Massive DDoS attacks on Dyn DNS cause outages at Twitter, Spotify, SoundCloud and other sites

Several waves of major cyberattacks against an internet directory service knocked dozens of popular websites offline yesterday, with outages continuing into the morning GMT +8 (Manila time).

Twitter, SoundCloud, Spotify, Shopify, and other websites have been inaccessible to many users throughout the day. The outages are the result of several distributed denial of service (DDoS) attacks on the DNS provider Dyn, the company confirmed. The outages were first reported on Hacker News.

“We are actively in the third flank of this attack,” Dyn’s chief strategy officer Kyle York told reporters around 4:30 p.m. ET today. “It’s a very smart attack. As we mitigate, they react.”

Dyn’s general counsel Dave Allen added that, with the help of other infrastructure companies Akamai and Flashpoint, Dyn has determined that some of the traffic used in the attacks comes from the Mirai botnet, a network of infected Internet of Things devices used in other recent large-scale DDoS attacks.

(print screen from digitalattackmap.com)

Dyn and other DNS providers operate as a link between the URLs you type into your browser and the corresponding IP addresses. DDoS attacks are frequently used to censor specific websites by overwhelming them with junk traffic and knocking them offline. However, by attacking Dyn, it’s possible to overwhelm that directory function and cause outages and loading problems across a large swath of the internet.

(print screen from cybermap.kaspersky.com) hmm notice all attacks originate from China?)

Other sites experiencing issues include Box, Boston Globe, New York Times, Github, Airbnb, Reddit, Freshbooks, Heroku and Vox Media properties. Users in Europe and Asia  (Symbianize) may experience fewer problems than those in the U.S. — according to DownDectector’s outage map, the DDoS attacks against Dyn are primarily impacting U.S. users. 

 (print screen from norsecorp)


The DDoS attacks on Dyn began yesterday morning. Service was temporarily restored around 9:30 a.m. ET, but a second attack began around noon, knocking sites offline once again.The DNS provider said engineers were working on “mitigating” the issue, but a third wave began around 4:30 p.m. ET before being resolved roughly two hours later.

At the moment, Dyn DNS is still dealing with the attack and its cause remains unknown.

Update: This incident has been resolved. Posted about 7 hours ago. Oct 21, 2016 - 22:17 UTC

The nation-wide internet outage was enabled thanks to a Mirai botnet that hacked into connected home devices, according to security intelligence company Flashpoint. 

Mirai is not a new hacking tool. A massive Mirai attack took down the site of popular security researcher Brian Krebs in late September, peaking at a nearly unprecedented 620 Gbps. 

Mirai takes advantage of weak security protocols on IoT devices -- in the Krebs case, 145,000 devices were infiltrated, including security cameras and DVRs in homes and offices around the world.

The author of the Mirai malware made its code open-source, and security experts have been warning of a possible large-scale attack since this information came to light.

Watch Live Worldwide Cyber attack on your PC  click here

Here’s a list of websites that readers have told us they are having trouble accessing:

ActBlue
Basecamp
Big cartel
Box
Business Insider
CNN
Cleveland.com
Etsy
Github
Grubhub
Guardian.co.uk
HBO Now
Iheart.com (iHeartRadio)
Imgur
Intercom
Intercom.com
Okta
PayPal
People.com
Pinterest
Playstation Network
Recode
Reddit
Seamless
Spotify
Squarespace Customer Sites
Starbucks rewards/gift cards
Storify.com
The Verge
Twillo
Twitter
Urbandictionary.com (lol)
Weebly
Wired.com
Wix Customer Sites
Yammer
Yelp
Zendesk.com
Zoho CRM
Credit Karma
Eventbrite
Netflix
NHL.com
Fox News
Disqus
Shopify
Soundcloud
Atom.io
Ancersty.com
ConstantContact
Indeed.com
New York Times
Weather.com
WSJ.com
time.com
xbox.com
dailynews.com
Wikia
donorschoose.org
Wufoo.com
Genonebiology.com
BBC
Elder Scrolls Online
Eve Online
PagerDuty
Kayak
youneedabudget.com
Speed Test
Freshbooks
Braintree
Blue Host
Qualtrics
SBNation
Salsify.com
Zillow.com
nimbleschedule.com
Vox.com
Livestream.com
IndieGoGo
Fortune
CNBC.com
FT.com
Survey Monkey
Paragon Game
Runescape

If you’re experiencing connection problems, you can try changing your DNS settings (instructions for how to do this on Mac and Windows are here). Anecdotally, our staff has used OpenDNS (208.67.222.222 and 208.67.220.220) and OpenNIC servers and seen connectivity improve. 


