Attackers abused insecure Network Time Protocol servers to launch what appears to be one of the largest DDoS (distributed denial-of-service) attacks ever, this time against the infrastructure of CloudFlare, a company that operates a global content delivery network.

The attack was revealed Monday on Twitter by Matthew Prince, CloudFlare’s CEO, who said that it’s “the start of ugly things to come” because “someone’s got a big, new cannon.”

The size of the attack appears to have been just shy of 400Gbps, ranking it among the largest DDoS attacks CloudFlare has seen, Prince said Tuesday via email, adding that the company is still gathering data about the incident from upstream providers.

The attack could be larger than the one last March against Spamhaus, a spam-fighting organization and CloudFlare customer whose website was hit by a 300Gbps DDoS attack, which was considered to be the largest in history at the time. CloudFlare reported then that it caused congestion at critical Internet exchange nodes in Europe. However, other companies later challenged the reported impact.

The new attack Monday used a technique called NTP reflection that involves sending requests with spoofed source IP addresses to NTP servers with the intention of forcing those servers to return large responses to the spoofed addresses instead of the real senders.

The attack was directed at a CloudFlare user, Prince said, but he declined to disclose any additional details about the customer citing the company’s policy.

The DDoS traffic hit CloudFlare’s data centers worldwide, but only caused temporary congestion on the company’s network in Europe, he said.

There is also some anecdotal evidence that there were congestion issues in other parts of the Internet infrastructure that are not directly related to CloudFlare, but nothing definitive, he said. “The most likely place that slowness would have been observed is across European peering exchanges. However, our team moved quickly to take traffic off exchanges in order to minimize collateral damage.”

Shortly after Prince revealed the attack on Twitter, Octave Klaba, the founder and CEO of large French hosting provider OVH, reported that his company’s network had also been hit for hours Monday with a DDoS attack that far exceeded 350Gbps.

It’s not clear if the attack against OVH also used NTP reflection or if it’s related to the attack against CloudFlare.

“I would suspect they were likely related due to the similar timing and scale,” Prince said. “However, I don’t have direct evidence of that.”

OVH did not immediately respond to a request for comment.

NTP is just one of several protocols that and can be abused to amplify DDoS attacks. Two others are DNS (Domain Name System) and SNMP (Simple Network Management Protocol).

What these protocols have in common is that they allow a relatively small query to generate a large response and are vulnerable to source IP spoofing if certain precautions are not taken because they work over UDP (User Datagram Protocol).

Instead of hitting a target’s IP address directly with traffic generated by a botnet with a combined bandwidth of, say, 10Gbps, attackers could use the botnet to send spoofed queries to a list of open DNS or NTP servers. Those queries could be crafted to appear as if they came from the victim’s IP address and could trigger large responses from those servers to that address.

In the case of DNS reflection, the amplification factor is 8x, meaning attackers could generate eight times more traffic than they would normally be able to generate with their botnet. However, in the case of NTP and SNMP reflection it can be over 200x and 650x, respectively, CloudFlare said in a blog post in January.

DNS reflection was commonly used in DDoS attacks last year, including in the attack against Spamhaus, prompting calls from Internet infrastructure groups and security researchers to organizations to identify and secure their DNS servers against this type of abuse.

SNMP reflection attacks are relatively rare, because the protocol is usually used with authentication and there are few open SNMP servers on the Internet, CloudFlare said in its January blog post.

However, NTP servers that are vulnerable to reflection attacks are apparently not that rare and attackers have caught on to this. NTP servers are used by computers and other devices to synchronize their clocks so many of them are publicly accessible.

Security vendor Symantec reported in December that it observed a spike in the number of NTP reflection attacks. Then in early January the same technique was used to attack online gaming servers.

“NTP contains a command called monlist (or sometimes MON_GETLIST) which can be sent to an NTP server for monitoring purposes,” CloudFlare explained in January. “It returns the addresses of up to the last 600 machines that the NTP server has interacted with. This response is much bigger than the request sent making it ideal for an amplification attack.”

Organizations can use the Open NTP Project to identify vulnerable NTP servers in their IP address ranges and can follow instructions provided by security research outfit Team Cymru to secure them on different OSes.

The U.S. Computer Emergency Response Team recommends updating NTP servers to at least ntpd (Network Time Protocol daemon) version 4.2.7, which addresses the monlist issue by default. Older versions need to be manually configured to restrict the functionality.

