DDoS Attacks – Understanding the Dangers

If you’re a small business owner, or if you own Web space for any reason, one of the new threats that have no doubt begun to appear on your horizon is the potential of being attacked online. Fortunately for the hackers, not a lot of people understand what online attacks really are, how they pull them off, or how to effectively protect from it. Most computer repair experts agree it is hard to guarantee 100 percent security, but you can take the necessary precautions to minimize damages if your security is ever compromised. Taking precautions starts by understanding the dangers: One of the most common types of attack that takes place these days is a DDOS, or Distributed Denial of Service attack. This type of attack is particularly effective because it doesn’t require an intimate knowledge of your security to be deployed. It just takes brute force. Prior to the scheduled attack, the hacker will create a swarm of “zombie” computers — computers infected by the hacker’s software. This software allows the hacker to use the processing power of thousands of computers belonging to other people to bring down your server. When the attack commences, the hacker tells the zombie computers to simultaneously and continually load information from your Web server. If the attack is powerful enough, your server will stop serving. It will become unreachable so even legitimate visitors can’t access the site. While this intense strain is taking over your server, the hacker can try to slip into the back door unnoticed. This is where a lot of the actual financial loss associated with DDOS attacks come from. Scared yet? Don’t be…too scared. Most DDOS attacks happen to high-profile sites that make a lot of money online and that have a lot to lose from even a temporary outage. But there’s still a chance it could happen to you for reasons beyond your control. So how do you protect against such a large-scale attack? The easiest way is to talk to your in-house IT Department and have them work through the nine steps that help defend against a DDOS attack. No IT onsite?  Then call your trusted IT or computer repair professionals and tell them you want to prepare for a DDOS attack. They can best help you and recommend plans to upgrade your servers or to install special software that can determine  legitimate traffic from DDOS attacks. They might also want to talk with you about the current security software you’re using. An off-the-shelf program probably won’t defend very well against this new type of attack, so talk with your IT professional about the options available to you. As always, the best defense is vigilance. As you’re managing your website, be sure to note any suspicious traffic, educate your staff on safe practices and call your computer repair professionals as soon as you note suspicious activity. Most likely it won’t be anything, but it never hurts to ask. For protection against your eCommerce site click here . Source: http://www.sitepronews.com/2013/05/22/ddos-attacks-understanding-the-dangers/

