Rapid7 researchers have recently unearthed an unusual piece of malware that turned out to be crucial to the formation of an elusive botnet – dubbed Skynet by the researchers – whose existence has been…
Follow this link:
Researchers uncover Tor-powered Skynet botnet
22-year-old Christopher Weatherhead from Northampton, U.K., has been convicted on Thursday on one count of conspiracy to impair the operation of computers for his involvement in the DDoS campaign agai…
Follow this link:
U.K. hacker convicted for taking part in Anonymous attacks
A British student has been convicted over his role in a series of denial of service attacks against PayPal, which cost the payment firm £3.5m. Christopher Weatherhead was part of an Anonymous gang that attacked PayPal in protest at the firm’s decision not to handle payments being made to whistle-blowing website Wikileaks, in an attack dubbed ‘Operation Payback’. According to multiple reports, the jury hearing the case took little more than two hours to reach their guilty verdict. Three other members of the gang had already pleaded guilty but Weatherhead had argued he had not taken part in the attacks, claiming his role had been limited to operating Anonymous chat rooms. The judge presiding over the case, Peter Testar, told the defendants that he regarded the offences as serious. Weatherhead, who was a student at Northampton University at the time of the attacks, was found guilty under the Criminal Law Act 1977, and could face jail time as a result of the guilty verdict. The Metropolitan Police arrested five youths in 2011 in connection with Operation Payback, while other suspected members were arrested by the Dutch authorities. Operation Payback had initially begun as a protest against the music industry’s anti-piracy stance, but the focus changed after Wikileaks published a series of leaked diplomatic memos. Several financial services firms including PayPal, MasterCard and Visa withdrew services from Wikileaks, and as a result drew the ire of the Anonymous activists. Source: http://www.v3.co.uk/v3-uk/news/2230251/british-student-found-guilty-of-anonymous-paypal-ddos-attacks
Link:
British student found guilty of Anonymous PayPal Distributed Denial of Service (DDoS) Attacks
The hackers behind the Gameover variant of the popular Zeus banking Trojan have rented the massive Cutwail botnet in order to send out millions of fake emails carrying the malware, warns Dell SecureWo…
See more here:
Gameover gang uses Cutwail botnet to swell its own
The hacktivists are now letting their words speak for their actions. For the third time in one month, a source claiming to be part of the self-proclaimed hacktivist group known as Izz ad-Din al-Qassam Cyber Fighters has granted an interview to discuss the wave of high-profile distributed denial of service attacks on U.S. banks. During the recent interview with Flashpoint Global Partners , an international consulting firm, the hacktivist representative said more attacks would be waged and that methods of attacks would diverge, until a YouTube movie trailer deemed by the group to cast Islam in a negative light is removed from the Internet. “We have done what we had promised,” the source said. “If the film isn’t removed, we’ll use our other abilities according to the new conditions.” No New Attacks Since Sept. 18, the group has taken credit for attacks on 10 leading U.S. banks: Bank of America, JPMorgan Chase, Wells Fargo, PNC, U.S. Bank, CapitalOne, HSBC, SunTrust, Regions and BB&T. No new attacks have been claimed by the group since mid-October. In early November, Webster Bank and Zions Bancorp also suffered from DDoS attacks, which caused intermittent outages to their online-banking sites for several hours. While the attacks were not linked directly to Izz ad-Din al-Qassam, Zions spokesman Rob Brough said the bank did not know who was behind the attack. “There’s no way for us to know if the attack against us was just the next one [in the series of attacks waged by Izz ad-Din al-Qassam] or if it was just a coincidence,” Brough said. “What I can tell you is that we were well-prepared because of the other incidents. When we recognized that it was a DDoS attack, we had plans in place.” DDoS and Fraud? The attacks have been concerning for two reasons: customer frustration with online-banking inaccessibility and the possibility of fraud being perpetrated in the background. On Sept. 17, the Federal Bureau of Investigation, along with the Financial Services Information Sharing and Analysis Center, issued a warning about DDoS being waged to mask incidents of account takeover occurring simultaneously. In their alert, the FBI and FS-ISAC note recent attacks that linked DDoS to fraud. “In some of the incidents, before and after unauthorized transactions occurred, the bank or credit union suffered a distributed denial of service (DDoS) attack against their public Web site(s) and/or Internet Banking URL,” the alert states. “The DDoS attacks were likely used as a distraction for bank personnel to prevent them from immediately identifying a fraudulent transaction, which in most cases is necessary to stop the wire transfer” (see High Risk: What Alert Means to Banks ). So far, no bank has reported fraud linked to DDoS attacks waged by Izz ad-Din al-Qassam, but security experts question what might really be taking place in the background. Questioning Consultants’ Competency The latest interview with Izz ad-Din al-Qassam marks the third time a member claiming affiliation with the group has spoken out on the attacks. On Oct. 31, ABC News was granted an e-mail interview, and