Category Archives: DDoS News

Dark Web Marketplaces Go Down In Reported Mass DDoS Attack

There seems to be some turbulence going on in the murky world of the dark web, with four of its major drug marketplaces unexpectedly going offline, reports said. The dark web is a section of the internet where people contact each other anonymously without the fear of being monitored. It is usually used by criminals to sell drugs, chemicals, weapons, child abuse images and even offer assassination services. Websites The Trade Route, Tochka, Wall Street Market and Dream Market, were down without any notification or clarification from the sites’ administrators. According to some users of such markets, this might either be a DDoS attack by a hacker or a large scale action by law enforcement authorities. However, there are more chances of the former happening than the latter. Some dark web users have also started complaining of botnet attacks. Another farfetched theory is that this is scam by a bunch of drug dealers — taking off with the money of their clients while not providing them with the required merchandize. With no notification or clarification from the sites’ administrators, the exact reason for the sudden disappearance of such marketplaces remains unclear. However, a user going by the name Automoderator commented on a the subreddit /r/DarkNetMarketNoobs that the WallStreetMarket is not listed currently, as it is facing “very serious issues” and warned others to avoid it all costs. Some other users on the subreddit say that the Dream Market has been working fine on all its mirrors, but, however its main site is down. At the time of writing, the marketplaces were still down, according to dark web marketplace tracker deepdotweb. Many sites on the dark web are also run by law enforcement — the Australian Police ran one of the world’s biggest child porn sites on the dark web between October 2016 and September 2017, called Child’s Play, in an effort to nab pedophiles. The police grabbed the administrator access from two cyber criminals — Benjamin Faulkner and Patrick Falte and started administering the sites. Police even posted more child porn on the site in an effort to convince the viewers that the site had not been taken over by the authorities. By the time they shut down the site, police were able to nab more than 90 pedophiles in Australia and 900 across the world. In case, the marketplaces were being taken over by law enforcement to nab drug traffickers and child porn purveyors, it might be a different case. However the development has many dark web users in a state of paranoia and many users have posted on Reddit reminding other users of such busts. Such attacks on dark web markets in the past have usually begun with large-scale DDoS attacks. In July, a massive trans-continental sting saw two of the dark web’s biggest sites at the time, AlphaBay and Hansa, being taken down. Law enforcement agencies claimed they were able to collect incriminating information on hundreds of buyers and vendors, going as far as threatening to prosecute them. Source: http://www.ibtimes.com/dark-web-marketplaces-go-down-reported-mass-ddos-attack-2601105

See the original article here:
Dark Web Marketplaces Go Down In Reported Mass DDoS Attack

DDoS Attacks Cause Train Delays Across Sweden

DDoS attacks on two separate days have brought down several IT systems employed by Sweden’s transport agencies, causing train delays in some cases. The incidents took place early in the mornings of Wednesday and Thursday, October 11 and 12, this week. The first attack hit the Sweden Transport Administration (Trafikverket) on Wednesday. According to local press, the attack brought down the IT system that manages train orders. The agency had to stop or delay trains for the time of the attack. Trafikverket’s email system and website also went down, exacerbating the issue and preventing travelers from making reservations or getting updates on the delays. The agency used Facebook to manage the crisis and keep travelers informed. Road traffic maps were also affected, an issue that lingers even today, at the time of publishing, according to the agency’s website. Three Swedish transportation agencies targeted Speaking to local media, Trafikverket officials said the attack was cleverly aimed at TDC and DGC, the agency’s two service providers, but they were both aimed in such a way to affect the agency’s services. Trafikverket was able to restore service in a few hours, but the delays affected the entire day’s train operations. While initially, some might have thought this was a random incident, the next day, a similar DDoS attack hit the website of another government agency, the Sweden Transport Agency (Transportstyrelsen), and public transport operator Västtrafik, who provides train, bus, ferry, and tram transport for parts of Western Sweden. Cyber-warfare implications In perspective, both incidents give the impression of someone probing various parts of Sweden’s transportation system to see how the country would react in the face of a cyber-attack and downtime. The DDoS attacks come a week after a report that Russia was testing cyber-weapons in the Baltic Sea region. In April 2016, Swedish officials blamed Russia for carrying out cyber-attacks on the country’s air traffic control infrastructure that grounded flights for a day in November 2015. Source: https://www.bleepingcomputer.com/news/security/ddos-attacks-cause-train-delays-across-sweden/

