Category Archives: DDoS Criminals

Online gambling sites taken out by DDoS attacks

Customer of Betfair and PokerStars have been left enraged after the software of both gambling giants suffered from major connectivity issues over the weekend. Betfair’s sportsbook, betting exchange and websites were unavailable for more of April 13 after the firm’s servers came under attack from a Distributed Denial-of-Service (DDoS) attack . Betfair’s customer service team, manning the @BetfairHelpDesk Twitter account, confirmed to customers that a DDoS attack was the cause of the problems and reassured worried punters that their details and funds were safe. The attack seems to be either over or under control as I was able to log into all Betfair products on April 14. A DDoS attack is designed to temporarily or indefinitely interrupt or suspend the services offered by the targeted website. One way of achieving this is to bombard the site’s servers with so much bogus information and requests that it is overloaded and cannot respond to legitimate traffic requests. This appears to be what happened to Betfair on April 13. You may recall that partypoker was targeted by numerous DDoS attacks in October 2014 that resulted in some of its Pokerfest events being cancelled. The attacks at partypoker resurfaced in early December 2014 and saw the site effectively taken offline for several hours while its technicians and its Internet Service Provider (ISP) in Gibraltar combated the problem. Around the same time, 888poker was suffering similar connectivity problems – its servers are also in Gibraltar – but the London Stock Exchange (LSE) listed company refused to comment on whether or not it had been targeted by the same DDoS attacks that plagued partypoker. Poker sites are often reluctant to announce they are suffering from a hacker’s attempt to cause a DDoS because of the possible widespread panic the mention of a hacker could and would cause. Usually, the so-called hacker isn’t interested in attempting to obtain information – major online poker and gambling sites have these details secure under state-of-the-art systems – they are attempting to disrupt the targeted site’s business. Although neither confirmed or denied by its management team, rumours of PokerStars being under a DDoS attack have been doing the rounds on various forums, including Two Plus Two. Players have been reporting major lag (low response when clicking buttons etc) and connectivity problems when attempting to play at PokerStars since April 9. The problems seem to be global, although resident of Belgium seem to be more severely affected judging by tweets from various Belgians including Friend of PokerStars Pierre Neuville and PokerStars’ Belgian Twitter account on April 12, although a more recent update claims all problems Pokerstars.be were facing are now resolved. While PokerStars does appear to be on top of the problems now, its Network Status panel shows it has Very Good connection at five of the six listed hosts, although Manx Telecom, Isle of Man has 0% connection and all packets of data being sent to it are currently being lost.   Source: http://uk.pokernews.com/news/2015/04/betfair-and-pokerstars-suffer-major-connectivity-problems-17360.htm?utm_medium=feed&utm_campaign=homefeed&utm_source=rss

See the article here:
Online gambling sites taken out by DDoS attacks

Microsoft, Sony, and Nintendo collaborating to stop DDoS attacks

Xbox boss Phil Spencer has been talking with his rivals to see how they can avoid a repeat of the Christmas Xbox Live and PSN downtime. It’s very rare for console manufacturers to work together on anything, but the DDoS attacks on Xbox Live and PSN over Christmas have been enough for Microsoft to initiate conversations with its two rivals. ‘I don’t think it’s great when PSN goes down,’ Spencer told Game Informer. ‘It doesn’t help me. All it does is put the fear and distrust from any gamer that’s out there, so I look at all of us together as this is our collective opportunity to share what we can about what we’re learning and how things are growing. Those conversations happen, which I think is great.’ He added that the Christmas attacks had been a ‘learning experience’ and that, ‘Our commitment to Xbox One customers is to make sure our service is robust and reliable’. Although Xbox Live seemed to recover more quickly from the attacks than Sony, and Nintendo weren’t affected at all, there is no easy defence against DDoS as they’re not really hacking (no data was stolen or accessed) and simply involve overloading a server with requests. As a result it’s not clear what defences Spencer was discussing with Sony and Nintendo, but it is good to know they’re at least talking. Source: http://metro.co.uk/2015/03/06/microsoft-sony-and-nintendo-collaborating-to-stop-ddos-attacks-5091159/

More:
Microsoft, Sony, and Nintendo collaborating to stop DDoS attacks

Michigan High School Student Facing Charges After lauching DDoS attack on School Network