on Nov. 7 technology news site Softpedia was given e-mailed insights. During all interviews, alleged members of the Izz ad-Din al-Qassam group stressed the group was not supported by any nation-state, government or other hacktivist group, and that all of its members were merely tech-savvy volunteers with a common mission to see the YouTube video removed (see Hacktivist Speaks Out About DDoS ). In the most recent interview, the respondent defends Izz ad-Din al-Qassam’s purpose as well as the efficacy of its attacks. “Many of [the] technical comments during the attacks have made us doubtful about [the] technical competence of American companies’ security consultants,” the respondent said, when asked by Flashpoint if the botnets it used also have attacked web-hosting companies and Internet service providers. “Many of [the] technical statements about this case are not scientific, reliable or significant,” the source added. Break Suspicious, But Expected An Oct. 23 Pastebin post notes the group’s plans to temporarily halt attacks in honor of a three-day Muslim holiday. Pastebin is the public online forum Izz ad-Din al-Qassam has used to communicate updates about its attacks. The continued break from attacks is curious, says Mike Smith , a security evangelist and DDoS specialist at Web security provider Akamai Technologies. It’s just difficult to know who is behind which attacks, he says. Speculating is pointless, he says. What is clear, however, is that banking institutions and other organizations are continually targeted, and staying ahead of these attacks, regardless of who wages them, is a necessity. “We get two or more large attacks per week against our entire customer base and countless smaller ones,” Smith says. But connecting those to one hacktivist group over another is nearly impossible, he adds. “Some of those targets are financial services, some are not.” Information-sharing shortens response time, he adds. “It’s always tough to be the first target when a new attacker or technique appears because you have to work your way to a diagnosis and implement blocking: things that take time,” Smith says. “However, good incident managers and organizations doing threat intelligence share what they know with each other, so that during subsequent attacks, although of the same magnitude and lethality, the targeted organizations know what indicators there are to the start of the attack and what techniques worked the best in previous attacks.” For DDoS protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/hacktivist-hints-at-new-ddos-attacks-a-5325/op-1
More here:
Hacktivist Hints at New Distributed Denial of Service (DDoS) Attacks
As leaders in their field, IT managers are tasked with the burden of not only managing but protecting company networks. Dedicated servers can be adversely affected by DDoS attackers, as their firewalls can be penetrated and flooded with malicious communication requests. Before assessing how you can prevent DDoS attacks it is first important to understand what they are and where they come from. What Are DDoS Attacks? A DDoS attack attempts to render a network or machine inaccessible or unresponsive for any considerable length of time. DDoS attacks typically saturate a network with requests as to slow, disrupt or obstruct communication from the intended user. In some cases, a DDoS attack may overwhelm network firewalls, leaving the problem up to IP providers to fix. Typical symptoms may include the following: a high volume of spam emails, in-accessibility of websites or services or exceptionally slow network performance. Either way, a DDoS attack can adversely affect business by bringing down a website, company application or cloud based computing platform. Here are a few suggestions to go about mitigating the risk associated with DDoS attacks: Preventative Measures Against Attack Properly setup of network firewalls are a must. These days, modern firewalls can be configured to deny unusual protocols from un-identified IP addresses. For instance, if your network firewall is configured to block traffic from sources it can’t identify, it may drop any or all illegitimate service requests as to maintain a normalized bandwidth threshold. Though IP bottlenecks are not always a symptom of DDoS attacks, configuring a firewall to block traffic incoming from specific ports is a form of preventative maintenance. As stated earlier, DDoS attackers may flood a system as to render it unresponsive. Rate limiting switches detect incoming traffic and may filter or slow IPs in such a way that prevents them from flooding the system. Many switches have wide-area-networks fail overs, which adjust incoming IP filtering thresholds automatically. Again, it is important to configure these systems correctly in order for them to remain effective. If system upgrades are in order then IT managers need to weigh the cost against the risk posed by DDoS attacks. Costs To Consider Personnel Costs – If attacked, how many IT workers will it take to address and remedy the problem? Support Calls – Do you really want to be tied up on the phone calling tech support? Factor in the time spent at the help desk Lost Business – If a DDoS attack causes downtime to your website, how much revenue may be lost? Lost Customers – Investing in network protection means you are also investing in consumer confidence. How many customers may be lost due to downtime. Brand Reputation – When network outages occur, brands may suffer damage to their reputation. It is important to consider this last factor. Lastly, it is important to remember that DDoS attacks may also occur by accident. Some sites may experience a denial of service when they experience a high amount of traffic. In any case where a popular website links to a trending event, traffic may suddenly spike creating a unintentional denial of service. Focus your energies on preventing the malicious attacks and it’ll be smooth sailing for your business or enterprise. For DDoS protection against your eCommerce site click here . Source: http://www.colocationamerica.com/blog/protecting-your-network-against-ddos-attacks.htm
