Category: News

Things remained calm for a few days before kicking off again with even greater intensity – to the extent that collateral damage was seen against services such as Netflix, the New York Times reports.

A blog post by CloudFlare, written last week before the latest run of attacks, explains the mechanism of the attack against Spamhaus and how it can be usde to amplify packet floods.

The basic technique of a DNS reflection attack is to send a request for a large DNS zone file with the source IP address spoofed to be the intended victim to a large number of open DNS resolvers. … The attackers’ requests themselves are only a fraction of the size of the responses, meaning the attacker can effectively amplify their attack to many times the size of the bandwidth resources they themselves control.

…The requests were likely approximately 36 bytes long (e.g. dig ANY ripe.net @X.X.X.X +edns=0 +bufsize=4096, where X.X.X.X is replaced with the IP address of an open DNS resolver) and the response was approximately 3,000 bytes, translating to a 100x amplification factor. “Because the attacker used a DNS amplification, the attacker only needed to control a botnet or cluster of servers to generate 750Mbps – which is possible with a small sized botnet or a handful of AWS instances,” it explains.

Link: http://www.theregister.co.uk/2013/03/27/spamhaus_ddos_megaflood/

.“The Anonymous hackers can certain cause local pockets of disruption, but these disruptions are going to be localized to networks where their attack machines are located, or where their ‘reflectors’ are located”, said Robert Graham of Errata Security.

“Just because I say Anonymous can’t do it doesn’t it mean it can’t be done,” the security expert said on Errata’s blog.

Link: http://bgr.com/2012/03/28/anonymous-hackers-plan-to-shut-down-the-internet-this-saturday/

In general, the term “private cloud” means using cloud computing technologies in a company’s own data center. This still uses hardware hosted by Amazon, but adds extra security to make it behave more like a private datacenter.

If Amazon were really to enter the private cloud business, this could be a big threat to VMware and Citrix, the two biggest players in this market.

Whether Amazon has had a massive change of heart about private clouds or not, gaining the CIA as a customer is a major coup. Competitors like IBM, HP, and Rackspace say their clouds are more reliable and far more secure than Amazon’s.

Link: http://www.businessinsider.com/cia-600-million-deal-for-amazons-cloud-2013-3

“It fixes critical vulnerabilities that could be used for machine takeover in all versions of Internet Explorer from 6 to 10, on all platforms including Windows 8 and Windows RT,” says Qualys CTO Wolfgang Kandek.

It affects Silverlight whether deployed on Windows or Mac OS X operating systems, where it is used to run media applications such as Netflix, Kandek says.

“It is puzzling to see such a high rating for this software that typically requires opening of an infected file in order for the attack to work. It will be interesting to see the attack vector for this vulnerability that warrants the ‘critical’ rating,” he says.

Three of the bulletins are rated important and include two that could allow data to leak and one that could allow attackers to elevate privileges on an exploited machine. Important bulletins include vulnerabilities that could lead to compromised confidentiality, integrity or availability of user data, or of the integrity or availability of processing resources, Microsoft says.

Link: http://www.arnnet.com.au/article/455814/microsoft_patch_tuesday_targets_internet_explorer_drive-by_attacks/

A corrupted PC in Latvia or Thailand may not appear to be a threat, but once compromised it can be networked to infiltrate PCs anywhere and deploy threats such as malware that tracks keystrokes to gather passwords and account information.

“Malicious code and nongenuine code go hand-in-hand, it’s as simple as that,” said David Finn, associate general counsel for Microsoft and head of its Cybercrime Center, who has spent the past 13 years leading piracy investigations for Microsoft from his Paris office.

Software counterfeiters have graduated from gangs selling disks of pirated software on street corners to sophisticated enterprises that distribute pirate code online and on new PCs–even name-brand PCs. In an investigation in China last year, researchers purchased 169 branded PCs through traditional Chinese IT malls, and all contained counterfeit versions of Windows pre-installed and 91% contained malware. From a base in Eastern Europe, CD Cheap spammed the world selling pirate versions of Windows and at its peak was generating about $3.9 million a month, said Peter Anaman, a senior investigator for Microsoft.

What investigators have done is develop a range of techniques and tools to stymie online thieves and, in some cases, “we’ve reached the point where we’ve taken the profit out of it,” he said.

Link: http://www.foxbusiness.com/technology/2013/03/06/microsoft-establishes-cybercrime-center-to-combat-piracy-malware/

Komercni Banka AS (BAAKOMB.PR), majority owned by France’s Societe Generale SA (SCGLY), confirmed that several websites belonging to the bank were not functioning.

At the current moment were are intensively working on countermeasures which will enable us to restore services for our clients,” Komercni’s spokeswoman Monika Klucova said.

The Czech Police Wednesday said they are analysing all the cases but at present they are unable to confirm the location of the hackers or provide further details.

On Monday the websites of several of the country’s largest news agencies were hit by hackers, and in that case the agencies said it appeared the hackers were located within the Czech Republic.

Link: http://www.foxbusiness.com/news/2013/03/06/hackers-hit-czech-central-bank-stock-exchange-commercial-banks/