#a ddos attack

http://www.everythingliveon.com/chinas-great-cannon-could-point-anywhere-when-next-fuse-is-lit/

China's Great Cannon Could Point Anywhere When Next Fuse Is Lit

China, which censors the Internet with its Great Firewall aka the “Golden Shield,” has a new censorship tool that is causing alarm. It’s known as the “Great Cannon.”

The University of Toronto’s Citizen Lab identified the tool in a report released last week.

The Great Cannon was first used in March, to launch a large-scale DDoS attack on GitHub and GreatFire.org, Citizen Lab said.

The attack apparently was designed to thwart efforts to circumvent Chinese censorship.

However, the Great Cannon could “be used to attack any target anywhere in the world,” said Tomer Weingarten, CEO of SentinelOne.

Catastrophic Potential

The Great Cannon can not only inject code into traffic but also suppress it; however, its design indicates it was created to inject code, Citizen Lab said.

In the attack on GreatFire.org and GitHub, it intercepted traffic sent to Baidu infrastructure servers that host analytics, social or advertising scripts.

The Great Cannon would respond to a request for certain JavaScript files on one of those servers. More than 98 percent of the time, it passed on the request; in the other 2 percent of cases, it sent back a malicious script conscripting the user into the DDoS attack.

“A weapon like this isn’t naturally restricted by borders and could be used by a variety of entities to do massive amounts of damage,” remarked Rob Enderle, principal analyst at the Enderle Group.

“This is one of those things you really don’t like to see, because the potential for catastrophic damage, such as shutting down commerce, is unacceptably high,” he told TechNewsWorld.

Future Fear and Loathing

Perhaps the most alarming thing about the Great Cannon is its as-yet-apparently unused ability to exploit by IP address, Citizen Lab pointed out.

Just switching the configuration from operating on traffic directed to a specific IP address to operating on traffic from a specific IP address would let the Cannon’s operator deliver malware to targeted individuals who communicate with any Chinese server not using cryptographic protection, such as Baidu’s ad network servers. A single request to such a server could result in the requester getting hit with a malicious payload.

“To conduct a DDoS attack to effectively shut down any site on the Internet … you just need the ability to generate a massive volume of traffic, and the Chinese can do that effectively by using their intercept methods,” SentinelOne’s Weingarten told TechNewsWorld.

DDoS Is Hell

DDoS has become the attack method of choice of late, and “45 percent of all organizations have been hit at least one time with a DDoS attack,” said Igal Zeifman, product evangelist at Incapsula.

The average size of DDoS attacks against VeriSign’s customers increased in the last quarter of 2014, the company reported.

Massive attacks over the holidays against the PlayStation Network and Xbox led Sony and Microsoft to form an anti-DDoS coalition in March.

That’s a refreshing development. A Kaspersky Lab survey found that 28 percent of all businesses believed protection against DDoS was not their concern but that of their Internet service providers.

To defend against DDoS attacks, organizations should be able to detect an attack rapidly and respond quickly, Zeifman told TechNewsWorld.

They should be able to differentiate between bad bots and legitimate users; have a Web application firewall for protection from application-level threats; and implement a solution that offers a time to mitigation that best meets their needs.

Anti-DDoS services “are only effective up to a certain volume,” Weingarten said, but they can help.

Like this:

http://www.everythingliveon.com/china-weaponizes-its-great-firewall-into-the-great-fire-cannon-menaces-entire-globe/

China weaponizes its Great Firewall into the GREAT FIRE CANNON, menaces entire globe

China has upgraded the website-blocking systems on its borders, dubbed The Great Firewall, so it can blast foreign businesses and orgs off the internet.

Researchers hailing from the University of Toronto, the International Computer Science Institute, the University of California Berkeley, and Princeton University, have confirmed what we’ve all suspected: China is hijacking web traffic entering the Middle Kingdom to overpower sites critical of the authoritarian state.

Typically, connections to web servers in the People’s Republic must pass through the nation’s border routers, which may inject malicious JavaScript into the fetched web pages. This code forces victims’ browsers to silently and continuously fire requests at selected targets.

