Lizard Squad Goes After Google

The hackers at Lizard Squad have been busy again. Early in March, they used DNS poisoning to redirect traffic from Google’s Vietnamese page to a page advertising their own DDoS tool, the Lizard Stresser.

Despite the outrage of many users who weren’t able to access Google during the attack, it appears that no real harm was done. No servers crashed, and no personal information was stolen. Nonetheless, this case highlights the vulnerabilities inherent in the DNS system, and the next attack might not be so harmless.

How Hackers Exploit DNS Servers

DNS servers have often been referred to as the phone book of the internet, but they’re really more of a translator. They turn the human-friendly words (called “queries”) we type into our browsers into IP addresses, those strings of numbers that computers use to find web sites. This system is what keeps the internet running smoothly. But, if a hacker can answer a DNS server’s query with a fake response sooner than it gets the legitimate response, it’ll send traffic to the wrong website. Sometimes it’s just an annoyance, like the Lizard Squad attack on Google. But, far too often, users are redirected to a spoofed site that looks just like the real one and even has the right URL. So users enter their personal information, and the hackers strike gold.

Why DNS Servers Are An Enticing Target

It’s the caching capability built into DNS servers that makes them so tempting to hackers. Every time a server looks up an IP address, it “remembers” that information for a while, saving time on future queries. If it caches a fake address, everybody who comes along after that also gets sent to the fake address. So what originally affected only one person can end up affecting many more.

DNS poisoning isn’t the only way hackers exploit the DNS system. They can also use it to launch amplified DDoS attacks. In one type of attack, hackers get open DNS servers to do their dirty work for them. Instead of being limited to the queries they can send out on their own, they have a whole team working with them, making it easy to overwhelm the target site. Other times, they flood servers with requests for non-existent web sites, so that the servers keep sending queries for sites that never answer, tying up valuable resources.

What You Can Do

The smartest thing you can do for your business is to stop thinking, “It will never happen to me,” because the facts say otherwise. Pulling off a DNS attack is both easy and cheap, and, since some hackers do it just to prove they can, there doesn’t even have to be a reason. No company is too big, no company is too small, and no company is too obscure.  

Once you recognize your risk, your next job is to figure out what to do about it. Some businesses handle their security in-house, but more and more are outsourcing the task to specialists. Not only is network security a critically important job, it’s also a fight against a constantly moving target, as hackers’ strategies evolve. Regardless of who manages your security, they key is to make sure they’re the right people, have the right resources, and are totally plugged into the world of network security so that they’ll be out in front of new developments. Can your security team handle all of that?

Tags: DDoS attacks → DDoS mitigation → DDoS protection → DNS-based DDoS → Protection for Networks → Vulnerabilities

Lizard Squad Goes After Google

By Unknown → Tuesday, March 3, 2015

Survey Report: Majority of Service Providers Experienced DDoS Attacks, 85 Percent Experienced Customer Churn As a Result

Nearly all participants have a solution in place, but most are insufficient

March 03, 2015 08:01 AM Eastern Standard Time

SAN FRANCISCO--(BUSINESS WIRE)--Black Lotus, a leader in availability security and provider of DDoS protection, released “DDoS Attacks: The Service Provider Impact,” a survey report showing the striking disparity between how threatened service providers feel by potential DDoS attacks and how prepared they are to mitigate one. The survey report shares data and insights into the types and sizes of attacks these service providers face, as well as how they respond to these attacks. The findings demonstrate that while almost all participants (92 percent) have some form of DDoS protection in place, it is insufficient to stop an attack before damage is done.

“DDoS attacks will continue to grow in scale and severity thanks to increasingly powerful (and readily available) attack tools, the multiple points of Internet vulnerability and increased dependence on the Internet. Enterprises have to move from thinking of DDoS as a possibility, to treating it as an eventuality.”

Most respondents incurred increased operational expenses due to DDoS attacks, with more than 35 percent of the providers surveyed indicating that they are hit with one or more attacks weekly. The respondents represented companies of all sizes, from small to large. The largest group represented in the survey was small companies of one to 999 employees worldwide (52 percent of all companies surveyed), with organizations of fewer than 250 employees (20 percent) as the largest subgroup.

