By David Meyer , 9 May, 2012 09:11

Hackers associated with Anonymous forced Virgin Media’s website offline for at least an hour on Tuesday, but the file-sharing service whose blockage sparked the protest has condemned the attack.

In an operation dubbed OpTPB, Anonymous hackers apparently subjected Virgin’s site to a distributed denial-of-service (DDoS) attack that began at 5pm. Twitter messages referring to OpTPB suggested that it was a response to Virgin Media’s blocking of The Pirate Bay (TPB), which began last week after a court ordered it.

Although Virgin admitted to an hour-long downtime, the site was still not working at the time of writing, around 16 hours after the attack began.

“DDoS and blocks are both forms of censorship,” The Pirate Bay told followers on its Facebook page, referring to “some random Anonymous groups [having] run a DDoS campaign against Virgin Media and some other sites”.

“We’d like to be clear about our view on this: We do NOT encourage these actions,” TPB said. “We believe in the open and free internets, where anyone can express their views. Even if we strongly disagree with them and even if they hate us. So don’t fight them using their ugly methods.”

The file-sharing service went on to suggest that those wanting to help it could set up a tracker, join or start a local Pirate Party, write to their political representatives or develop a new P2P protocol.

According to the BBC, Virgin said in a statement that it has to comply with court orders, but believes that “tackling the issue of copyright infringement needs compelling legal alternatives, giving consumers access to great content at the right price, to help change consumer behaviour”.

“Copyright defenders, including the British recorded music industry body BPI, have argued that illegal copies of films, books and music made available on file-sharing sites destroy creative industry jobs and discourage investment in new talent,” the ISP added.

The court order followed a ruling in February which established that TPB was infringing on copyright by providing a service that people use to unlawfully share copyrighted material.

TPB was not itself represented at the hearing that led to that ruling, but the judge, Mr Justice Arnold, argued that there was little point in trying to get the site’s proprietors into court when even the authorities in Sweden, TPB’s home country, had failed to do so.

Virgin Media was the first ISP to carry out the block ordered last week, but others covered by the same court order include Sky, Everything Everywhere, TalkTalk and O2. BT is not yet subject to the order as it has requested more time to assess the implications.

Source: http://www.zdnet.co.uk/blogs/communication-breakdown-10000030/pirate-bay-condemns-virgin-media-hack-10026118/

Guest post written by Jonathan Lewis

5/08/2012 @ 10:02PM

As cyber security moves from a purely technical issue to a major business concern, CIOs are faced with the thorny problem of how to best protect their company without over-spending on security.  Security is about protecting confidentiality, integrity and network availability. Thus far, security spending has largely been focused on confidentiality and integrity with relatively little spending on protecting network availability. Research shows that it’s time for this approach to change.

Loss of data center availability due to Distributed Denial of Service (DDoS) attacks has emerged as one of the most prevalent and costly forms of cybercrime. Motivations include extortion, revenge and competitive advantage, as well as a recent explosion of politically motivated attacks, also known as “hacktivism.”

The means to carry out sophisticated and effective attacks are within easy reach of anyone with a PC and an Internet connection. Do-it-yourself DDoS attack tools are readily available and easy to use. Botnets for rent and DDoS attack services are available to anyone with as little as $50 and a grudge. A quick search on YouTube for “DDoS Service” shows how openly these attack services are being sold. As a result, enterprises and service providers are experiencing attacks on their data centers more often and with more severe business consequences than ever before.

The goal of the attacker is to prevent a data center from performing its core function – whether that be transacting e-commerce; delivering e-mail or voice services; providing DNS services; serving up Web content delivery; hosting games; and so on. Because the attacker is trying to create maximum disruption, attacks are most likely to occur at the worst possible time for the victim. For example, online retailers are especially vulnerable during the peak shopping period between Thanksgiving and Christmas and especially on Cyber Monday.

CIOs should take a proactive approach for incorporating the DDoS threat into security and business continuity planning. The steps are straightforward. First, gain an understanding of the cost of service outages. In other words, determine what the hourly cost will be to your business if the data center is down or disabled due to an attack. Second, understand the probability that your business will be attacked and experience service outages. Lastly, take a risk management approach and consider the business impact of extended outages (i.e. 24 hours or more), weighing the expected costs/risks against the cost of investing in DDoS protection to ensure service availability.

