#ddos

https://www.afnic.fr/medias/tweet-florian-rey.png

Retour sur la "panne" rencontrée par plusieurs FAI français, dont SFR et Bouygues les 1 et 2 septembre. Explications par @stephane ▻https://www.afnic.fr/fr/ressources/blog/a-propos-de-l-attaque-sur-les-resolveurs-dns-de-fai-francais-2.html #DNS #DDoS #SFR #BouyguesTelecom #Afnic #France #Internet

On 1 and 2 September 2020, several French ISPs were “down”, @stephane reviews this #DNS resolvers attack on ▻https://www.afnic.fr/en/resources/blog/about-the-attack-on-french-isps-dns-resolvers.html #Afnic #DDoS #Internet #cyberattacks

L’impression de plusieurs quotidiens américains perturbée par une attaque informatique
▻https://cyberguerre.numerama.com/475-limpression-de-plusieurs-quotidiens-americains-perturbee-p

Ce samedi, le Los Angeles Times, le Chicago Tribune, le Baltimore Sun et d’autres journaux américains n’ont pas pu être distribués. L’entreprise qui imprime ces quotidiens a été touchée par une virulente attaque informatique. Ce samedi 29 décembre, les abonnés du Los Angeles Times n’ont pas trouvé dans leurs boîtes aux lettres leur journal. Ce dernier, comme un certain nombre de quotidiens américains imprimés par Tribune Publishing, n’a pas pu passer sous les rotatives à temps. L’atelier où est imprimé le (...)

#algorithme #hacking #ransomware #Riyuk

//c1.lestechnophiles.com/cyberguerre.numerama.com//content/uploads/sites/2/2018/12/150610-F-PT194-107.jpg

Can #snmp (Still) Be Used to Detect DDoS Attacks?
▻https://hackernoon.com/can-snmp-still-be-used-to-detect-ddos-attacks-32b03aa9df8a?source=rss---

https://cdn-images-1.medium.com/max/962/1*uw5DcJMjapFUWNqh6d_Ymg.png

SNMP is an Internet Standard protocol for collecting information about managed devices on IP networks. SNMP became a vital component in many networks for monitoring the health and resource utilization of devices and connections. For a long time, SNMP was the tool to monitor bandwidth and interface utilization. In this capacity, it is used to detect line saturation events caused by volumetric DDoS attacks on an organization’s internet connection. SNMP is adequate as a sensor for threshold-based volumetric attack detection and allows automated redirection of internet traffic through cloud scrubbing centers when under attack. By automating the process of detection, mitigation time can considerably be reduced and volumetric attacks mitigated through on-demand cloud DDoS services. SNMP (...)

#detect-ddos-attacks #burst-attacks #ddos-protection #anomaly-detection

Information Security : How to DoS 29% of the World Wide Websites - CVE-2018-6389
▻https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html

et hop ! encore une vulnérabilité de Wordpress rendue publique sans qu’il y ait de correctif officiel ! (avec y compris le script python « qui va bien » pour réaliser le DDOS...)

Voir aussi : le patch officieux (script bash modifiant les fichiers en cause) : ▻https://github.com/Quitten/WordPress/blob/master/wp-dos-patch.sh

#vulnérabilité #wordpress #DDOS #python

Une vision étriquée de la cyber-guerre : choisir entre les #DDoS ou les #Missiles
▻https://reflets.info/une-vision-etriquee-de-la-cyber-guerre-choisir-entre-les-ddos-ou-les-missi

Un tweet de l’ami Bortzmeyer n’a pas manqué d’attirer mon attention aujourd’hui. Le 6 octobre dernier, je faisais justement une intervention au Festival des nouvelles explorations de Royan sur le sujet controversé et oh combien […]

#Technos #Cyber_Guerre #Cyberguerre #Darkweb #DISA

https://www.afnic.fr/medias/images/actus/rapport-anssi.jpg

Découvrez l’Observatoire de la résilience de l’Internet français 2016 par l’ANSSI et l’Afnic ▻https://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/10681/show/rapport-2016-de-l-observatoire-de-la-resilience-de-l-internet-francais.html

#VendrediLecture #ANSSI #Afnic #Internet #Securité #DNS #TGP #BGP #TLS #DDoS #SMTP #IPV6 #RPKI

“In this paper, we present #DDoSCoin, which is a #cryptocurrency with a malicious proof-of-work. DDoSCoin allows miners to prove that they have contributed to a #distributed_denial_of_service attack against specific target servers. This proof involves making a large number of TLS connections to a target server, and using cryptographic responses to prove that a large number of connections has been made. Like proof-of-work puzzles, these proofs are inexpensive to verify, and can be made arbitrarily difficult to solve.”

