Tag Archives: Denial-of-service attack

Real Mafia War Online; Could Crash the Global Internet

Last week econoTwist’s reported on what most likely was tha largest cyber attack on US banks, ever. Now, it turns out, that it was only the beginning of something much larger – and even more scarier – the largest computer attack in the history of the Internet. The biggest DDoS attack ever recorded is said to be  jamming crucial infrastructure all over the world and causing widespread congestion. But this has nothing to do with the Anonymous or other online activists – this is in fact the first full-blown real mafia war online we’ve ever seen. I’m afraid it won’t be the last.

“These guys are just mad.”

Patrick Gilmore

mafia-wars-wallpaper

According to BBC, five national cyber-police-forces are investigating the attacks. The attackers have used a well-known  tactic called “Distributed Denial of Service (DDoS),” which floods the intended target with large amounts of traffic in an attempt to render it unreachable. But they have also found a way to amplify the effect, creating a data-tsunami of 300 gigabyte per second – three times larger than any DDoS attack we’ve seen before.

The intended main target appears to be Spamhaus, a European organization that maintains a blacklist of ISPs that supposedly host “spam gangs” and who refuse to stop serving them as customers.

Spammers are – plain and simple – the marketeers of organized crime, making it possible for counterfeit products, medicine and illegal (child) pornography to reach potential customers worldwide. They are the “street pushers” of internet dope.

And the competition seems to have reached  a whole new level.

wp7As you can imagine, Spamhaus has no shortage of enemies, given its line of business. But most rumors point to the Dutch spammer CyberBunker who that prides in hosting anything –  except terrorist material and child pornography. Cyberbunker brags on its Web site that it has been a frequent target of law enforcement because of its “many controversial customers.” The company also claims that at one point it fended off a Dutch SWAT team“Dutch authorities and the police have made several attempts to enter the bunker by force,” the site says. “None of these attempts were successful.”

However, up until now these cyber cowboys have fought their internal battles mostly by blocking each others traffic. But this time the Dutch were really, really angry.

Sven Olaf Kamphuis, an Internet activist who claims he is a spokesman for the attackers, says in an online message to The New York Times that  Cyberbunker was retaliating against Spamhaus for “abusing their influence.” 

according to the NYT, they got help from Eastern European and Russian gangs.

“Nobody ever deputized Spamhaus to determine what goes and does not go on the Internet. They worked themselves into that position by pretending to fight spam,” Mr. Kamphuis says.

Spamhaus is pretty resilient, as its own network is distributed across many countries, but the attack was still enough to knock its site offline on March 18. A spokesman for Spamhaus says the attacks began on March 19, but have so far not stopped the group from distributing its blacklist.

Patrick Gilmore, chief architect at Akamai Technologies, confirms Spamhaus’s role as generator of Internet spammer lists.

Commenting on Cyberbunker, he says: “These guys are just mad. To be frank, they got caught. They think they should be allowed to spam.”

Mr. Gilmore also explains that the attacks consists of concentrate data streams that are larger than the Internet connections of entire countries.

He compares the technique to using a machine gun to spray an entire crowd when the intent is to kill one single person.

If you want to read what the involved parties have to say for themselves – here are some links:

Amplified Attack

What makes this case specially interesting (and disturbing) is that the cyber criminals seems to have found a way to amplify the attacks.

Professor Alan Woodward of the University of Surrey, one of the UK’s premier computer security experts, says that the attack “seems to be orders of magnitude larger than anything seen before,” and highlights the technique that’s been used.

“The thing that got people talking is that it’s a DNS amplification attack. The point is, if you’re targeting something and  the target has a 10 Gbps switch, you only have to throw 11 Gbps at it and you’ve pole-axed the system. If it is at 300 Gbps, then potentially some of the main infrastructure is being affected, though I’m not sure how much it’s really affecting it.”

The company that Spamhouse called for help, (Cloudflare), provides an even more detailed explanation:

“The largest source of attack traffic against Spamhaus came from DNS reflection… This method has become the source of the largest Layer 3 DDoS attacks we see (sometimes well exceeding 100Gbps). Open DNS resolvers are quickly becoming the scourge of the Internet and the size of these attacks will only continue to rise until all providers make a concerted effort to close them…”

“The basic technique of a DNS reflection attack is to send a request for a large DNS zone file with the source IP address spoofed to be the intended victim to a large number of open DNS resolvers. The resolvers then respond to the request, sending the large DNS zone answer to the intended victim. The attackers’ requests themselves are only a fraction of the size of the responses, meaning the attacker can effectively amplify their attack to many times the size of the bandwidth resources they themselves control.”

Exactly, How Dangerous?

Steve Linford, chief executive for Spamhaus, says that this kind of attack power would be strong enough to take down government internet infrastructure.

“If you aimed this at Downing Street they would be down instantly, They would be completely off the internet.”

“They are targeting every part of the internet infrastructure that they feel can be brought down,” Mr Linford says.

“There’s certainly possibility for some collateral damage to other services along the way, depending on what that infrastructure looks like,” says Dan Holden,  director of security research at Arbor Networks.

