uncompiled.com

Media Temple, Web hosting provider for Adobe, ABC, Sony, NBC, Time, Volkswagen, and Starbucks, was hit with a sophisticated distributed denial-of-service (DDoS) attack Tuesday.

The outage began about 3:50 p.m. PDT, when Media Temple’s domain name servers were deluged by a flood of traffic coming from outside the U.S., and lasted a total of about two-and-a-half hours, according to a tech support representative at the Los Angeles-based company.

“Due to the sophistication of the attack, our normal DDoS firewall prevention techniques didn’t block the attack adequately, as the traffic appears to be legitimate,” the company reported at around 5:40 p.m. PDT.

The company said it had initially blocked all traffic from Asia, South America, and Mexico to reduce strain on the network, but later removed the blocks. As of 6:10 p.m. PDT the network was reported stable.

“Overall, network health is normalizing, however more work must be done to mitigate the effects of this incident and prevent future occurrences,” the company said, adding that it would provide an update at 10 p.m. PDT.

Company representatives did not immediately return a call seeking comment.

Update May 25 at 11:59 p.m. PT: A tech support representative at Media Temple said the outage lasted a total of about two-and-a-half hours.

Source

The second man charged in 2006 computer attacks on The Planet and T35 Hosting has agreed to plead guilty.

According to court filings, Thomas James Frederick Smith is set to plead guilty before a federal judge in Dallas on June 10. He and David Anthony Edwards are facing five years in prison and fines of up to US$250,000 on charges that they assembled a 22,000 node botnet and then trained it on two ISPs to show a prospective buyer what it could do.

Edwards pleaded guilty to the charges before U.S. District Judge Jane J. Boyle on April 29. He is set to be sentenced August 19. Before he decided to plead guilty, Smith’s case had been set to go to trial next week.

Federal prosecutors say that Smith and Edwards — known by their hacker handles Zook and Davus — created a botnet they called Nettick, which they then tried to sell to cybercriminals, asking US$0.15 per infected computer.

To prove that they really controlled Nettick, the two allegedly trained it on a system hosted by The Planet, launching an August 2006 DDoS (distributed denial of service) attack on the ISP.

Six weeks later, the two allegedly broke into Texas Web hosting provider T35 Hosting, stole the company’s database of user names and passwords and then defaced T35′s Web site, posting this data to the public. T35 is best known as the free ISP that had hosted the Web site of Joe Stack, who crashed his plane into an IRS building in Austin, Texas, earlier this year.

Shortly after the attack, Smith allegedly posted a message to the HelptingWebmasters.com, pretending to be an innocent witness to the incident. “I found out today at around 11:40 PM that the t35 Website was Completly [sic] defaced,” Zook wrote in the post. “I posted it to a few news sites and noticed after posting them that the Mysql dumps were actually up for grabs… How are all the users going to be compensated? Im [sic] sure EVERYONES [sic] password was in that file…”

Source

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach.

A global hacking offensive has broken into U.S. companies and government agencies. Cyber attacks could soon be seen as a national security threat, WSJ executive editor Jerry Seib tells the News Hub.

The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

The hacking operation, the latest of several major hacks that have raised alarms for companies and government officials, is still running and it isn’t clear to what extent it has been contained, NetWitness said. Also unclear is the full amount of data stolen and how it was used. Two companies that were infiltrated, pharmaceutical giant Merck & Co. and Cardinal Health Inc., said they had isolated and contained the problem.
How the Attack Spread

Starting in late 2008, hackers operating a command center in Germany got into corporate networks by enticing employees to click on contaminated Web sites, email attachments or ads purporting to clean up viruses, NetWitness found.

In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier’s military email account, NetWitness found. A Pentagon spokesman said the military didn’t comment on specific threats or intrusions.

At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee’s apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past.

The spyware used in this attack allows hackers to control computers remotely, said Amit Yoran, chief executive of NetWitness. NetWitness engineer Alex Cox said he uncovered the scheme Jan. 26 while installing technology for a large corporation to hunt for cyberattacks.

That discovery points to the growing number of attacks in recent years that have drafted computers into cyber armies known as botnets—intrusions not blocked by standard antivirus software. Researchers estimate millions of computers are conscripted into these armies.