Read more here:
DDoS Attacks – Understanding the Dangers

Legitimate online services enable DDoS-attacks-for-hire sites

A recent expose shines a light onto the strange world of “booter” or “stressor” web sites which offer DDoS-attacks-for-hire Is an online payment giant Paypal unwittingly enabling DDoS attacks? That’s the question posed by security researchers who have studied a small, weird corner of the market for distributed denial of service (DDoS) services: so-called “booter” or “stressor” web sites. Speaking at The Security B-Sides Boston security conference on Saturday, independent researchers Allison Nixon and Brandon Levene said that their investigation of booter sites found that many rely on legitimate online services, including Paypal to accept payment on behalf of customers interested in attacking web sites they do not own, and Cloudflare, a DDoS prevention service. The presentation was just the latest to peek into the strange world of “booter” or “stressor” web sites, which offer DDoS attacks for hire, often targeted at online gaming services popular with teenagers. In the past week, the web site krebsonsecurity.com published exposes on two such sites: assylumstressor.net and Ragebooter.net, both booter services for hire. In the process, Krebs revealed the identities of the purported owners of the sites and details of conversations he had with them about their services. In their presentation Saturday, Levene and Nixon, who assisted Krebs in his research, said that the booter sites were common online, but wholly different from the massive, 300Gbps attacks directed at Spamhaus, or the site-crippling DDoS attacks on leading banks and financial services firms like Citi, Chase, Wells Fargo and others in recent months. Rather, the services use mostly simple, reflected DNS and UDP flood attacks to knock small sites and residential home routers offline, the two researchers said. Many of the features of sites like Ragebooter.net are poorly designed or don’t work at all, said Nixon. Most victims are very often small websites hosting online gaming servers. In fact, the most reliable customers of booter sites are often other booter sites, said Nixon. The sites are not hugely profitable, but do generate some income. An analysis of data on the site Asylumstressor.com by Nixon and Levene suggest that site operators made, at most, $23,000 in 2012 – though probably much less. The sites operate more or less in the open. Speaking with Brian Krebs last week, a Tennessee man named Justin Poland, the operator of ragebooter.net, argued that the services were legal. “Since it is a public service on a public connection to other public servers this is not illegal,” Poland told Krebs in a Facebook chat. Poland even claimed to be working on behalf of the local FBI, turning over information gleaned from his service to law enforcement as needed. The Memphis FBI would not confirm or deny that Poland’s claims were true. Legal or not, most booter sites operate more or less in the open and with impunity, Nixon told an audience at B-Sides Boston, which was held at Microsoft’s New England Research and Development Center (NERD) in Cambridge. Site operators – many teenagers and 20-somethings with little technical sophistication – make little effort to conceal their identities. Paypal payments are often sent to e-mail accounts that are also associated with public Facebook profiles, making it easy to link booter sites to real world identities like Poland’s, she said. Law enforcement seems unconcerned with small scale attack sites like Ragebooter.net, or those who operate them, meaning that booter site operators continue to operate despite ample evidence about who they are and the illegal nature of their business, Nixon said. Similarly, services like PayPal and Cloudflare enable small-scale DDoS operations to continue, by turning a blind eye to the true nature of their businesses. Nixon said as many as 70 percent of booter sites use Cloudflare, a DDoS protection site. The service mainly protects booter sites from other booter sites, she said. Paypal isn’t the only online payment service, but it is easy and convenient to use and widely respected. Inexperienced booters who had to go through the trouble of setting up an account at a site like LibertyReserve might think twice, Nixon argued. In an e-mail statement to ITworld and other news outlets, Paypal said that it couldn’t discuss the specifics of customer accounts but that it “will review suspicious accounts for malicious activity and work with law enforcement to ensure cyber criminals are reported properly.” “We take security very seriously at PayPal,” the statement continued. “We do not condone the use of our site in the sale or dissemination of tools, which have the sole purpose to attack customers and illegally take down web sites.” Cloudflare CEO Matthew Prince said that his company protects millions of web sites – most of them legitimate private and public sector entities. However, his company doesn’t discriminate, and Prince admits that some sites protected by Cloudflare are troubling, including the booter and stressor sites. Cloudflare works closely with law enforcement and always responds promptly to requests for information from the courts or law enforcement offiicals. However, in the absence of any action by law enforcement, Prince said that it isn’t for him or his company to decide who to work with. “I do find it troubling when there are extralegal measures taken to determine what is and is not going on,” he said, in an apparent reference to the investigation by Krebs, Nixon and Levene. “How far do you go with that, if someone assumes XYZ shouldn’t be on the Internet? Should Google remove them from their search index?” he asked. “We believe in due process,” said Prince. Source: http://www.itworld.com/it-management/357306/legitimate-online-services-enabling-ddos-attacks-hire-sites

Read this article:
Legitimate online services enable DDoS-attacks-for-hire sites

Barracuda updates web application firewall

Barracuda Networks announced Barracuda Web Application Firewall 7.8, specifically aimed at reducing the impact of automated attack attempts from botnets. Automated botnet attacks recently have gain…

