Telegram Sofre Poderoso Ataque DDoS Da China Durante Protestos De Hong Kong

Por Mohit Kumar em 13/06/19 no site The Hacker News

O Telegram, um dos mais populares aplicativos de mensagens criptografadas, ficou brevemente offline ontem para centenas de milhares de usuários em todo o mundo depois que um poderoso ataque de negação de serviço distribuído (DDoS) atingiu seus servidores.

O fundador do telegrama, Pavel Durov, revelou mais tarde que o ataque estava principalmente vindo dos endereços IP localizados na China, sugerindo que o governo chinês poderia estar por trás disso para sabotar os manifestantes de Hong Kong.

Desde a semana passada, milhões de pessoas em Hong Kong estão lutando contra seus líderes políticos por causa das emendas propostas a uma lei de extradição que permitiria que uma pessoa detida em Hong Kong fosse julgada em outro lugar, inclusive na China continental.

Muitas pessoas a veem como uma ameaça fundamental às liberdades cívicas do território e ao estado de direito.

Muitas pessoas em Hong Kong estão atualmente usando o serviço de mensagens criptografadas do Telegram para se comunicar sem serem espionadas, organizar o protesto e alertar umas às outras sobre as atividades no local.

De acordo com a Telegram, a empresa recebeu " GADZILLIONS de pedidos de lixo " que impedem seus servidores de processar solicitações legítimas, e o ataque "tamanho de ator de estado" foi rastreado até os endereços IP na China.

"Endereços IP vindos principalmente da China. Historicamente, todos os DDoS do tamanho de atores estaduais (200-400 Gb / s de lixo) que nós experimentamos coincidiram no tempo com protestos em Hong Kong (coordenados em @ telegram). Este caso não foi uma exceção, "O fundador do telegrama, Pavel Durov, twittou .

Embora seja evidente que um ataque DDoS não tenha nada a ver com a segurança dos dados armazenados nos servidores de destino; em vez disso, pretende levar um serviço offline, a empresa ainda garantiu que os dados do usuário são seguros.

No entanto, não é a primeira vez que o serviço Telegram é usado com força usando um ataque DDoS durante a agitação política para perturbar os ativistas.

New Mirai Okiru Botnet targets devices running widely-used ARC Processors

Mohit Kumar em 15/01/2018 no site The Hacker News.

The cybersecurity threat landscape has never been more extensive and is most likely to grow exponentially in 2018.

Although the original creators of Mirai DDoS botnet have already been arrested and jailed, the variants of the infamous IoT malware are still in the game due to the availability of its source code on the Internet.

Security researchers have spotted a new variant of infamous Mirai IoT malware designed to hijack insecure devices that run on ARC embedded processors.

Until now, Mirai and its variants have been targeting CPU architectures—including x86, ARM, Sparc, MIPS, PowerPC and Motorola 6800—deployed in millions of Internet of Things (IoT) devices.

Dubbed Okiru, the new Mirai variant, first spotted by @unixfreaxjp from MalwareMustDie team and notified by independent researcher Odisseus, is a new piece of ELF malware that targets ARC-based embedded devices running Linux operating system.

"This is the FIRST TIME ever in the history of computer engineering that there is a malware for ARC CPU, & it is #MIRAI OKIRU!! Pls be noted of this fact, & be ready for the bigger impact on infection Mirai (specially #Okiru) to devices hasn't been infected yet," Odisseus tweeted.

ARC (Argonaut RISC Core) embedded processor is the world's second-most-popular CPU core that's being shipped in more than 2 billion products every year, including cameras, mobile, utility meters, televisions, flash drives, automotive and the Internet of Things.

However, this isn't first Mirai botnet variant based on Linux ELF malware. Mirai also has another ELF-based variant, which was designed to target devices running MIPS and ARM processors.

It should also be noted that Okiru, which has previously been also named as Satori IoT botnet (another Mirai variant discovered late last year), is "very different" from Satori despite having several similar characteristics, as explained in a Reddit thread.

Record-Breaking DDoS? The Calm Before The Storm

IoTs are currently being deployed in a large variety of devices throughout your home, businesses, hospitals, and even cities (smart cities), but they're routinely being hacked and used as cyber weapons due to lack of stringent security measures and insecure encryption mechanisms.

