Hackers 'weaponised' Malware To Mount Massive Assault

The huge attack on global Internet access on Friday 21st October, which blocked some of the world’s most popular websites, is believed to have been unleashed by hackers using common devices like webcams and digital recorders.

Among the sites targeted recently were Twitter, PayPal and Spotify. All were customers of Dyn, an infrastructure company in New Hampshire in the US that acts as a switchboard for Internet traffic.

Outages were intermittent and varied by geography, but reportedly began in the eastern US before spreading to other parts of the country and Europe.

Users complained they could not reach dozens of Internet destinations, including Mashable, CNN, the New York Times, the Wall Street Journal, Yelp and some businesses hosted by Amazon.

Hackers used hundreds of thousands of internet-connected devices that had previously been infected with a malicious code – known as a “botnet” or, jokingly, a “zombie army” – to force an especially potent distributed denial of service (DDoS) attack.

The aim of a DDoS attack is to overwhelm an online service with traffic from multiple sources, rendering it unavailable. Dyn said attacks were coming from millions of Internet addresses, making it one of the largest attacks ever seen.

Dyn said it had resolved one attack, which disrupted operations for about two hours, but disclosed a second a few hours later that was causing further disruptions. By the evening it was fighting a third.

At least some of the malicious traffic was coming from connected devices, including webcams and digital video recorders. 

Security researchers working with Dyn to investigate the attack have linked it to a network of web-enabled CCTV cameras made by a single Chinese company, XiongMai Technologies.

Allison Nixon, director of research at the security firm Flashpoint, said its web-enabled CCTV cameras and digital video recorders were forcibly networked together using the sophisticated malware program Mirai to direct the crushing number of connection requests to Dyn’s customers. “It’s remarkable that virtually an entire company’s product line has just been turned into a botnet that is now attacking the United States,” she told security researcher Brian Krebs.

The same Mirai malware was used in September to launch what was then described as the biggest DDoS attack ever on Krebs’ website, Krebs on Security. His reporting on cybercrime has made him a target in the past.

Hackers released the source code for Mirai earlier this month, inspiring a significant number of copycats. Experts had warned of increasingly sophisticated botnets, in essence, a weaponised combination of malware and as many as 100,000 hijacked individual devices, just days before the attack.

Researchers at Level 3 Communications, a global communications company focused on managed security, warned earlier this week that “the threat from these botnets is growing” as more and more devices were connected to the web.
The US Department of Homeland Security had issued a warning the previous week.

Mirai was the most sophisticated botnet malware Level 3 had seen yet, able to rotate the IP addresses (likely to avoid detection) about three times as often as had been observed with other botnets. More worryingly still, it was “becoming still more sophisticated”.

Mirai targeted household and everyday devices, such as DVRs, cameras and even kettles, that were connected to the internet, a concept of connectivity commonly referred to as “the internet of things” (IoT). Many were devised without particular mind to security.

Level 3 researchers said the majority, as many as 80%, of botnets were networked DVRs, with the rest routers and other miscellaneous devices such as IP cameras and Linux servers. “The devices are often operated with the default passwords, which are simple for bot herders to guess.”

Michael Mimoso, of cybersecurity research group Kaspersky Lab, estimated that the number of compromised devices had reached 493,000, with most in the US. “But Brazil and Colombia are also high on the list”. 

Dyn categorized the attack as “resolved” shortly after 6pm New York time, but it is still not known who deployed the botnet, and why. “The complexity of the attacks is what’s making it very challenging for us,” the company’s chief strategy officer, Kyle York, told Reuters. Homeland Security and the Federal Bureau of Investigation said they were investigating.

A tweet from WikiLeaks implied that its supporters were behind the attack. “Mr. Assange is still alive and WikiLeaks is still publishing. We ask supporters to stop taking down the US Internet. You proved your point.”  

Security researcher Bruce Schneier caused waves when he wrote in September that someone, probably a country, was “learning how to take down the Internet”. He wrote that “a large nation state” (“China or Russia would be my first guesses”) had been testing increasing levels of DDoS attacks against unnamed core Internet infrastructure providers in what seemed like a test of capability. 

Guardian
 

« FBI Using Big Data To Predict Terrorism
Media Vulnerable To Election Night Cyber-Attack »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

SafeCharge

SafeCharge

SafeCharge is a global provider of technology-based multi-channel payments services and risk management solutions for demanding businesses.

OpenText

OpenText

OpenText is a leader in Enterprise Information Management software and a portfolio of related solutions for Information Governance, Compliance, Information Security and Privacy.

SCIS Security

SCIS Security

SCIS Security provides affordable cyber security services and solutions to small to medium sized businesses and homes.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Gijima

Gijima

Gijima is one of SA’s leading ICT companies in Cloud & Outsourcing, Systems integration, Human Capital Management & Training, Cybersecurity, and Unified Communications.

Cyber Command - Romania

Cyber Command - Romania

Cyber Command represents the military authority responsible for the development, protection and resilience of military IT networks and services that support the Romanian Force Structure.

WhizHack Technologies

WhizHack Technologies

WhizHack's mission is to not only create a pipeline of cyber security products but also to empower people to sustainable innovation in securing digital assets of tomorrow.

Centroid

Centroid

Centroid is a cloud services and technology company that provides Oracle enterprise workload consulting and managed services across Oracle, Azure, Amazon, Google, and private cloud.

European Cybersecurity Competence Centre (ECCC)

European Cybersecurity Competence Centre (ECCC)

The ECCC aims to increase Europe’s cybersecurity capacities and competitiveness, working together with a Network of National Coordination Centres to build a strong cybersecurity Community.

e-Xpert Solutions

e-Xpert Solutions

e-Xpert Solutions is a company specialized in the Information Security field since 2001. Our skills are strong technical expertise and the development of tailor-made solutions.

Liquis Inc.

Liquis Inc.

Liquis, founded in 2002, is one of the largest facility decommissioning services companies in the U.S.

CyberTest

CyberTest

CyberTest offers cybersecurity consulting and penetration testing services that helps organizations and businesses securing their assets.

Defence Innovation Accelerator for the North Atlantic (DIANA)

Defence Innovation Accelerator for the North Atlantic (DIANA)

The NATO DIANA accelerator programme is designed to equip businesses with the skills and knowledge to navigate the world of deep tech, dual-use innovation.

Exodata

Exodata

Exodata is a French digital services company specializing in the outsourcing of IT Systems and solutions.

Q-Bird

Q-Bird

Q*Bird's mission is to provide equipment for the current, and future European quantum internet.

Trium Cyber

Trium Cyber

Trium Cyber - Expert Cyber Underwriting and Claims Management. Based in the US and UK. Backed by Lloyd’s of London.

Uninets

Uninets

UniNets mission is to provide IT professionals with high-quality, accessible, and relevant e-learning courses that enable them to stay ahead of the curve in their industry.