See more here:
Barracuda updates web application firewall

Saudi Web Sites Under DDoS Attack

The Saudi Interior Ministry said Friday that several government Web sites have come under attack in a campaign hackers are calling #OpSaudi. Hackers who identify with the loose hacking collective Anonymous have aimed at several government Web sites, including the Saudi Ministry of Finance, General Intelligence Presidency, the Ministry of Foreign Affairs, and the Directorate General of Passports, as well as sites for several major Saudi provinces, including Makkah and Jeddah. Most of the sites are facing distributed denial of service, or DDoS, attacks, in which hackers flood each site with traffic until they collapse under the load. But hackers claimed to have also broken into some sites through a so-called SQL injection, in which attackers exploit a software vulnerability and enter commands that cause a database to produce its contents. In one case, the Twitter account for @AnonySaudi claimed to delete the database of a Saudi Web server. Hackers say their motive is twofold. On Twitter, some claim the #OpSaudi campaign is in retaliation for unconfirmed reports of a rape and murder in Saudi Arabia. Some Tweets include links to YouTube videos which show images of a naked body dumped on the side of a road. The attacks also followed an announcement by Matthew Rosenfield, the well-known security researcher who goes by the hacker handle Moxie Marlinspike, that Mobily, a major Saudi telecommunications company, approached him about assisting in a continuing Saudi surveillance project. In a widely circulated blog post Monday, Mr. Marlinspike said he learned that on behalf of a Saudi “regulator,” Mobily is working to intercept mobile app data for communication tools including Twitter and free mobile messaging apps like Viber, Line and WhatsApp that send messages over the Web. He published his e-mail correspondence with an executive at Mobily, which showed the company is developing the ability to monitor mobile data communication and already has the ability to block it. Mr. Marlinspike told Yasser D. Alruhaily, a Mobily security executive, that he declined the job for privacy reasons. Mr. Alruhaily replied, “I know that already and I have same thoughts like you freedom and respecting privacy, actually Saudi has a big terrorist problem and they are misusing these services for spreading terrorism and contacting and spreading their cause that’s why I took this and I seek your help,” he wrote. “If you are not interested than maybe you are on indirectly helping those who curb the freedom with their brutal activities.” Mobily spokesman denied contacting Mr. Marlinspike. ”Mobily or its employees never communicated with the author of this blog,” the company told Reuters. “Mobily communicates with information security companies only based on legal and lawful requirements. We never communicate with hackers. Moreover, it is not our job to spy on customers.” On Friday, the Mobily Web site was among the growing number of Saudi Web sites that #OpSaudi had taken offline. Source: http://bits.blogs.nytimes.com/2013/05/17/saudi-web-sites-under-attack-following-surveillance-accusations/

More:
Saudi Web Sites Under DDoS Attack

LulzSec Hackers Get Years Of Prison Time

Four men who took part in a significant number of cyber attacks on the likes of the NHS, Sony and the CIA received stern sentences today, following a lengthy trial into the activities of hacktivist crew LulzSec. News International and the UK Serious Organised Crime Agency (SOCA) were also hit by the hackers, who thought they were “latter-day pirates”, according to prosecutors speaking yesterday. Tough sentences for LulzSec Ryan Cleary, who was affiliated with LulzSec but not believed to be a leader, received the toughest sentence, with 32 months in prison. He let LulzSec members use his botnet to carry out distributed denial of service (DDoS) attacks. Cleary is also due to be sentenced over indecent images of children found on his computer at a later date. Ryan Ackroyd received a 30-month sentence for his part in researching and executing many attacks. Jake Davis, the spokesperson of LulzSec, is to serve 24 months in young offenders’ institution, whilst Mustafa Al-Bassamwas, who researched vulnerabilities for the attacks, was handed a 20-month suspended sentence of two years and 300 hours unpaid work. It is believed US law enforcement are keen to have some of the men extradited to face charges on US soil. However, Cleary’s legal team issued the following statement: “We believe the pleas that were entered today do cover all aspects of Mr Cleary’s criminality and therefore we do not anticipate that he will be in receipt of an application for extradition from the United States of America.” The notice, from Karen Todner Solicitors, also noted Cleary suffered from Aspergers Syndrome, but added he “does not seek to excuse his behaviour”. No laughing matter Charlie McMurdie, head of the Police Central e-Crime Unit, which carried out the investigation into the hackers alongside the FBI, said LulzSec had been “running riot, causing significant harm to businesses and people”. “Theirs was an unusual campaign in that it was more about promoting their own criminal behaviour than any form of personal financial profit,” added McMurdie, who is soon to retire from the force. “In essence, they were the worst sort of vandal – acting without care of cost or harm to those they affected, whether that was to cause a company to fold and so costing people their jobs, or to put at threat the thousands of innocent Internet users whose logins and passwords they made public. “They claimed to be doing it for ‘a laugh’ but real people were affected by their actions. Today’s convictions should serve as a deterrent to others who use the Internet to commit cyber attacks.” This might not be the denouement to the LulzSec saga, however, as hackers are threatening to take revenge. According to Sophos’ Graham Cluley, before the sentences were announced today, a group using the Twitter handle @LulzSecWiki said courts “could be in for ‘fun’” depending on their decision. Source: http://www.techweekeurope.co.uk/news/lulzsec-hackers-jailed-uk-116507