If you are unaware, the world's largest 1 Tbps DDoS attack so far was launched from just 152,000 infected IoT devices using Mirai botnet, and in a separate attack, just 100,000 devices took down the popular DynDNS service in late 2016.

Since Okiru has been ported to target a new range of millions of "expectedly insecure" devices running ARC processors, the DDoS attack going to be generated by Okiru botnet would probably be the biggest cyberattack ever.

"From this day, the landscape of #Linux #IoT infection will change. #ARC CPU has produced #IoT devices more than 1 billion per year. So these devices are what the hackers want to aim to infect #ELF #malware with their #DDoS cannons. It's a serious threat will be," Odisseus tweeted.

The fresh arrival of ARC-based IoT devices into botnet scheme will exponentially raise the number of insecure devices to an unprecedented size, making it easy for hackers to gain control over a large number of poorly configured and vulnerable IoT devices.

Bitcoin exchange hit by DDoS attack after kidnapping of its official

Por Wagas em 29/12/2017 no site HackRead

Bitcoin is one of those cryptocurrencies whose value has rapidly increased making it a lucrative target for cybercriminals and hackers. That is the reason we often read about scams including malware, phishing or malicious apps aiming at cryptocurrency exchanges and investors.

Kidnapping

On December 26th, 2017, Russian blockchain expert Pavel Lerner, one of the employees at Exmo cryptocurrency was kidnapped in Kiev, Ukraine after a group of men in balaclavas dragged him into a black Mercedes-Benz when Lerner left for work.

The incident was first reported by Ukranian and Russian media. The police, on the other hand, has also confirmed the incident but declined to share the victim’s identity citing that the case is under investigation.

Pavel Lerner (Facebook)

Exmo Finance which is a United Kingdom-based cryptocurrency exchange with operations in India, Russia, Spain, Thailand, Lithuania, Singapore and the United States told RT.

“Any information regarding his whereabouts is very much appreciated. Despite the situation, the exchange is working as usual. We also want to stress that nature of Pavel’s job at EXMO doesn’t assume access either to storages or any personal data of users. All users funds are absolutely safe”

DDoS Attacks

On December 28th, 2017, that is two days after Lerner’s kidnapping, EXMO tweeted that its servers are under DDoS attack, as a result, its website suffered an outage. “EXMO is under the DDoS attack. The site will be available within half an hour. We apologize for the temporary inconvenience. Sincerely, The EXMO Team.”

EXMO@Exmo_com

EXMO is under the DDoS attack.

The site will be available within half an hour.

We apologize for the temporary inconvenience.

Sincerely, The EXMO Team

6:57 AM - Dec 28, 2017

•  1010 Replies
 
 7
• 7 Retweets
 
 14
• 14 likes

Twitter Ads info and privacy

The company did not provide any further information about the cyber attack, however, its customers used Twitter to show their anger and complaint about poor support, slow service and not returning their funds.

Not The First Kidnapping

Although it is unclear whether Lerner’s kidnapping is related to his job and the fact that he analyzes a multi-billion industry or whether it was a result of some personal grudges; this is not the first time when the terms cryptocurrency and kidnapping have been used altogether.

A couple of weeks ago, a man in New York was kidnapped, held at gunpoint and asked for the 24-word secret passphrase for his Ethereum (Bitcoin rival) cryptocurrency. As a result, $1.8 million worth of Ethereum belonging to the victim were stolen.

5 Notable DDoS Attacks of 2017

Por David Bisson em 21/12/2017 no site The State of Security

We all know what a great year distributed denial-of-service (DDoS) attacks had in 2016. In the last four months, the web registered two significant DDoS campaigns. The first targeted Brian Krebs at a peak size of 620 Gbps. The second struck Dyn and, in so doing, took down Twitter, Amazon, Spotify and other clients of the DNS provider’s critical infrastructure.

2017 was far quieter in terms of DDoS attacks, by comparison. But not for want of trying on the part of computer criminals. Indeed, Arbor Networks detected 6.1 million campaigns through September 30.

This figure breaks down to 22,426 attacks per day, 934 per hour, and 15 per minute. Additionally, the provider of network monitoring software observed several massive DDoS campaigns in 2017, with one even surpassing the attack that struck Krebs at 622 Gbps.

Amidst these millions of attacks, a few stood out for their targets and consequences. Here are five campaigns in particular that deserve mention.