Original post:
Protecting Your Network Against Distributed Denial of Service ‘DDoS’ Attacks
Whether motivated by an extreme form of free expression or criminal intent, distributed denial-of-service attacks (DDoS attacks) are increasingly commonplace worldwide. Yet there remains a universal m…
Original post:
Most Americans uninformed about DDoS attacks
Distributed denial-of-service attacks get bigger and combine application-layer exploits requiring defenders to be more agile. n the past, attackers using distributed denial-of-service (DDoS) attacks to take down Web sites or network servers typically adopted one of two tactics: Flooding the site with a deluge of data or overwhelming an application server with seemingly valid requests. Companies concerned about denial-of-service attacks have generally focused more on mitigating data floods, also known as volumetric or infrastructure attacks. Yet, increasingly attackers are using a hybrid approach, using multiple vectors to attack. The attacks that hit financial firms in September and October, for example, often used a massive flood of data packets that would overwhelm a victim’s network connection, while a much smaller subset of traffic would target vulnerable applications functions, consuming server resources. “It is almost like sending a whole squadron of tanks and then have an assault team that can go in and be mores stealthy in taking out their targets,” says Carlos Morales, vice president of global sales engineering and operations for network protection firm Arbor Networks. “It broke the model that people had for stopping these things.” The one-two punch is potent. Many financial firms thought they had the defenses in place to defeat such attacks but had problems staying accessible during the onslaught. Companies prepared to handle application-layer attacks or smaller volumetric attacks could not handle the 20Gbps or more that saturated their Internet connection. Even a gateway that can keep up with 10Gbps connection speed cannot deal with twice as much–or more–traffic sent to the same server. A recent report from network-security firm Prolexic found that the average attack bandwidth had increased to nearly 5Gbps, with 20Gbps attacks quite common. In a year, the average volume of attacks had doubled, the firm found. “The late Senator Ted Stevens got mocked for saying that the Internet is a ‘series of tubes,’” says Matthew Prince, CEO of Cloudflare, a content-delivery and network-security firm. “But the Internet is a series of tubes, and you can only fit so much through it.” Companies must start creating a multi-layered approach to stopping distributed denial-of-service attacks, according to mitigation experts. The greatest amount of attack volume should be stopped inside a provider’s network, away from the company’s links to the Internet. Trying to over-provision your network for the worst case scenario will likely not work and will be very expensive to boot. “Even if you are a large bank in the U.S., you are doing less than 10Gbps of traffic across all the properties of your network combined,” says Cloudflare’s Prince. “If you have to over-provision that by 10x, that is wasting a lot of resources.” By using a service provider to filter out most of the spurious traffic at the edge of the Internet, companies can pay attention to the data that actually enters their network. Collecting information on the traffic can help a company to better develop defenses for future attacks as well, even if a company does not have the resources to identify attacks in real time. Yet, faster detection and more agile response can mean the difference between successful defenses and downtime. “Seeing an impact and understanding that there is an attack happening is not necessarily going to happen at the same time,” says Neal Quinn, chief operating officer for attack-mitigation service Prolexic. For many companies, the threat of attacks is not over, but rather, just beginning. The most recent attacks did not start with the financial industry; other industries have been hit by similar attacks for almost the last year. Companies should not expect it to end there either. The holiday season tends to be a popular time for attackers to attempt to extort money from retailers by threatening denial-of-service attacks. “It is traditionally a very busy time of year for these attacks,” Prolexic’s Quinn says. “If anything, organizations should make themselves more aware of how well they can handle these attacks.” Source: http://www.darkreading.com/security-services/167801101/security/perimeter-security/240142616/evolving-ddos-attacks-force-defenders-to-adapt.html
Read More:
Evolving Distributed Denial of Service ‘DDoS’ Attacks Force Defenders to Adapt