A student at Monroe High School in Monroe, Michigan, was recently caught conducting a distributed denial of service attack (DDoS), and Monroe Public Schools Superintendent Barry Martin says the district will be pressing charges. Over a period of two weeks, the unnamed student managed to take the network down for ten to fifteen minutes at a time during the school day. This had a heightened effect on the district, as modern-day high schools rely heavily on the Internet for administration as well as classroom instruction. “We are so reliant on the Internet that we can’t afford to have down time,” said Stephen McNew, the superintendent of the district in which the student attended school. No Sensitive Data Compromised Despite having success at being disruptive, an act that the student considered to be a prank, no sensitive documents, e-mails, or files were ever compromised, which should contribute greatly to his defense. Merely disrupting communications is far less of a crime than is stealing sensitive information about other students or private communications between staff members. “A Good Student” Barry Martin called the alleged hacker “a good student” in comments to the Monroe News but said that this act could not be tolerated, and charges would be filed. DDoS is a federal felony, but from the sounds of it, the FBI has not yet been involved in the case. It is taken very seriously when the targets are larger organizations or government institutions, and ordinarily those who are serious about conducting DDoS attacks are careful to cover their tracks. It is not yet evident how the student was found to be a suspect in the case, but in the town of roughly 20,000 people, the pool of likely suspects is rather slim. The profile would be a student with high grades and extreme computer aptitude. This would make the pool of likely suspects even smaller. The way that high schools often conduct such investigations, the student would have been brought in front of a police officer and interrogated until he confessed. Like as not, school officials would pretend to know already that he was guilty, and he would confess. Equally as likely, the student bragged about it to another student, who then turned him in. Another thing that the administrators said about the student was that he probably didn’t know the seriousness of what he was doing. This is in line with existing research that has concluded that adolescents are less likely to consider the consequences of their actions before taking them. Locals Have Mixed Feelings Many locals on the Monroe News Facebook page felt that a felony would be too stern a response for the gifted student’s prank. After all, in the end, the one thing he illustrated was that the school district had a weak network infrastructure that needs upgrading. Especially if, as administrators have said, they are extremely reliant on the Internet in daily teaching. Source: https://hacked.com/michigan-high-school-student-facing-charges-ddosing-school-network/

View post:
Michigan High School Student Facing Charges After lauching DDoS attack on School Network

Anonymous proxies now used in a fifth of DDOS attacks

The number of DDOS attacks using anonymous proxies has increased The number of distributed denial of service attacks using anonymous proxies has increased dramatically over the past year, according to a new research report, as attackers use these proxies to create an instant pseudo-botnet. Ofer Gayer, security researcher at Redwood Shores, CA-based Incapsula Inc., said he first spotted the trend about a year ago. Incapsula was working on creating a database of IP addresses spotted attempting malicious activity, and discovered that attackers were abusing anonymous proxies to turn a regular single-origin denial of service attack into a distributed denial of service attack with traffic flowing through thousands — or tens of thousands — different IP addresses. A year ago, fewer than 5 percent of DDOS attacks came through anonymous proxies. Today, the number is close to 20 percent, Gayer said. “The trend intensified over the past two months,” Gayer said. “Currently, 20 percent of all application-layer attacks are originating from these proxy servers.” Of those, nearly 45 percent came from the TOR network of anonymous routers, and, of those, 60 percent used the TOR Hammer DoS tool. On average, a single attacker would direct traffic from 1,800 different IP addresses, with 540,000 requests per instance. According to Incapsula product evangelist Igal Zeifman, what this means is that an attacker could be sitting at home, on a single computer, and route traffic to a list of anonymous proxies to create an instant botnet-style attack. All it takes is a proxy harvesting script and a publicly-available DOS toolkit. Anonymous proxies, or anonymizers, can serve a useful purpose, preventing identity theft, protecting search histories, avoiding geographical marketing and access restrictions, and allowing activists to bypass Internet censorship of repressive regimes. They also offer several benefits to DDOS attackers. First, they mask the source of an attack and help the attackers evade security measures based on access control lists. They also help the attacker avoid geo-blacklisting, since the attack can be spread among proxies in many different countries. Second, since each proxy is only passing along a small number of messages, it helps the attackers avoid counter-measures based on limiting the number of messages from a single source. Finally, proxies make slight changes to message headers. That helps the attackers avoid signature-based defenses. “You can Google to find several options to generate lists of these servers,” said Zeifman. “And these servers accept requests from anyone.” Each of the anonymous proxies can be used to forward a small amount of traffic, that, together, add up to enough to take down an application. “It’s like a thousand needles, stinging all at the same time,” said Zeifman. Since the attackers are going after application, not much traffic is required. “Very few server operators think about over-provisioning their CPUs,” he said. “Even a small overhead of 100 requests per second is enough to take down a dedicated server environment.” Source: http://www.csoonline.com/article/2903939/application-security/anonymous-proxies-now-used-in-a-fifth-of-ddos-attacks.html

Visit link:
Anonymous proxies now used in a fifth of DDOS attacks

Massive DDoS against GitHub continues

Popular web-based Git repository hosting service GitHub has been battling a massive DDoS attack – the biggest they have ever experienced – for the last four days. “The attack began around 2AM UTC o…

