A massive worldwide effort is under way to harden the net’s clocks against hack attacks. The last few months have seen an “explosion” in the number of attacks abusing unprotected time servers, said security company Arbor. Unprotected network time servers can be used to swamp target computers with huge amounts of data. About 93% of all the vulnerable servers are now believed to have been patched against attacks. ‘Appropriate’ use The attack that paved the way for the rapid rise was carried out by the Derp Trolling hacker group and was aimed at servers for the popular online game League of Legends, said Darren Anstee, a network architect at net monitoring firm Arbor. That attack took advantage of weaknesses in older versions of the software underlying the network time protocol (NTP). Known as an “NTP reflection” attack, it used several thousand poorly configured computers handling NTP requests to send data to the League of Legend servers. Around the world about 1.6 million NTP servers were thought to be vulnerable to abuse by attackers, said Harlan Stenn from the Network Time Foundation that helped co-ordinate action to harden servers. Precise timings are very important to the steady running of the net and many of the services, such as email and e-commerce, that sit on it. Early 2014 saw the start of an Open NTP initiative that tried to alert people running time servers to the potential for abuse, Mr Stenn told the BBC. Now, he said, more than 93% of those vulnerable servers had been updated. However, he said, this did leave more than 97,000 still open to abuse. Arbor estimates that it would take 5,000-7,000 NTP servers to mount an overwhelming attack. The feature that attackers had exploited had been known for a long time in the net time community and was not a problem as long as those servers were used “appropriately”, he said. “This was before spammers, and well before the crackers started using viruses and malware to build bot armies for spamming, phishing, or DDoS attacks,” he said. Distributed Denial of Service (DDoS) attacks are those that try to shut servers down by overwhelming them with data. The success of the Derp Trolling attack prompted a lot of copycat activity, said Mr Anstee from Arbor. “Since that event it’s gone a bit nuts to an extent and that tends to happen in the attack world when one particular group succeeds,” he said. “We’ve seen an explosion in NTP reflection activity.” NTP reflection attacks can generate hundreds of gigabits of traffic every second, said Mr Anstee, completely overwhelming any server they are aimed at. The copycat attacks have fed into a spike in the number of “large events”, mainly DDoS attacks, that Arbor sees hitting the net, he said. “Historically we used to see a couple of hundred gigabit events every year,” said Mr Anstee. “In February 2014 we tracked 43.” Source: http://www.bbc.com/news/technology-26662051
Elance hit by major DDoS attack, downing service for many freelancers
The freelancer platform Elance has been under a sustained distributed denial-of-service (DDoS) attack for more than a day, making the service unavailable for many users — but apparently not compromising their data. The attack seems to have been a so-called NTP reflection attack, judging from an Elance tweet referencing a piece I recently wrote about the technique. Such attacks use botnets and badly configured NTP servers — essentially time checks for computers’ clocks — to amplify a small amount of data into a large one that overpowers the targets’ systems. Mountain View, Calif.-based Elance has over 4 million users (it will roughly double that through its upcoming merger with chief rival oDesk). It’s not clear how many have been affected by the outage, as a company spokeswoman told me only that “some users have not been impacted.” One comment on my February DDoS story suggests that oDesk was also down in the last day, though it’s not yet clear whether this was connected to the Elance attack. Elance’s spokeswoman said by email that the attack began at 6am PT on Monday and remains ongoing, albeit sporadically. She didn’t respond to a question about the possible motivation, but she did say Elance had defenses in place to ward off DDoS attacks on its service, and has “since invested in new technology to try to thwart the attackers.” She added: “We have a unique community of both businesses and freelancers and we’ve reached out to inform them about the attack and let them know that none of their data was compromised but to expect delays. Both sides of our community have been very responsive and sympathetic.” Source: http://gigaom.com/2014/03/18/elance-hit-by-major-ddos-attack-downing-service-for-many-freelancers/
More:
Elance hit by major DDoS attack, downing service for many freelancers
Gang wielding ColdFusion exploits expands botnet of hacked e-commerce sites
A German website of French automaker Citroën is the latest of the wide array of higher-profile webshop sites that have been compromised by a hacker gang leveraging Adobe ColdFusion vulnerabilities. …
Continued here:
Gang wielding ColdFusion exploits expands botnet of hacked e-commerce sites
NATO websites hit by DDoS attack