Paper: ▻https://www.usenix.org/conference/woot16/workshop-program/presentation/wustrow

Code: ▻https://github.com/ewust/DDoSCoin

#dDoS #blockchain

Des accès qui s’apparentent à des attaques #DDoS
▻http://www.dsfc.net/internet/web-analytics/des-acces-qui-s-apparentent-a-des-attaques-ddos

http://www.dsfc.net/wp-content/uploads/2017/04/ec2-54-ddos.jpg

Encore des machines « anonymes » hébergées chez Amazon qui, par leurs requêtes, surchargent l’activité de mon serveur #Apache !

#Web_Analytics #Awstats #Déni_de_service #Formateur_Apache #Formateur_Awstats #Formateur_Web_Analytics

How to stop Small #DDOS attacks (Some basic security advice)

▻http://rockdio.org/ayudatech/how-to-stop-small-ddos-attacks-some-basic-security-advice

This is a more or less step by step guide intended for begginers to help stabilize the linux server and prevent further attacks.

There are some basic settings you should have already implemented in your linux server as part of security 101 but this is not always the case and also it is not enough.

Questions and Answers:

– Limiting the ammount of concurrent connections from the same IP address to your Server.
– Identifying the offending IP.
– And kill the Ongoing TCP Connections with TCPKILL.
– Or use Cutter to kill the connections on any port/Network interface.
– Drop it With #Iptables.
– Make the DROP Persistant after a reboot. (iptables save and restore)
– Basic Iptables-save trouble shoot.
– Stop Start Iptables

Petit compte rendu de ce que j’ai fait hier soir pour calmer les flood que subissait ▻http://pastebin.fr :

Bloquer un #flood #Apache avec #fail2ban et #iptables

▻https://labo.eliaz.fr/article144.html

#ddos

RFC 8073 : Coordinating Attack Response at Internet Scale (CARIS) Workshop Report

Ce nouveau #RFC fait le bilan de l’atelier CARIS (Coordinating Attack Response at Internet Scale) qui s’est tenu à Berlin le 18 juin 2015. Cet atelier avait pour but d’explorer les problèmes de coordination entre les victimes et témoins d’une attaque portant sur l’Internet. Ce RFC est un compte-rendu, les positions exprimées ne sont pas forcément celles de l’IAB ou de l’Internet Society (organisateurs de l’atelier). D’autant plus que les participants ont mis les pieds dans le plat, expliquant très bien pourquoi il n’y a toujours pas de coordination globale des acteurs de l’Internet face aux attaques. (La plupart des rapports sur la #cybersécurité sont des monuments de lourde langue de bois, où on ne dit jamais ce que tout le monde sait, mais qui fâche. Par exemple que les acteurs de l’Internet ne partagent pas facilement avec les autorités, tout simplement parce qu’ils n’ont pas confiance - et ils ont bien raison.)

▻http://www.bortzmeyer.org/8073.html

#attaque_par_déni_de_service #dDoS #botnets

Cloudbleed : le bug qui cache la forêt
▻https://reflets.info/cloudbleed-le-bug-qui-cache-la-foret

Le mois dernier, un bug a été découvert par Tavis Omandy (un chercheur d’une équipe de Google) dans l’un des programmes utilisés par #cloudflare, une société américaine qui fournit différents services aux opérateurs de sites […]

#Rainbow_Hat #Technos #DDoS #Hackers_russes #macron #Proxies

Necurs += DDoS
World’s largest spam botnet (5 million bots) adds proxy module with DDoS features, but will it really be used that way?

▻http://blog.anubisnetworks.com/blog/necurs-proxy-module-with-ddos-features

Necurs is a malware that is mainly known for sending large spam campaigns, most notably the Locky ransomware. However, Recurs is not only a spambot, it is a modular piece of malware that is composed of a main bot module, a userland rootkit and it can dynamically load additional modules.

[...]