Source: http://www.cio.com/article/748095/Attackers_Use_NTP_Reflection_in_Huge_DDoS_Attack?page=2&taxonomyId=3071

A record-breaking distributed denial-of-service (DDoS) attack Monday peaked at 400 Gbit/s, which is about 100 Gbit/s more than the largest previously seen DDoS attack.

DDoS defense firm CloudFlare disclosed the attack — against one of its customers — Monday. “Very big NTP reflection attack hitting us right now. Appears to be bigger than the #Spamhaus attack from last year, tweeted CloudFlare CEO Matthew Prince, referring both to attacks that target vulnerabilities in the Network Time Protocol, as well as the March 2013 DDoS attack against Spamhaus, which peaked at a record-breaking 300 Gbit/s.

Prince said Monday’s attack caused trouble “even off our network,” suggesting that some upstream service providers — particularly in Europe — may have experienced slowdowns.

“Someone’s got a big, new cannon. Start of ugly things to come,” Prince tweeted. “These NTP reflection attacks are getting really nasty,” he added.

Who was the target of the attack? Prince declined to disclose the name of the CloudFlare customer being targeted, saying that unlike the attack against Spamhaus, his company didn’t have permission to name names.

CloudFlare’s assessment of the attack bandwidth appeared to be validated by Oles Van Herman, the head of French hosting firm OVH.com, who reported via Twitter that his company was seeing a DDoS attack with a bandwidth “far beyond” 350 Gbit/s. He confirmed that IP addresses involved in the DDoS attack — which according to one report first began Friday — traced back to his firm’s network, but noted, “Our network is the victim, not the source.”

Van Herman’s statement suggests that attackers spoofed the OVH.com IP address — as part of their record-breaking attack against a CloudFlare customer — which squares with how reflection attacks work. “A reflection attack works when an attacker can send a packet with a forged source IP address,” according to an overview of NTP reflection attacks published by CloudFlare programmer John Graham-Cumming. “The attacker sends a packet apparently from the intended victim to some server on the Internet that will reply immediately. Because the source IP address is forged, the remote Internet server replies and sends data to the victim.”

Many reflection attacks previously targeted domain name system (DNS) servers. But lately, attackers have also begun to target NTP, which — like DNS — “is a simple UDP-based protocol that can be persuaded to return a large reply to a small request,” said Graham-Cumming.

Monday’s record-breaking DDoS attack isn’t the first time that large reflection attacks have been seen in the wild. According to a threat report released last month by DDoS defense firm Black Lotus, while HTTP and HTTPS attacks — including SYN floods, ACK floods, and application-layer attacks — remain the dominant type of DDoS attacks seen in the wild, “distributed reflection denial of service (DrDoS) attacks began to gain ground moving into 2014,” and were being used to support “huge volumetric attacks exceeding 100 Gbit/s in volume.”

Launching a reflection attack isn’t difficult, especially if the attacker taps a toolkit such as DNS Flooder v1.1, which DDoS defense firm Prolexic said first appeared on underground hacking forums about six months ago. In a threat report released Tuesday, the company warned that the DNS-attack toolkit has since been used to launch a number of reflection attacks, with some successfully amplifying the initial attack bandwidth by a factor of 50.

“This toolkit uses a unique method where attackers assign DNS servers with arbitrary names and utilize them as reflectors,” according to Prolexic’s report. “This new technique allows malicious actors to purchase, set up, and use their own DNS servers to launch reflection attacks, without the need to find open and vulnerable DNS servers on the Internet.”

But most DDoS attackers still rely on blended attacks, which gives them a better chance “to find weaknesses in the target’s defenses and to confuse security engineers who may be trying to mitigate the attack,” according to the Black Lotus report.

The number of DDoS attacks that included NTP reflection-attack techniques increased substantially after January 2, when US-CERT released vulnerability advisory CVE-2013-5211, detailing a network time protocol daemon (ntpd) bug that can be exploited to launch DDoS reflection attacks. “Specifically, an attacker can send a spoofed monlist command to a vulnerable ntpd which will respond to the victim at an amplification factor of 58.5,” according to Black Lotus. The firm said that beginning in early January, it saw “a massive shift in the tactics used by attackers,” when they began tapping the NTP vulnerability en masse.