Nginx with Stream Module Dynamic Upstream CNAME

In the age on scalable web applications , many organizations turn to cloud-based server hosting to dynamically add additional servers during peak usage, or attain redundancy by having multiple geographic web -server locations. One of the methods used for this is DNS CNAME resolution. Using this option with various cloud hosting providers that support it can allow the following: 1) Load Balancing. The CNAME DNS record can be configured to respond to requests with more then one IP Address, allowing load balancing of multiple origin servers, dynamically scaled by the cloud hosting providers DNS service. 2) Global Server Load Balancing. The cloud hosting DNS can provide different record results in different geographic areas of the world. This can be achieved based on Geo-Location or other methods. 3) Fail-over redundancy. Since the CNAME record is controlled by the cloud provider, upon failure of one data center, all records pointing to a geographic location which has failed can be automatically switched to the remaining data-center. Is there a way Nginx can perform Dynamic DNS resolution, for CNAME or other records used as Upstreams/Origins? Reverse proxies have been a core component of our service since 2007, to say we are experienced in this area is an understatement. Which is why when a customer of ours was having trouble configuring their open-source Nginx to use cnames for their load balancing configuration, they came to us to see if we had any advice or ideas (one of the many benefits being part of a fully managed DDoS mitigation service). The challenge the customer was facing, and which some of you Nginx administrators may be aware of, is that the open-source version of Nginx does not have a built in dynamic DNS resolver. Essentially it will only resolve domains initially on web-server “start”, and “reload”, but will not update the record if a DNS record changes during running operation. After doing some research on various forums and testing in our labs, we identified that in order to use open-source Nginx to dynamically resolve domains, one would have set the domain in a variable, which would then cause Nginx to resolve the domain in the variable dynamically, and according to Nginx’s DNS Cache/TTL . The variable is then used in the “proxy_pass” directive to send the visitor to the correct origin without requiring a reload to be kept up to date. **There is a problem with using the above workaround for Nginx’s “Stream” module; The “Set” directive does not exist. If you attempt to perform the same method on a TCP Pass-through using Nginx Stream, you will find that since the ‘set $variable “value”; ‘ method is not available within Nginx Stream. The previous method cannot be used. Is there a way to perform dynamic DNS resolution within open-source Nginx’s stream module, or is a 3rd party module that could be used? Although there is a “stream-lua-nginx” module by Openresty team being developed that could be used for such a purpose, we are not aware of any free 3rd party Dynamic DNS resolution modules that work with Stream. There is however a way to use essentially the same method as used with the Nginx HTTP Proxy, by using the Nginx Stream Map directive. Above is the relevant configuration file snippet. **This configuration snippet requires that you have a base nginx.conf configuration already setup. Included in the example are the portions of the configuration that should be present within the Nginx “stream” directive. ***Please keep in mind the following facts: 1) Fail-over / Load Balancing behavior works differently then standard Nginx upstreams. Instead of using Nginx upstream load balancing or Passive health-checks, Load Balancing and Redundancy should be handled by the CNAME DNS service itself; Nginx “Upstream” directives are not used in this case, so there is no way to mark a server as down. Since there is more then one worker process in any deployed configuration, Round Robin DNS , where a Nameserver lookup returns more then one resulting record can be used to perform load balancing. 2) Each Nginx “Worker” will perform DNS lookups for requests handled by that worker. This means that if you have 20 worker processes , all 20 will be performing DNS lookups and caching the results , holding the results in memory for the DNS Cache/TTL configured using the Nginx “resolver” directive. You may want to use a local DNS server or caching resolver in order to lower the number of DNS queries made. Scott Girbav DOSarrest Internet Security Senior Network Security Engineer Source: https://www.dosarrest.com/ddos-blog/nginx-with-stream-module-dynamic-upstream-cname/

See the article here:
Nginx with Stream Module Dynamic Upstream CNAME

Investigation reveals large botnet hiding behind Fast Flux technique

Fast Flux, a DNS technique first introduced in 2006 and widely associated with the Storm Worm malware variants, can be used by botnets to hide various types of malicious activities – including phishing, web proxying, malware delivery, and malware communication. The technique allows the botnet to “hide” behind an ever-changing network of compromised hosts, ultimately acting as proxies and making detection incredibly difficult. High-level architecture overview of the Fast Flux network ?and associated threat landscape … More ?

