“First-known Android DDoS malware infects phones in 100 countries”

A half dozen technology and security companies — some of them competitors — issued the exact same press release today. This unusual level of cross-industry collaboration caps a successful effort to dismantle ‘WireX,’ an extraordinary new crime machine comprising tens of thousands of hacked Android mobile devices that was used this month to launch a series of massive cyber attacks.

Experts tracking the attacks soon zeroed in on the malware that powers WireX: Approximately 300 different mobile apps scattered across Google‘s Play store that were mimicking seemingly innocuous programs, including video players, ringtones or simple tools such as file managers.

Perhaps to avoid raising suspicion, the tainted Play store applications all performed their basic stated functions. But those apps also bundled a small program that would launch quietly in the background and cause the infected mobile device to surreptitiously connect to an Internet server used by the malware’s creators to control the entire network of hacked devices. From there, the infected mobile device would await commands from the control server regarding which Websites to attack and how.

WireX botnet likely began its existence as a distributed method for conducting “click fraud,” a pernicious form of online advertising fraud that will cost publishers and businesses an estimated $16 billion this year, according to recent estimates. Multiple antivirus tools currently detect the WireX malware as a known click fraud malware variant.

Identical copies of the WireX report and Appendix are available at the following links:

Flashpoint

Akamai

Cloudflare

New Post has been published on https://www.securityinet.com/massive-ddos-attack-dyn-dns-service-popular-sites-offline/

Massive DDoS Attack Against Dyn DNS Service Popular Sites Offline

Massive DDoS Attack Against Dyn DNS Service Popular Sites Offline

Twitter, Reddit, Spotify, Etsy, Box, Wix Customer Sites Squarespace Customer Sites and bunch of other websites were offline earlier today. That’s because someone conducted a massive distributed denial of service (DDoS) attack on the Dyn, a world renowned Domain Name Servers (DNS) service provider.

Not all users were affected equally, however, and sites appear to have been intermittently accessible. To see a full list of sites that have reportedly been affected, click here.

Cyber attacks are getting evil and worst nightmare for companies day-by-day, and the Distributed Denial of Service (DDoS) attack is one such attacks that cause a massive damage to any service.

 It was not immediately clear who was responsible and Gillian Christensen of the U.S. Department of Homeland Security said the agency was ‘investigating all potential causes.’

Outages overview

10/21/2016

Wikia

Problems at Wikia

10/21/2016

Uplay

Problems at Uplay

10/21/2016

Battle.net

Problems at Battle.net

10/21/2016

T-Mobile

Problems at T-Mobile

10/21/2016

Cox

Problems at Cox

10/21/2016

Photobucket

Problems at Photobucket

10/21/2016

Quora

Problems at Quora

10/21/2016

Salesforce.com

Problems at Salesforce.com

10/21/2016

Office 365

Problems at Office 365

10/21/2016

Cloudflare

Problems at Cloudflare

10/21/2016

Steam

Problems at Steam

10/21/2016

Go Daddy

Problems at Go Daddy

10/21/2016

Hulu

Problems at Hulu

10/21/2016

Cable One

Problems at Cable One

10/21/2016

The Division

Problems at The Division

10/21/2016

Fatcow

Problems at Fatcow

10/21/2016

WOW

Problems at WOW

10/21/2016

PNC

Problems at PNC

10/21/2016

Disqus

Problems at Disqus

10/21/2016

Suddenlink

Problems at Suddenlink

10/21/2016

Kayak

Problems at Kayak

10/21/2016

Bright House Networks

Problems at Bright House Networks

10/21/2016

Zillow

Problems at Zillow

10/21/2016

WeTransfer

Problems at WeTransfer

10/21/2016

Hostgator

Problems at Hostgator

10/21/2016

HBO Go

Problems at HBO Go

10/21/2016

Verizon

Problems at Verizon

10/21/2016

Heroku

Problems at Heroku

10/21/2016

Star Wars Battlefront

Problems at Star Wars Battlefront

10/21/2016

Overwatch

Problems at Overwatch

10/21/2016

eBay

Problems at eBay

10/21/2016

Rocket League

Problems at Rocket League

10/21/2016

CenturyLink

Problems at CenturyLink

10/21/2016

GTA 5

Problems at GTA 5

10/21/2016

Call of Duty

Problems at Call of Duty

10/21/2016

Youtube

Problems at Youtube

10/21/2016

Origin

Problems at Origin

10/21/2016

Crunchyroll

Problems at Crunchyroll

10/21/2016

Reddit

Problems at Reddit

10/21/2016

Comcast

Problems at Comcast

10/21/2016

Frontier

Problems at Frontier

10/21/2016

Mediacom

Problems at Mediacom

10/21/2016

Jive

Problems at Jive

10/21/2016

Rainbow Six

Problems at Rainbow Six

10/21/2016

Xbox Live

Problems at Xbox Live

10/21/2016

AT&T

Problems at AT&T

10/21/2016

2k

Problems at 2k

10/21/2016

Gmail

Problems at Gmail

10/21/2016

Whatsapp

Problems at Whatsapp

10/21/2016

RCN

Problems at RCN

All of these sites and services are reportedly experiencing outages and downtime, either completely or partially.

