admin or root/1111111, so it is little wonder these devices continue to be compromised.” Source: http://www.scmagazineuk.com/73-of-organisations-across-the-globe-have-suffered-a-ddos-attack/article/527211/
More:
73% of organisations across the globe have suffered a DDoS attack
Massive distributed denial of service (DDoS) attacks have been grabbing headlines recently, with cyber security reporter Brian Krebbs being forced to temporarily take his site down after his service provider couldn’t handle a 620 Gbps attack, followed a few days later by a 1 Tbps attack on French hosting provider OVH. The incidents have some worried that DDoS attacks can now scale so high that current mitigation technology renders targeted organizations defenceless. Not so, says a Toronto security firm. In a report issued Tuesday DDoS Strike concludes CISOs worry too much about high volume network layer attacks and not enough about application layer attacks, which can take down a site with as little as 4.3 Gpbs of traffic. “Most organizations are only part way to understanding DDoS attacks and therefore having the capacity to defend against them with full effectiveness,” the report concludes. The report is based on an analysis of data gathered by DDoS Strike, which offers a service for testing enterprise infrastructures on their layer 3-7 denial of service mitigation techniques. DDoS Strike is a division of Security Compass, which makes application development security tools. What the company found after looking at its data from test attacks on 21 systems of Canadian and U.S.-based customers (some companies had more than one system) was that 95 per cent of targets tested suffered service degradation close to knocking a site offline — suggesting their DDoS mitigation efforts were useless. Of attacks at the application layer 75 per cent would have been successful. But, Sahba Kazerooni, vice-president DDoS Strike, said in an interview, network scrubbing techniques are largely effective. with service generally being denied only for a few hours until mitigation can either be tuned or turned on. More importantly, he added, is that application layer attacks are harder to defend, needing multiple tiers of defence, more expertise among IT staff trying to block them and fine controls. The result is more downtime for a successful app layer attack. “Our customers have a skewed way of looking at DdoS as a threat,” he said, “because they were being warned by the industry to worry about major ( network) attacks “and they’re forgetting about high level attacks on the app layer.” “We have this tendency to over-focus on technology when it comes to DDoS. We’re very quick to deploy on-site mitigation devices or to buy a scrubbing service. The piece that’s missing is to focus on the process and the training of staff to handle DDoS attacks.” Some of the customers tested brought their systems back from the brink in an average of 25 minutes, he said. (DDoS Strikes thinks that’s too long.) But of the successful test attacks his company carried out, over 70 per cent had some kind of process or people gap that resulted in longer than necessary downtime, he said. “A lot of companies can benefit not only from buying services and product but also training their employees,” Kazerooni concludes focusing more on their own processes with the goal of ultimately reducing downtime.” The report concludes that • businesses should stop thinking of DDoS attacks as crude acts of brute force, and start thinking of them as sophisticated, incisive attacks as complex as any other major hacking threat; • DDoS mitigation is incomplete out of the box, and can only be effective with proper DDoS simulation testing at all levels; • and DDoS mitigation should be viewed as a multifaceted strategy, involving people, process, and technology, rather than solely a technical fix. Source: http://www.itworldcanada.com/article/worry-more-about-small-app-layer-ddos-attacks-than-huge-network-blasts-says-canadian-vendor/386956
Link:
Worry more about small app layer DDoS attacks than huge network blasts, says Canadian vendor
Do try this at home – but carefully The SANS Institute is hoping sysadmins can help it to do what vendors won’t: improve Internet of Things security.…
See the original post:
SANS issues call to arms to battle IoT botnets
Newsweek reported suffering a massive DDoS attack right after they published an exposé on how some of Donald Trump’s companies had violated the United States embargo on trading with Cuba. The attack was sufficient to prevent access to the article on Friday, September 30, but the attack subsided, and the report was available the following day. Kurt Eichenwald, the journalist that penned the piece, and Jim Impoco, Newsweek Editor-in-Chief, both categorized the incident as a cyber-attack. “The reason ppl couldnt read #TrumpInCuba piece late yesterday is that hackers launched a major attack on Newsweek after it was posted,” Eichenwald wrote on Twitter. “Last night we were on the receiving end of what our IT chief called a ‘massive’ DoS (denial of service) attack,” Impoco told fellow media outlet TalkingPointMemo (TPM) via email. Some websites that generate enough hype can suffer from huge traffic loads that overcome servers. Nevertheless, Newsweek is a reputable news portal that has the resources to deal with such traffic spikes. Impoco was very adamant that the incident was because of a coordinated DDoS attack, which he claims might have originated from Russia, but did not elaborate beyond explaining that the DDoS attack’s “main” IP address was from Russia. This explanation doesn’t make any technical sense since DDoS attacks don’t have “main” IP addresses. Source: http://news.softpedia.com/news/newsweek-website-suffers-ddos-attack-after-publishing-controversial-trump-report-508874.shtml
More:
Newsweek Website Suffers DDoS Attack After Publishing Controversial Trump Report
IoT-powered DDoS attacks are on the rise, and the situation is poised to become even worse now that the source code for the Mirai malware has been made public. Reporter Brian Krebs, whose website has recently been bombarded with a huge DDoS attack by botnets created with the Mirai and Bashlite malware, spotted a post on hacking community Hackforums by a user named “Anna-senpai” offering the code. “When I first go in DDoS industry, I … More ?