Follow this link:
Investigation reveals large botnet hiding behind Fast Flux technique

DDoS attacks double as corporate data becomes new target

While more organisations are being hit by a DDoS attacks in 2017 compared to last year, less are being hit by more than one. DDoS attacks have increased in frequency in 2017, with 33 per cent of organisations having faced one this year compared to just 17 per cent in 2016. While DDoS attacks have been previously used to disable the operations of a target, the driving motivation to use it now is the theft of corporate data. Over a third of organisations having been hit by a DDoS attack this year, 20 per cent have been small businesses, 33 per cent medium, and 41 per cent have been in the enterprise category. Security provider Kaspersky is behind this data, with findings from its Global IT Security Risks Survey 2017. The damage inflicted by a DDoS attack may prove more long lasting than some might expect, with 26 per cent of businesses hit reporting a lasting impact on the performance of services. Russ Madley, Head of VSMB & channel at Kaspersky Lab UK, said: “While DDoS attacks have been a threat for many years, it’s still important that businesses take DDoS attacks seriously as they are one of the most popular weapons in a cybercriminal’s arsenal. They can be just as damaging to a business as any other cybercrime, especially if used as part of a bigger targeted attack.” It important to remember that DDoS attack can leave an organisation lame as it returns to regular activity, but an attack can also have a direct and immediate impact on reputation and the financial standing of a business. “The ramifications caused by these types of attacks can be far-reaching as they’re able to reach deep into a company’s internal systems. Organisations must understand that protection of the IT infrastructure requires a comprehensive approach and continuous monitoring, regardless of the company’s size or sphere of activity,” said Madley. While more organisations are facing DDoS attacks, the percentage of businesses hit by more than one has dropped this year to 76 per cent, a reduction from the 82 per cent that experienced more than one last year. Source: http://www.cbronline.com/news/cybersecurity/ddos-attacks-double-corporate-data-becomes-new-target/

View post:
DDoS attacks double as corporate data becomes new target

US SEC Corporate Filing System Said to Be Vulnerable to DDoS Attacks

The US Securities and Exchange Commission (SEC), Wall Street’s top regulator, has discovered a vulnerability in its corporate filing database that could cause the system to collapse, according to an internal document seen by Reuters. The SEC’s September 22 memo reveals that its EDGAR database, containing financial reports from US public companies and mutual funds, could be at risk of “denial of service” attacks, a type of cyber intrusion that floods a network, overwhelming it and forcing it to close. The discovery came when the SEC was testing EDGAR’s ability to absorb monthly and annual financial filings that will be required under new rules adopted last year for the $18 trillion mutual fund industry. The memo shows that even an unintentional error by a company, and not just hackers with malicious intentions, could bring the system down. Even the submission of a large “invalid” form could overwhelm the system’s memory. The defect comes after the SEC’s admission last month that hackers breached the EDGAR database in 2016. The discovery will likely add to concerns about the vulnerability of the SEC’s network and whether the agency has been adequately addressing cyber threats. The mutual fund industry has long had concerns that market-sensitive data required in the new rules could be exploited if it got into the wrong hands. The industry has since redoubled its calls for SEC Chairman Jay Clayton to delay the data-reporting rules, set to go into effect in June next year, until it is reassured the information will be secure. “Clearly, the SEC should postpone implementation of its data reporting rule until the security of those systems is thoroughly tested and assessed by independent third parties,” said Mike McNamee, chief public communications officer of The Investment Company Institute (ICI), whose members manage $20 trillion worth of assets in the United States. “We are confident Chairman Clayton will live up to his pledge that the SEC will take whatever steps are necessary to ensure the security of its systems and the data it collects.” An SEC spokesman declined to comment. The rules adopted last year requiring asset managers to file monthly and annual reports about their portfolio holdings were designed to protect them in the event of a market crisis by showing the SEC and investors that they have enough liquidity to cover a rush of redemptions. During a Congressional hearing on Wednesday, Clayton testified that the agency was considering whether to delay the rules in light of the cyber concerns. He did not, however, mention anything about the denial of service attack vulnerability. Virtual vomit EDGAR is the repository for corporate America, housing millions of filings ranging from quarterly earnings to statements on acquisitions. It is a virtual treasure trove for cyber criminals who could trade on any information gleaned before it is publicly released. In the hack disclosed last month involving EDGAR, the SEC has said it now believes the criminals may have stolen non-public data for illicit trading. The vulnerability revealed in the September memo shows that even an invalid form could jam up EDGAR. The system did not immediately reject the form, the memo says. Rather, “it was being validated for hours before failing due to an invalid form type.” That conclusion could spell trouble for the SEC’s EDGAR database because it means that if hackers wanted to, they could “basically take down the whole EDGAR system” by submitting a malicious data file, said one cyber security expert with experience securing networks of financial regulators who reviewed the letter for Reuters. “The system would consume the data and essentially throw up on itself,” the person added. Source: http://gadgets.ndtv.com/internet/news/us-sec-corporate-filing-system-said-to-be-vulnerable-to-ddos-attacks-1759392