The distributed denial of service attack (DDoS) from hacktivist Anonymous has cost PayPal more than €4.3 million . The attack which was named Operation Payback were initially aimed at companies that opposed internet piracy, but switched to companies like Mastercard, Visa and PayPal after they refused to process payments to WikiLeaks . After that attack PayPal -the global leader in online money transfer and payments has paid around £3.5 million defend and arm itself against such kind distributed denial-of-service (DDoS) attacks. In a report BBC said that more than one hundred skilled employees from eBay, PayPal’s parent company, spent almost three weeks working on DDoS-attack-related issues and that PayPal had bought software and hardware to defend itself against further attacks. In all, the total cost of this work came to £3.5 million. This details have been revealed in a court case at Southwark Crown Court where a defendant, Christopher Weatherhead (studying at Northampton University when who allegedly took part in the campaign), is facing charges of conspiring to impair the operation of computers. He has pleaded not guilty to conspiring to impair the operation of computers between 1 August 2010 and 22 January 2011. Sandip Patel , prosecuting, said the group caused PayPal “enormous economic harm” . Mr Patel said they used distributed denial of service, or DDoS, which flooded the targets computers with enormous amounts of online requests. Target websites would crash and users would be directed to a page displaying the message: “You’ve tried to bite the Anonymous hand. You angered the hive and now you are being stung.” Mr Patel said: “This case, simply put, is about hackers who used the internet to attack and disable computer systems – colloquially described as cyber-attackers or vandals.” He said Mr Weatherhead, who used the online name Nerdo, posted plans on an Internet Relay Chat (IRC) channel encouraging an attack on PayPal. He said PayPal was the victim of a series of attacks “which caused considerable damage to its reputation and loss of trade”. Source: http://www.voiceofgreyhat.com/2012/11/DDoS-Attack-From-Anonymous-Cost-PayPal-3.5-Million.html?utm_source=dlvr.it&utm_medium=identica
Continue Reading:
Distributed Denial of Service ‘DDoS’ Attacks From Anonymous Cost PayPal £3.5 Million of Damage
What will you do if your organization is the next target of a distributed denial of service attack? Hacktivists recently launched DDoS attacks that caused online outages at several major U.S. banks. Each institution was warned in advance; none were able to prevent disruptions. And while banks are the current targets, any organization could be next. Join this panel for expert insight on: Why these recent DDoS attacks elude traditional defenses; New security solutions to help detect and respond to DDoS attacks; How to respond if you are attacked – from ramping up fraud prevention in other channels to what to tell customers about the attacks. Background Beginning in mid-September, hacktivists initiated a series of sophisticated DDoS attacks against major U.S. banks, including Bank of America, Chase and Wells Fargo. The attackers claim to be waging a cyber war against top-tier banking institutions because of outrage over a YouTube movie trailer believed by the hacktivists to be anti-Islam. In each instance, the group has given at least 24 hours notice before launching the DDoS attacks. But no institution so far has successfully avoided online outages resulting from the attacks. These incidents send two clear messages to security leaders: The sophistication and strength of the DDoS attacks are greater than organizations have seen before. One industry expert measured the DDoS traffic flow at one institution to be 65 gigabytes per second – roughly 65 times heavier than previous DDoS attacks. Any organization is susceptible. Banks are today’s DDoS target, but tomorrow it could be a government agency, merchant or healthcare entity that offends a hacktivist group with the resources to launch an attack. If banks, with their mature security programs and state-of-the-art defenses, cannot ward off these attacks, then what other organization can? In this panel webinar, industry leaders with expertise in DDoS defense will present the unique qualities of these latest attacks, why no organization should feel immune, then discuss successful solutions that can empower organizations to detect, prevent and respond to attacks. Leading the discussion is Matthew Speare, SVP of IT at M&T Bancorp. He will set the stage by discussing how his institution responded to the attacks against other banks, including preparation, security controls and customer communication strategies. Speare then will be joined by thought-leaders from Akamai, Fortinet and Neustar, who will discuss a range of DDoS-related topics, including: Sophistication of Attacks – In the past, DDoS meant brute-force network attacks. Now, experts say, they are not only stronger, but also morphing into application layer attack, which makes them harder to detect and block. What have we learned from these attacks, and which new solutions are best for identifying and rerouting the DDoS traffic? A Cover for Fraud? – Sometimes DDoS attacks are meant as a distraction – to keep security personnel focused online while the fraudsters turn to other channels, such as the call center, to commit fraud. What are the account anomalies you need to be equipped to detect? Incident Response – Not only does your organization need to be prepared to respond internally to DDoS attacks, but you also need to know how to communicate externally to customers. What’s your message, and how can you take this opportunity to better explain your security posture? Source: http://www.bankinfosecurity.com/webinars/new-wave-ddos-attacks-how-to-prepare-respond-w-308
Read the article:
The New Wave of Distributed Denial of Service ‘DDoS’ attacks: How to Prepare and Respond