At first look, it seemed to be a simple SOCKS/HTTP proxy module, but as we looked at the commands the bot would accept from the C2 [port 5222] we realised that there was an additional command, that would cause the bot to start making HTTP or UDP requests to an arbitrary target in an endless loop, in a way that could only be explained as a DDOS attack.

[...]

Please notice that we have not seen Recurs being used for DDOS attacks, we simply saw that it has that capability in one of the modules that it has been loading

The rest of their post contains the results of a technical analysis of this module, detailing its C2 protocol, the SOCKS/HTTP proxy features, and the DDOS attack features.

#DDoS #Necurs botnet

Someone DDoSed A University’s internet connection by hacking its vending machines
The University’s Internet connection was blocked using infected IoT devices including vending machines and street lamps.

▻https://www.hackread.com/university-servers-ddosed-through-vending-machines

Verizon Enterprise’s RISK (Research, Investigations, Solutions and Knowledge) department researchers were tasked with the investigation of internet blockage at an unidentified US university and they discovered that [5000] infected IoT devices are responsible for cutting off the internet. The attackers reprogrammed the devices in such a way that they started attempting to connect with seafood-oriented websites sporadically.

[...]

The report explained that “The botnet spread from device to device by brute forcing default and weak passwords – The firewall analysis identified over 5,000 discrete systems making hundreds of DNS lookups every 15 minutes.

▻http://www.verizonenterprise.com/resources/reports/rp_data-breach-digest-2017-sneak-peek_xg_en.pdf

#DDoS
#IoT

Cisco, Bosch and Foxconn Create an IoT Blockchain Consortium

▻http://www.newsbtc.com/2017/01/29/cisco-bosch-foxconn-create-iot-blockchain-consortium

According to reports, these companies will be working in collaboration to create a shared IoT blockchain protocol that can connect everyday objects of all sizes to the internet. These networked objects will be able to send and receive data.

The secure and tamper proof nature of cryptocurrency blockchain will be utilised by the consortium to ensure the security of the connection between various IoT devices. The increasing need for securing IoT devices emerged after a massive DDoS attack on the internet exploited several connected devices to do their bidding. With the implementation of IoT devices slated to increase in the coming years, it is the right time to explore all available and potential options.

#blockchain
#IoT
#DDoS

On connait désormais le nom de l’auteur du #malware #Mirai. Il a été reconnu par sa combinaison assez inhabituelle de compétences dont il s’était vanté, sur un forum sous un pseudo, et sur LinkedIn sous son vrai nom...

▻https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author

#botnet #cyberdélinquance #vantardise

Europol operation Tarpit together with FBI arrests 34 users who paid for DDoS attacks

▻https://www.europol.europa.eu/newsroom/news/joint-international-operation-targets-young-users-of-ddos-cyber-attac

From 5 to 9 December 2016, Europol and law enforcement authorities from Australia, Belgium, France, Hungary, Lithuania, the Netherlands, Norway, Portugal, Romania, Spain, Sweden, the United Kingdom and the United States carried out a coordinated action targeting users of Distributed Denial of Service (DDoS) cyber-attack tools, leading to 34 arrests and 101 suspects interviewed and cautioned.

▻https://www.bleepingcomputer.com/news/security/34-users-who-paid-for-ddos-attacks-arrested-by-police-101-more-que

At the source of Operation Tarpit is Operation Vulcanalia, an older investigation by the UK’s National Crime Agency (NCA), into the activity of a DDoS-for-hire service called Netspoof.

Behind Netspoof was a UK teen, Grant Manser, 20, of Kidderminster, a town near Birmingham, who between January 2012 and November 2014 created and managed #Netspoof and three other DDoS booter services such as #Dejabooter, #Vexstresser, and #Refinedstresser.

It appears that the NCA is now using the data they obtained from Netspoof to go after its users with the help of Europol and other agencies around the world.

#DDoS #booter #stresser
#Europol #Tarpit

KSI : Keyless Security Infrastructure

An Estonian, blockchain stack alternative to PKI, developed in 2007

▻https://guardtime.com/technology/ksi-technology

Unlike traditional approaches that depend on asymmetric key cryptography, KSI uses only hash-function cryptography, allowing verification to rely only on the security of hash-functions and the availability of a public ledger commonly referred to as a blockchain.

A blockchain is a distributed public ledger; a database of transactions such that there is a set of pre-defined rules as to how the ledger gets appended, achieved by distributed consensus of participants in the system.

