Sydor Instruments partners with SABRE Ballistics t... » ROCHESTER, N.Y.: Sydor Instruments has has entered into an agreement with SABRE Ballistics to serve ... Interconnective to deliver smart two way radio IP ... » Interconnective Security Products (ISP) announced that it has entered into an agreement with the awa... Security B-Sides London announces its galaxy of sp... » Security B-Sides London, the event driven by the information security community, has confirmed its l... Russian Kubinka Tank Museum to restore Maus Super-... » Company to assist the museum in building a unique collection of military warfare exhibits Wargaming... ISACA donates $20,000 to help UNESCO build knowled... » London, UK: As part of its new corporate social responsibility (CSR) program, ISACA, a global associ... Army couples needed for relationship study » Participants hold the key to improved relationships after deployment DENVER: Judy Davis is an acti... Global Association ISACA reaches 45 years and 115,... » London, UK: In 1969, the first message was sent between computers via ARPANET, the precursor o... Datum Datacentres announces fast growing cloud and... » FARNBOROUGH: Datum Datacentres has announced the official launch of the Datum Cloud Hub, the co-loca... ANIMATRONIC MANNEQUIN TO TEST PROTECTIVE EQUIPMENT » The Ministry of Defence has invested £1.1m in a new state-of-the-art robotic mannequin that will tes... Options upgrades low latency route between Cartere... » New York: Options has announced that it has upgraded the route between the firm’s data center facili...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

Following on from the DDos attacks on US Banks, Imperva have posted up an interesting blog which shows the origins of these attacks which have stemmed from malware being planted into webservers.

 

Please see link below:

http://blog.imperva.com/2013/03/itsoknoproblemo-eyes-wide-shut.html

Itsoknoproblemo, Eyes wide shut.

In January, Incapsula released analysis showing how infected webservers were being used in order to elevate broader attacks, such as DDoS campaigns, which we have recently witnessed targeting the banking industry.

Today, ThreatPost released an article discussing the recent rise of DDoS against US Banks. Some banks were reported to suffer service disruption ( via sitedown). This follows a warning issued by the Qassam Cyber Fighters hacktivist group, claiming it will disrupt US Banks operations as part of “Operation Ababil.”

Denial of Service (DoS) attacks are technical attacks that are focused on consuming the resources of a server/service, which prevents it from serving more legitimate users of that specific service. This is done either by consuming the available network bandwidth, or in the application age, by consuming the actual application resources. These attacks usually require many machines addressing the service in the same time to generate the load.

The Web Threat Angle

In the industrialized hacking age, where Hactivism has become talk of the day, hackers build botnets in order to coordinate such an attack from many computers. One of the easiest ways to build a botnet is through “Waterhole” websites, which are popular websites infected with malware that infect the host, which becomes a zombie in the botnet, waiting for instructions to generate targeted traffic upon demand. The recent NBC malware infection attack is a great example of the use of Waterhole websites to infect the masses

Now we are seeing itsoknoproblemo, which is one of the tools most used in the recent DDoS attacks against the US Banking industry, some peaking at 70 Gbps.

This tool is distributed mostly via a Remote File Inclusion (RFI) attack, creating a drive-by download vector for users that hit the infected web pages, and then become zombies. An RFI attack allows you to plant/redirect users to malicious code just by going on the website.

What does this teach us?

There are two problems that need to be dealt with here. One is the problem that the banks now deal with: the DDoS attacks themselves. The other is the infection vector of the malware via webservers.

 

The RFI vulnerability is the starting point that allows hackers to build the bot-net that eventually generates the DDoS attack.

 

Since alongside spear-phishing, it enables one of the biggest ways for hackers to send malware and DDoS-specific malware to users.

 

Interestingly enough, companies protected by Web Application Firewalls are capable of protecting themselves against RFI attacks and from the follow-up of distributing malware. And even though they do not suffer from the DDoS attack itself, the malware distribution creates the reputation damage that companies fear