The democratization of censorship: when anyone can kill as site as effectively as a government can

idaho-l-0010_teton_dam_flood

On the eve of the Stuxnet attacks, half a decade ago, I found myself discussing what it all meant with William Gibson (I'd just interviewed him on stage in London), and I said, "I think the most significant thing about any of these sophisticated, government-backed attacks is that they will eventually turn into a cheap and easy weapon that technically unskilled people can deploy for petty grievances." We haven't quite got there yet with Stuxnet, but there's a whole class of "advanced persistent threat" techniques that are now in the hands of fringey criminals who deploy them at the smallest provocation. Read the rest

A powerful attacker is systematically calibrating an internet-killing tool

050 056c026d-1c66-4d42-9fae-a8e96df290c5-1020x1181

Someone -- possibly the government of China -- has launched a series of probing attacks on the internet's most critical infrastructure, using carefully titrated doses of denial-of-service to precisely calibrate a tool for shutting down the whole net. Read the rest

UPDATED: Wikileaks dumps years' worth of email from Turkey's ruling party

AKP

Update: This dump turned out to primarily consist of public mailing list traffic; Wikileaks promotions of the dump included links to spreadsheets containing thousands of Turkish women's sensitive personal information, and the organization has largely ducked responsibility for its mistakes, attacking those who point out its mistakes.

Wikileaks have just published the Erdoğan Emails, which is claimed to represent years' worth of email from the APK, the Turkish ruling party, with messages dating from 2010 to as recent as July 6. Read the rest

Always-on CCTVs with no effective security harnessed into massive, unstoppable botnet

CCTV_Cameras

When security firm Sucuri investigated the source of a 50,000-request/second DDoS attack on a jewelry shop, they discovered to their surprise that the attacks originated on a botnet made of hacked 25,500+ CCTV cameras in 105 countries. Read the rest

How it feels to be under DDoS attack

056c026d-1c66-4d42-9fae-a8e96df290c5-1020x1094

At this week's O'Reilly Velocity conference in Santa Clara, Artur Bergman, founder and CTO, told the story of how he got involved in starting a denial-of-service-resistant CDN -- a personal story about helping his old company cope with a titanic DDoS attack that brought it and its upstream provider to their knees. Read the rest

One million machines, including routers, used to attack banks

ZyXEL_Prestige_600_series_20070304

Akamai's Ryan Barnett reports on two attacks against the service's financial customers last year: attackers used nearly 1m compromised systems to attempt to log in to users' accounts using logins and passwords from earlier breaches. Read the rest

Security economics: black market price of hacked servers drops to $6

5900608214_8c609f61e7_b (1)

A new Kaspersky report analyzes an online hacker marketplace called xDedic, where access to 70,000 hacked servers -- multiplayer game servers, billing servers, cellular/ISP servers, dating servers, betting servers, government and university servers -- in 173 countries can be bought for $6 and up. Read the rest

DDoSers sell attacks for $5 on Fivver

056c026d-1c66-4d42-9fae-a8e96df290c5-1020x1068

Many years ago, EFF co-founder John Gilmore and I were discussing the prevalence of botnets, which are commonly used to launch distributed denial of service (DDoS) attacks that overwhelm websites with floods of traffic; John said that if the botnets were really on the rise at the reported rate, we should expect to see a massive crash in the price of DDoS services, following simple supply/demand logic. Read the rest

Web security company breached, client list (including KKK) dumped, hackers mock inept security

Screen-Shot-2016-03-11-at-12.00.51-PM-640x263 (1)

Newport Beach based Staminus Communications offered DDoS protection and other security services to its clients; early this morning, their systems went down and a dump of their internal files were dumped to the Internet. Read the rest

Google launches Project Shield, to protect news sites from DDoS attacks

animation

Insecure desktop operating systems (and even server/CMS vulnerabilities) has led to the creation of enormous, powerful botnets comprised of thousands, hundreds of thousands, or even millions of machines -- and thanks to the law of supply and demand, it's remarkably cheap and easy to rent time on a botnet and blast any site of your choosing off the Internet. Read the rest

Wargames-style map shows ongoing internet attacks

wargamescyber

The Norse Map is a Wargames-style visualization of ongoing attacks on servers around the world. Though it shows honeypots rather than actual private or government targets, the result is a live snapshot of trends in computer mischief.

Dubai seems to be getting quite a pounding today. Read the rest

Life inside a DDOS "booter site"

The internal records of Lizardsquad's Lizardstresser -- a service that would, for money, flood sites with traffic intended to knock them off the Internet -- were dumped to Mega by Doxbin's former operator, providing an unprecedented public look at the internal workings of booter. Read the rest

Brian Krebs's "Spam Nation"

In Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door, Brian Krebs offers a fascinating look at the mass-scale cybercrime that underpins the spam in your inbox and provides an inside peek at a violent fight among its principle players. Cory Doctorow reviews.

Online activism and why the Computer Fraud and Abuse Act must die

MOLLY-LARGE
Courts have appreciated that even distributed denial of service attacks can be legitimate form of public protest. Molly Sauter on the insane U.S. law used to criminalize them and other forms of online activism.

Microsoft non-pologizes for misleading judge, seizing No-IP's DNS

Yesterday, Microsoft convinced a judge to let it take over No-IP's DNS service, shutting down name service for many websites, in order to stop a malware attack. Today, the company fake-pologized. Read the rest

Cyber-crooks turn to Bitcoin extortion

Security journalist Brian Krebs documents a string of escalating extortion crimes perpetrated with help from the net, and proposes that the growth of extortion as a tactic preferred over traditional identity theft and botnetting is driven by Bitcoin, which provides a safe way for crooks to get payouts from their victims. Read the rest

Basecamp, Meetup hit by extortionist's 20Gb/s DDoS

If you're a Basecamp user who couldn't get into your account yesterday, here's why: the company refused to pay ransom to a criminal who hit them with a 20Gb/s denial-of-service flood, apparently by the same person who attacked Meetup, who uses gmail addresses in this pattern: "dari***@gmail.com." Read the rest

More posts