Among the findings were:

• 61 percent of providers feel that DDoS is a threat to their businesses.
• Only 16 percent of the providers surveyed indicated that they had been rarely or never hit by a DDoS attack.
• The top three industries with customers affected by DDoS attacks are managed hosting solutions (MHS), voice over IP (VoIP) and platform as a service (PaaS).
• In case of a DDoS attack, 34 percent of the surveyed providers remove the targeted customer, and 52 percent temporarily null route or block the problem customer.
• 64 percent of PaaS providers have been impacted by DDoS.
• 56 percent of MHS providers have been impacted by DDoS.
• 52 percent of infrastructure as a service (IaaS) providers have been impacted by DDoS.

One hundred and twenty-nine service providers responded to the electronic survey, which became available on August 2014 and was closed on Oct 31, 2014. IT-related administrators represent the largest occupational group among the respondents (65 percent), with network administrators (13 percent) and IT-related directors (10 percent) being the largest occupational groups selected. The relatively high participation of operational and network personnel in this survey, along with members of IT security teams, demonstrates that DDoS attacks are of prime interest to those responsible for network operations as well.

“DDoS attacks lasting hours or even minutes can lead to loss of revenue and customers, making DDoS protection no longer a luxury, but a necessity,” said Shawn Marck, co-founder and chief security officer of Black Lotus. “DDoS attacks will continue to grow in scale and severity thanks to increasingly powerful (and readily available) attack tools, the multiple points of Internet vulnerability and increased dependence on the Internet. Enterprises have to move from thinking of DDoS as a possibility, to treating it as an eventuality.”

Download DDoS Attacks: The Service Provider Impact for more details. An infographic of the results is available.

About Black Lotus Communications

Black Lotus Communications is a security innovator that pioneered the first commercially viable DDoS mitigation solutions. These advanced solutions enhance the security posture of small and medium businesses and enterprise clients while reducing capital expenditures, managing risk, ensuring compliance, and improving earnings and retention. Breakthrough developments at Black Lotus include the world's first DDoS-protected hosting network, the first IPv6 DDoS mitigation environment, and the first highly effective Layer 7 attack mitigation strategy. For more information, visit www.blacklotus.net or follow Black Lotus on Twitter at https://twitter.com/ddosprotection.

Contacts

Metis Communications
Justine Boucher, 617-236-0500
blacklotus@metiscomm.com

Tags: Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection → DNS-based DDoS

Survey Report: Majority of Service Providers Experienced DDoS Attacks, 85 Percent Experienced Customer Churn As a Result

By Unknown →

Hackers Exploit DNS Servers to Launch Massive DDoS Attacks

DNS servers are the traffic cops of the internet: They get everybody where they need to go. If DNS servers go down, users can’t reach the sites they need. If you’re a business, a DNS failure can stop you in your tracks and send your customers fleeing to your competitors.

DNS servers are critical – the internet wouldn’t function without them – but they can be used against you, too. Those same DNS servers that keep your business running can be exploited by hackers to launch massive DDoS attacks. These hackers can use open DNS servers to generate a flood of queries, which can quickly take the victim’s server offline.

Think of it like a fraudulent pyramid scheme. Let’s say you have a con artist who targets 10 potential victims every day. But then, let’s say you get each of those 10 victims to target 10 more potential victims…and so on. The number of potential victims increases exponentially. That’s amplification, and it’s exactly what happens when hackers launch a DNS-based DDoS attack.

Sometimes, hackers will use an array of vulnerable DNS servers to overwhelm a victim’s server with traffic. Instead of being limited to the number of queries they can send out on their own, they enlist a bunch of unwitting DNS servers to do it for them: amplification. And, if they intentionally design the queries to elicit a large number of responses, the impact is even greater.

Another way hackers use DNS servers to launch DDoS attacks is by flooding the servers with requests for non-existent web sites. The servers keep sending requests that are never answered. All of those open requests gobble up resources. And, if the server is caching bogus results, resources are depleted even faster.

Hackers can also bring down a DNS server by flooding it with fake responses. It keeps the server engaged with what is essentially “junk mail,” tying up resources that would otherwise be used for legitimate business purposes.