These sites may end up being overwhelmed and crash as a result – a classic denial of service – meaning no one in the world can access them.

It would seem to be a clear case of China engineering a way to knock arbitrary websites off the internet for everyone.

Such an attack was launched last month at California-based GitHub.com, which was hosting two projects that circumvented the Great Firewall’s censorship mechanisms, and GreatFire.org, a website dedicated to fighting China’s web blocking. GitHub mitigated the assault to mostly stay online.

This weaponized firewall has been dubbed the Great Cannon by the researchers, and typically hijacks requests to Baidu’s advertising network in China. Anyone visiting a website that serves ads from Baidu, for example, could end up unwittingly silencing a foreign site disliked by the Chinese authorities.

(A technical writeup of the GitHub attack by Robert Graham of ErrataSec can be found here.)

“In the attack on GitHub and GreatFire.org, the Great Cannon intercepted traffic sent to Baidu infrastructure servers that host commonly used analytics, social, or advertising scripts,” the university researchers explained in a blog post on Friday.

“If the Great Cannon saw a request for certain JavaScript files on one of these servers, it appeared to probabilistically take one of two actions: it either passed the request onto Baidu’s servers unmolested (roughly 98.25 per cent of the time), or it dropped the request before it reached Baidu and instead sent a malicious script back to the requesting user (roughly 1.75 per cent of the time).”

The researchers note that the Great Cannon and Great Firewall are very similarly structured, with both taking internet traffic either coming in or going out of the country and analyzing it before either passing on or redirecting the traffic.

Unlike the Great Firewall, however, the Great Cannon operates with a very narrow focus, only intercepting traffic to a few specified locations before injecting it with JavaScript code to carry out the distributed denial-of-service attack.

The researchers are also convinced the Chinese government is directly behind the Great Cannon’s operations. They note that the Great Cannon and Great Firewall are located in facilities run by state-run Chinese ISPs.

“Deploying the Great Cannon is a major shift in tactics, and has a highly visible impact,” they wrote.

“It is likely that this attack, with its potential for political backlash would require the approval of high-level authorities within the Chinese government.”

http://www.everythingliveon.com/heartbleed-threat-wont-fade-away/

Heartbleed Threat Won't Fade Away

This week marks the first anniversary of the Heartbleed vulnerability that caused a panic across the Internet last year. While the flaw appears to have faded from the recollections of Net denizens, it still poses danger at many sites in cyberspace.

Heartbleed was discovered in April 2014 in an open source library, OpenSSL, used by the SSL protocol. SSL is used to encrypt data in transit on the Net. By exploiting the flaw with a specially crafted packet, hackers could extract data from a server’s memory in 64K chunks.

The vulnerability got its name from the “heartbeat” servers send out at short intervals to let other servers on the Net know that they’re alive and well. However, by exploiting a bug in the heartbeat function, an attacker can get the heartbeat to bleed more information than just “I’m alive” — information such as passwords, credit card data, Social Security numbers and anything else hanging around in memory at the time of the attack.

Despite grabbing lots of attention when it was first discovered, Heartbleed seems to have fallen victim to short-attention-span syndrome. Eighty-six percent of Americans said they’d never heard of Heartbleed in a March poll of 2,000 U.S. adults conducted by the Harris organization for Dashlane.

“There was a lot of coverage at the time, so it was hard not to hear about it,” Dashlane CEO Emmanuel Schalit told TechNewsWorld. “People just seem to have forgotten it.”

Not Bled Out Yet

That kind of memory lapse could prove dangerous to consumers, as many servers remain vulnerable to Heartbleed attacks. Eighty-four percent of the external servers of Global 2000 organizations remain vulnerable to cyberattacks due to Heartbleed, suggests a survey Venafi Labs released this week.

“Folks did a really great job of patching after Heartbleed was discovered,” said Kevin Bocek, vice president for security strategy and threat intelligence at Venafi.

However, Heartbleed also put at risk the certificates and the encryption keys used to sign those certificates. The quick and dirty solution to that problem was to reissue certificates for a website.

“The problem with Heartbleed was that you have to assume that the key itself was compromised,” Bocek told TechNewsWorld. “If you don’t change the key, you’re not fixing the problem, because an attacker can use the key to spoof a site or perform a man-in-the-middle attack.”