“It highlights the weaknesses in cyber security right now,” said Adam Meyers, a senior engineer at government contractor SRA International Inc. who reviewed the NetWitness data. “If you’re a Fortune 500 company or a government agency or a home DSL user, you could be successfully victimized.”

Disclosure of the attack comes on the heels of Google Inc.’s allegation that it and more than 20 other companies were breached by Chinese hackers. This operation appears to be more far-reaching, infiltrating some 75,000 computers and touching 196 countries. The highest concentrations of infected computers are in Egypt, Mexico, Saudi Arabia, Turkey and the U.S.

NetWitness, based in Herndon, Va., said it was sharing information with the companies infected. Mr. Yoran declined to name them. The company provides computer security for U.S. government agencies and companies. Mr. Yoran is a former Air Force officer who also served as cyber security chief at the Department of Homeland Security.

Besides Merck and Cardinal Health, people familiar with the attack named several other companies infiltrated, including Paramount Pictures and software company Juniper Networks Inc.

Merck said in a statement that one computer had been infected. It said it had isolated the attack and that “no sensitive information was compromised.”

Cardinal said it removed the infected computer from its network. Paramount declined to comment. Juniper’s security chief, Barry Greene, wouldn’t speak about any specific incidents but said the company worked aggressively to counter infections.

NetWitness, which does extensive work for the U.S. government and private-sector clients, said it was sharing its information with the Federal Bureau of Investigation. The FBI said it received numerous allegations about potential compromises of network systems and responded promptly, in coordination with law-enforcement partners.

The computers were infected with spyware called ZeuS, which is available free on the Internet in its basic form. It works with the FireFox browser, according to computer-security firm SecureWorks. This version included a $2,000 feature that works with FireFox, according to SecureWorks.

Evidence suggests an Eastern European criminal group is behind the operation, likely using some computers in China because it’s easier to operate there without being caught, said NetWitness’s Mr. Yoran.

There are some electronic fingerprints suggesting the same group was behind a recent effort to dupe government officials and others into downloading spyware via emails purporting to be from the National Security Agency and the U.S. military, NetWitness’s Mr. Yoran said.

That attack was described in a Feb. 5 report from the Department of Homeland Security, which said it was issuing an alert to the government and other organizations to “prevent further compromises.”

A DHS official said that ZeuS was among the top five reported tools for malware infections.

Source

More than 74,000 PCs at nearly 2,500 organizations around the globe were compromised over the past year and a half in a botnet infestation designed to steal login credentials to bank sites, social networks, and e-mail systems, a security firm said Wednesday.

The systems were infected with the Zeus Trojan and the botnet was dubbed “Kneber” after a username that linked the infected PCs on corporate and government systems, according to NetWitness.

The Wall Street Journal reported that Merck, Cardinal Health, Paramount Pictures, and Juniper Networks were among the targets in the attack. NetWitness speculated that criminals in Eastern Europe using a command-and-control server in Germany sent attachments containing the malware in e-mails or links to the malware on Web sites that employees within the companies clicked on.

NetWitness said it discovered more than 75 gigabytes worth of stolen data during routine analytic tasks as part of an evaluation of a client network on January 26. The cache of stolen data included 68,000 corporate login credentials, access to e-mail systems, online banking sites, Facebook, Yahoo, Hotmail, 2,000 SSL (Secure Sockets Layer) certificate files and data on individuals, NetWitness said in a statement and in a whitepaper available for download from its Web site.

In addition to stealing specific data, Zeus can be used to search for and steal any file on the computer, download and execute programs and allow someone to remotely control the computer.

More than half of the compromised machines were also infected with peer-to-peer bot malware called Waledac, the company said. Nearly 200 countries were affected, with most of the infections found in Egypt, Mexico, Saudi Arabia, Turkey and the United States.

The news comes after Google announced an attack targeting it and what is believed to be more than 30 other companies and which was linked back to China. McAfee dubbed that attack “Operation Aurora.”

“While Operation Aurora shed light on advanced threats from sponsored adversaries, the number of compromised companies and organizations pales in comparison to this single botnet,” said Amit Yoran, chief executive of NetWitness and former Director of the National Cyber Security Division. “These large-scale compromises of enterprise networks have reached epidemic levels.”

