DDoS – SWITCH Security-Blog

IT-Security-Links #63

Home Depot overtakes Target: While Target’s breach in December ‘only’ exposed 40 million customer debit and credit card accounts, Home Depot confirms that the recent breach impacted 56 million customers. A malware infected its point-of-sale-network between April and September.
What comes after CVE-2014-9999? The international database for Common Vulnerabilities and Exposures faces its ‘Y2K’ moment. Read more about the syntax change here.
pEp: pretty Easy privacy is a new crowdfunding project based in Switzerland with the aim to simplify encryption for existing communication tools.
IptabLes / IptabLex: Akamai has published a threat advisory (PDF) to warn of attacks where cybercriminals are infecting Linux servers with malware capable of launching powerful DDoS attacks.
Heartbleed: Traffic data collected by researchers on several large networks shows no exploit attempts in the months leading up to the public disclosure of the OpenSSL Heartbleed vulnerability.
US government ordered Yahoo to hand over user data or pay USD 250.000 fine per day!
Do you like Online Security Dashboards? techiehow.com compiled a list.

IT-Security-Links #60

Mobile Security: FireEye researchers have discovered a new software which takes Android malware to a new level by combining multiple malicious activities into one app.
According to a new blog post from Glenn Greenwald, the GCHQ has developed tools to seed the internet with false information, including the ability to manipulate the results of online polls, artificially inflate pageview counts on web sites or censor video content.
After all, new research shows that ‘123456’ is a great password: Websites that would not present a threat if hacked should get throwaway credentials.
World Cup & Threat Intelligence: According to the Imperva Data Security Blog, Hackers like soccer so much, that they put their weapons down during the World Cup Finals. But during the rest of the matches, attacks actually increased.
‘Bill Gates’ is the name of a versatile DDoS trojan for Linux.
Countersurveillance: Germany’s government is seriously considering manual typewriters as a means to avoid spying – not electronic models of course.
Cloud Security: Everybody is talking about it, but how secure is cloud computing really? SWITCH’s Rüdiger Rissmann wrote an interesting article about the technical and non-technical aspects of Cloud security.

IT-Security-Links #56

“No Place to Hide” is the new book on the NSA’s sweeping efforts to “Know it All” written by Glenn Greenwald. A comprehensive review has been published on washingtonpost.com.
According to this book the NSA has been covertly implanting interception tools in US network equipment heading overseas…
Cisco is not amused: “Governments should not interfere with the ability of companies to lawfully deliver internet infrastructure as ordered by their customers.”
Crimeware has steadily transferred Windows-based technology to Android. Now “Police Ransomware” expands to the Android ecosystem.
DNS DDoS: Incapsula reported in their blog on a DNS flood of 1.5 Billion requests per minute, fueled by different DDoS protection services.
How to characterize a target device through its wireless traffic? French researchers published a study on passive 802.11 device fingerprinting.

German:

Der deutsche E-Mail-Anbieter Posteo setzt künftig auf DNS-based Authentification of Name Entries (DANE), um Kunden die Möglichkeit zu bieten, Zertifikate für TLS-Verbindungen zu prüfen. DANE basiert auf DNSSEC.

IT-Security-Links #52

Microsoft released a Security Advisory this week to notify customers that opening an e-mail containing a crafted RTF file in Outlook may hand the computer to hackers. Microsoft provides a fix-it tool. Another option: Read your e-mail in plain text.
The Full Disclosure security mailing list has been shut down after 12 years and more than 91.500 posts …
…and reborn under new management after a few days! You need to manually subscribe if you wish to be a member.
Amazon Web Services (AWS) is urging developers using GitHub to ensure they haven’t inadvertently exposed their log-in credentials. A search on GitHub reveals thousands of results where code containing AWS secret keys. (How to remove sensitive data on GitHub.)
NTP DDoS Attacks: Since December 2013 there has been a dramatic rise in NTP traffic, much of it due to NTP amplification attacks. According to the Open NTP Version (Mode 6) Scanning Project, currently 4.6 million distinct IPs (IPv4) respond to a NTP Mode 6 query.
Operation Windigo: Hackers compromised more than 25.000 servers and used them for stealing SSH credentials, sending an average of 35 million spam messages on a daily basis and infecting visitors with malware. ESET published a 69-page paper (PDF) with details of the large and sophisticated operation.
Data Privacy: Is it an out of date concept or more important than ever?

