March 2013 – Page 2 – CyberSecurity Institute

AWS Launches CloudHSM App To Bolster Data Security In The Cloud

Posted on March 27, 2013December 30, 2021 by admini

You retain full control of the keys and the cryptographic operations performed by the HSM(s) you create, including exclusive, single-tenant access to each one. Your cryptographic keys are protected by a tamper-resistant HSM that is designed to meet a number of international and US Government standards including NIST FIPS 140-2 and Common Criteria EAL4+.”

Users who sign up for the service will be provided with administrator credentials, allowing them to create user accounts, create and manage encryption keys, and perform other cryptographic-related tasks using their accounts.

It can be accessed via a number of standard APIs once provisioned, including Microsoft Cryptography API (CAPI), PCKS #11 (Cryptographic Token Interface Standard) and Java JCA/JCE (Java Cryptography Architecture / Java Cryptography Extensions).

Even so, it’s certainly not the cheapest solution around, with AWS demanding a cool $5,000 to provision a single CloudHSM, on top of the $1.88 hourly fee it charges (about $1,373 per month, on average).

Link: http://siliconangle.com/blog/2013/03/27/aws-launches-cloudhsm-app-to-bolster-data-security-in-the-cloud/

BIGGEST DDoS ATTACK IN HISTORY hammers Spamhaus

Posted on March 27, 2013December 30, 2021 by admini

Things remained calm for a few days before kicking off again with even greater intensity – to the extent that collateral damage was seen against services such as Netflix, the New York Times reports.

A blog post by CloudFlare, written last week before the latest run of attacks, explains the mechanism of the attack against Spamhaus and how it can be usde to amplify packet floods.

The basic technique of a DNS reflection attack is to send a request for a large DNS zone file with the source IP address spoofed to be the intended victim to a large number of open DNS resolvers. … The attackers’ requests themselves are only a fraction of the size of the responses, meaning the attacker can effectively amplify their attack to many times the size of the bandwidth resources they themselves control.

…The requests were likely approximately 36 bytes long (e.g. dig ANY ripe.net @X.X.X.X +edns=0 +bufsize=4096, where X.X.X.X is replaced with the IP address of an open DNS resolver) and the response was approximately 3,000 bytes, translating to a 100x amplification factor. “Because the attacker used a DNS amplification, the attacker only needed to control a botnet or cluster of servers to generate 750Mbps – which is possible with a small sized botnet or a handful of AWS instances,” it explains.

Link: http://www.theregister.co.uk/2013/03/27/spamhaus_ddos_megaflood/

Preparing major Israeli companies against Anonymous attacks on the 7th of April

Posted on March 26, 2013December 30, 2021 by admini

A cyber-attack on this scale on Israel would have serious consequences; therefore major companies are already preparing themselves for these cyber-attacks by using Bot-Trek™, initially as a test pilot.

On the example of the ISPs, it will provide tons of cyber intelligence information on infected machines within IP ranges including public and private sector, including Socks-, spam- and DDoS-bots IP-addresses and Data leaked from corporate domains or IP-ranges (e.g. corporate e-mail accounts, intranets, etc.).

Group-IB, one of the leading computer security companies, specializing in the investigation of computer crime, information security breaches, and computer forensics organized several pilot projects on Bot-Trek which will help to reduce the level of harmful and malware activities by proactive monitoring of ASN/BGP and 24/7/365 cyber intelligence. Group-IB CERT-GIB operates as the first private computer emergency response team in Russia and is internationally known for bringing down several of the biggest Botnet masters around the globe.

Previously, several largest botnets were found and blocked by Group-IB Bot-Trek system, such as Origami (4 000 000 infected PCs) in joint operation with Ministry of Interior of Russian Federation, Dragon, Grum, Virut together with SPAMHAUS, Australian CERT and CERT.pl , and many others. Last year Group-IB prevented theft from over 30,000 customers of various banks, and the number of identified and analyzed information is constantly growing.”, and more than “1.2 million infected PCs were found within the leading ISPs of different countries, which helped to stop malware, SPAM and DDOS activities”.

Link: http://i-hls.com/2013/03/preparing-major-israeli-companies-against-anonymous-attacks-on-the-7th-of-april/

Wells Fargo says cyber attack disrupting website

Posted on March 26, 2013December 30, 2021 by admini

Since September, a hacker activist group called the Izz ad-Din al-Qassam Cyber Fighters has said it was launching denial of service attacks against major U.S. banks.

In a posting Tuesday on pastebin.com, the group listed Wells Fargo as one of the banks “being chosen as a target.”

In its annual report filing last month, Wells said it had not experienced any “material losses” related to cyber attacks but that enhancing its protections remained a priority.

Link: http://www.theoaklandpress.com/articles/2013/03/26/news/story_a57178bd-e005-4605-9097-7ba3ca50eccf.txt?mobredir=false

The CIA Is About To Sign A Game-Changing $600 Million Deal With Amazon

Posted on March 19, 2013December 30, 2021 by admini

In general, the term “private cloud” means using cloud computing technologies in a company’s own data center. This still uses hardware hosted by Amazon, but adds extra security to make it behave more like a private datacenter.

If Amazon were really to enter the private cloud business, this could be a big threat to VMware and Citrix, the two biggest players in this market.

Whether Amazon has had a massive change of heart about private clouds or not, gaining the CIA as a customer is a major coup. Competitors like IBM, HP, and Rackspace say their clouds are more reliable and far more secure than Amazon’s.

Link: http://www.businessinsider.com/cia-600-million-deal-for-amazons-cloud-2013-3

‘Anonymous’ hackers plan to shut down the Internet this Saturday

Posted on March 19, 2013December 30, 2021 by admini

.“The Anonymous hackers can certain cause local pockets of disruption, but these disruptions are going to be localized to networks where their attack machines are located, or where their ‘reflectors’ are located”, said Robert Graham of Errata Security.

“Just because I say Anonymous can’t do it doesn’t it mean it can’t be done,” the security expert said on Errata’s blog.

Link: http://bgr.com/2012/03/28/anonymous-hackers-plan-to-shut-down-the-internet-this-saturday/