The hourly cost of downtime will be unique to your business but generally comprises the following elements:

  • Operations: What is the number of IT personnel that will be tied up addressing the attack and what is the hourly cost of that?
  • Help Desk: If systems are shut down, how many help desk calls will be received and what is the cost per call?
  • Recovery: How much manual work will be required to re-enter transactions?
  • Lost Worker Output: What is the level of employee output lost to downtime and the costs associated with that?
  • Lost Business: How much business will be lost for every hour the network is down?
  • Lost Customers: How many existing customers will defect to the competition? What is the lifetime value of these customers?
  • Penalties: How much will it cost in terms of service level agreement (SLA) credits or other penalties?
  • Lost Future Business: How much will your ability to attract new customers be affected? What is the full value of that lost business?
  • Brand and Reputation Damage: What is the cost to the company in terms of brand value?

Compare your results to industry averages. The Ponemon Institute surveyed 41 business managers from 16 different industry segments on the costs their operations had incurred due to unplanned data center outages. The hourly cost of downtime ranged from $8,500 to $210,000 per 1000 square feet of data center space in operation. Financial services and online commerce showed the highest costs per hour.

Next, consider the risk of attack. If your business has already been a victim of DDoS, the likelihood of subsequent attacks is high – you are already a target. Even if you have not been attacked before there is still substantial risk. Once again, industry averages provide helpful guidance for risk planning. The most recent figures indicate expected annual downtime due to DDoS for an average data center is about 12 hours.

Combining the expected annual downtime with the hourly cost of downtime provides a good guideline as to the annual cost (or “annual loss expectancy”) your business is likely to incur if you do not deploy effective DDoS protection. However, this does not provide the complete picture. There is the question of managing risk. DDoS attacks can bring down or seriously degrade services for days at a time. While the average expected annual outage time is about 12 hours, there is a smaller but real risk of extended downtime from DDoS. Outages of 24 hours and more are not uncommon. Thus DDoS should figure into business continuity planning much in the same way as fire and natural disaster do. In short, while the annual loss expectancy due to DDoS is an important economic consideration, it may be even more important to protect the business from catastrophic loss if it can be done at a cost that is both manageable and predictable.

DDoS attacks are trending upward in frequency, size, duration and effectiveness. The good news is that there are solutions available that can prevent these attacks from bringing down data center services. CIOs who understand the economic value of data center services to their business, and who are aware of costs associated with DDoS threat, are well positioned to make the right business decisions with regard to investments in network availability protection.

 

Source: http://www.forbes.com/sites/ciocentral/2012/05/08/figuring-ddos-attack-risks-into-it-security-budgets/

NEWS

The Serious Organised Crime Agency has taken its website offline due to a distributed denial-of-service attack.

By Tom Espiner, ZDNet UK, 3 May, 2012 15:02

The UK law enforcement agency asked its hosting provider to take the site down at approximately 22.00 on Wednesday, and the site was taken offline at around 22.30, a SOCA spokesman told ZDNet UK on Thursday. The site remained offline at the time of writing.

“The site was taken offline last night to limit the impact of a distributed denial-of-service attack (DDoS) against other clients hosted by our service provider,” the SOCA spokesman said. “The website only contains publically available information.”

The spokesman declined to say who the agency thought was behind the attack, but said it did not pose a security risk.

While website attacks are “inconvenient to visitors”, SOCA does not consider maintaining the necessary bandwidth to deal with DDoS a good use of taxpayers’ money, the SOCA spokesman said.

A Twitter news feed that claims links to the Anonymous hacking collective publicised the DDoS on Thursday, but did not claim responsibility.

“TANGO DOWN: DDoS attack takes down site of UK Serious Organised Crime Agency (SOCA),” said the @YourAnonNews feed.

The SOCA website was taken offline in June 2011, in an action that was claimed by LulzSec, a hacking group affiliated to Anonymous.

“What is surprising is that defence and intelligence levels have not been improved sufficiently since the last successful DDoS attack on SOCA in June 2011,” said Ovum analyst Andrew Kellett. “Hacktivist attacks targeting particular operations have been known to be both persistent and long-standing, requiring extensive DDoS defences.”

SOCA announced last week that it worked with the FBI to take down 36 websites used to sell stolen bank card data.

On Thursday Cabinet Office minister Francis Maude said that SOCA had “recovered nearly two million items of stolen payment card details since April 2011 worth approximately £300m to criminals” in a speech made in Estonia.

 

Source: http://www.zdnet.co.uk/news/security-threats/2012/05/03/soca-website-taken-down-in-ddos-attack-40155157/

TrustSphere says its TrustVault product helps crucial emails get through–even in the midst of a denial of service attack–by correctly identifying trusted senders.