If that sounds like a lot of trouble for hackers to go to, it isn’t. These attacks are surprisingly easy and inexpensive to carry out, which is why they’re so common. According to an article in SC Magazine, 66 percent of U.S. organizations have experienced a DNS attack in the last 12 months. The survey, which included 300 IT decision-makers from companies with at least 1,000 employees, also revealed that 74 percent of the respondents who reported a DNS attack had experienced a DDoS attack aimed at slowing down their network or taking it completely offline.

Those statistics reveal the startling truth that, if you haven’t yet been the victim of a DDoS attack, you’re in the minority. Shawn Marck, CSO of cybersecurity company Black Lotus, agrees. “You will, eventually, be the target of a DDoS attack,” he explains. “It’s inevitable. Nobody is too big, nobody is too small, and nobody is too obscure. Sometimes it’s an unsatisfied customer; sometimes it’s a disgruntled employee. And, a lot of times, it’s just somebody who’s bored and wants to prove that they can do it. And when you’re dealing people who commit cybercrime as entertainment, there doesn’t have to be a reason. If you’re online, you’ll eventually be targeted.”

How secure is your company from DDoS attacks? Do you have protocols in place? What about contingency plans in case you are attacked? If you aren’t 100 percent sure of the answer to those questions, you need to become sure – today. Whether you do it in-house or partner with a cybersecurity firm, protecting your network from DDoS attacks just may be the most important thing you do this year.

Tags: Amplification attacks → Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection → DNS-based DDoS

Hackers Exploit DNS Servers to Launch Massive DDoS Attacks

By Unknown → Wednesday, February 25, 2015

DDoS Attacks Not Just an Inconvenience; They’re an Existential Threat

Distributed Denial of Service (DDoS) attacks are becoming increasingly common, and they’re deceptively simple – hackers just overwhelm your site with false traffic – and disproportionately damaging. And while it’s the attacks on major companies that make the headlines, according to a report in The Telegraph, nearly one third of DDoS attacks reported in 2014 targeted businesses with 250 or fewer employees. Even more disconcerting, 60 percent of those small businesses shut down within six months of the attack. It’s clear that cybercrime isn’t just an annoyance; it can be an existential threat.

Even the U.S. government is sitting up and taking notice. In February of 2015, the government announced the creation of a new Cyber Threat Integration Center that will report to the Director of National Intelligence. Lisa Monaco, Assistant to the President for Homeland Security and Counterterrorism, explained that the center will do for cybercrime what the National Counterterrorism Center does for terrorism. Few actions could do more to underscore the serious nature of this growing threat.

Government support promises to be a valuable resource, but the primary responsibility falls to individual organizations. It’s kind of like CPR; the best medical team in the world can’t help if you can’t keep a heart attack victim alive until they get there. Fortunately, there are some things you can do to mitigate the risk. The Telegraph recommends companies take these steps:

Be vigilant.

To spot what’s abnormal, you have to know what’s normal, first. It’s crucial to have either an inside expert or an outside provider who knows the normal traffic patterns of your business and has the ability to spot and diagnose a sudden spike, which is typically the first sign of a DDoS attack.

Invest in extra capacity.

What makes DDoS attacks so devastating is that the tidal wave of traffic overwhelms the system’s ability to process it. If you normally operate at maximum capacity, you have no chance of staying online during a DDoS attack. Invest in as much bandwidth as you can afford. It probably won’t be enough to completely stop a DDoS attack, but it could buy you some time to activate your contingency plans.

Conduct drills.

You rehearse plans for other disasters; you should treat your emergency response plan for a DDoS attack no less seriously. Practice your plans frequently enough that everybody knows what needs to happen and who is supposed to do it, and practice the plans until the responses become automatic. These drills should include implementing any stop-gap measures, like rate-limiting your router or adding filters to drop packets that are obviously part of an attack.

Call in the pros.

No matter how talented and trained your in-house staff is, once you’re under attack, you’re probably going to need the help of professionals. For moderate attacks, your ISP provider should be able to offer some help, such as “null-routing” your traffic, which means dropping packets before they even arrive at your server. For larger attacks, you may need the services of a DDoS mitigation specialist, experts who specialize in stopping and recovering from DDoS attacks.