Hackers brought down several public NATO websites over the weekend in what appeared to be the latest escalation in cyberspace over growing tensions over Crimea. A spokesperson for the Western military alliance said the cyber attacks had begun on Saturday evening and continued on Sunday, although most services had now been restored. “It doesn’t impede our ability to command and control our forces. At no time was there any risk to our classified networks,” another NATO official said. NATO’s main public website, which carried a statement by Secretary-General Anders Fogh Rasmussen saying that Sunday’s referendum on Crimea’s status would violate international law and lack legitimacy, worked intermittently. The distributed denial of service (DDoS) attack also hit the site of a NATO-affiliated cyber security centre in Estonia. NATO’s unclassified email network was also affected. A group calling itself “cyber berkut” said the attack had been carried out by patriotic Ukrainians angry over what they saw as NATO interference in their country. The claim, made at www.cyber-berkut.org, could not be independently verified. “Berkut” is a reference to the feared and now disbanded riot squads used by the government of ousted pro-Russian Ukrainian President Viktor Yanukovich. Cyber warfare expert Jeffrey Carr, in a blog on the attacks, described cyber berkut as staunch supporters of Yanukovich and a “pro-Russia hacktivist group working against Ukrainian independence”. Lungescu noted the statement but said due to the complexities involved in attributing the attacks, NATO would not speculate about who was responsible or their motives. “Kicking sand” John Bumgarner, chief technology officer at the non-profit research institute US Cyber Consequences Unit, said initial evidence strongly suggested the attacks were launched by pro-Russian sympathisers. “One could equate these cyber attacks against NATO as kicking sand into one’s face,” he said. Crimeans voted in a referendum on Sunday on whether to break away from Ukraine and join Russia, with Kiev accusing Moscow of rapidly building up its armed forces on the peninsula in “crude violation” of an international treaty. The website for the Crimea referendum said on Sunday it had come under cyber attack overnight, although it appeared to be working on Sunday. Cyber attacks on NATO’s computer systems are common, but a NATO official said the latest one was a serious online assault. Ian West, director of NATO’s cyber defence nerve centre at Mons in southern Belgium, said last year that the alliance’s network intrusion detection systems handled around 147 million “suspicious events” every day and around 2500 confirmed serious attacks on its computers in the previous year. Tensions between Moscow and the West have been rising steadily since Russia intervened following the ouster of Yanukovich. Ukrainian and Russian websites have both been targets for cyber attacks in recent weeks but this appeared the first major attack on a Western website since the crisis began. Suspected Russian hackers used DDoS attacks to cripple websites and services in Estonia in 2007 during a dispute over a war memorial, and against Georgia during its brief 2008 war with Russia. Moscow denied orchestrating such attacks, saying they were simply carried out by independent patriots. Groups calling themselves cyber berkut have attacked several Ukrainian websites in recent weeks, computer security experts say. Source: http://www.itnews.com.au/News/375271,nato-websites-hit-by-ddos-attack.aspx
View post:
NATO websites hit by DDoS attack
Week in review: Target breach reaction fail, WordPress sites exploited in DDoS attack
Here's an overview of some of last week's most interesting news, podcasts, videos, interviews and articles: Latvia establishes a Cyber Defence Unit The newly established unit is part of the volu…
See the original article here:
Week in review: Target breach reaction fail, WordPress sites exploited in DDoS attack
NATO websites hit by cyber attacks
A number of NATO websites have been hit by cyber attacks, but they have had no impact on the military alliance’s operations, a NATO spokeswoman said. The attacks, which affected NATO’s main website, came amid rising tensions over Russian forces’ occupation of Ukraine’s Crimea region where a referendum is to be held on Sunday. NATO spokeswoman Oana Lungescu said on Twitter that several NATO websites have been the target of a “significant DDoS (denial of service) attack.” She said there had been no operational impact and NATO experts were working to restore normal function. Source: http://www.itv.com/news/update/2014-03-16/several-nato-websites-hit-by-ddoscyber-attacks/
View original post here:
NATO websites hit by cyber attacks
162,000 reasons to tighten up WordPress security
“Cyber-criminals continue to innovate and find vulnerabilities to exploit for their criminal activity” says Lancope CTO Tim Keanini. 162,000 reasons to tighten up WordPress security WordPress may be one of the most popular website systems used to publish on the Internet, but its open source nature – and consequent security challenges – have been highlighted this week after around 160,000 WordPress sites have apparently been used as DDoS zombies. Security research firm Securi reports that the WordPress pingback option – which allows WordPress sites to cross-reference blog posts – has been misused in recent times by unknown hackers to launch large-scale, distributed denial-of-service (DDoS) attacks. The attack vector used is not unknown as, back in the summer of last year, Incapsula reported that one of its clients was targeted in a pingback DDoS attack involving 1,000 page hits a second. Securi says it has been monitoring a swarm attack involving more than 162,000 WordPress sites and collectively generating many hundreds of IP requests to a single WordPress site. Whilst Daniel Cid, Securi’s CTO, has declined to identify the site, this suggests the attack may have been a proof-of-concept trial. On a technical level, the attack vector exploits an issue with the XML-RPC (XML Remote Procedure Call) code within WordPress and which is used for