Category Archives: DDoS Vendors

DDoS Attack on Russia Today News Website

The RT news website has undergone the most powerful Distributed Denial of Service (DDoS) attack in its history, the press service of the channel reported Wednesday. “Thanks to the website’s reliable technical protection, RT.com was unavailable just for a few minutes,” the statement reads. According to the channel’s press service, RT.com has been repeatedly subjected to DDoS-attacks. One of the most powerful hacker attacks occurred on February 18, 2013. The website was unavailable for about 6 hours. In 2012 the channel’s English and Spanish websites also came under attack. The attack was claimed by anti-WikiLeaks hacker group AntiLeaks. A DDoS-attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. The RT network’s first channel was launched in December 2005 and now consists of three global news channels broadcasting in English, Spanish and Arabic. RT has 22 bureaus in 19 countries and territories. RT reaches over 644 million people in more than 100 countries. Source: http://en.ria.ru/society/20140918/193035597/Hackers-Attack-RT-News-Website.html

Read the original:
DDoS Attack on Russia Today News Website

Silk Road 2.0 Hit by ‘Sophisticated’ DDoS Attack

Online black market Silk Road 2.0 experienced a distributed denial-of-service (DDoS) attack last week, which forced the site’s administrators to temporarily suspend services. News of the attack broke on bitcoin forums hours after it started, with the Silk Road team soon confirming the news via its own forums. For reasons that are less clear, black market Agora has faced outage issues problems of its own in the last few days. Silk Road remains defiant Silk Road 2.0 moderator ‘Defcon’ issued a statement saying that the site was facing a “very sophisticated” DDoS attack using the most advanced methods the site has experienced to date. The moderator said: “The dev team is working around the clock to get marketplace service restored, as well as watch the security of our systems closely. Much of the downtime you have seen is intentional on our part: if this is an attempt to locate our servers through packet analysis, we do not want to make it easy for our adversary and would rather be offline while we adapt our defences.” As the attack continued, Silk Road 2.0 remained offline. Defcon eventually issued a second update, indicating that the team is trying out different approaches to blocking the inbound DDoS. He stressed that the site is still processing withdrawals, although these have been delayed by the attacks. Silk Road 2.0 is aware that cashflow is very important and the site is therefore prioritising delayed withdrawals, the moderator added. Defcon ended the update on a defiant note: “To our adversaries: you cannot stop us. We will overcome every attack.” Questions persist Silk Road 2.0 vendors started reporting problems earlier last week, before the site was finally forced to shut down. Despite official updates, the outage prompted a number vendors to raise questions about the impact of the attack. Silk Road 2.0 was targeted by hackers in the past: last February, the site lost 4,476 BTC to an alleged hack, worth over $2.6m at the time. The attack was blamed on a transaction malleability exploit used by one of the vendors. The site decided to compensate affected customers and, by late May, it said more than 80% of bitcoins stolen in the alleged heist have been repaid to the victims. The source and goal of the latest attack remains unclear. Speculation is mounting that the attack was in fact launched by law enforcement in an attempt to ascertain the location of Silk Road 2.0 servers, while other users believe the attack was launched by criminals or competitors. Following the February hack, Silk Road 2.0 said it would introduce a multi-signature wallet system to replace its previous escrow platform. A multisig system should be less vulnerable to hackers, but has not been fully implemented yet. Online black market Agora faces outage Silk Road 2.0 is not the only black market suffering outage issues. While Silk Road 2.0 was struggling to restore services, which it eventually did late on Friday, competing market Agora went offline. Agora users started reporting intermittent problems on Saturday. The site was out of action over  much of the weekend and had still not become available by press time  (12:15 BST, Monday). The reason for the outage remains unclear. Earlier this month, Agora confirmed that it was suffering from availability issues on a regular basis. However, the team offered an extensive explanation into the inner workings of the market and the need for security, saying it considers that more important than around-the-clock availability. The Agora team said at the time: “Our primary goal is to stay hidden from law enforcement agencies and secure from hackers. We implement much more security measures than many others, which causes problems with availability.”   Source: http://www.coindesk.com/silk-road-2-0-shrugs-sophisticated-ddos-attack/

