Tag Archive for: DDoSes

Meet the Windows servers that have been fueling massive DDoSes for months


Meet the Windows servers that have been fueling massive DDoSes for months

Aurich Lawson / Getty

A small retail business in North Africa, a North American telecommunications provider, and two separate religious organizations: What do they have in common? They’re all running poorly configured Microsoft servers that for months or years have been spraying the Internet with gigabytes-per-second of junk data in distributed-denial-of-service attacks designed to disrupt or completely take down websites and services.

In all, recently published research from Black Lotus Labs, the research arm of networking and application technology company Lumen, identified more than 12,000 servers—all running Microsoft domain controllers hosting the company’s Active Directory services—that were regularly used to magnify the size of distributed-denial-of-service attacks, or DDoSes.

A never-ending arms race

For decades, DDoSers have battled with defenders in a never-ending arms race. Early on, DDoSers simply corralled ever-larger numbers of Internet-connected devices into botnets and then used them to simultaneously send a target more data than it could handle. Targets—be they games, new sites, or even crucial pillars of Internet infrastructure—often buckled at the strain and either completely fell over or slowed to a trickle.

Companies like Lumen, Netscout, Cloudflare, and Akamai then countered with defenses that filtered out the junk traffic, allowing their customers to withstand the torrents. DDoSers responded by rolling out new types of attacks that temporarily stymied those defenses. The race continues to play out.

One of the chief methods DDoSers use to gain the upper hand is known as reflection. Rather than sending the torrent of junk traffic to the target directly, DDoSers send network requests to one or more third parties. By choosing third parties with known misconfigurations in their networks and spoofing the requests to give the appearance that they were sent by the target, the third parties end up reflecting the data at the target, often in sizes that are tens, hundreds, or even thousands of times bigger than the original payload.

Some…

Source…

New IoT botnet offers DDoSes of once-unimaginable sizes for $20

  1. New IoT botnet offers DDoSes of once-unimaginable sizes for $ 20  Ars Technica
  2. Hackers behind new botnet also host a GTA: San Andreas server  CNET
  3. The latest IoT botnet displays evidence of a halfway clever botmaster  Boing Boing
  4. Full coverage

botnet – read more

Facebook transparency, Apple bugs, SEA DDoSes itself – 60 Sec Security [VIDEO]

Which country came top of Facebook’s new “Government Requests” report aimed at outing the countries that fish for Facebook user data the most? (I bet you’re thinking it’s the USA – but it isn’t.) Watch this week’s 60 Second Security and find out!
Naked Security – Sophos