Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label DDoS Flaw. Show all posts
saaS
Cyber Crime Cyber Crime Reports DDoS DDOS Attacks DDoS Flaw Microsoft Ransomware saaS

A Huge DDoS Network was Taken Down by the US DOJ

 


According to the US Department of Justice (DOJ), 48 domains were seized after it was discovered that they were offering distributed denial of service (DDoS) attacks on-demand as a service that criminals could exploit.  

This information was provided in a press release from the office of E Martin Estrada, the United States Attorney for the Central District of California. This release was intended to inform the public that in addition to these seizures, six defendants are being charged with crimes in connection with operating these platforms.  
 
With the addition of the DDoS attacks which are plaguing the internet, this news brings back to the forefront the concept of Cybercrime-as-a-Service, outlined in the Microsoft Digital Defence Report (MDDR) released in November 2022. 

What is DDoS?

It is a platform for performing distributed denial-of-service attacks (DDoS attacks) that primarily allows anyone to purchase and execute such attacks for free. Based on the software as a service (SaaS) business model, these services are lucrative because they allow the owner of an IoT botnet to conduct low-overhead attacks.


DoS-for-Hire Services

Until recently, the majority of cybercrime-as-a-service reports have covered cybercrime using the context of ransomware, or a threat actor encrypting data and locking it out so that people cannot access what they want (usually until a ransom has been paid), or droppers bots that spread malware via delaying software updates.  

Despite this, DDoS-as-a-service (sometimes known as "booters" since they boot targeted systems from the internet) continues to be one of the most popular cybercrime methods for those who wish to commit a crime without having the necessary knowledge. 

According to the US Attorney's office, the websites seized during the operation launched "millions" of DDoS attacks, attacking victims around the world, with some claiming to provide legitimate services for your business to cope with stress. 

With booter services such as these, anyone can launch cyberattacks against victims, causing grave harm to individuals, and compromising the internet access of everyone, said US Attorney Estrada, noting the ease with which the attacks are carried out, allowing for maximum damage to be done. 

This week’s sweeping law enforcement activity is a considerable step in our ongoing efforts to eradicate criminal conduct that threatens the internet’s infrastructure and our ability to function in a digital world.

There are several organizations, including the FBI, the National Crime Agency, the Netherlands Police, and the National Crime Strategy, which are taking a much softer approach towards anyone who shows an interest in using the DDoS-for-hire services that are available. 

To deter would-be cybercriminals from investing in these services and to educate the public about the dangers of DDoS activity, an advertorial campaign will be conducted using placement ads in search engines on common keywords related to DDoS-for-hire activity. The campaign aims to target the use of common keywords related to DDoS-for-hire activity. As part of its commitment to victims, the FBI has also pledged to assist them whenever possible. 

"The FBI is ready to work with victims of crimes whether they launch them independently or hire a skilled contractor to execute them," said Donald Alway, Assistant Director in Charge of the FBI Los Angeles Field Office. 

American victims of cybercrime are encouraged to contact their local FBI field office or to file a complaint with the FBI's Internet Crime Complaint Center at www.ic3.gov.
Read more »
Website Hacked
Cyber Attacks DDoS DDOS Attacks DDoS Flaw User Security Website Attack Website Hacked

DoS Attackers are Employing ‘TCP Middlebox Reflection’ to Knock Websites Offline

 


Distributed denial-of-service (DDoS) hackers are employing a new amplification technique called TCP Middlebox Reflection to target websites. Last week, researchers at Akamai, a content distribution network firm, detected the novel attack methodology for the first time in the wild, six months after the technique was published in theory. 

"The attack […] abuses vulnerable firewalls and content filtering systems to reflect and amplify TCP traffic to a victim machine, creating a powerful DDoS attack," Akamai researchers stated in a blog post. "This type of attack dangerously lowers the bar for DDoS attacks, as the attacker needs as little as 1/75th (in some cases) the amount of bandwidth from a volumetric standpoint."

Generally, most DDoS assaults exploit the User Datagram Protocol (UDP) to amplify packet delivery by sending packets to a server that replies with a larger packet size, which is then forwarded to the victim. In these attacks, the attacker sends thousands of DNS or NTP requests containing a fake source IP address to the victim, causing the destination server to return the responses back to the spoofed address in an amplified manner that exhausts the bandwidth issued to the target. 

The amplification technique was published in a research paper in August 2021, which showed that malicious actors could exploit middleboxes such as firewalls via TCP to magnify denial of service attacks.  