The KSI blockchain overcomes three major weaknesses of mainstream blockchain technologies - which were designed to facilitate asset transactions - making KSI suitable also for cybersecurity and data governance applications:

• Scalability
• Settlement time
• Formal security proof

It can be used to help combat cyberattacks :

▻https://techcrunch.com/2016/12/05/how-blockchain-can-help-fight-cyberattacks

“The fundamental threat with PKI is that you need to base your security on the secrets (keys) and the people who manage them,” Johnson says. “That is very hard to do well and impossible to prove — just as in the real world you can‘t prove a secret has been kept, in the security world you can‘t prove a key has not been compromised.”

In contrast, instead of relying on secrets, blockchain-based security is predicated on distributing the evidence among many parties, which makes it impossible to manipulate data without being detected.

“Blockchain has eliminated the need for trusted parties to verify the integrity of data just as in the cryptocurrency example it eliminated the need for a centralized authority to act as a bank,” Johnson explains.

See also ▻https://seenthis.net/messages/540234

#blockchain
#PKI #KSI
#DDoS

Gamification of DDoS attacks

It was only a matter of time:

A Turkish hacking crew is luring participants to join its DDoS platform to compete with peers to earn redeemable points that are exchangeable for hacking tools and click-fraud software. The goal, security researchers say, is to “gamify” DDoS attacks in order to attract a critical mass of hackers working toward a unified goal.

▻https://threatpost.com/hackers-gamify-ddos-attacks-with-collaborative-platform/122290

Hackers are recruited via Turkish Dark Web hacker forums, and to participate in the program they must download the Surface Defense collaboration program and register. Surface Defense runs locally on a computer. Users congregate online within the program and can communicate and compare points they earn.

Next, participants are required to download a DDoS attack tool called Sledgehammer. Sledgehammer is software [with an unadvertised backdoor] that comes preconfigured to perform HTTP-based Slowloris-type DDoS assaults against 24 preselected sites determined by the software’s author.

Users receive a point for every 10 minutes they attack one of the websites. With those point they can obtain hacking software.

The list of websites can be found here
▻https://www.bleepingcomputer.com/news/security/turkish-hackers-are-playing-a-ddos-for-points-game

https://www.bleepstatic.com/images/news/u/986406/Hackers/Turkey/Balyoz-targets.png

#DDoS #Surface_Defense #Sledgehammer

Digital Attack Map
▻http://www.digitalattackmap.com

http://www.digitalattackmap.com/static/share_image.png http://lh5.ggpht.com/4sApwTqHKcn6RlComBNogejBmXEeny9ksRCG3cN5j6JqIhR9gWrr4bUVoop4BkP_B0owPiN27oWGRhCuWxg=s160-c#.jpg http://lh6.ggpht.com/37RYNL0ZvBGXCK28iouUjfHkVa-8HsCalxYaWcaoEL21cgkV6a4R-H99_so_-OEleonBrRN0ZmC6jDqk9nw=s160-c#.jpg

#DDoS #cyberguerre #cartographie

Failed #Mirai botnet attack causes internet outage for 900,000 Germans

▻http://www.dw.com/en/deutsche-telekom-hack-part-of-global-internet-attack/a-36574934

German security experts have suggested internet outages that have hit hundreds of thousands of Deutsche Telekom customers in Germany were part of a worldwide attempt to hijack routing devices.

“The BSI considers this outage to be part of a worldwide attack on selected remote management interfaces of DSL routers,” the government agency said on its website.

Deutsche Telekom said the issues seemed to be connected to an attempt to make a number of customers’ routers part of the Mirai botnet.

Deutsche Telecom information page:

▻https://www.telekom.com/en/media/media-information/archive/information-on-current-problems-444862

Deutsche Telekom has developed a software update together with the router manufacturers which is offered for download here ▻https://www.telekom.de/stoerung

#DDoS
#botnet

New DoS attack vector : Blacknurse

http://blacknurse.dk/onewebstatic/dfb1ea6026-blacknurse2.png

It’s unclear why the ICMP Type 3 Code 3 requests overload firewall’s CPU. However, researchers at SANS Internet Storm Center believe it’s tied to firewall logging.