More:
US SEC Corporate Filing System Said to Be Vulnerable to DDoS Attacks

DDoS trends, DNS survey signal warnings to infosec pros

Two vendor reports out this week may be of interest to CISOs in planning their defensive strategies. —Imperva, a supplier of DDoS protection services, said it found a new attack tactic, nicknamed “pulse wave DDoS”, due to the traffic pattern it generates: A rapid succession of attack bursts that split a botnet’s attack output, enabling an offender to go after multiple targets. One such attack was also the largest network layer assault it mitigated in the second quarter peaked at 350 Gbps. –Meanwhile Infoblox Inc., which makes IP address management solutions, released a global survey finding that DNS security is often overlooked when it comes to cybersecurity strategy, with most companies inadequately prepared to defend against DNS attacks. Imperva’s announcement is included in its Q2 Global DDoS Threat Landscape report, on data from 2,618 network layer and 12,825 application layer DDoS attacks on customers’ Websites that use its services. The pulse wave DDoS tactic was described in an August blog , and researchers think it is designed to double a botnet’s output and exploit soft spots in “appliance first cloud second” hybrid mitigation solutions. “It wasn’t the first time we’ve seen attacks ramp up quickly. However, never before have we seen attacks of this magnitude peak with such immediacy, then be repeated with such precision. “Whoever was on the other end of these assaults, they were able to mobilize a 300Gbps botnet within a matter of seconds. This, coupled with the accurate persistence in which the pulses reoccurred, painted a picture of very skilled bad actors exhibiting a high measure of control over their attack resources.” Researchers suspect the tactic allows the threat actors behind it to switch targets on the fly. One suggested defence for organizations that have a DDoS mitigation provider is to double checking the ‘time to mitigation’ clause in the service level agreement. The report also notes two trends: First, the continued decline in network level attacks (at least for Imperva customers) and the continued increase (although in Q2 there was a slight dip) in application level attacks. Second, that the second quarter 75.9 percent of targets were subjected to multiple attacks—the highest percentage the company has seen. Number of targets subjected to repeat DDoS attacks. Imperva graphic The Infoblox global survey of over 1,000 security and IT professionals found respondents indicating that 86 per cent of those whose firms have DNS solutions said they failed to first alert teams of an occurring DNS attack, and nearly one-third of professionals doubted their company could defend against the next DNS attack. Twenty per cent of companies were first alerted to DNS attacks by customer complaints. In a release summarizing the survey (available here. Registration required), three out of 10 companies said they have already been victims of DNS attacks. Of those, 93 per cent have suffered downtime as a result of their most recent DNS attack. 40 percent were down for an hour or more, substantially impacting their business. Only 37 per cent of respondents said their companies were able to defend against all types of DNS attacks (hijacking, exploits, cache poisoning, protocol anomalies, reflection, NXDomain, amplification). Twenty-four per cent of respondents said their companies lost US $100,000 or more from their last DNS attack. “Most organizations regard DNS as simply plumbing rather than critical infrastructure that requires active defense,” Cricket Liu, chief DNS architect at Infoblox, said in the release. “Unfortunately, this survey confirms that, even on the anniversary of the enormous DDoS attack against Dyn—a dramatic object lesson in the effects of attacks on DNS infrastructure—most companies still neglect DNS security. Our approach to cybersecurity needs a fundamental shift: If we don’t start giving DNS security the attention it deserves, DNS will remain one of our most vulnerable Internet systems, and we’ll continue to see events like last year’s attack.” Source: https://www.itworldcanada.com/article/ddos-trends-dns-survey-signal-warnings-to-infosec-pros/397309