Visit link:
Massive DDoS against GitHub continues

GitHub recovering from massive DDoS attacks

The attacks were aimed at two GitHub-hosted projects fighting Chinese censorship Software development platform GitHub said Sunday it was still experiencing intermittent outages from the largest cyberattack in its history but had halted most of the attack traffic. Starting on Thursday, GitHub was hit by distributed denial-of-service (DDoS) attacks that sent large volumes of Web traffic to the site, particularly toward two Chinese anti-censorship projects hosted there. Over the next few days, the attackers changed their DDoS tactics as GitHub defended the site, but as of Sunday, it appears the site was mostly working. A GitHub service called Gists, which lets people post bits of code, was still affected, it said. On Twitter, GitHub said it continued to adapt its defenses. The attacks appeared to focus specifically on two projects hosted on GitHub, according to a blogger who goes by the nickname of Anthr@X on a Chinese- and English-language computer security forum. One project mirrors the content of The New York Times for Chinese users, and the other is run by Greatfire.org, a group that monitors websites censored by the Chinese government and develops ways for Chinese users to access banned services. China exerts strict control over Internet access through its “Great Firewall,” a sophisticated ring of networking equipment and filtering software. The country blocks thousands of websites, including ones such as Facebook and Twitter and media outlets such as The Wall Street Journal, The New York Times and Bloomberg. Anthr@X wrote that it appeared advertising and tracking code used by many Chinese websites appeared to have been modified in order to attack the GitHub pages of the two software projects. The tracking code was written by Baidu, but it did not appear the search engine — the largest in China — had anything to do with it. Instead, Anthr@X wrote that some device on the border of China’s inner network was hijacking HTTP connections to websites within the country. The Baidu tracking code had been replaced with malicious JavaScript that would load the two GitHub pages every two seconds. In essence, it means the attackers had roped in regular Internet users into their attacks without them knowing. “In other words, even people outside China are being weaponized to target things the Chinese government does not like, for example, freedom of speech,” Anthr@X wrote. GitHub has not laid blame for the attacks, writing on Saturday that “based on reports we’ve received, we believe the intent of this attack is to convince us to remove a specific class of content.” The attackers used a wide variety of methods and tactics, including new techniques “that use the web browsers of unsuspecting, uninvolved people to flood github.com with high levels of traffic,” GitHub said. In late December, China cut off all access to Google’s Gmail service, after blocking Facebook’s Instagram app, and the phone messaging app Line. A month prior, it appeared many non-political sites supported by the U.S. content delivery network EdgeCast Network were blocked. EdgeCast may have been a casualty because its cloud services are often used to host mirror sites for ones that have been banned. Source: http://www.computerworld.com/article/2903318/github-recovering-from-massive-ddos-attacks.html

Originally posted here:
GitHub recovering from massive DDoS attacks

Indiana’s website taken out by DDoS in response to ‘religious freedom’ law

The state’s website was up and down for most of the early afternoon on Friday The state of Indiana is having a bad week. First, Governor Mike Pence signed a controversial “religious freedom” bill into law; earning the state a black eye for taking step backwards on civil rights. Now, twenty-four hours later, the state’s website was knocked offline by a group taking up another person’s protest against Religious Freedom Restoration Act. The group responsible for taking IN.gov offline has targeted 34 other state, local, tribal, and territorial government websites this month. Going by the name @YourVikingdom on Twitter, the group targeted Indiana’s website after another user suggested that a campaign against the state be mounted in response to recently enacted discriminatory law. Senate Bill 101, also known as the Religious Freedom Restoration Act, was surrounded by controversy in the days leading up to its signing. Businesses and organizations on both sides of the debate, including religious groups such as The Christian Church (Disciples of Christ) urged Gov. Pence to veto the bill. The problem most people have with the new law is that it opens the door for business owners to deny services to the LGBT community for religious reasons. The law, said to be nothing short of legalized discrimination, has caused business leaders to react, including Salesforce CEO Marc Benioff, who stated that employees and customers would no longer be sent to Indiana. Salesforce bought ExactTarget, an Indiana-based marketing software company, for $2.5B in 2013. “Today we are canceling all programs that require our customers/employees to travel to Indiana to face discrimination,” Benioff said via Twitter. There’s no way to prove it, but the DDoS attack against Indiana’s primary website might have been avoided. The group responsible has no real purpose. Despite their outlandish claims, the reality is they attack vulnerable infrastructures – or low-hanging fruit as it were – for fun. There is no cause for them to support, just their own amusement. All of their victims, especially the government websites, have little to no anti-DDoS protection. Indiana is no different. Yet, because of the backlash against Indiana over the ‘religious freedom’ law, @YourVikingdom took notice and flooded the website with traffic to the point that it collapsed. The site was able to recover, but the damage had already been done. Then again, the ‘religious freedom’ law might have been nothing more than an excuse. As low-hanging fruit, Indiana’s servers were always a possible target, especially given the established pattern set by @YourVikingdom. Indiana’s website was offline at 2:00p.m. EST, and recovered 45 minutes later, but remained sluggish for another half-hour while the Indiana Office of Technology worked to resolve the issue. Source: http://www.csoonline.com/article/2903314/business-continuity/indianas-website-taken-out-by-ddos-in-response-to-religious-freedom-law.html

