January 2013 – Page 5 – CyberSecurity Institute

DNS attacks increase by 170%

Posted on January 23, 2013December 30, 2021 by admini

The shift from single-server attacks to the use of multiple servers in different geographic locations has allowed attackers to quickly and effectively launch more powerful DDoS attacks than ever before. Just a few attacking servers can produce the same attack traffic as a large number of client botnets, with the 24/7 availability of servers allowing for greater reliability as well as command-and-control. In 2013, Radware expects this method to gain in popularity, requiring that organizations make sure their defense architecture can withstand these scaled up attacks.

The numbers are staggering – with 58 percent of attacks scoring a 7 or higher in complexity (out of 10), as compared to just 23 percent of attacks in 2011. Though conventionally associated with security on the web, hackers have managed to weaponize the encryption layer, using it to launch application-level and SSL attacks that can escape detection and remain hidden until its already too late.

With some of the worlds largest institutions victimized by cyber attacks in 2012, the question remains as to why many of these organizations continue to be vulnerable. The fact remains that less than a quarter of all organizations surveyed invest their efforts in mitigating attacks as they’re happening – a fact exploited by hackers. In 2013, Radware recommends that organizations dedicate resources to creating a “security war room” equipped to dynamically respond to and handle persistent security attacks during all phases of an attack and adopt a three-phased security approach.

The supply chain includes took kits and for-hire services that are available to anyone with minimal coding or advanced hacking skills for as little as $10 for a ransomware attack tool.

Key findings include:
– Server-based botnets represent a new and more powerful order in the DDoS environment.
– The number of DDoS and DoS attacks lasting more than one week doubled in 2012.
– Encrypted layer attacks fly below the radar – and can’t be ignored.
– In today’s security environment, most organizations are bringing a knife to a gunfight.
-The DIY phenomenon.

Link: http://www.net-security.org/secworld.php?id=14285

Three indicted for making, spreading Gozi Trojan – Computerworld

Posted on January 23, 2013December 30, 2021 by admini

Paunescu, a Romanian national based in Bucharest, operated a so-called “bullet-proof” hosting service using computers housed in Romania, the United States and other countries. The complaint says Paunescu provided Kuzmin and others with servers and IP addresses that allowed them to use and distribute Gozi and other banking Trojans such, as Zeus and SpyEye, with relative anonymity.

The court papers also allege Paunescu’s rented servers hosted the tools used to launch distributed denial of service attacks, including several that took advantage of the infamous Black Energy botnet. The server were often used as command and control servers for botnets and as proxy systems that let attackers to hide their identities, the complaint said.

Calovskis, a Latvian national, was indicted on charges of developing a web injection code that was used to alter how banking websites appeared on infected computers. The software fooled victims into providing key security information such as their mother’s social security number and mother’s maiden name when they attempted to log into their bank’s website.

http://www.computerworld.com/s/article/9236055/Three_indicted_for_making_spreading_Gozi_Trojan?source=CTWNLE_nlt_pm_2013-01-23

Three indicted for making, spreading Gozi Trojan – Computerworld

Posted on January 23, 2013December 30, 2021 by admini

Paunescu, a Romanian national based in Bucharest, operated a so-called “bullet-proof” hosting service using computers housed in Romania, the United States and other countries. The complaint says Paunescu provided Kuzmin and others with servers and IP addresses that allowed them to use and distribute Gozi and other banking Trojans such, as Zeus and SpyEye, with relative anonymity.

The court papers also allege Paunescu’s rented servers hosted the tools used to launch distributed denial of service attacks, including several that took advantage of the infamous Black Energy botnet. The server were often used as command and control servers for botnets and as proxy systems that let attackers to hide their identities, the complaint said.

Calovskis, a Latvian national, was indicted on charges of developing a web injection code that was used to alter how banking websites appeared on infected computers. The software fooled victims into providing key security information such as their mother’s social security number and mother’s maiden name when they attempted to log into their bank’s website.

http://www.computerworld.com/s/article/9236055/Three_indicted_for_making_spreading_Gozi_Trojan?source=CTWNLE_nlt_pm_2013-01-23

Two-thirds of banks suffered a DDoS attack in 2012

Posted on January 22, 2013December 30, 2021 by admini

Banks are still predominately relying on previously deployed traditional technology, in particular firewalls (35%), to protect their organisation from today’s sophisticated attacks according to the survey, further raising concerns about the extent of board-level buy-in.

Morgan Chase & Co., Bank of America and Wells Fargo were just a few high-profile victims of cyber attacks in 2012 – a year which raised serious concerns regarding the safety of financial institutions – and Meyer says this is prompting banks into action. “We are seeing a tonne of activity in terms of engagement of the number of banks who are searching for information about DDoS mitigation, so I actually think there is going to be a ramped amount of spending in 2013,” he said.

We have met with a few banks already this year and all of them have a budget for DDoS, and many of them for on-premise DDoS.”

Link: http://www.insurancetimes.co.uk/two-thirds-of-banks-suffered-a-ddos-attack-in-2012/1400637.article