As annoying as spam is, an overactive spam filter is almost worse when it prevents important messages from getting through.

A company called TrustSphere says the TrustVault product it introduced this week can act as a counterweight to the spam filter, using a type of “social graph” to identify trusted senders and allow their messages to get through–even in the midst of a crisis such as a distributed denial of service attack on an executive’s email account.

“Inside the the organization, we’re effectively mapping who’s speaking to whom and turning that into an enterprise social graph,” Manish Goel, CEO of TrustSphere, said in an interview. “We’re tracking who’s speaking with whom and how often–what’s the cadence of communication.” In that way, TrustVault can identify the trustworthy senders and allow their messages to go through, even if they would otherwise be blocked by a spam filter.

So far, this social graph is based entirely on the exchange of email, although TrustSphere is working on ways of integrating social media and voice over Internet protocol communications for a more complete picture, Goel said. But TrustSphere is applying elements of social networking theory such as Dunbar’s number, anthropologist Robin Dunbar’s concept that humans can only track a limited number of relationships, often theorized as about 150, and rely on “circles of trust” for more extended relationships. In this way, TrustSphere models trustworthy connections at the organizational level, as well as at the individual level. TrustVault is also linked to a related service, TrustCloud, which tracks the reputation of email accounts across the Internet.

TrustSphere doesn’t filter the content of the messages at all, looking only at the pattern of communication and touching only the email header fields, Goel said. The service does detect email authentication methods, such as the use of Sender Policy Framework tagging, but it’s counted as an indicator of trustworthiness rather than a final verdict, he said.

Messages cleared by TrustVault can still go through anti-virus and spyware scans, and even previously trusted senders can be screened out if they start exhibiting suspicious behavior, Goel said. But sometimes letting the right messages through can be as important as keeping the wrong ones out. For example, corporations targeted by activists or hactivists sometimes have the email accounts of top executives rendered useless when they are flooded by messages sent by angry consumers or generated by bots. With TrustVault, the messages from known senders could be delivered to the executive being targeted, while all the rest would be routed for review by an administrative assistant.

One of the company’s oldest customers, the doctors.net.uk social network for physicians in the U.K., has been using a version of the same technology to allow email that uses words like “Viagra” or “penis” to get past spam filters when those words are used in a legitimate medical context, rather than for spam or pornographic promotions, Goel said.

“This also allows you to turn up the threshold on the aggressiveness of your spam filters without missing messages,” Goel said. “I liken this to why cars have brakes–to allow you to go faster. Spam filtering is very much focused on identifying the bad guys. We’re using the good and the bad to improve the overall security infrastructure.”

Founded in Singapore, TrustSphere is just now bringing its product to the U.S. market.

Source: http://www.informationweek.com/thebrainyard/news/email/232901586

The Koobface botnet, popularly known for using pay-per install and pay-per click mechanisms yearning huge amount for its masterminds has recently been upgraded with a classy traffic direction system (TDS). The TDS controls all the traffic that are related to affiliated websites, reports security researchers at security firm, Trend Micro.

The TDS feature forwards the traffic into various other locations and proves to be helpful in gaining hefty amount for the crooks through access into specific sites.

With Google going stricter with their creation of botnets that combats creation of fake e-mail accounts by spammers, cyber criminals are taking privilege of Yahoo mail for the accomplishment of their task.

Immediately, once the creation of the e-mail accounts is over, innumerable other accounts are created on social networking sites, such as FC2, Tumblr, FriendFeed, Twitter, livedoor, So-net, and Blogger.

As the process continues, images are gathered through a novel binary component, which collects pictures of celebrities, cars and any other images that might attract innocent users.

In the last stage, the botnet generates blog posts that are conducted through a malware component creating blog accounts, whereas the others recover matters or blog posts that are stored in the proxy command-and-control (C&C) server.

These posts are uploaded automatically to the intended platforms. The posts are comprised of links, images, and keywords, which aids in increasing the sites’ search engine optimization (SEO) ranking, together with an obfuscated JavaScript code that conceals the references of TDS domain of the botnet.

As a result, the TDS can easily follow the visits to each of the blog post and redirect the visitors to the sites that are affiliated by the botnets. The botnet helps in earning money through the clicks made by victims while they are reading blog posts and also from the traffic that the TDS directs to the chosen final landing sites.

However, for increasing the traffic to the nasty blog posts further, the Koobface gang also circulates keywords on the Web that are inter-related and promotes the posts through various social networking websites. These are undertaken with the assistance of numerous binary components that are catered by each site, as reported by security researchers at Trend Micro.