#a dos attack

http://www.everythingliveon.com/steer-clear-of-ios-8s-infinite-loop/

Steer Clear of iOS 8's Infinite Loop

A flaw in iOS 8 allows hackers essentially to crash apps that perform SSL communications whenever they like. Skycure reported the bug at the RSA security conference held last week, advising owners of iOS devices to upgrade to iOS 8.3.

Apple this week confirmed that iOS 8.3 addresses the vulnerability, according to Skycure.

An attack would involve specially crafting an SSL certificate to regenerate a bug. SSL is used in almost all apps in the iTunes App Store, which means pretty much every device user running iOS 8 could be at risk.

The flaw is an SSL parsing vulnerability that affects iOS itself, and heavy use of affected devices will crash the OS, Skycure said.

Further, under certain conditions, affected devices can be put into a reboot loop, which locks them up. If the attack’s coming through a WiFi network, victims can’t disable the WiFi interface to stop it. They’re stuck in what Skycure has dubbed a “No iOS Zone.”

However, “we have not seen any instances [of exploits based on this vulnerability] in the wild,” Skycure CEO Adi Sharabani told TechNewsWorld.

The No iOS Zone

Combining the iOS 8 SSL vulnerability with WiFiGate, which Skycure disclosed in 2013, or with the Karma tool, would let attackers form a No iOS Zone.

Attackers could automatically recruit any iOS device in range into what essentially would be a mobile botnet that could launch denial of service attacks on target iOS devices.

The possibility of such an attack is real, according to Simone Margaritelli, a developer and security researcher at Zimperium.

“I recently used a Karma attack against my updated iOS device, and it worked like a charm,” he told TechNewsWorld.

Victims can’t do anything about the No iOS Zone, Skycure said.

Follow the Money

“Mobile malware and WiFi hacks like the No iOS Zone are on the rise, driving a multibillion-dollar market opportunity for mobile security companies,” said Steve Morgan, CEO of Cybersecurity Ventures.

“This is like the early days of antivirus, when the vendors were leapfrogging each other in the media as they each scurried to be the first one to report a bug,” he told TechNewsWorld. “Companies … who report a bug initially are poised for growth.”

Nothing to Fear but Fear Itself?

Attacks exploiting the iOS 8 SSL vulnerability “will happen, but I would be much more worried about the prevalence of bugs in iOS that allow malicious apps or malicious websites to run code on the devices,” said Marble Security CEO Dave Jevans.

“In the one month between the release of iOS 8.2 and iOS 8.3, Apple fixed 37 iOS security bugs, one of which also allowed denial of service attacks over the air,” he told TechNewsWorld.

“There were also nine security bugs fixed that were related to malicious apps or websites taking over devices or running unauthorized code on them. The myth that iOS is secure is just that — a myth,” Jevans added.

The iOS 8 SSL vulnerability Skycure found is “similar to the Darwin Nuke flaw discovered by Kaspersky,” said Jimmy Shah, senior director of research at Zimperium.

The current threat level for the vulnerability is low, he told TechNewsWorld, because “DoS is not persistent, and no code execution is involved.”

Staying Safe

Users whose iOS devices keep on crashing or rebooting should disconnect from a troublesome WiFi network or change their location, Skycure recommended, and they should upgrade to version 8.3 post haste.

Users of iOS devices can enable the OS’s “Ask to join networks” feature to protect themselves, Zimperium’s Shah suggested.

“Android and iOS are constantly improving their security mechanisms,” he remarked. Although iOS is generally believed to be the more secure of the two, “in reality [they] are equally secured, with pluses and minuses for each.”

Like this:

http://www.everythingliveon.com/github-suffers-largest-ddos-attack-in-sites-history/

GitHub suffers 'largest DDoS' attack in site's history

GitHub is suffering a DDoS attack deemed the largest in the website’s history and believed to originate from China.

The coding website is a popular repository for projects from game engines to security applications and web app frameworks, and is used by programmers and tech firms to develop and share tools. Since Thursday, the website has been under fire in a DDoS attack of a scale which has forced GitHub staff to rally and attempt to mitigate access problems.

In a blog post last week, GitHub said the distributed denial of service (DDoS) attack is the largest in github.com’s history. Beginning on March 26, at the time of writing the onslaught is yet to end.

GitHub says the attack “involves a wide combination of attack vectors,” which “includes every vector we’ve seen in previous attacks as well as some sophisticated new techniques that use the web browsers of unsuspecting, uninvolved people to flood github.com with high levels of traffic.”

“Based on reports we’ve received, we believe the intent of this attack is to convince us to remove a specific class of content,” GitHub says.

The “specific class” of content may be related to China. As reported by the Wall Street Journal, GitHub’s traffic surge is based on visits intended for China’s largest search engine, Baidu. Security experts told the publication that the vast levels of traffic intended for Baidu has paralyzed GitHub over the DDoS attack’s duration.

Specifically, two particular sections of GitHub have been targeted. One content area is run by Greatfire.org, an anticensorship organization which releases tools to help Chinese citizens circumvent the county’s stringent censorship controls — known colloquially as the “Great Firewall of China. The second links to copies of the New York Time’s Chinese language website and other banned domains.

Chinese security specialist Anthr@x from Insight Labs, currently living outside of the country, said when using Baidu at the time of the first attack, “my first thought was someone naughty XSSed the page,” and after further inspection, discovered the page was trying to load two URLs: github.com/greatefire/ and github.com/cn-nytimes/ every few seconds.

Anth@x believes the attack was due to HTTP hijacking, and “a certain device at the border of China’s inner network and the Internet has hijacked the HTTP connections went into China, replaced some javascript files from Baidu with malicious ones that would load every two seconds.” Block code execution was also apparently used to prevent looping. The security researcher states:

“In other words, even people outside China are being weaponized to target things the Chinese government does not like, for example, freedom of speech.”

Both Greatfire.org and the New York Times are censored in China.

According to tweeted GitHub status updates, the website has “adjusted mitigation tactics and are observing improved TCP performance for the majority of non-attack traffic.” 87 hours into the attack, the mitigation techniques appear to be working.