Long Tail of Death

The problem can be worse for larger organizations.

“It’s a very simple equation,” Bocek noted. “The more servers that were vulnerable, the more keys and certificates you have, the less time, effort and capability you have to fix it.”

As applications, virtual machines and servers are replaced, new keys will be created, so Heartbleed will bleed out in the long term — “but that could take years,” Bocek said. “It’ll be a long tail of death.”

Meanwhile, consumers — who may need their memories refreshed — need to take precautions should they run into a website compromised by Heartbleed.

“The only real thing the consumer can do is limit the risk by protecting personal digital information that sits in the cloud,” said Dashlane’s Schalit.

“The only thing under the consumer’s control to do that is having a unique password on every website,” he said. “At least then if one password is stolen, it doesn’t spread to other accounts and other websites.”

Bigger Problem

Heartbleed is a symptom of a larger problem, though, and that’s the dependence of the infrastructure of the Internet on under-resourced open source projects.

“About 66 percent of all servers connected to the Internet use some version of the OpenSSL library, but virtually no one is maintaining it,” said Pavel Krcma, CTO of Sticky Password.

“There can be problems hidden in these libraries for years, just because there are so few people taking care of these critical libraries,” he told TechNewsWorld.

“More companies have to invest in developing and testing OpenSSL,” added Krcma. “They need to share some of the money they make on products built on it.”

Breach Diary

March 30. British Airways confirms a number of its executive club frequent flyer accounts have been compromised by hackers. The data thieves apparenty obtained a database of user names and passwords from somewhere on the Internet and used them to mount the attack.

March 30. Bradley University in Peoria, Illinois, reveals personal information of some 4,700 current and former employees is at risk after malware discovered on school’s computer systems.

March 30. Uber denies its computer systems breached and user names and passwords stolen. Company was reacting to reports that thousands of its users’ credentials were being sold on the Internet underground.

March 31. Neustar survey of 250 IT pros in Europe, the Middle East and Africa finds DDoS attacks could expose 40 percent of businesses to losses of US$150,000 an hour at peak times.

March 31. Operators of GitHub, one the largest repositories for programming code on the Internet, say Distributed Denial of Service attack, which lasted five days, has subsided. Some security experts attributed the attack to state-sponsored Chinese hackers.

March 31. Google and University of California at Berkeley study finds that 5 percent of people visiting Google sites are infected with ad injectors. About a third of the injectors, the study said, could be classified as malware.

April 2. President Barack Obama issues executive order establishing framework for imposing sanctions on anyone engaged in malicious cyberactivity that aims to harm critical infrastructure, damage computer systems, and steal trade secrets or sensitive information.

April 2. U.S. District Judge Beth Labson Freeman rejects motion by Google to dismiss lawsuit alleging company violated the privacy of its Wallet users by sharing their personal information with outside developers.

April 2. U.S. Veterans Administration office in Denver says personal informaton of 508 patients compromised in document leaked to local TV station.

Upcoming Security Events

April 9. How Many of Your Digital Assets Are Currently Unmanaged? 2 p.m. ET. RiskIQ webinar. Free with registration.

April 11. B-Sides Nashville. Lipscomb University, Nashville, Tennessee. Fee: $10.

April 11-12. B-Sides Charm. Howard Community College, Gateway Building, Charles I. Ecker Business Training Center, 6751 Columbia Gateway Drive, Columbia, Maryland. Fee: TBD.

April 11-12. B-Sides Orlando. University of Central Florida, 4000 Central Florida Blvd., Orlando, Florida. Fee: $20.

April 15. Secure Government: Manage, Mitigate, Mobilize. Symantec Government Symposium, Walter E. Washington Convention Center, Washington, D.C. Registration: government, free; non-government, $295.

April 16. Enterprise Defense and Why You’re Most Likely Doing It All Wrong. 2 p.m. ET. Black Hat webcast. Free with registration.

April 17-18. B-Sides Algiers. Ecole Nationale Supérieure d’Informatique, Oued Smar, Algiers, Algeria. Free.