One more list of affected websites :

MySpace.com Box.com Twitter.com Schoology and Apex Npmjs.com (Node Package Manager (major javascript package manager) Roblox.com Github.com Spotify.com Shopify.com Freshbooks.com Netflix.com (slow loading time) The Boston Globe The New York Times PayPal Theverge.com Pinterest.com Constantcontact.com Playstation Network (PSN) Revcontent.com Fox News Elder Scrolls Online Starbucks rewards/gift cards Braintree Zoho CRM xbox.com Indeed.com ActBlue Grubhub Kayak Basecamp Yammer Ancersty.com Mashable Intercom.com Disqus Eventbrite Wufoo.com Iheart.com (iHeartRadio) Business Insider Imgur NHL.com Cleveland.com Credit Karma Squarespace Customer Sites Atom.io Wikia Weebly nimbleschedule.com Okta Big cartel Zendesk.com Blue Host dailynews.com Twillo Intercom donorschoose.org Eve Online Weather.com PagerDuty Recode Wix Customer Sites Speed Test Salsify.com Yelp People.com Wired.com Genonebiology.com Guardian.co.uk HBO Now youneedabudget.com time.com Qualtrics BBC Etsy CNN Urbandictionary SBNation Zillow.com WSJ.com Bill.com WhatsApp.com MLB.com Namecheap.com Chewy.com Applicant Tracking System and Recruiting Software | iCIMS.com WorkMarket Quora Kijiji PayCor My.WPengine Dyn.com Netlog HomeLight Sterlingbank.com (sign in issues) ipage.com isitdownrightnow.com

  Recently, the Internet witnessed a record-breaking largest DDoS attack of over 1 Tbps against France-based hosting provider OVH, and now the latest victim of the attack is none other than Dyn DNS provider.

The attack appears to have started just after 7am ET and appears to have affected huge swaths of the East Coast and much of the Midwest. Level3, which monitors internet activity, shows the extent of the outage.

A sudden outage of popular sites and services, including Twitter, SoundCloud, Spotify, and Shopify, for many users, is causing uproar online. It’s because of a DDoS attack against the popular Domain Name System (DNS) service provider Dyn, according to a post on Ycombinator.DNS act as the authoritative reference for mapping domain names to IP addresses. In other words, DNS is simply an Internet’s phone book that resolves human-readable web addresses, like thehackernews.com, against IP addresses.

Dyn DNS is used by many websites and services as their upstream DNS provider, including Twitter, Spotify, SaneBox, Reddit, Box, Github, Zoho CRM, PayPal, Airbnb, Freshbooks, Wired.com, Pinterest, Heroku and Vox Media properties.

A couple of months ago researchers exposed Lizard Squad group hacking CCTV systems and carrying DDoS attacks on financial and government institutions in Brazil whilst the DDoS prevention firm Sucuri and Incapsula revealed that thousands of CCTV cameras have not only been hacked but also turned into DDoS botnet worldwide – reason, once again: their weak login credentials.

However, Linux-based IoT devices are the prime target for cyber criminals. Recently, Luabot and Bashlite aka Lizkebab malware were found taking over Linux-based CCTV cameras and attacking banking and small business worldwide.

   DDOS Digital Attack Map  – not showing and not working during the attack :

 Fortinet Threat Map

https://threatmap.fortiguard.com/

Norse Attack Map

map.norsecorp.com/

 Is i think there is a problem with iot devices and the only solution is to patch them . To mitigate thous kinds of attacks you need very powerful anti DDos Dos system and as we see today (21 October) there is a problem with that kind of device. Researches will now spend tons of time to learn how to mitigate thous kinds of attacks .

I think couple possible solutions L:

Patch problematic/affected devices

Invent an powerful anti DDos hardware that even an small comapy`s can buy.

Mitigate the attack by learning it out – thous devices have signatures and by thous signatures the prevention hardware on ISP level need to prevent thous kinds of attacks.

Block all traffic from thous kinds of devices – if this iot device is violating in big traffic activity (block IP in ISP level)

   UPDATE 1# 22.10.2016 01:12

New Post has been published on http://www.newsnish.com/technology/web-social/ddos-botnet-leverages-thousands-of-insecure-soho-routers/

DDoS Botnet Leverages Thousands of Insecure SOHO Routers

Small office and home office (SOHO) routers are an increasingly common target for cybercriminals, not because of any vulnerability, but because most routers are loosely managed and often deployed with default administrator credentials.

A new report suggests that hackers are using large botnet of tens of thousands of insecure home and office-based routers to launch Distributed Denial-of-Service (DDoS) attacks. Security researchers from DDoS protection firm Incapsula uncovered a router-based botnet, still largely active while investigating a series of DDoS attacks against its customers that have been underway since at least last December, 2014.

Over the past four months, researchers have recorded malicious traffic targeting 60 of its clients came from some 40,269 IP addresses belonging to 1,600 ISPs around the world. Almost all of the infected routers that were part of the botnet appear to be ARM-based models from a California-based networking company Ubiquiti Networks, sold across the world.

This makes researchers believed that the cyber criminals were exploiting a firmware vulnerability in the routers.

What’s revealed in the close inspection?

However, this assumption was proved wrong when inspected deeply, revealing that… All of the compromised routers could be remotely accessible on the default ports (via HTTP and SSH). Almost all of those accounts continued to make use of vendor-provided login credentials

This basically opens the door for an attacker to man-in-the-middle (MitM) attacks, eavesdrop on all communication, cookie hijack, and allows hackers to gain access to other local network devices such as CCTV cameras.

Router makers design their devices in such a way that it can be easily connected, and therefore they give each user the same administrator credential, without giving any warning to change the default credentials. Moreover, instead of allowing users to turn on remote administration, the manufacturers make it on by default.

“Given how easy it is to hijack these devices, we expect to see them being exploited by additional perpetrators,” researchers wrote. “Even as we conducted our research, the Incapsula security team documented numerous new malware types being added—each compounding the threat posed by the existence of these botnet devices.”

Almost all of the infected routers that were part of the botnet appear to be ARM-based models from a California-based networking company Ubiquiti Networks, sold across the world. This makes researchers believed that the cyber criminals were exploiting a firmware vulnerability in the routers.