Follow this link:
Leaked: Source code for Mirai IoT DDoS botnet
Hackforums leak Malicious code used to press-gang IoT connected devices into a botnet was leaked online over the weekend.…
Taken from:
Source code unleashed for junk-blasting Internet of Things botnet
Someone on the internet seems very angry with cybersecurity blogger Brian Krebs. On 20 September, Krebs’ website was hit with what experts say is the biggest Distributed Denial of Service (DDoS) attack in public internet history, knocking it offline for days with a furious 600 to 700 Gbps (Gigabits per second) traffic surge. DDoS attacks are a simple way of overloading a network router or server with so much traffic that it stops responding to legitimate requests. According to Akamai (which had the unenviable job of attempting to protect his site last week), the attack was twice the size of any DDoS event the firm had ever seen before, easily big enough to disrupt thousands of websites let alone one. So why did someone expend time and money to attack a lone blogger in such a dramatic way? Krebs has his own theories, and the attack follows Krebs breaking a story about the hacking and subsequent takedown of kingpin DDoS site vDOS, but in truth nobody knows for certain and probably never will. DDoS attacks, large and small, have become a routine fact of internet life. Many attacks are quietly damped down by specialist firms who protect websites and internet services. But the latest attack has experts worried all the same. Stop what you’re doing DDoS attacks first emerged as an issue on the public internet in the late 1990s, and since then have been getting larger, more complex and more targeted. Early motivations tended towards spiteful mischief. A good example is the year 2000 attacks on websites including Yahoo, CNN and Amazon by ‘MafiaBoy’, who later turned out to be 15-year old Canadian youth Michael Calce. Within weeks, he was arrested. Things stepped up a level in 2008 when hacktivist group Anonymous started an infamous series of DDoS attacks with one aimed at websites belonging to the Church of Scientology. By then, professional cybercriminals were offering DDoS-for-hire ‘booter’ and ‘stresser’ services that could be rented out to unscrupulous organizations to attack rivals. Built from armies of ordinary PCs and servers that had quietly been turned into botnet ‘zombies’ using malware, attacks suddenly got larger. This culminated in 2013 with a massive DDoS attack on a British spam-fighting organization called Spamhaus that was measured at a then eye-popping 300Gbps. These days, DDoS is now often used in extortion attacks where cybercriminals threaten organizations with crippling attacks on their websites unless a ransom is paid. Many are inclined to pay up. The Krebs effect The discouraging aspect of the Krebs attack is that internet firms may have thought they were finally getting on top of DDoS at last using techniques that identify rogue traffic and more quickly cut off the botnets that fuel their packet storms. The apparent ease with which the latest massive attack was summoned suggests otherwise. In 2015, Naked Security alumnus and blogger Graham Cluley suffered a smaller DDoS attack on his site so Krebs is not alone. Weeks earlier, community site Mumsnet experienced a DDoS attack designed to distract security engineers as part of a cyberattack on the firm’s user database. At the weekend, Google stepped in and opened its Project Shield umbrella over Krebs’ beleaguered site. Project Shield is a free service launched earlier in 2016 by Google, specifically to protect small websites such as Krebs’ from being silenced by DDoS attackers. For now it looks like Google’s vast resources were enough to ward off the unprecedented attack, but it’s little comfort to know that nothing short of the internet’s biggest player was the shield that one simple news site needed. With criminals apparently able to call up so much horsepower, the wizards of DDoS defence might yet have to rethink their plans – and fast. Source: https://nakedsecurity.sophos.com/2016/09/29/why-a-massive-ddos-attack-on-a-blogger-has-internet-experts-worried/
View post:
Why a massive DDoS attack on a blogger has internet experts worried
A French web hoster is claiming his firm has been hit by the biggest DDoS attack ever seen, powered by an IoT botnet with an estimated capacity of 1.5Tbps. Octave Klaba, the founder and CTO of OVH, took to Twitter late last week to reveal his firm was under attack from a stream of DDoS blitzes creeping towards and eventually past the 1Tbps mark. He claimed the botnet in question was initially comprised of around 145,000 internet-connected cameras and digital video recorders with an estimated 1-30Mbps capacity each – that’s a potential 1.5Tbps in total. In further updates this week Klaba said the botnet had increased by first another 6857 devices and then 15,654 more. The news follows reports last week that Akamai was forced to withdraw its pro bono DDoS protection of the KrebsOnSecurity site after it was allegedly hit by an attack measuring 665Gbps, then the largest on record. Dave Larson, CTO and COO at Corero Network Security, claimed the recent attacks are beginning to change the way IT security professionals view DDoS. “The internet is a powerful tool, and must be viewed with security and protection first and foremost,” he added. “Motivations for attacks, and the tools and devices used to execute the attacks, are readily available to just about anyone; combining this with almost complete anonymity creates a recipe to break the Internet.” Roland Dobbins, principal engineer at Arbor Networks, argued that IoT botnets are increasingly favored by hackers because they frequently ship with insecure defaults, are often connected to high speed internet and are rarely patched to fix bugs. “Embedded IoT devices are often low-interaction – end-users don’t spend much time directly interfacing with them, and so aren’t given any clues that they’re being exploited by threat actors to launch attacks,” he told Infosecurity . “Organizations can defend against DDoS attacks by implementing best current practices for DDoS defense, including hardening their network infrastructure; ensuring they’ve complete visibility into all traffic from their networks; having sufficient DDoS mitigation capacity and capabilities either on premise or via cloud-based DDoS mitigation services or both; and by having a DDoS defense plan which is kept updated and is rehearsed on a regular basis.” Source: http://www.infosecurity-magazine.com/news/web-host-hit-by-ddos-of-over-1tbps/