Visit link:
DDoS trends, DNS survey signal warnings to infosec pros

As US launches DDoS attacks, N. Korea gets more bandwidth—from Russia

Fast pipe from Vladivostok gives N. Korea more Internet in face of US cyber operations. As the US reportedly conducts a denial-of-service attack against North Korea’s access to the Internet, the regime of Kim Jong Un has gained another connection to help a select few North Koreans stay connected to the wider world—thanks to a Russian telecommunications provider. Despite UN sanctions and US unilateral moves to punish companies that do business with the Democratic People’s Republic of Korea, 38 North’s Martyn Williams reports that Russian telecommunications provider TransTelekom (????????????m) began routing North Korean Internet traffic at 5:30pm Pyongyang time on Sunday. The connection, Williams reported, offers a second route for traffic from North Korea’s Byol (“Star”) Internet service provider, which also runs North Korea’s cellular phone network. Byol offers foreigners in North Korea 1Mbps Internet access for €600 (US$660) a month (with no data caps). Up until now, all Byol’s traffic passed through a single link provided by China Unicom. But the new connection uses a telecommunications cable link that passes over the Friendship Bridge railway bridge—the only connection between North Korea and Russia. According to Dyn Research data, the new connection is now providing more than half of the route requests to North Korea’s networks. TransTelekom (sometimes spelled TransTeleComm) is owned by Russia’s railroad operator, Russian Railways. A Dyn Research chart showing the new routing data for North Korea’s ISP. According to a Washington Post report, The Department of Defense’s US Cyber Command had specifically targeted North Korea’s Reconnaissance General Bureau—the country’s primary intelligence agency—with a denial-of-service attack against the organization’s network infrastructure. That attack was supposed to end on Saturday, according to a White House official who spoke with the Post . While the unnamed official said the attack specifically targeted North Korea’s own hacking operations, North Korea has previously run those operations from outside its borders—from China. So it’s not clear whether the attack would have had any impact on ongoing North Korean cyberespionage operations. Source: https://arstechnica.com/information-technology/2017/10/as-us-launches-ddos-attacks-n-korea-gets-more-bandwidth-from-russia/

View post:
As US launches DDoS attacks, N. Korea gets more bandwidth—from Russia

US pressured North Korea by overwhelming hackers with data traffic

The US is no stranger to hacking North Korea, but it’s usually in a bid to directly thwart the country’s military ambitions. Now, however, those attacks are being used as a diplomatic strategy. The Washington Post has learned that President Trump ordered a broad pressure campaign against North Korea that led to the US conducting a denial of service attack against North Korea’s spying office, the Reconnaissance General Bureau. The move flooded the RGB’s servers with traffic that effectively strangled their internet access, including the Bureau 121 group responsible for the North’s hacking campaigns. And while it clearly didn’t change Kim Jong Un’s mind, it does appear to have had a practical effect. Reportedly, the initiative was designed to be temporary and only lasted for half a year — Trump signed the order in March, and it ended on September 30th. It wasn’t destructive, either. According to the Post ‘s sources, however, North Korean hackers were complaining about the ability to do their jobs during that period. North Korea certainly isn’t going to get much sympathy. With that said, it raises questions about the use of cyberattacks as a pressure tactic. It no doubt sends the message that the US can cripple a hostile country’s digital warfare capabilities if it wants, but there is the concern that it could escalate an already tense situation. After all, North Korea is the sort of country that claims you can declare war with a tweet — while that’s hyperbolic, it might interpret a denial of service attack as an act of aggression that merits revenge. Source: https://www.engadget.com/2017/10/01/us-launched-dos-attack-against-north-korea-hackers/

UK lotto players quids in: Website knocked offline by DDoS attack

It could be you* The UK National Lottery has apologised for a website outage that left money in their pockets of punters unable to play games on Saturday evening.…

Read the article:
UK lotto players quids in: Website knocked offline by DDoS attack