“If it was done really seriously in a wider attack, then it could affect many users. Trying to take down the whole internet is impractical, but you could start to decapitate sections of it,” Professor Alan Woodward says, according to gigaom.com.

medium_complicated_censoredSo, just to summarize:

  • We now have local police trawling Facebook in search of gang activity.
  • The FBI is busy chasing trolls who mocks them by hacking their computers.
  • Governments are making laws to forbid people from speaking their mind on their personal blogs.
  • Meanwhile, the really dangerous cyber criminals are experimenting with new cyber weapons with unimaginable destruction power. 

4 Comments

Filed under Laws and Regulations, Technology

Want To Hack The CIA? Click Here!

After Ddos attack on CIA (Central Intelligence Agency) website by the group of hackers called “Lulzsec,” some Indian hacker who calls himself  “lionaneesh” claims he have found an XSS vulnerability on same site.

The party seems to have just started, and you can join in by clicking on the picture below:

Or you can follow “lionaneesh” on Twitter HERE.

Who knows what will be the next target….

MORE: thehackersnews.com

2 Comments

Filed under Philosophy, Technology

Top 10 Cyber Threats of 2011 – Updated

PandaLabs, the antimalware laboratory of Panda Security, the cloud security company, has forecasted several radical innovations in cyber-crime for 2011. Hacktivism and cyber-war; more profit-oriented malware; social media; social engineering and malicious codes with the ability to adapt to avoid detection will be the main threats.

“There will also be an increase in the threats to Mac users, new efforts to attack 64-bit systems and zero-day exploits.”

PandaLabs

Here is a summary of what PandaLabs now predicts as the ten major security trends of 2011:

1. Malware creation:
In 2010, PandaLabs witnessed significant growth in the amount of malware and discovered at least 20 million new strains, more than in 2009. At present, Panda’s Collective Intelligence database stores a total of more than 60 million classified threats. The actual rate of growth year-on-year however, appears to have peaked. Several years ago it was over 100 percent and in 2010 it was 50 percent.

2. Cyber war:
Stuxnet and the WikiLeaks cables suggesting the involvement of the Chinese government in the cyber-attacks on Google and other targets have marked a turning point in the history of these conflicts. Stuxnet was an attempt to interfere with processes in nuclear plants, specifically, with uranium centrifuge. Attacks such as these, albeit more or less sophisticated, are still ongoing, and will undoubtedly increase in 2011, even though many of them will go unnoticed by the general public.

3. Cyber-protests:
Cyber-protests , or hacktivism, are all the rage and will continue to grow in frequency. This new movement was initiated by the Anonymous group and Operation Payback, targeting organizations trying to close the net on Internet piracy, and later in support of Julian Assange, editor-in-chief of WikiLeaks. Even users with limited technical know-how can join in the distributed denial of service attacks (DDoS) or spam campaigns. Despite hasty attempts in many countries to pass legislation to counter this type of activity effectively by criminalizing it, PandaLabs believes that in 2011 there will be more cyber-protests, organized by this group or others that will begin to emerge.

4. Social engineering:
Cyber-criminals have found social media sites to be their perfect working environment, as users are even more trusting with these than with other types of tools, such as email. Throughout 2010, PandaLabs witnessed various attacks that used the two most popular social networks – Facebook and Twitter – as launching pads. In 2011, not only will hackers continue to use these networks, but it is predicted that they will also be used more for distributed attacks.

BlackHat SEO attacks (indexing and positioning of fake websites in search engines) will also be widely employed throughout 2011, as always, taking advantage of hot topics to reach as many users as possible. In addition, a significant amount of malware will be disguised as plug-ins, media players and other similar applications.

5.Windows 7 influencing malware development:

It will take at least two years before there is a proliferation of threats designed specifically for Windows 7. In 2010, PandaLabs began seeing a shift in this direction, and predicts that in 2011, new cases of malware targeting users of this new operating system will continue to emerge.

6.Mobile phones:

In 2011 there will be new attacks on mobile phones, but it will not be on a massive scale. Most of the existing threats target devices with Symbian, an operating system which is now on the wane. Of the emerging systems, PandaLabs predicts that the threats for Android will increase considerably throughout the year, becoming the number one mobile target for cyber-crooks.
7. Tablets:

The dominance of the iPad will start to be challenged by new competitors entering the market. Therefore PandaLabs does not believe that tablet PCs will become a major consideration for the cyber-criminals in 2011.

8. Mac:

Malware for Mac exists, and will continue to exist. And as the market share of Mac users continues to grow, the number of threats will grow. The greatest concern is the number of security holes in the Apple operating system. Developers will need to patch these holes as soon as possible, as hackers are well aware of the possibilities that these vulnerabilities offer for propagating malware.

9. HTML5:

HTML5 is the perfect target for many types of criminals and could eventually replace Flash. It can be run by browsers without any plug-ins, making it even more attractive to find a security hole that can be exploited to attack users regardless of which browser they use. PandaLabs expects to see the first attacks on HTML5 in the coming months.

10. Highly dynamic and encrypted threats:
PandaLabs expects dynamic and encrypted threats to increase in 2011. PandaLabs is receiving more and more encrypted, stealth threats designed to connect to a server and update themselves before security companies can detect them. There are also more threats that target specific users, particularly companies, as information stolen from businesses will fetch a higher price on the black market.

Related by the Econotwist’s:

5 Comments

Filed under International Econnomic Politics, Laws and Regulations, Technology