If you’re not 100 percent sure that your contingency plans for DDoS attacks are as good as your plans for any other emergency, contact a specialist today to discuss how you can make those plans rock-solid.

Tags: Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection

DDoS Attacks Not Just an Inconvenience; They’re an Existential Threat

By Unknown → Thursday, February 19, 2015

The Democratization of Cybercrime

One of the most profound societal effects of technology has been democratization. In other words, technological advances have blown away many traditional barriers to entry for all kinds of endeavors. Thanks to Google, for instance, anybody with internet access can find the answer to almost any question within seconds. You can explore the Sistine Chapel without leaving your living room. You can plan your own vacation from your kitchen table rather than relying on a travel agent. Most of the time, that’s a good thing. Unfortunately, one of the things that’s been democratized by easy access to technology is cybercrime.

We used to think of hackers as antisocial geniuses, pulling off technical feats that were totally incomprehensible to the average user. But that’s not true anymore. Today, even a college kid can take down a huge company from his dorm room. And, thanks to tools that are out there for anyone who knows they exist, he can do it without missing a single minute of The Walking Dead.

Case in point: The Christmas Day DDoS attacks on the Sony PlayStation Network and Microsoft XBOX Live. XBOX Live was down for three days, and PlayStation Network was down for five. As it turned out, the whole thing was a publicity stunt, designed to draw attention to Lizard Stresser, a new DDoS-for-Hire product developed by Lizard Squad. As reported in Venturebeat, the tool came complete with marketing text: “This booter is famous for taking down some of the world’s largest gaming networks such as Xbox Live, Playstation Network, Jagex, BattleNet, League of Legends, and many more! With this stresser, you wield the power to launch some of the world’s largest denial of service attacks.” And the prices were rock-bottom, with the mid-range package costing $130 to take down a site for over eight hours.

Since then, the site has been taken offline, and several of the hackers have been arrested. But that doesn’t mean the threat is over, because there are plenty of others eager to step in and fill gap. Thanks to cybercrime as a product, the field of people capable of launching a devastating DDoS attack has just grown exponentially, as has the challenge facing IT staff everywhere.

The task of fending off DDoS tasks is too big, too varied, and too subject to lightning-fast change for businesses to treat it as just another IT project. The irony would be almost funny if the threat wasn’t so big: As DDoS attacks become something available to anybody with a few dollars to spend, DDoS protection is becoming a specialty service, provided by companies that focus on DDoS and nothing else. DDoS attacks are for the masses, and DDoS protection is for the experts.

Don’t waste another day. If you’re not absolutely certain you can handle DDoS protection in-house, find a provider you trust. Look for a company that offers multi-layer protection, constant updates to protect against the latest strategies, and 24/7 emergency service in case your company does become the victim of a DDoS attack. It’s not enough to just protect you from attacks; you need somebody who can get you back online as quickly as possible if something slips through. If your web site is mission-critical, your DDoS protection has to be mission-critical, too.

###

Tags: Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection → Threat Report

The Democratization of Cybercrime

By Unknown → Wednesday, February 18, 2015

DNS Attacks: DDoS Attacks on Steroids

On Super Bowl Sunday, one of the most socially active days of the year, the Playstation Network (PSN) experienced yet another extended outage — the second since Christmas. While it’s not yet clear whether the outage was caused by another DDoS attack (like the Christmas Day outage), that’s the most likely cause. And, even if this outage wasn’t a result of a DDoS attack, you can bet there will be another one soon.

Media and the entertainment industry were the most common victims of DDoS attacks during the third quarter of 2014, and those attacks were 40 percent larger than similar attacks in Q2. Entertainment and gaming providers are just too tempting a target to resist, with dedicated users who are experts at using social media to air their complaints. This type of DDoS attack garners a lot of attention — and that’s the whole point.

The most important takeaway is that even big companies with extensive resources are vulnerable, especially when the attackers implement the attack via Domain Name Servers (DNS). In a DNS attack, hackers do what’s called IP address spoofing — they masquerade as their victim’s IP address and, using that address, start pinging servers for all kinds of information. The servers answer and send everything they have to the spoofed IP. The targeted system then crashes, being too overwhelmed to process that much traffic. It’s called amplification, and it’s a DDoS attack on steroids. To make matters worse, Internet Service Providers (ISPs) frequently think the tidal wave of traffic is an attack on them, so they start blocking websites, adding insult to injury.