pingbacks, trackbacks and remote access from mobile Web browsers. SCMagazineUK.com notes that WordPress has known about the issue for several years, but the problem is that it a key structural issue with WordPress’s kernel architecture. Despite this, WordPress development teams have changed the default setting of sites to operate with a Web cache, meaning there is less load placed on the hosting server concerned. The hackers, however, have generated fake website addresses within their IP calls, so bypassing the web cache. Securi’s CTO says he been talking to WordPress developer teams about the issue, who are reportedly investigating a workaround. Tim Keanini, CTO of Lancope, said that the structural natures of the issue mean that it is not something that will ever go away. “Think of it as a supply chain and these criminals need compromised connected computers for their botnets – if you are connected for whatever reason to the Internet, you are a part of this supply chain,” he said, adding that cyber-criminals continue to innovate and find vulnerabilities to exploit for their criminal activity. To add to this, he explained, we – as Internet users – continue to put insecure devices on the Internet and with the Internet of Things ramping up, he warns there is just no end to the supply of targets. “What we need to do is to focus on the precision, timeliness, and leadership through these crisis – not the fact that they will just go away. They are here to stay and a part of doing business in the Internet age. When these events happen, what does leadership look like that provides business continuity and restores customer confidence? That is the question we need to be asking because hanging your head in shame does no one any good,” he said. Sean Power, security operations manager with DDoS security vendor DOSarrest, said that the vulnerabilities in old versions of WordPress mean that hackers can exploit them to be used for DDoS attacks. “This is nothing new – in fact, it was first recognised back in 2007. Attackers exploited a vulnerability in the core WordPress application and therefore it could be used for malicious purposes in DDoS attacks,” he said. “The fix for this feature was actually released in the 3.5.1 version of WordPress in January 2013 and would be picked up by most good vulnerability scanners,” he added. Power went on to say that this a prime example of how users aren’t regularly performing updates to their websites – “because if they were, we wouldn’t still be seeing DDoS attacks being carried out by websites taking advantage of this old flaw.” Source: http://www.scmagazineuk.com/162000-reasons-to-tighten-up-wordpress-security/article/337956/
See original article:
162,000 reasons to tighten up WordPress security
High-bandwidth NTP amplification DDoS attacks escalate
Prolexic issued a high alert threat advisory on NTP amplification DDoS attacks. This attack method has surged in popularity this year, fueled by the availability of new DDoS toolkits that make it simp…
See original article:
High-bandwidth NTP amplification DDoS attacks escalate
WordPress USED AS ZOMBIE in DDoS attacks
Tens of thousands of vulnerable WordPress sites have been co-opted into a server-based botnet being used to run DDoS attacks. More than 160,000 legitimate WordPress sites were abused to run a large HTTP-based (layer 7) distributed flood attack against a target, which called in cloud security firm Sucuri for help. Security experts discovered that the attack traffic was coming from WordPress sites with pingbacks enabled on blog posts, which is on by default. Pingbacks allow automatic backlinks to be created when other websites link to a page on a WordPress blog. The problem can be fixed by installing a simple plugin, as explained by Sucuri CTO and OSSEC Founder Daniel Cid in a blog post. “Any WordPress site with Pingback enabled (which is on by default) can be used in DDOS attacks against other sites,” Cid explains. “Note that XML-RPC is used for pingbacks, trackbacks, remote access via mobile devices and many other features you’re likely very fond of. But, it can also be heavily misused.” Sean Power, security operations manager for DOSarrest, a DDoS mitigation technology services firm, said the attack relied on exploiting vulnerabilities in old versions of WordPress. This type of issue has been known about since 2007 and the specific problem abused in the latest run of attacks was fixed more than a year ago in a WordPress core release in January 2013. “Attackers exploited a vulnerability in the core WordPress application and therefore it could be used for malicious purposes in DDoS attacks,” Power explained. “The fix for this feature was actually released in the 3.5.1 version of WordPress in January 2013 and would be picked up by most good vulnerability scanners. “This is a prime example of how users aren’t regularly performing updates to their websites, because if they were, we wouldn’t still be seeing DDoS attacks being carried out by websites taking advantage of this old flaw,” Power added. WordPress is an open source blogging platform and content management system (CMS) that’s used by millions of websites across the interwebs. Source: http://www.theregister.co.uk/2014/03/12/wordpress_vuln_creates_botnet_army/
View the original here:
WordPress USED AS ZOMBIE in DDoS attacks
MUM’s WordPress recipe blog USED AS ZOMBIE in DDoS attacks
Well, it’s statistically reasonably likely. Just update to 3.8.1, OK? Tens of thousands of vulnerable WordPress sites have been co-opted into a server-based botnet being used to run DDoS attacks.…
View post:
MUM’s WordPress recipe blog USED AS ZOMBIE in DDoS attacks