Source: https://www.dynstatus.com/incidents/nlr4yrr162t8

Read More

Security journalist recovers from massive 620Gbps DDoS attack

Security journalist Brian Krebs turned to Project Shield for free protection after an unknown party knocked his website offline last week with a massive distributed denial of service attack (620Gbps of non-stop data) as revenge for exposing two major cyberattack sellers who've since been arrested. 

He most recently ticked off allies of vDOS; Krebs wrote about the DDoS-for-hire company and the two teenagers allegedly behind it were arrested. Some of the POST request attacks included the string “freeapplej4ck,” referring to one of the alleged teenage owners of vDOS.

He's only back online after taking advantage of Google's Project Shield, which protects journalists against censorship-oriented denial of service campaigns. 

His previous anti-DDoS provider, Akamai, had little choice but to drop him -- the company tells the Boston Globe that a sustained attack on that level would have cost the company "millions."

The campaign might not have required an elaborate effort, either. Krebs believes that the attackers took advantage of a botnet made up of hacked Internet of Things devices like DVRs, home internet routers and security cameras, many of which have poor or even unchangeable passwords. A larger attack recently played havoc with a French web host using similar tactics. There's also the chance that the culprits used spoofing, which magnifies attacks by tricking machines into sending reply messages to the victim.

To Krebs, the incident highlights the dangers to free speech in the modern era. It's not just that it's relatively trivial to mount a censorship campaign, it's that the cost of defending yourself against that campaign can be prohibitive. One anti-DDoS service estimated that an Akamai-level defense would cost Krebs over $150,000 per year. 

“Free speech in the age of the internet is not really free,” Krebs told Ars Technica. “We're long overdue to treat this threat with a lot more urgency. Unfortunately, I just don't see that happening right now.”

Krebs needed to bring his site back up, so he opted for Project Shield which offers “free, unlimited protection.” The service is built on Google Cloud Platform in order “to protect news sites and free expression from DDoS attacks on the web.”

The free service claims:

No matter the size of your website or the size of the attack, Project Shield provides free protection for news, journalist, human rights, and elections monitoring sites.

How could any small-scale news outfit afford that kind of protection? A concerted effort to clamp down on device exploits and block spoofed traffic could be vital not just to improving basic internet security, but protecting freedom of expression. Countries with a penchant for censorship can easily use these data floods to silence critics, and they might just try so long as it's easy.

source: Krebs on Security, Boston Globe

Read More

How to Watch Worldwide Cyberattacks Live

Cyberattacks are becoming more common, then you should check out the four sites below: They purport to provide real-time maps of the sources and targets of hacking attacks taking place right now all over the world.

(Of course, these maps just happen to be provided by security vendors who have no reason at all to exaggerate the threat.)

Norse Attack Map

Norse is an Internet security company that helps companies prevent and deflect malicious attacks. And to give you a better idea of how many attacks it could help prevent, it has created its Norse Attack Map. 

The image above — which looks like Missile Command on steroids — shows just a snippet of hacking attempts around the world, the countries from which they originate, and the countries that they are attacking.

In reality, the attackers are hitting what Norse calls honey pots — special traps designed to detect unwanted network intrusions by hackers. It’s important to note that the location an attack comes from isn’t necessarily its true origin, as hackers can make an attack look like it’s coming from one place when it’s really coming from another.

Digital Attack Map

Created by Google and the network security and management company Arbor Networks, Digital Attack Map gives you a live look at the insane number of Distributed Denial of Service (DDoS) attacks happening at any given time.

These kinds of attacks usually involve a group surreptitiously taking control of a massive network of computers, then making them all try to access the same website at the exact same time. That flood of requests can eventually overload the target system and force it to be taken offline.

Kaspersky Cyberthreat Real-Time Map

You might know Kaspersky for its antivirus software, but that’s not all the company does. It also protects network systems for some seriously large businesses. To give those customers a better idea of the security threats they face, Kaspersky built its Cyberthreat Real-Time Map.

 
The map itself takes information about malicious software (including run-of-the-mill viruses) trying to invade someone’s computer, strips it of any personal data, and displays it on a map showing where the attacks are happening.

FireEye Cyber Threat Map

FireEye’s Cyber Threat Map doesn’t post information in real time, but it still gives you a good idea about the kind of threats posed by hackers and criminals around the world.

The map shows communications over the last 30 days between malware installed on target networks and the servers that control them. Sure it’s not happening live, but it still helps spread fear, er, understanding about how dangerous the Web can be.

Read More