Taken from:
LulzSec Hackers Get Years Of Prison Time

Fraudster who hired hackers to manipulate stock prices goes to prison

The central organizer of a worldwide conspiracy to manipulate stock prices through a “botnet” network of virus-controlled computers was sentenced today to 71 months in prison and was ordered to pay a …

See the article here:
Fraudster who hired hackers to manipulate stock prices goes to prison

Paypal turns blind eye to payments totaling $35,000 for on-demand DDoS

It seems as though just about anyone with Internet access can set up a profitable online enterprise these days — including a criminal one. And for one Illinois teen, YouTube and PayPal have been all too happy to help him make a fast (albeit illegal) buck. Brian Krebs has been sleuthing once again, and his target this time was a “stress testing” service called Asylum Stresser . Stress testing, of course, is the thin veil that skiddies (script kiddies) like to drape over a for-hire DDoS attack setup. According to Krebs and his cohorts, Asylum looks like it’s been built using fairly run-of-the-mill cybercrime kitware that’s promoted in underground forum sites. Its servers are based in Romania, and appear to be nestled safely in a data center that is nothing if not criminal-friendly. Nothing shocking so far, right? Anyone who has a few extra bucks (or BitCoins) to white label someone else’s criminal back-end can do this stuff. But here’s the twist: the kid Krebs believes is running Asylum Stesser is accepting PayPal payments and advertising on YouTube. Recently, Asylum’s user database was leaked to the web and it revealed that more than $35,000 had been sent to one chandlerdowns1995(at)gmail.com. Downs also appears to have hired an eager infomercial actor over on Fiverr. While the promo spot is good for a chuckle, it’s hard to believe that YouTube will jump all over a 30 second fan-made video for copyright infringement, but has somehow allowed an ad for an illegal DDoS service to be viewed more than 42,000 times. Downs maintains that it’s not his fault if people use the service to launch illegal attacks. Asylum Stresser was launched so that law-abiding folk can make sure their websites are resilient. Maybe that’s why PayPal and YouTube have been fine with ignoring what’s gone on to this point. Former U.S. Justice Department attorney Mark Rasch, however, feels differently. He told Krebs that if Downs triggers an attack after being paid to do so, he is “criminally and civilly liable.” Downs didn’t exactly made it difficult for Krebs to connect the dots here. Let’s see if PayPal and YouTube get their heads out of the sand now and do something before an Illinois court orders them to. For protection against your eCommerce site click here . Source: http://www.geek.com/news/paypal-turns-blind-eye-to-payments-totaling-35000-for-on-demand-ddos-1554902/

See the original post:
Paypal turns blind eye to payments totaling $35,000 for on-demand DDoS