While UDP reflection vectors DoS amplification attacks have traditionally been used in DoS amplification assaults due to the protocol’s connectionless nature. The novel attack approach exploits TCP non-compliance in middleboxes such as deep packet inspection (DPI) tools to launch TCP-based reflective amplification assaults.  

The first wave of this novel campaign is said to have occurred around February 17, targeting Akamai customers across banking, travel, gaming, media, and web hosting industries with high amounts of traffic that peaked at 11 Gbps at 1.5 million packets per second (Mpps).  

"The vector has been seen used alone and as part of multi-vector campaigns, with the sizes of the attacks slowly climbing," Chad Seaman, lead of the security intelligence research team (SIRT) at Akamai, explained.  

The basic thought of attackers with TCP-based reflection is to exploit the middleboxes that are used to enforce censorship laws and enterprise content filtering policies by sending specially designed TCP packets to trigger a volumetric response. Indeed, in some cases, Akamai noted that a single SYN packet with a 33-byte payload triggered a 2,156-byte response, effectively achieving an amplification factor of 65x (6,533%).  

"The main takeaway is that the new vector is starting to see real world abuse in the wild. Typically, this is a signal that more widespread abuse of a particular vector is likely to follow as knowledge and popularity grows across the DDoS landscape and more attackers begin to create tooling to leverage the new vector,” Seaman explained.
Read more »
Vulnerable Network
Citrix Critical Flaw DDoS Flaw Flaws Security Patch Vulnerabilities and Exploits Vulnerable Network

Critical Citrix DDoS Flaw Collapses Network Access

 

Cyberattackers could use a significant security flaw in the Citrix Application Delivery Controller (ADC) and Citrix Gateway to disrupt entire corporate networks without requiring them to authenticate. 

The two Citrix solutions in issue (previously the NetScaler ADC and Gateway) are used to manage application-aware traffic and provide secure remote access, respectively. According to the alert, the federated working specialist released a security patch on Tuesday for the CVE-2021-22955 vulnerability, which permits unauthenticated denial of service (DoS) due to uncontrolled resource consumption. 

Citrix also fixed an issue of a lower severity that was caused by unmanaged resource usage. It affects both prior Citrix SD-WAN WANOP Edition products and the Citrix SD-WAN WANOP Edition appliance. The latter offers optimization for Citrix SD-WAN deployments, which enable secure connectivity and seamless access to virtual, cloud and software-as-a-service (SaaS) apps across enterprise and branch locations.

The second vulnerability, labelled CVE-2021-22956, allows for temporary interruption of a device's management GUI; the Nitro API for configuring and monitoring NetScaler appliances; and remote procedure call (RPC) communication, which is what facilitates Citrix's distributed computing in Citrix settings. 

In terms of exploitation's effect, all three products are extensively used over the world, with Gateway and ADC deployed in at least 80,000 firms in 158 countries as of early 2020, as per Positive Technologies analysis at the time. 

Any of the equipment being down could hinder remote and branch access to corporate assets and the blocking of cloud and virtual assets and apps in general. All of this makes them a tempting target for cybercriminals, and the Citrix ADC and Gateway, in particular, are far from novices when it comes to severe vulnerabilities. 

About affected versions: 

Though Citrix did not provide technical information on the new vulnerabilities, VulnDB stated on Wednesday that “the exploitability is told to be difficult. The attack can only be initiated within the local network. The exploitation doesn’t require any form of authentication.” 

Despite Citrix's internal classification of "critical," it gave the issue a severity score of 5.1 out of 10. The site stated that vulnerabilities are worth up to $5,000, and that "manipulation with an unknown input leads in a denial of service vulnerability...This will have a negative influence on availability." 

The vulnerabilities, according to the vendor, impact the following supported versions:
Citrix ADC and Citrix Gateway (CVE-2021-22955 and CVE-2021-22956): 
• Citrix ADC and Citrix Gateway 13.0 before 13.0-83.27 
• Citrix ADC and Citrix Gateway 12.1 before 12.1-63.22 
• Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.23 
• Citrix ADC 12.1-FIPS before 12.1-55.257 

Citrix SD-WAN WANOP Edition (CVE-2021-22956): 
• Models 4000-WO, 4100-WO, 5000-WO and 5100-WO 
• Version 11.4 before 11.4.2 
• Version 10.2 before 10.2.9c 
• The WANOP feature of SD-WAN Premium Edition is not impacted. 

Appliances have to be set up as a VPN or AAA virtual server to be vulnerable to the initial Citrix ADC and Gateway flaw. In the case of the second bug, appliances must have management interface access to NSIP or SNIP. Customers that use Citrix-managed cloud services will not be impacted.
Read more »
Subscribe to: Posts (Atom)