German:

Die Digitale Gesellschaft Schweiz hat ihren Swiss Lawful Intercept Report 2014 veröffentlicht. Dieser dokumentiert die Überwachungsaktivitäten der Kantone und des Dienstes Überwachung Post- und Fernmeldeverkehr (ÜPF).

IT-Security-Links #51

“SOHO-Farming”: Hackers have compromised 300.000 SOHO routers and changed DNS settings to redirect to the attacker site. Team Cymru has published a report about recent Pharming attacks (PDF) targeting Small office and Home office (SOHO) routers.
WordPress DDoS: securi.net reported that more than 162.000 WordPress sites have been used for a DDoS Attack using the pingback feature. Here you can check, if your WordPress domain participated in the DDoS. Meanwhile Brian Krebs described different ways how to disable the pingback functionality.
We don’t know who Justin Bieber is. But his official twitter account which has more than 50 million followers has been hijacked by attackers to spread spam links from the account. Subsequently more than 13.000 users have favorited the tweets and over 7.000 users have re-tweeted them…
NSA Today: Recently published NSA slides explain some more projects. For example the Tailored Access Operations (TAO) hacking unit run a system called TURBINE, which can spam out millions of pieces of sophisticated malware at a time. HAMMERCHANT and HAMMERSTEIN is malware designed to sit on routers and grab encryption keys to decrypt supposedly secure VPN connections in real time. QUANTUMCOPPER automatically corrupts any data downloaded by a user. In the meantime, Facebook founder and CEO Mark Zuckerberg said he had called President Obama to voice his concerns about government surveillance.
CrowdResponse is a new, free incident response toolkit designed to help enterprises collect the data they need to analyze sophisticated attacks.
Dendroid: Symantec researchers have come to know another android malware toolkit called “Dendroid” which is being sold in the underground forums. And an example already made its way into Google’s official app store.

IT-Security-Links #49

Economic Crime Data: PwC published the findings of their Global and Swiss Economic Crime Survey 2014 as well as a 30-page PDF “Global Economic Crime Survey 2014 – A Swiss Perspective“.
More than 300.000 credentials were posted on Pastebin in 2013 according to a recent analysis by a Swiss security firm – which is just a small percentage of the stolen information posted publicly by hackers.
Sophos says 2013 was an epic year for data breaches – with over 800 million records lost.
DDoS: Who run the DDoS-for-hire services and why they themselves have to hide behind DDoS protection?
DDoS: What comes after NTP reflection attacks? And a friendly BCP38-reminder…
Meet Brian Krebs: How the author of the widely read cyber security blog ‘Krebs on Security’ lives and survives.
The ‘Moon’ worm never reaches a device which has anti-virus protection running on it. Why? It infects your Linksys router.

IT-Security-Links #48

DDoS: A ‘record-breaking’ NTP reflection DDoS attack peaked at 400 Gbit/s, which is about 100 Gbit/s more than the largest previously seen DDoS attack against Spamhaus…
…and in this blog article from Cloudflare ntpd- and Network-Operators learn how to mitigate NTP-based DDoS attacks.
NSA: The German government and the German Federal Intelligence Service are facing legal action because they allegedly aided the U.S. National Security Agency data collection program. The German Chaos Computer Club filed a criminal complaint together with the International league for human rights.
ENISA published a flash note about the risks of using discontinued software.
Arbor Networks released their annual Worldwide Infrastructure Security Report. A presentation of key findings and infographics are also available.
Most vulnerable operating systems and applications in 2013: Cristian Florian compiled the data from the US National Vulnerability Database (NVD) to a report.
NIST Cybersecurity Framework: The US National Institute of Standards and Technology released the first version of a Framework for Improving Critical Infrastructure Cybersecurity, a 41-page PDF file with standards, guidelines and practices to promote the protection of critical infrastructure.

IT-Security-Links #42

VB2013 / hack.lu 2013: Slides from the Virus Bulletin 2013 Security Conference in Berlin are available now…
…as well as the slides from hack.lu 2013.
Security 101: Watering holes remove the challenge of finding and chasing an elusive target. Stefanie Hoffman wrote about Watering Hole Attacks in the Fortinet Blog.
Global DDoS Attack Map: Google and Arbor Networks visualize DDoS attacks around the globe. The tool allows you to see where attacks are taking place and where they are coming from. And you can also investigate historic attacks.
How open source projects should handle security vulnerabilities – a blog article by Alex Gaynor.
Q3 findings from ATLAS: the quarterly data pull from ATLAS to glean new insight into DDoS attack trends

German:

Cloud-Richtlinien für Schweizer Schulen: Die Vereinigung der Schweizerischen Datenschutzbeauftragten hat Richtlinien für den Einsatz von Cloud-Services veröffentlicht.