1. Melbourne IT

Domain name registrar Melbourne IT, as well as two of its subsidiaries Netregistry and TPP Wholesale, suffered a DDoS attack on April 13. The assault began at 10:00 local time, forcing the victimized organizations to inform customers that their cloud hosting and mailing platforms, among other services, were at the time unavailable.

By 11:30, the companies had returned normal service by implementing “our DDoS mitigation services as standard operating procedure and… international traffic management measures.” It took them another hour to tell customers that they had resolved the issues and that they would continue to monitor the situation.

2. DreamHost

At 09:20 PDT on August 24, a DDoS attack deluged web hosting provider and domain name registrar DreamHost, knocking its systems –particularly its DNS infrastructure – offline.

The Register‘s Iain Thomson believes the attack originated from those who opposed the company’s decision to take on as Punished Stormer, a reincarnation of the neo-Nazi Daily Stormer website for which CloudFlare terminated service following the Charlottesville protests, as a customer that same day. DreamHost mitigated the attack a few hours later.

3. UK National Lottery

After 19:00 local time on September 30, someone decided to target the UK National Lottery with a DDoS campaign. The attack knocked the Lottery’s website www.national-lottery.co.uk and its mobile app offline, which prevented many UK citizens from playing the Lottery without visiting a partner retailer to purchase a ticket.

By 23:00 local time, the bulk of the attack had died down. Even so, the Lottery’s website and app continued to experience lesser issues until 03:00.

4. Electroneum

Electroneum cryptocurrency startup had crowdfunded $40 million worth of Bitcoin and Ether following an initial coin offering (ICO). Just before it launched its mobile mining app on November 2, the company’s website suffered a DDoS attack.

The campaign led Electroneum to lock investors out of their accounts while it worked to restore its network access. In the meantime, the Financial Conduct Authority took a moment to remind investors that ICOs offer no protection, which means investors should “be prepared to lose [their] entire stake.”

5. Boston Globe

On November 8 at approximately 15:00 EST, the Boston Globe suffered what was likely a probe to gauge the anti-DDoS defenses of bostonglobe.com and other websites owned by the company. This initial wave disrupted the newspaper’s telephones. It also interrupted its editing system.

Subsequently, the bad actors took the results of their test and resumed their attack at 11:00 EST on November 9. In so doing, they prevented many Boston Globe employees from doing their jobs and rendered bostonglobe.com inaccessible. Relief eventually came in mid-afternoon when the company’s Internet service provider put effective anti-DDoS measures in place.

Some Advice for the New Year

In light of the DDoS attacks discussed above, it’s important that companies make sure they prepare themselves for 2018 and beyond. Technology firms will continue to work to take down DDoS botnets like WireX. However, organizations should make sure they’ve protected themselves with DDoS mitigation technologies in the meantime.

For additional advice on how to defend against DDoS attacks, click here.

Hackers Targeting Servers Running Database Services for Mining Cryptocurrency

 Swati Khandelwal em 21/12/20017 no site The Hacker News

Security researchers have discovered multiple attack campaigns conducted by an established Chinese criminal group that operates worldwide, targeting database servers for mining cryptocurrencies, exfiltrating sensitive data and building a DDoS botnet.

The researchers from security firm GuardiCore Labs have analyzed thousands of attacks launched in recent months and identified at least three attack variants—Hex, Hanako, and Taylor—targeting different MS SQL and MySQL servers for both Windows and Linux.

The goals of all the three variants are different—Hex installs cryptocurrency miners and remote access trojans (RATs) on infected machines, Taylor installs a keylogger and a backdoor, and Hanako uses infected devices to build a DDoS botnet.

So far, researchers have recorded hundreds of Hex and Hanako attacks and tens of thousands of Taylor attacks each month and found that most compromised machines are based in China, and some in Thailand, the United States, Japan and others.

To gain unauthorized access to the targeted database servers, the attackers use brute force attacks and then run a series of predefined SQL commands to gain persistent access and evade audit logs.

What's interesting? To launch the attacks against database servers and serve malicious files, attackers use a network of already compromised systems, making their attack infrastructure modular and preventing takedown of their malicious activities.

For achieving persistent access to the victim's database, all three variants (Hex, Hanko, and Taylor) create backdoor users in the database and open the Remote Desktop port, allowing attackers to remotely download and install their next stage attack—a cryptocurrency miner, Remote Access Trojan (RAT) or a DDoS bot.