Read the article:
Silk Road 2.0 Hit by ‘Sophisticated’ DDoS Attack

5 most targeted industries for DDoS attacks

1. Gaming Gaming is the most-targeted industry, according to the report, accounting for more than 45% of total attacks. The industry, which includes any company related to online gaming or gaming-related content, is prone to attacks by motivated players seeking to gain a competitive advantage or by malicious actors seeking to steal personal data from players. The industry received a large percentage of infrastructure layer attacks and a fair percentage of application-layer attacks in Q2, including 46% of all NYN floods and 68% of GET floods. 2. Software and technology The software and technology industry, which includes companies that provide solutions such as SaaS and cloud-based technologies, was hit with the second-greatest number of attacks (22%), and was the most-frequently targeted with infrastructure-layer attacks. The report reveals that the most popular attack vectors against the software and technology industry were DNS and NTP reflection and amplification attacks, accounting for 33% and 26% respectively. SYN floods made up approximately 22% of attacks, and UDP floods accounted for 27%. 3. Media and entertainment The report reveals that the media and entertainment industry accounted for a smaller percentage of all attacks, at 15% in Q2. This marks a 39% decrease from last quarter. Despite this shift, the media and entertainment industry remains one of the most targeted industries for hackers. These attacks often offer higher visibility for malicious actors, with press coverage that helps campaign organizers reach out to supporters and recruit new participants. The media and entertainment industry was hit by mostly infrastructure attacks, including SYN floods (18%), UDP floods (25%) and UDP fragments (22%). 4. Financial services Major financial institutions, such as banks and trading platforms, were targeted in 10% of all attacks in Q2, according to the Prolexic report. Historically, financial institutions have been the target of many DDoS attacks, including those orchestrated by the group Izz ad-Din al Qassam Cyber Fighters (QCF), using the Brobot botnet. The report discloses that recent activity indicates a possible resurgence of the use of the Brobot botnet, but the financial sector did not experience many major attack campaigns this quarter. 5. Internet and telecom Including companies that offer internet-related services such as ISPs and CNDs, the internet and telecom industry was the fifth most-targeted industry in Q2, accounting for 4% of all attacks. Infrastructure-layer attack vectors were the most common, with 10% of all attacks as UPD floods, and 9% as UPD fragments. Internet and telecom was the target of 12% of all NTP flood attacks this quarter. Source: http://www.propertycasualty360.com/2014/09/12/5-most-targeted-industries-for-ddos-attacks?t=tech-management&page=6

Continue Reading:
5 most targeted industries for DDoS attacks

Use home networking kit? DDoS bot is BACK… and it has EVOLVED

OMG, it reconfigures your firewall… SAVE yourselves, Linux lords A router-to-router bot first detected two years ago has evolved – and now has the capability to reconfigure the firewalls of its victims.…

Excerpt from:
Use home networking kit? DDoS bot is BACK… and it has EVOLVED

DDoS reflection/amplification attacks disrupting ISP networks

Attacks being used by gamers to settle disputes and by people with rudimentary hacking skills to target companies Reflection/amplification distributed denial of service (DDoS) attacks have now become so large that entire ISP networks are getting disrupted, says a networking security expert. Arbor Networks senior security engineering & response team (ASERT) analyst Roland Dobbins told Computerworld Australia that DDoS attacks are being used by gamers to settle disputes and by people with rudimentary hacking skills to target companies. “The main characteristic of these attacks is that they are huge. The biggest one we have seen so far was 400Gb/s. Because these attacks are so large, they fill up the pipes of Internet service providers [ISPs], the peering and transit links,” he said. According to Dobbins, the attacks are possible because many ISPs and enterprise networks have not implemented universal anti spoofing measures. “The way these [DDoS] attacks work is that the attacker will try to get control of a computer on a network that does not enforce IP source validation. [The attacker] spoofs the IP address of his target and sends a bunch of queries to a misconfigured server.” The misconfigured server answers these queries and “pummels” the target of the attack with unsolicited responses, he said. “It’s as if I called up 20 pizza parlours in Sydney, pretended to be someone else and ordered a lot of large pizzas to be delivered to that person.” The largest reflection/amplification DDoS attack recorded in Australia by Arbor Networks staff was 62Gb/s, he said. The attack, which took place in early 2014, appeared to be triggered by an online gaming dispute. “Since October 2013, there has been an explosion in these attacks that online gamers use. One player gets a grudge against another and decides to be unsportsman like and resort to a DDoS attack. It’s like using a nuclear weapon to solve a playground dispute,” he said. Dobbins had three tips for ISPs to avoid reflection/amplification DDoS attacks. The first was that ISPs should enforce anti-spoofing or source address validation at the edges of their network. “The second thing they [ISPs] can do is make sure they utilise flow telemetry analysis from routers and switches. This provides real time visibility into network traffic. When these attack floods traverse their network, they can detect it and trace it back [to the source] immediately,” he said. “The third thing they need to do is implement reaction and mitigation mechanisms. One of these is called an intelligent DDoS mitigation system [IDMS].” “If they have these reaction and mitigation tools to deal with this attack traffic, they will be in a much better position to deal with these events and minimise disruption,” said Dobbins. Source: http://www.computerworld.com.au/article/554558/ddos-reflection-amplification-attacks-disrupting-isp-networks-analyst/