Source

More than 300 Web sites are being pestered by infected computers that are part of the Pushdo botnet, according to security researchers.

The U.S. Federal Bureau of Investigation, Twitter, and PayPal are among the sites being hit, although it doesn’t appear the attacks are designed to knock the sites offline, said Steven Adair, of The Shadowserver Foundation, a group that tracks botnets.

Shadowserver was tipped off to the Pushdo issue by Joe Stewart, director of malware analysis at vendor SecureWorks.

Pushdo, which is also known as Pandex or Cutwail, has been around for about three years, according to a report from Trend Micro. Computers infected with Pushdo are used to send out spam, but the malware is capable of downloading other harmful code to a computer.

Pusho appears to have been recently updated to cause computers infected with it to make SSL (Secure Sockets Layer) connections to various Web sites. SSL is an encrypted protocol used to protect information exchanged.

The bots start to create an SSL connection and then disconnect, a process that is repeated, Adair said. Serving up SSL connections puts more of a burden on a Web site than HTTP connections, Adair said, but the traffic has been so sporadic that some large Web sites didn’t even notice.

“Despite how noisy it is, the traffic is still too infrequent and not large enough to really be seen as what we would think is an intentional DDOS attack,” Adair said in an e-mail exchange. “Much smaller botnets are capable of generating far more traffic and causing more of an impact to Web sites than what is being done with Pushdo.”

The traffic, however, is significant and results in large Web sites getting millions of hits across hundreds of thousands of IP (Internet Protocol) addresses. “This might be a big deal if you’re used to only getting a few hundred or thousands of hits a day or you don’t have unlimited bandwidth,” Adair wrote on Shadowserver’s blog.

One option for Web sites is to change their IP addresses, but that may only be a temporary fix. “We have also had numerous people write in offering assistance and feedback on ways to slow or stop these attacks,” Adair said. “We hope to put out an updated post that can help our system administrators associated with these Web sites soon.”

Source

Targeted attacks against backend systems have replaced botnet-powered traffic floods as the main concerns for security staff at telcos and large ISPs.

Only one in five of the 132 senior telco security experts quizzed by DDoS security and network management specialists Arbor Networks reported the largest attacks they observed as lying within the one-to-four Gbps range last year, compared to 30 per cent in 2008. The most potent DDoS attacks recorded in 2009 hit 49Gbps, a relatively modest 22 per cent rise from the 40Gbps peak reached in 2008.

Although botnet-enabled DDoS attacks the top operational threats faced by the network operators surveyed by Arbor this may change in future. One in three (35 per cent) of security managers at ISPs and telcos across the world quizzed by Arbor reckoned more sophisticated service and application-layer attacks are the biggest threat they face over the coming year.

By comparison, 21 per cent thought large-scale botnet attacks would be their single biggest problem during 2010.

Service level attacks, while also driven from compromised networks of zombie PCs, are designed to exploit service weaknesses, like back-end database flaws rather than simply flooding a site with more traffic than it can handle.

Several of the senior techies quizzed by Arbor reported prolonged (multi-hour) outages of prominent internet services last year as a result of application-level attacks. Systems targeted included distributed domain name system (DNS) rigs, load balancers and SQL server back-end infrastructures.

Source

Google today said that a “highly sophisticated and targeted” attack against its network last month originated in China, and tried to access the Gmail accounts of Chinese human rights activists.

In a blog post Tuesday, David Drummond, Google’s chief legal officer, said that attacks have forced the company to “review the feasibility of our business operations in China.” Google, continued Drummond, is “no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all.”

The end result of those discussions, said Drummond, may be that Google shuts down its search engine and close its offices in the People’s Republic of China.

“This is a bold and a very difficult move on [Google's] part,” said Leslie Harris, the president and CEO of the Center for Democracy & Technology (CDT), a Washington, D.C.-based civil liberties group. “But with the revelations that there have been major cyber attacks aimed at human rights activists, both in China and in the West, it’s hard to see how Google could have remained silent.”

According to Drummond, Google was one of at least 20 large companies that were targeted by massive attacks in December. In Google’s case, the attacks resulted in the theft of some company intellectual property.