▻http://www.bleepingcomputer.com/news/security/blacknurse-attack-low-volume-ping-packet-traffic-can-shut-down-som
▻http://soc.tdc.dk/blacknurse/blacknurse.pdf
▻https://threatpost.com/blacknurse-low-volume-dos-attack-targets-firewalls/121916
▻http://www.netresec.com/?page=Blog&month=2016-11&post=BlackNurse-Denial-of-Service-Attack

#Blacknurse #DoS #DDoS

Researcher develops worm to fight Mirai botnet

Researcher Scott Tenaglia found a stack buffer overflow vulnerability in the Mirai code which could be used to crash bots and shut down Mirai attacks.

▻http://www.theregister.co.uk/2016/10/28/mirai_botnet_hack_back

Now, a GitHub user going by Leo Linsky has forked a repo created by researcher Jerry Gamblin to create an anti-worm “nematode” that could help to patch vulnerable devices used in the Mirai DDoS attacks. (the code is unfortunately no longer available)

▻http://www.theregister.co.uk/2016/10/31/this_antiworm_patch_bot_could_silence_epic_mirai_ddos_attack_army

A Nematode is a controlled worm that can be used for beneficial purposes, such as self-healing networks.

The worm goes further and can be used to break into woefully insecure internet-of-things devices and change the default Telnet credentials within.

Doing so would lock Mirai and other malware users out of the devices, along with legitimate administrators.

“This is a purely academic research project intended to show a proof of concept anti-worm worm, or nematode, for the types of vulnerabilities exploited by Mirai,” Linsky says.

"The idea is to show that devices can be patched by a worm that deletes itself after changing the password to something device- specific or random.

Unleashing the nematode would breach computer crime laws in the US, UK, and Australia, and likely in many other countries where unauthorised use and modification of computer equipment is an offense.

More on Mirai

►https://seenthis.net/messages/531503

#Mirai #DDoS #malware

DDoS attack put out heating of apartments for the weekend in Finland

▻http://www.forbes.com/sites/leemathews/2016/11/07/ddos-attack-leaves-finnish-apartments-without-heat

Both buildings are managed by Valtia, a facilities services company headquarted in Lappeenranta. Volta CEO Simo Rounela confirmed to Metropolitan.fi that the central heating and hot water systems in both buildings had been attacked. In attempt to fight off the attack, the systems rebooted — and subsequently got stuck in an endless loop. This is precisely the kind of thing that Chester Wisniewski at SophosLabs was concerned with when he urged makers (and users) of industrial control systems to take meaningful steps toward improving security.

▻http://boingboing.net/2016/11/08/winter-denial-of-service-attac.html

A DDoS attack that incidentally affected the internet connections for at least two housing blocks in Lappeenranta, Finland caused their heating systems to shut down, leaving their residents without heat in subzero weather.

After an hour, maintenance crews went on-site and shut down the internet links and switched the heating systems over to manual, restoring service.

The attack brought down the buildings’ access to DNS, causing the automated systems to cycle every five minutes, until the heat, ventilation and water all shut down.

#DDoS
#IoT

a Mirai botnet perturbed Liberia’s internet connectivity

Liberia is connected to internet via only one undersea cable (part of ACE - African Coast to Europe) of 5.12 Tbps, shared between all 23 countries connected via ACE.

Mirai has been targeting IP addresses of Lonestarcell MTN, a telecom operators managing the Liberian ACE leg, flooding the pipe with 500 Gbps and thereby impacting Liberia’s internet several times. (well, the 6% of the country that actually has internet access).
Lonestarcell MTN is one of the 4 telecom operators

▻http://thehackernews.com/2016/11/ddos-attack-mirai-liberia.html

Many media, including BBC, PC World, The Guardian, Forbes, IBtimes, Quartz, Mashable, The Register, inaccurately reported that Liberia was totally cut off.

https://upload.wikimedia.org/wikipedia/commons/d/d4/Cable_map18.svg

▻https://krebsonsecurity.com/2016/11/did-the-mirai-botnet-really-take-liberia-offline

“Both our ACE submarine cable monitoring systems and servers hosted (locally) in LIXP (Liberia Internet Exchange Point) show no downtime in the last 3 weeks,” [the general manager of Cable Consortium of Liberia] said. “While it is likely that a local operator might have experienced a brief outage, we have no knowledge of a national Internet outage and there are no data to substantial that.”

Mirai announces its attacks here:

▻https://twitter.com/MiraiAttacks

#Mirai #DDoS #botnet
#undersea_cable #câble_sous-marin