Read the original post:
DDoS reflection/amplification attacks disrupting ISP networks

Are your servers secure from hackers ?

As the Reuters headline read this week “Hackers break into server for Obamacare website” It was about hackers who uploaded malicious code onto a development server, which is part of ObamaCare. The code installed on the government website was said to be part of a larger operation and used primarily to carry out DDoS attacks on other websites. What’s so important about such a tiny infraction ? It gives you an idea of why DDoS attacks are getting larger and more sophisticated and more frequent. It would be a safe bet to assume this development machine had plenty of horsepower and a GigE connection that wasn’t throttled. This is where a lot of DDoS attacks are being perpetrated from especially the large and complex variety. Its not bot infected laptops at home anymore, although they can be troublesome too sometimes. Its easy to let security slide if it’s a test or development machine that’s just used by programmers and maybe just completely forgotten about when a project ends. Don’t become part of the problem. Run vulnerability scans to test and find holes where hackers can gain entry. When DOSarrest Internet Security started offering Vulnerability testing last year, they saw almost 9 out of 10 servers had at least one vulnerability and most had multiple holes.

View the original here:
Are your servers secure from hackers ?

Hackers launch DDoS attack on Obamacare website server, user data safe

In what could be another jolt for US President Barack Obama’s dream project ‘Obamacare health insurance program’, a government cybersecurity team last week discovered that an unknown hacker or a group of hackers tried to peep into a computer server supporting the HealthCare.gov website by apparently uploading malicious files. The Centers for Medicare and Medicaid Services, the lead Obamacare agency, on Thursday briefed about the intrusions to top congressional staff. “The first incidence of breach occurred on July 8”, Aaron Albright, CMS spokesman, said. According to Albright, the main objective of the hackers was not to steal personal data but to launch a distributed denial of service (DDoS) attack against other websites. In a DDoS attack, the malwares trying to communicate with the website makes the computers with internet-connectivity so overwhelmed that they fail to handle legitimate requests and lead to crash. “Our review indicates that the server did not contain consumer personal information; data was not transmitted outside the agency, and the website was not specifically targeted. We have taken measures to further strengthen security,” Albright said. Albright also shed out speculations that the attack would adversely impact on the second round of enrollment period, which begins on November 15, for the health coverage under the Obamacare. Meanwhile, the CMS’s parent agency – Office of Inspector General of the Department of Health and Human Services- and the HHS leadership have been notified of the attack and sources say investigation is under process. The Department of Homeland Security spokesperson said that the affected server has been forensically preserved by its Computer Emergency Readiness Team (US-CERT). The agency, which is also responsible in investigating cyber attacks, said that they had identified the malware designed to launch the DDoS attack and extracted them. Source: http://www.wallstreetotc.com/hackers-launch-ddos-attack-on-obamacare-website-server-user-data-safe/28570/

Original post:
Hackers launch DDoS attack on Obamacare website server, user data safe