Unfortunately, these attacks are hard to detect and even harder to stop. The most reliable method of DDoS security, eliminating unsecured recursive resolvers, is time-consuming and expensive – even more so when you consider that, out of approximately 27 million DNS servers on the internet, about 25 million of them are vulnerable to being used in an attack.

With the average cost of downtime estimated to be a whopping $79,000 per minute, companies simply can’t afford to give DDoS protection short shrift. The threat merits dedicated resources, which is why more and more companies are outsourcing their DDoS protection to experts. Hackers’ methods are constantly evolving, so people who spend their days (and nights) doing nothing but keeping up with and stopping the newest DDoS attacks stand the best chance of developing and implementing a good defense.

The best providers of DDoS protection also offer 24/7 emergency services, with a crew standing by to help out if you do become the victim of an attack. The two-pronged approach – implementing safeguards to prevent DDoS attacks and being ready to come to the rescue if one slips through – is essential to data security and will become even more so over the coming weeks and months.

It’s time to give your DDoS protection a checkup, and if you’re not absolutely sure you’re protected and prepared, take the time to make some changes before it’s too late.

###

Tags: Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection

DNS Attacks: DDoS Attacks on Steroids

By Unknown → Thursday, February 12, 2015

China’s Great Firewall and Its Great Problem

China’s Great Firewall had a massive and unexpected effect on sites all over the Internet upon the completion of its most recent upgrade. Apparently random sites experienced huge traffic spikes, sending them scrambling to figure out why as much as 52 Mbps of search traffic was pouring into their system.

To make that figure more meaningful consider that it represents about 13,000 requests per second, which is roughly a third of Google’s search traffic. All of that traffic came from China, and the vast majority of the traffic seems to be trying to find Bittorrents or Facebook.

How did this come about? And how can small sites and blogs deal with such a deluge of requests?

The Collateral Damage of Censorship

How did this apparent DDoS attack inflict such massive damage on so many unique sites and blogs? Reports from system administrators across the web have revealed that sites’ IP addresses suddenly found themselves targeted. Such targeting forces sysadmins to introduce blocking measures just to ensure that they can get back online.

Theories abound as to what was going on: foreign hackers, focussed DDoS attacks, something else? But one theory that has generated increasing interest in the technical community is that China’s Great Firewall has a bug. The bug causing the problem seems to be in how the firewall uses DNS cache poisoning to redirect users away from websites that the Chinese government censors.

China’s Great Firewall utilizes a weakness of the DNS system: it intercepts requests going both in and out of the country. If it finds something the Chinese government wishes to censor ( “twitter.com,” “facebook.com,” or “torrentz.com”) it redirects the request to a different IP address. In the past, those requests were sent to IP addresses that didn’t exist which simply caused the request to time out. However, China has begun sending those request to IP addresses used by real servers.

In effect, all these sites found themselves unluckily in the crosshairs of the machinery of the Chinese government’s censorship.

And this is how a server on the other side of the world can get hit with a full stream of millions upon millions of users requesting information the server simply doesn’t have. When million of users suddenly and without warning starting making requests, the server fails.

The Bigger Problem in the Making

While this particular problem may be attributed to human error, an even bigger and more frightening question must be asked: what happens if someone gains a foothold in the DNS system? Such a tactical advantage would allow a hacker to use DNS poisoning to cause unprecedented attacks. And if a single hacker could cause such damage, imagine what a hostile country or intelligence agency could do.

Whether accidental or intentional, any individual, agency, or government can knock out vast amounts of websites. If those sites were for critical services such as utilities infrastructure, emergency services, government agencies, and the like, the fallout could be immensely devastating.

Issues such as DNS poisoning or DDoS attacks are serious and, as we have seen, can happen on an extremely large scale, devastating your site and server. Luckily, you can prepare for and manage the risks of such an attack, and there are steps you can take to protect yourself today.

###

Tags: Application Layer DDoS → DDoS attacks → DDoS mitigation → DDoS protection → Vulnerabilities

China’s Great Firewall and Its Great Problem

By Unknown → Monday, February 2, 2015