Continue reading here:
Indiana’s website taken out by DDoS in response to ‘religious freedom’ law

The injected JavaScript used to smash anti-Great Firewall of China GitHub projects offline

Servers up and down during 24-hour-long DDoS GitHub’s servers are being hammered by web traffic from an army of unwitting cyber-foot-soldiers.…

Continue reading here:
The injected JavaScript used to smash anti-Great Firewall of China GitHub projects offline

Police website target of repeated DDoS attacks

A denial of service attack on Thursday morning to the Finnish Police website was the third attack of its kind this week. The website of the Finnish Police has been the target of repeated denial of service attacks this week, with the latest service disruption on Thursday downing the website for several hours. It marked the third such attack to the poliisi.fi webpage in the last few days. The first attack took place on Tuesday, and downed the website from late morning to 7 pm. Wednesday marked a smaller attack of the same nature. Tomi Moilanen, Chief Information Security Officer with the National Police Board, says the attacks have not led the police to implement any extraordinary measures quite yet. The attacks have also not detrimentally affected the various online services available on the site. The police have filed an investigation request with the National Bureau of Investigation in order to get to the bottom of the cyber attacks. Source: http://yle.fi/uutiset/police_website_target_of_repeated_denial_of_service_attacks/7891226

Read the article:
Police website target of repeated DDoS attacks

Companies under DDoS Attack Fear Losing Business Opportunities the Most

DDoS attacks are now one of the most common and affordable cyberweapons. They are used by unscrupulous competitors, sinister extortionists or just everyday cyber-vandals. More and more companies, regardless of their size or business, are encountering this threat. And, according to the results of a survey conducted by Kaspersky Lab and B2B International, the majority of companies believe that revenue and reputation losses are the most damaging consequences of a DDoS attack. According to the figures, companies regard lost business opportunities – the loss of contracts or on-going operations that generate guaranteed income – as the most frightening consequence of a DDoS attack. 26 per cent of companies that encountered DDoS attacks regarded this as the biggest risk. Reputational risks (23 per cent) were viewed as the next most frightening consequence, likely to be since a negative customer or partner experience can drive away future contracts or sales. Losing current customers who could not access the anticipated service due to a DDoS attack was in third place: named by 19 per cent of respondents. Technical issues were at the bottom of the pile: 17 per cent of respondents identified a need to deploy back-up systems that would keep operations online as the most undesirable consequence, followed by the costs of fighting the attack and restoring services. The research also revealed that respondents from companies in different fields take different views of the consequences of DDoS attacks. For example, industrial and telecoms companies, as well as e-commerce and utilities and energy organisations, tend to rate reputational risks ahead of lost business opportunities. In the construction and engineering sector there is more concern about the cost of setting up back-up systems, perhaps because larger companies face higher expenditure on this kind of system. “ People who have not yet faced a particular threat often tend to underestimate it while those who have already experienced it understand which consequences might be the most damaging for them. However, it makes little sense to wait until the worst happens before acting – this can cost companies a lot, and not only in financial terms. That is why it is important to evaluate all possible risks in advance and take appropriate measures to protect against DDoS attacks ”, said Evgeny Vigovsky , Head of Kaspersky DDoS Protection, Kaspersky Lab. DDoS attacks on company resources are becoming a costly problem but only 37 per cent of the organisations surveyed said they currently have measures in place to protect against them. This is an unnecessary oversight at a time when the IT security market can offer reliable and easy-to-deploy security solutions that are able to prevent loss of access to online services caused by a DDoS attack. For example : Kaspersky DDoS Protection does not require the installation of heavy server solutions on the customer’s infrastructure. Traffic filtration during an attack is handled in special cleaning centers according to the tailor-made rules defined for each customer and each attack. The solution is backed up by Kaspersky Lab experts, whose many years’ experience of protecting against online threats allows them to detect attacks fast and block them, regardless of the intensity and complexity of the assault. Source: http://www.informationsecuritybuzz.com/companies-under-ddos-attack-fear-losing-business-opportunities-the-most/

See the original post:
Companies under DDoS Attack Fear Losing Business Opportunities the Most