April 18. B-Sides Oklahoma. Hard Rock Casino, 777 W. Cherokee St., Catoosa, Oklahoma. Free.

April 19-20. B-Sides San Francisco. 135 Bluxome St., San Francisco. Registration: $20, plus $2.09 fee.

April 20-24. RSA USA 2015. Moscone Center, San Francisco. Registration: before March 21, $1,895; after March 20, $2,295; after April 17, $2,595.

April 25. B-Sides Rochester. German House, 315 Gregory St., Rochester, New York. Free.

April 29. Best Practices for DDos Protection. 9 a.m. ET. Arbor Networks webinar. Free with registration.

April 29. SDN and NFV: Protecting the Next Wave Infrastructure. 11 a.m. ET. Arbor Networks webinar. Free with registration.

April 29. Dark Reading’s Security Crash Course. Mandalay Bay Convention Center. Las Vegas, Nevada. Registration: through March 20, $899; March 21-April 24, $999; April 25-29, $1,099.

May 6-7. Suits and Spooks London. techUK, 10 Saint Bride St., London. Registration: government/military, $305; members, $486; industry, $571.

May 2. B-Sides San Antonio. Texas A&M, Brooks City Base, San Antonio, Texas. Fee: $10.

May 9. B-Sides Boston. Microsoft 1 Cambridge Center, Cambridge, Massachusetts. Fee: $20.

May 13. SecureWorld Houston. Norris Conference Center, Houston, Texas. Registration: open sessions pass, $25; conference pass, $175; SecureWorld plus training, $545.

June 8-10. SIA Government summit 2015. W Hotel, Washington, D.C. Meeting Fees: members, $595; nonmember, $795.

June 8-11. Gartner Security & Risk Management Summit. Gaylord National, 201 Waterfront St., National Harbor, Maryland. Registration: before April 11, $2,795; after April 10, standard $2,995, public sector $2,595.

June 16-17. Black Hat Mobile Security Summit. ExCel London, London, UK. Registration: before April 11, Pounds 400; before June 16, Pounds 500; after June 15, pounds 600.

August 1-6. Black Hat USA. Mandalay Bay, Las Vegas, Nevada. Registration: before June 6, $1795; before July 25, $2195; after July 24, $2595.

http://www.everythingliveon.com/github-defenses-hold-in-4-days-and-counting-battle/

GitHub Defenses Hold in 4-Days-and-Counting Battle

After battling a distributed denial of service attack for four days, GitHub on Monday was able to restore normal service levels.

The primary target of the assault is GreatFire.org, which is hosted on GitHub. GreatFire has attracted the ire of the Chinese government for offering anticensorship tools, including access to uncensored versions of The New York Times.

“Very clearly, the Cyberspace Administration of China is behind both of the recent DDoS attacks,” GreatFire Co-founder Charles Smith told TechNewsWorld.

The attack used malicious code inserted in China’s version of Google Analytics, Baidu Analytics, to turn millions of unwitting users into procreators of crippling DDoS traffic aimed at GreatFire.org and GitHub, Smith explained in a post on the GreatFire website.

“Inserting malicious code in this manner can only be done via the Chinese Internet backbone. Even if CAC did not launch the DDoS attack directly, they are responsible for managing the Internet in China and it is not possible that they did not know what was happening,” he wrote.

“Hijacking the computers of millions of innocent Internet users around the world is particularly striking as it illustrates the utter disregard the Chinese authorities have for international as well as even Chinese Internet governance norms,” Smith added.

Atypical Attack

The attack on GitHub and GreatFire is atypical in both its length and intensity.

“Amateur attackers tend to give up after a while, because it’s a lot of effort to keep up the attack, especially without some kind of financial motivation,” said Richard Stiennon, chief research analyst at IT Harvest.

“It’s unusual that it’s been going on for four days like this,” he told TechNewsWorld.

The magnitude of the attack — 700,000 requests per second — is also unusual.

“That’s bigger than the majority of the attacks we see,” said Ofer Gayer, a researcher with Incapsula. “We usually see attacks at a maximum of 200,000 to 300,000 requests per second.”