How can businesses better prevent their servers from being used — or abused — by DDoS attackers who target NTP vulnerabilities? “As all versions of ntpd prior to 4.2.7 are vulnerable by default, the simplest recommended course of action is to upgrade all versions of ntpd that are publically accessible to at least 4.2.7,” according to the US-CERT advisory. “However, in cases where it is not possible to upgrade the version of the service, it is possible to disable the monitor functionality in earlier versions of the software.”

To further help lock down vulnerable systems, research firm Team Cymru has released secure NTP templates for Cisco IOS, Juniper Junos, and Unix. In addition, the NTP Scanning Project provides a free service to scan any server for NTP vulnerabilities.

Source: http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hits-400-gbit-s-breaks-record/d/d-id/1113787?_mc=sm_iwk_edit

Internet services for the US Court system were taken down Friday afternoon for several hours by a Distributed Denial of Service attack.

Friday afternoon, shortly after GMail and Google+ went down, a distributed denial of service (DDOS) attack took down Internet systems for the US Courts.

pacer.tweet

Several sites were affected, including both the public web site for the courts and PACER, “… an electronic public access service that allows users to obtain case and docket information from federal appellate, district and bankruptcy courts…”

A report in Politico cites a federal court clerk from Arkansas saying that it appeared to be a “new national cyberattack on the judiciary,” but there is no verification for that at this time.

As of Friday evening all sites appeared to be functioning.

A part of the AfterDawn network was unreachable for 1-2 hours this morning (around 10:00 AM Eastern Time, 15:00 GMT). The outage was caused by a Distributed Denial of Service (DDoS) attack towards our servers that saturated the downlink of our rack cabinet. Most of the English language sites were available again within an hour, but much of the international sites were unreachable for nearly two hours.

DDoS attack a considerable amount if traffic is directed at a server or servers in an attempt to bring down the server or the network infrasturcture. In our case the 1GBps network link of the rack cabinet couldn’t handle all the incoming traffic. In response the traffic to the affected services was blackholed.

The attack did not cause security issues with our services.

We would like to apologize for the inconvenience caused by the outage.

Source: http://www.afterdawn.com/news/article.cfm/2014/01/11/ddos_attack_brings_a_brief_outage_to_afterdawn

Malvertising is a consistent challenge which can see reputable websites having frames infected to serve up any matter of attack.

 

After Yahoo beat down malicious advertisements which redirected users to the “Magnitude” exploit kit, which was enabled following the infection of a third party, Sean Power, security operations manager at DOSarrest, said that the problem is that many banner ad companies allow JavaScript or other code inside the advert.

 

“This is something we have seen before. In our case it was an advertising campaign that included a DDoS attack against one of our customers,” he said. “For companies allowing these ads on their website, the ads should be sanitised before displaying to the public.”

 

Power said that businesses should find a balance of risk versus profit to deal with this type of attack, and techniques could range from simply “trusting that all ads are malware free” to digitally signing each ad and only showing the ones that have been verified as malware free.
He also said the responsibility should lie with the ad company to sanitise all of its ads;  although he pointed out all of the bad press will be focused on the site displaying the ads (in this case Yahoo).  “No one is going to take kindly to a “not my responsibility” attitude when they got a virus after visiting your site,” Power concluded.

 

“As with any other business relationship – do your due diligence. Find out if the ad company allows code to be inserted in the ads.  Anytime your business relationships have the ability to directly alter your customer’s experience, they should be part of your security review,” he said.

 

Also hit by malicious adverts was video-sharing website Dailymotion, which according to research by Invincea delivered a malicious executable file as a ruse to “clean” their “infected” machine. Visitors were automatically redirected via Javascript to a website that distributed the fake infection warning, and this then automatically serves up the fake anti-virus.

 

Luis Corrons, technical director of PandaLabs, told IT Security Guru that adverts can lead to exploit kits and that has happened a number of times in the past. “In this kind of attack, the site serving the malicious advert has not been compromised, so I won’t say the responsibility to sanitise the ads lies directly with them,” he said.

 

“However, it is in the company’s own interest to protect people using their website. The company serving the ads is the one that should hold most of the responsibility, as it is their platform the one being abused.”

Source: http://www.itsecurityguru.org/responsibility-malvertising-lies-advert-platform-website/