IT-Security-Links #40

Adobe hacked: Acrobat and ColdFusion code stolen in mid-August 2013 along with credit card and other data on approximately 2.9 million customers.
Silk Road: The underground drug marketplace has been taken down by the FBI after many years of investigation.
Heads up Internet Explorer users! A Metasploit module for the latest vulnerability (CVE-2013-3893) is available. The flaw allows attackers to execute arbitrary code on the victim’s computer.
A 56-page “DDoS Survival Handbook” (PDF) is freely available from Radware.

German:

Unser aktueller SWITCH Security-Report (PDF) ist online! Die Themen:
- Apples biometrische Verführungen und mögliche Folgen
- NSA-Überwachungsspiel ohne Grenzen
- Der Endkunden-Router als sicherheitskritische Komponente neu entdeckt
- Zum Stöbern: Spannende Artikel zu aktuellen Themen
“Ihr seid alle Freiwild”: Bruce Schneier war kürzlich in Lausanne und hat an der Konferenz der Information Security Society Switzerland (ISSS) zum Thema NSA-Skandal gesprochen.

IT-Security-Links #36

DDoS: China suffered a DDoS attack that disrupted and slowed access to sites in the .cn domain. According to the China Internet Network Information Center (CNNIC) the attack was the largest in history against the domain servers for Chinas ccTLD.
NSA and Lavabit: New insights about the immediate closure of the encrypted e-mail service Lavabit.
Linux Trojan “Hand of Thief”: Avast did an analysis of the new trojan for Linux.
SSL/TLS: What’s under the hood – Where are the TLS sessionkeys in your Browser and how can you use them with Wireshark?
Do you have the right methodical approach to introduce and run your ‘Next Generation Firewall’ successfully?
justdelete.me: is a directory of direct links to delete your account from web services.

IT-Security-Links #35

DDoS as a diversionary tactic: While keeping the Security staff busy with a ‘low-powered’ DDoS, attackers took over the wire payment switch at several US banks.
APT: Read how Attackers are refining their tactics, using public cloud services to bypass monitoring or leveraging well known off-the-shelf tools for their attacks.
ENISA, the European Union Agency for Network and Information Security issued their Annual Incident Report 2012 providing an overview of the major outage incidents in the EU in 2012. Pierluigi Paganini wrote a summary of it in the Securityaffairs Blog.
“Spying NSA”: Listen (at your own risk) how an update of the Beach Boys song “Surfin USA” sounds at this years CRYPTO conference. And in case you want to sing along, here are the lyrics.

German:

PRISM@CH: Ein Artikel in der Weltwoche sinniert darüber, wie und wo in der Schweiz Traffic gesnifft wird und wie das damit rechtlich aussieht.
Ist das Trusted Platform Module (TPM) Version 2.0 als Hintertür für Geheimdienste gedacht? Die Deutsche Bundesregierung warnt vor Windows 8. – Ach nee doch nicht!

IT-Security-Links #32

The Washington Post published an article by Andrea Peterson on why stolen European credit card numbers cost 5 times as much as U.S. ones on the underground market. There are several reasons for this, different credit card technology or how monetization for stolen cards works out are two of them but in the end it’s a function of supply and demand and the structure of the online underground economy.
Distributed Denial of Service (DDoS) attacks are not a matter of if but when they happen to you. Sean Leach of Verisign provides 5 key steps enterprises can take to be prepared for a future attack.
In an anti-botnet takeover of .pl domains, NASK (the .pl ccTLD registry) and CERT Polska have shutdown over 641 malicious domains, with 179 being used for C&C purposes. They terminated the agreement with the Registrar Domain Silver, Inc, which only had one benign domain name (domainsilver.pl itself) registered.
Jeremiah Grossman and Matt Johansen of White Hat Security presented their research at Black Hat USA 2013 showing that you can “build” a browser botnet by leveraging advertising networks such as AdSense or DoubleClick.
Another Black Hat speaker Paul Stone of Context Information Security showed how you can steal data from a web browser with the use of JavaScript-based timing attacks.
Simon Mullis of FireEye posted part one and two of a three-part series on why old malware such as Carberp or Zeus are still successful. Part one: Why Carberp, ZeuS, and Other Vintage Malware Have a Bigger Bite Than You Think. Part two: Cybercriminal Intent: How to Build Your Own Botnet in Less Than 15 Minutes.
David Kriesel found out that Xerox scanners/photocopiers randomly alter numbers in scanned documents! Apparently, the problem only exists with small font sizes and with low-resolution.