9 PH gov’t sites inaccessible due to DDoS Attack

Two days before the May 13 elections, the Commission on Elections (Comelec) and the Philippine News Agency websites appeared inaccessible to the public. Cursory inspections of the websites of the Philippines’ Departments of Interior and Local Government, National Defense, Foreign Affairs, and Science and Technology, showed they were also apparently inaccessible. The pages for the Philippine National Police, the Army and Navy, and the Philippine Information Agency also could not be accessed. As of 4:10 pm., the Department of Science and Technology (DOST) acknowledged and confirmed distributed denial of service (DDoS) attacks occurring against government sites, but they did not mention where the attacks came from. In a text message to Rappler, Roy Espiritu of the DOST ICT Office said the attacks started on May 10 on gov.ph, then to additional gov.ph-based websites on May 11. He added that the DOST was working on neutralizing the attacks and determining the source. They are also assisting government agencies outside their secured servers who have asked for help. Interaksyon.com earlier reported on the possibility of the downtime being caused by a cyberattack, but noted that the Facebook page of Anonymous Philippines, a hacker-activist group, stated they would undertake no operations during this time. GMA wrote that its technical team “detected an overnight cyberattack that was still ongoing as of posting time on numerous Philippine websites, including GMA News Online, ABS-CBN News, Philippine Airlines, Globe, Smart, and more than two dozen Philippine government websites.” Based on referrer tags and forum activity, GMA also added the attacks seem to have come from Taiwan, linking to a Taiwanese webpage that seems to have reacted positively to the Philippine site downtime. The possibility of a cyberattack related to Philippine-Taiwanese tensions resulting from the shooting of a Taiwanese fisherman was also raised. While no announcement has been made by the Philippine government, Comelec spokesperson James Jimenez mentioned previously to Rappler that the Comelec website may have downtime due to the number of people visiting it, as well as the location of the Comelec website servers. It also repeated this in a recent tweet. As of 2:30 pm., Rappler could access the site, which appears to have had a redesign in time for the elections. With regard to election issues, those seeking information from the Comelec about finding one’s voting precinct but cannot access their homepage can contact the Comelec through the following hotlines: 525335; 5259297; 5259301; 5259302; 5259345; 5271892; 5516552; 5521451; 5523044. – Rappler.com For protection against your eCommerce site click here . Source: http://www.rappler.com/nation/28804-philippine-government-sites-inaccessible

View original post here:
9 PH gov’t sites inaccessible due to DDoS Attack

Nationwide DDoS Attack Hits ReputationChanger.com

ReputationChanger.com was the most recent target in a string of high-profile cyber-attacks against U.S. web companies and governmental organizations. Reputation.com, LivingSocial and Name.com have all announced recently that they have been the targets of successful attacks by hackers. Tens of millions of consumers have been asked to change passwords in the wake of these attacks with large numbers of the population informed that personal data may have been accessed. A hack of the Associated Press account in Twitter resulted in a temporary loss on U.S. stock markets of $200 billion in late April. The U.S. Defense Department accused Chinese government-backed hackers this week of a sustained cyber campaign which successfully targeted governmental and defense contractor websites. The Chinese later denied these allegations. ReputationChanger.com was indeed targeted by an attack from a Chinese IP address that lasted most of the day. While the company’s public website was taken down for roughly half an hour in a distributed denial of service attack (DDoS), an investigation confirms that the company’s critical information — including client data — remained untouched. “The attack brought down our main website briefly but I think overall it revealed the strength and security of our operation in a way that we are truly proud of,” comments the company’s president, Michael Zammuto. “Because of the system set up, no client data was in danger of being accessed or compromised — and indeed, no client data was accessed or compromised. No action is required of any client although periodic password changes are always recommended.” Even a cyber-attack targeting the company’s Command Center, the firm’s online reputation management platform, could not have led to illicit data access. “The confidentiality of what we do is critical, and we are endlessly devoted to maintaining the complete privacy of our clients,” Zammuto offers. “As such, we have a highly distributed cloud system, response teams and processes in place to prepare for cyber threats.” Though the identity of the cyber assailant is yet unknown, Zammuto says the impetus for the attack is likely the high-profile client list that ReputationChanger.com maintains. “We were surely targeted because of the very important clients that we work with,” he affirms. ReputationChanger.com’s clientele encompasses governments, political figures, educational institutions, celebrities, and major, internationally-recognized businesses and brands. Despite the brief downtime experienced on the ReputationChanger.com website, Zammuto says that he is ultimately thrilled with how well the enterprise held up in the face of a malicious online assault. “I am very pleased with the performance of our network security team and partners,” he remarks. “It is a great reminder of how valuable investments are in these areas. They kept us safe from a vicious online enemy. It is because of their hard work and their expertise that ReputationChanger.com’s clients can rest assured that their confidential data is in the best possible hands.” ReputationChanger.com is the top rated online reputation management firm according to Top SEOs and was announced as a finalist for the Red Herring 100 earlier this week Both organizations citing the firm’s technology and its commitment to serving its clients. For protection against your eCommerce site click here . Source: http://online.wsj.com/article/PR-CO-20130509-912785.html?mod=googlenews_wsj

Visit link:
Nationwide DDoS Attack Hits ReputationChanger.com