Hackers upload malicious files on the Obamacare website to launch a DDoS Attack

In what could be another jolt for US President Barack Obama’s dream project ‘Obamacare health insurance program’, a government cybersecurity team last week discovered that an unknown hacker or a group of hackers tried to peep into a computer server supporting the HealthCare.gov website by apparently uploading malicious files. The Centers for Medicare and Medicaid Services, the lead Obamacare agency, on Thursday briefed about the intrusions to top congressional staff. “The first incidence of breach occurred on July 8”, Aaron Albright, CMS spokesman, said. According to Albright, the main objective of the hackers was not to steal personal data but to launch a distributed denial of service (DDoS) attack against other websites. In a DDoS attack, the malwares trying to communicate with the website makes the computers with internet-connectivity so overwhelmed that they fail to handle legitimate requests and lead to crash. “Our review indicates that the server did not contain consumer personal information; data was not transmitted outside the agency, and the website was not specifically targeted. We have taken measures to further strengthen security,” Albright said. Albright also shed out speculations that the attack would adversely impact on the second round of enrollment period, which begins on November 15, for the health coverage under the Obamacare. Meanwhile, the CMS’s parent agency – Office of Inspector General of the Department of Health and Human Services- and the HHS leadership have been notified of the attack and sources say investigation is under process. The Department of Homeland Security spokesperson said that the affected server has been forensically preserved by its Computer Emergency Readiness Team (US-CERT). The agency, which is also responsible in investigating cyber attacks, said that they had identified the malware designed to launch the DDoS attack and extracted them. Source: http://www.wallstreetotc.com/hackers-launch-ddos-attack-on-obamacare-website-server-user-data-safe/28570/

Read this article:
Hackers upload malicious files on the Obamacare website to launch a DDoS Attack

DDoS Attacks: Increasingly the Weapon of Choice

Distributed denial of service (DDoS) attacks are a method attackers favor for disrupting an organization’s operations by flooding the network with traffic, overwhelming available bandwidth, and making network resources unavailable. According to research from the Ponemon Institute, DDoS attacks accounted for 18 percent of data center outages in 2013, up from 2 percent in 2010. They found that such attacks are the most costly data-center attacks to mitigate, costing an average of $822,000 per outage, leading to problems such as business disruption, loss of revenues, and reduced productivity. However, the costs can be even higher for organizations that rely on their websites as their main sales vehicle, since the unavailability of those websites can lead to those organizations losing multiple millions of dollars in sales. According to Forrester Research, the average organization loses $27 million for a 24-hour outage, with business services and financial services institutions faring the worst. Despite the damage that DDoS attacks can do in and of themselves, they are often used as a smoke screen to divert resources into clearing up the disruption, leaving organizations unaware of other attacks happening simultaneously. Often, the real motivations are financial manipulation or a competitive takeout. In other cases, the motivations are ideological, looking to hurt or embarrass organizations. For example, in late 2012 to early 2013, 46 financial institutions in the United States were hit with over 200 coordinated and timed DDoS attacks. It is believed that the motivation for this campaign of attacks was to cause consumers to lose their trust in the retail banking system. However, organizations in any walk of life can be impacted, both in the private and public sector, and such attacks should be considered a top concern by any organization, especially as DDoS attacks are increasingly becoming a weapon of choice. Not only are DDoS attacks growing in number and affecting a wider range of organizations, but more tools are becoming available that make them easier to pull off. Whereas previously an attacker would have had to possess a fair degree of skill and recruit an army of computers into a botnet in order to create enough computing power to launch an attack, new attack methods require considerably fewer resources and less skill. DDoS attack kits are now readily available on the Internet for low prices, making the job of a relatively unskilled hacktivist much easier, and DDoS-as-a-service attacks are an increasingly common phenomenon, whereby attackers hire themselves and their botnets out to those wishing to launch attacks. Another recent development is the use of network time protocol amplification attacks, which use publicly available network time protocol servers, the real purpose of which is to provide clock-synchronization services over public networks. Using this method means that attackers no longer need to go through the effort of putting together a botnet to launch their attacks. Recently, there has also been a dramatic rise in mobile applications used in DDoS attacks, driven by the ease with which mobile apps can be downloaded. These apps allow any mobile user to join a DDoS attack if he or she wishes—for example, for an ideological cause with which he or she sympathizes. It is predicted that such attacks will increase dramatically. The tremendous growth in DDoS attacks in 2013 that continued, if not accelerated, in 2014 means that all organizations should beware of the consequences. Where they do not have the resources in-house to defend themselves, organizations should investigate the use of services that can divert traffic away from their networks while remediation measures are taken. While, on the one hand, there is a trend toward increasing complexity and sophistication of attacks, on the other hand, attacks are becoming easier to pull off by an ever-wider range of criminal actors. The DDoS attack landscape is set to become much more complicated, and many more organizations will become victims. All organizations should beware. Source: https://blogs.rsa.com/ddos-attacks-increasingly-weapon-choice/

More here:
DDoS Attacks: Increasingly the Weapon of Choice