Because of the magnitude of the attack, it’s likely a large player like a nation state is behind it.

“You need to have good control over infrastructure to mount an attack like this,” he told TechNewsWorld.

“The Chinese have control of the infrastructure of an entire country, so they can divert traffic to wherever they want, inject code they want to run, and create requests with the code to GitHub,” Gayer explained.

Clever Adversaries

The method used to launch the attack is difficult to combat.

“With botnets, all the requests look pretty much the same, so once patterns are identified, you can block them,” Gayer pointed out.

“In this case, it’s very diverse. You have many different IPs and browsers creating non-homogenous traffic,” he noted. “This attack is very clever, and it’s not very easy to mitigate.”

However, GitHub has come up with a clever way to counter the attack. Once it identified the malicious resource generating requests, GitHub used it to trigger an alert for a user. If the user didn’t respond to the alert, the loop creating requests would break, and a device would stop sending requests.

“That reduced traffic from a user by a factor of anywhere from 10 to 100,” Gayer said.

US Action Needed?

If China can be identified with some degree of certainty as the perpetrator of the attack, the U.S. government should intervene, maintained IT Harvest’s Stiennon.

“We’ve already established a precedent with the reaction to the attack on Sony,” he said.

“As soon as they can get the same level of assurance of attribution, then, at the very least, they should use diplomatic efforts to get them to stop,” Stiennon argued.

“GitHub is an extremely important website for software development,” he said. “Many of our startups use GitHub as their software repository. It is part of the core infrastructure for our technology industry.”

If China is involved, its decision to attack GitHub could backfire on the country.

http://www.everythingliveon.com/github-suffers-largest-ddos-attack-in-sites-history/

GitHub suffers 'largest DDoS' attack in site's history

GitHub is suffering a DDoS attack deemed the largest in the website’s history and believed to originate from China.

The coding website is a popular repository for projects from game engines to security applications and web app frameworks, and is used by programmers and tech firms to develop and share tools. Since Thursday, the website has been under fire in a DDoS attack of a scale which has forced GitHub staff to rally and attempt to mitigate access problems.

In a blog post last week, GitHub said the distributed denial of service (DDoS) attack is the largest in github.com’s history. Beginning on March 26, at the time of writing the onslaught is yet to end.

GitHub says the attack “involves a wide combination of attack vectors,” which “includes every vector we’ve seen in previous attacks as well as some sophisticated new techniques that use the web browsers of unsuspecting, uninvolved people to flood github.com with high levels of traffic.”

“Based on reports we’ve received, we believe the intent of this attack is to convince us to remove a specific class of content,” GitHub says.

The “specific class” of content may be related to China. As reported by the Wall Street Journal, GitHub’s traffic surge is based on visits intended for China’s largest search engine, Baidu. Security experts told the publication that the vast levels of traffic intended for Baidu has paralyzed GitHub over the DDoS attack’s duration.

Specifically, two particular sections of GitHub have been targeted. One content area is run by Greatfire.org, an anticensorship organization which releases tools to help Chinese citizens circumvent the county’s stringent censorship controls — known colloquially as the “Great Firewall of China. The second links to copies of the New York Time’s Chinese language website and other banned domains.

Chinese security specialist Anthr@x from Insight Labs, currently living outside of the country, said when using Baidu at the time of the first attack, “my first thought was someone naughty XSSed the page,” and after further inspection, discovered the page was trying to load two URLs: github.com/greatefire/ and github.com/cn-nytimes/ every few seconds.

Anth@x believes the attack was due to HTTP hijacking, and “a certain device at the border of China’s inner network and the Internet has hijacked the HTTP connections went into China, replaced some javascript files from Baidu with malicious ones that would load every two seconds.” Block code execution was also apparently used to prevent looping. The security researcher states:

“In other words, even people outside China are being weaponized to target things the Chinese government does not like, for example, freedom of speech.”

Both Greatfire.org and the New York Times are censored in China.

According to tweeted GitHub status updates, the website has “adjusted mitigation tactics and are observing improved TCP performance for the majority of non-attack traffic.” 87 hours into the attack, the mitigation techniques appear to be working.