"Later in the attack, the attacker stops or disables a variety of anti-virus and monitoring applications by running shell commands," the researchers wrote in their blog post published Tuesday. 

"The anti-virus targeted is a mixture of well-known products such as Avira and Panda Security and niche software such as Quick Heal and BullGuard."

Finally, to cover their tracks, the attackers deletes any unnecessary Windows registry, file, and folder entry using pre-defined batch files and Visual Basic scripts.

Administrators should check for the existence of the following usernames in their database or systems in order to identify if they have been compromised by the Chinese criminal hackers.

• hanako
• kisadminnew1
• 401hk$
• Guest
• Huazhongdiguo110

To prevent compromise of your systems, researchers advised administrators to always follow the databases hardening guides (provided by both MySQL and Microsoft), rather than just having a strong password for your databases.

"While defending against this type of attacks may sound easy or trivial—'patch your servers and use strong passwords'—we know that 'in real life' things are much more complicated. The best way to minimize your exposure to campaigns targeting databases is to control the machines that have access to the database," the researchers advised. 

"Routinely review the list of machines that have access to your databases, keep this list to a minimum and pay special attention to machines that are accessible directly from the internet. Every connection attempt from an IP or domain that does not belong to this list should be blocked and investigated."

Ataques DDoS aumentam 138% e ficam, em média, em 300 Gbps no Brasil

Por Roberta Prescott ... 04/12/2017 ... Convergência Digital

As notificações de ataques negação de serviço (DDoS) registraram um aumento de 138% e essa amplificação acendeu o sinal vermelho do pCentro de Estudos, Resposta e Tratamento de Incidentes de Segurança no Brasil. Durante palestra na 7ª Semana da infraestrutura da internet no Brasil, nesta segunda-feira, 04/12, Cristine Hoepers, do CERT.br, mostrou que 300 Gbps é o novo normal dos ataques DDoS e que há casos de até 1 Tbps contra alguns alvos.

Os tipos mais frequentes são ataques por meio de botnets IoT e amplificação de tráfego. Além disto, as varreduras (scan) estão usando as portas 22 e 23 por meio da força bruta de senhas de servidores e modems ou roteadores, além de dispositivos voltados para a internet das coisas. Na porta 25, os ataques ocorrem por força bruta de senha de e-mail.

A partir de dados fornecidos por parceiros internacionais, o CERT.br levantou quantos dispositivos ou serviços permitem ampliação (veja foto). Em DNS, o total de ASNs e IPs únicos notificados em 2017 chegou a 2.279 ASNs e 61.281 em novembro.

Os ataques a modems e roteadores de banda larga têm como objetivo a alteração de DNS para fraudes. Os dispositivos são comprometidos via força bruta de senhas (geralmente telnet), explorando vulnerabilidade ou via ataques CSRF, atrás de iFrames com JavaScripts maliciosos, colocados em sites legítimos comprometidos pelos fraudadores.

Já os atacantes visam a alterar a configuração de DNS dos clientes do sistema autônomo para que consultem servidores sob controle dos atacantes. Os servidores DNS maliciosos hospedados em serviço de hosting ou nuvem. Há casos com mais de 30 domínios de redes sociais, serviço de e-mail buscadores, comércio eletrônico, cartões, banco entre outros, conforme apontou  Cristine Hoepers. “Temos um volume grande de redes e dispositivos que estão permitindo a amplificação”, disse.

De acordo com ela, os ataques não são muito elaborados, visando a adivinhar login e senha das redes. As recomendações para inibir a força bruta de senhas em roteadores de borda, servidores, modems e roteadores de banda larga é usar senhas fortes e acesso via chaves SSH, além de desabilitar telnet, FTP e outros acessos sem criptografia ou autenticação e de fazer a gerência remota e acesso somente via redes de gerência.

Já para conter os abusos de serviço UDP para amplificação em servidores malconfigurados, modems e roteadores de banda larga (que vem de fábrica com serviços abertos) e que dependem de capacidade de fazer spoofing de IP, as recomendações são implantar antispoofing (BCP 38), configurar os modems e roteadores domésticos para não ter serviço abertos e não deixar a senha padrão e detectar proativamente ataques saindo da rede.