Was kommt nach DNS Response Rate Limiting?

Werden autoritative DNS-Server über reflektierende DNS-Angriffe missbraucht, zum Beispiel um in einem Distributed Denial of Service (DDoS) Angriff ein Zielsystem zu überlasten, so ist eine der vorgeschlagenen Massnahmen DNS Response Rate Limiting (DNS RRL) zu aktivieren.

SWITCH hat auf diesem Blog bereits in früheren Posts über DNS Angriffe und Massnahmen berichtet. In diesem Artikel möchten wir unsere neusten Beobachtungen im Betrieb von DNS RRL teilen und zeigen, dass es Anzeichen gibt, dass die Angreifer die Schwächen von DNS RRL ausnutzen um weiterhin ihre Angriffe durchführen zu können.

Stärken und Schwächen von DNS RRL
Für viele autoritative DNS Serverbetreiber war DNS RRL eine ersehnte Lösung um die Serverlast und vor allem die ausgehende Serverbandbreite aufgrund von reflektierenden DNS-Angriffen einzuschränken. DNS RRL lässt für einen IP-Adressbereich nur eine bestimmte Anzahl identische DNS Antworten zu. Wird der konfigurierte Schwellwert überschritten, verwirft DNS RRL zum einen die DNS-Antwort. Für einen anderen Teil der Antworten wird das “Truncated”-Bit (TC) in der Antwort gesetzt, damit wird der DNS Resolver aufgefordert, die Anfrage noch einmal über TCP zu stellen. Da bei reflektierenden DNS-Angriffen die Quelladresse gefälscht wird, kommt nie eine Verbindung über TCP zu Stande. Im Gegensatz zu Firewall-Regeln hat der DNS RRL Ansatz den Vorteil, dass bei einem leicht geänderten Angriffs-Pattern (z.B. Query-Name ändert) die implementierten Firewall-Regeln nicht angepasst werden müssen. Kurz, DNS RRL ist sehr effektiv gegenüber Angriffen, bei denen DNS-Anfragen gesendet werden, welche in identischen Antworten resultierten.
Continue reading “Was kommt nach DNS Response Rate Limiting?”

IT-Security-Links #29

DEF CON 21, Black Hat 2013 and the NSA: We need some time apart – DEF CON founder Jeff Moss has asked federal agents not to attend this year’s DEF CON. At the same time the Director of the NSA, General Keith Alexander, will talk at Black Hat USA 2013.
Android Security: Last week we reported about a vulnerability that allows to modify a legitimate, digitally signed Android application (.APK-File) without breaking the app’s cryptographic signature. In the meantime Google released a fix to OEMs. But only a few have released the patch to customers yet. A proof of concept exploit code is there, released by Pau Oliva Fora. And yes, there’s also a “Master key” Security Scanner App available from Bluebox to test if your device is vulnerable.
PRISM: How Microsoft collaborates with the NSA. An article in ‘The Guardian’ which is worth reading (not only) for Hotmail, Outlook.com, SkyDrive and Skype users.
DDoS: To provide insights on the latest DDoS threats – and effective mitigation strategies – Information Security Media Group has launched a DDoS Resource Center.
Windows 7 Reinstall-How-to: Your PC has become infected with malware? You don’t know how to correctly reinstall your system, and reduce the risk of becoming reinfected at the same time? Have a look at the new How-to from EBAS. (Available in 4 languages.)

IT-Security-Links #27

Android Security I: USBCleaver – How your Smartphone steals your PC’s browser passwords, the Wi-Fi password and network information.
Android Security II: Only 4% of Android users are running the latest version of the mobile OS – which can mitigate some 77% of all existing Android malware threats.
Opera network cracked, code signing certificate stolen: At least a few thousand Opera users received malware through the Opera update process.
DDoS: Have you heard about Download-Flooding-Attacks? U.S. mid-tier banks are currently facing this kind of attacks. Nothing new, but useful to get around standard DDoS-detection and mitigation measures.
PRISM: The Washington Post published some NSA slides that explain the data-collection program… …If you’re now looking for alternatives to Google, Facebook and Co, prism-break.org is worth a look… …and if you’ve decided to encrypt everything from now on, you should read this first.
An interesting view on Recycling User IDs, E-Mail-Accounts or Domains and the impact on Privacy – and what this means for providers of internet services.