More troubling, said Drummond, was that the attacks were aimed at accessing the Gmail accounts of human rights activists in China. Gmail is officially unavailable in the country, but activists and others use anonymous proxies to circumvent that rule.

“We have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists,” said Drummond, who added that with the exception of two accounts, those attacks had been unsuccessful. The message content of those accounts was not compromised, Drummond claimed; instead, only some information, such as subject lines and the date the account was created, was accessed.

Drummond also said Google had discovered that the Gmail accounts of dozens of U.S.- and Europe-based advocates of human rights in China had been “routinely” accessed by unauthorized users.

“We have taken the unusual step of sharing information about these attacks with a broad audience not just because of the security and human rights implications of what we have unearthed, but also because this information goes to the heart of a much bigger global debate about freedom of speech,” said Drummond.

Source

About 30,000 customers of the Cheshire-based ISP Vispa were forced offline for almost 12 hours today by a DDOS attack traced to the Baltic state of Latvia.

Broadband service has now been restored, a spokesman said, but customers are unable to call customer service because the firm’s phone system was also crippled by the attack.

“As a result of a major denial of service attack on our network we suffered a severe outage between 1am and 12.30pm Friday January 10,” Vispa commercial director Adam Binks said.

“All services have now been restored except for our phone system which has been affected as part of the problem. We are currently working with suppliers to have the main numbers diverted to other lines within the office but expect to restore the system by the end of today.”

Source

Amazon.com and Amazon Web Services (AWS) were apparently affected by a distributed denial of service attack Wednesday that struck their DNS provider.

The extent of the impact of the DDoS assault could not be immediately determined. However, Allen Goldberg, spokesman for UltraDNS, said the attack started about 4:45 p.m. Pacific time Wednesday, causing some delays to customers. UltraDNS had its systems running normally within an hour, and the attack only affected Northern California Internet users, Goldberg said.

“No one was ever out. There was no downtime,” Goldberg told InformationWeek Thursday. “Queries may have taken some time to resolve and some may not have been completed, but there was never an outage.”

Details of the attack were not available, and Goldberg declined to discuss specific customers. However, postings on the Twitter thread of Jeff Barr, a strategist for Amazon Web Services, indicated that AWS and Amazon were affected. Amazon could not be reached for comment in time for this writing.

The AWS Service Health Dashboard indicated that AWS’ storage and computing cloud services, S3 and EC2, respectively, were affected. At 5:44 p.m. Pacific AWS was investigating reports of “DNS resolution errors,” and by 6:02 p.m. confirmed that “some customers in the West Coast are experiencing issues with resolving DNS.” By 6:39 p.m., the system had fully recovered.

DDoS attacks occur regularly on the Web and are usually brought under control by service providers before the assaults cause serious damage. AWS has been a target of DDoS attacks before. A suspected denial-of-service attack on AWS shut down a code hosting service for nearly 24 hours in early October.

In October, an assault aimed at AWS shut down Bitbucket, a code hosting service, for nearly 24 hours. The company detailed its ordeal in its blog. Facebook and Twitter have also been targeted.

Source

The malware writers and criminals who run botnets for years have been using shared hosting platforms and so-called bulletproof hosting providers as bases of operations for their online crimes. But, as law enforcement agencies and security experts have moved to take these providers offline, the criminals have taken the next step and begun setting up their own virtual data centers.

IP address space allocation is handled by five regional Internet registries (RIR), each of which is responsible for a particular group of countries. The RIRs work with large enterprises, ISPs, telecoms and other organizations that need large blocks of IP space. These organizations typically have to go through an application and screening process in order to get these allocations, including providing legal documentation listing the officers of the company, its business and why the address space is needed.

And that’s the way it’s supposed to work everywhere. Applicants who can’t show a need for the IP space are told politely to take a walk. But in some cases, criminals have found a way around this by going through local Internet registries (LIR) or by taking advantage of RIRs that don’t have the resources to investigate every application as fully as they’d like.

The criminals will buy servers and place them in a large data center and then submit an application for a large block of IP space. In some cases, the applicants are asked for nothing more than a letter explaining why they need the IP space, security researchers say. No further investigation is done, and once the criminals have the IP space, they’ve taken a layer of potential problems out of the equation.

Source