hacking – Page 370 – STE WILLIAMS

Google stored some passwords in plain text for 14 years

library
crime | hacking | security

Oops, Google said on Tuesday: you know that domain administrator’s tool to reset passwords in the G Suite enterprise product? The one we implemented back in 2005, as in, 14 years ago?

We goofed, Google said. The company’s been storing copies of unhashed passwords – as in, plaintext, unencrypted passwords – all this time.

From a blog post written by Google vice president of engineering Suzanne Frey:

We made an error when implementing this functionality back in 2005: The admin console stored a copy of the unhashed password. This practice did not live up to our standards.

Only a small number of enterprise customers were affected, she said, though Google hasn’t put a number on it. People using the free, consumer version weren’t affected. Google’s notified a subset of its enterprise G Suite customers that some of their passwords were stored in plaintext in its encrypted internal systems.

Frey said that no harm came of it, as far as Google can ascertain, and it’s since been fixed:

To be clear, these passwords remained in our secure encrypted infrastructure. This issue has been fixed and we have seen no evidence of improper access to or misuse of the affected passwords.

How it’s supposed to work

The way Google typically handles passwords is by scrambling them with a hashing algorithm so humans can’t read them. It then stores hashed passwords along with their usernames. Then, both usernames and hashed passwords are encrypted before being saved to disk.

The next time a user tries to sign in, Google again scrambles their password with the same hashing algorithm. If the result matches the stored string, Google knows you must have typed the correct password, so your sign-in can proceed.

As Frey explained, the beauty of hashing is that it’s one-way: scrambling a password is easy, but it’s nearly impossible to unscramble it. So, if someone gets your scrambled password, they won’t be able to backtrack to your real password. Presuming, that is, that it’s also been salted. A salt is a random string added to a password before it’s cryptographically hashed.

The salt isn’t a secret. It’s just there to make sure that two people with the same password get different hashes. That stops hackers from using rainbow tables of pre-computed hashes to crack passwords, and from cross-checking hash frequency against password popularity. (In a database of unsalted hashes, the hash that occurs most frequently is likely to be the hashed version of the notoriously popular “123456”, for example.)

The downside of that one-way password hashing street is that you’re out of luck if you forget your password: Google can’t help you out by unscrambling your password for you. What it can do is to reset your password to a temporary password, make it valid only for one-time use, and then require you to pick a new one.

That’s the way it should work, anyway, though we’ve seen plenty of cases where forgetful users get emailed their plaintext password: an indication that their passwords are being stored, in plaintext, unsalted and unhashed.

Goodbye, handy dandy password recovery tool

To avoid storing passwords in plaintext, and to still be able to help out users who’ve forgotten their passwords, Google in 2005 introduced a tool for password setting and recovery to G Suite.

The tool, located in the admin console, enables admins to upload or manually set user passwords for their company’s users. Google’s intent behind introducing the tool was to help with onboarding of new users, such as when a new employee needs an account on the first day they start work, and also for account recovery.

Well, we can kiss that goodbye. Google’s removed the feature.

But wait, there’s more: Google says that when it was troubleshooting its new G Suite customer sign-up flows, it discovered that starting in January 2019, it also inadvertently stored a subset of unhashed passwords in its secure encrypted infrastructure. The passwords were there for, at most, 14 days. That glitch has also been fixed. And like the other glitch, this second one apparently didn’t lead to anybody getting at the passwords.

Sorry, Google said: we’ll try to ensure this is an isolated incident.

So not isolated in the broader scheme of password storage

Unfortunately, it’s not all that isolated on the broader scale of tech giants – or little guys, for that matter – storing passwords unencrypted, in plain text. In March, user data acquired via Facebook by third-party apps was found lying around in the cloud.

Initially, the damage was said to involve hundreds of millions of Facebook Lite users, tens of millions of Facebook users, and tens of thousands of Instagram users.

Whoops – make that millions of Instagram users, Facebook went on to say in April, as in, 100x more than we thought.

The moral of the story is that tech behemoths like Google and Facebook sometimes screw up and store passwords in plaintext, which makes it a pretty good bet that any other smaller online service that employs less slick technology and far fewer security engineers might very well slip up and do the same, be it by mistake or because they don’t know any better.

Plaintext passwords = bad. Plaintext passwords = not all that uncommon.

Therefore, two-factor authentication (2FA) = a good way to save your bacon. Slather it on everywhere you can: 2FA, or U2F (Universal 2nd Factor) security keys, mean that a password alone isn’t enough for crooks to raid your account.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/FIQsF_1bVFw/

Phisher folk reel in Computacenter security vetting mailbox packed with sensitive staff data

library
crime | hacking | security

The third-party mailbox used by Computacenter employees and contractors to deposit data for security clearance applications has been hacked and used in phishing scams.

The company, one of Europe’s largest resellers, counts some of the biggest names in financial services among its corporate client base, and sells to a raft of local and central government customers.

Computacenter wrote to its staff yesterday to confirm the incident:

We have established that a mailbox provided by a third party as part of the vetting service it provides to Computacenter UK Ltd has been the target of a cyber security attack. Unfortunately, we believe the mailbox may have included data relating to you.

The mailbox was used to collate data from individuals when information relating to their security clearance applications was deemed to be missing or incorrect. The information requested could include ID data, contact details, bank details, addresses and employment history.

The “attacker” gained entry and changed the password for the mailbox, which system audit logs showed prevented further access by Computacenter. The mailbox was then used to send phishing emails.

“However, these logs cannot tell us precisely what was in the mailbox at the time of the attack or whether the data was exported or just deleted,” the mail to staff stated.

On being made aware of the attack, Computacenter said it initiated the Group Information Assurance compliance methodology, establishing that other systems connected to the security vetting process were unaffected and “secure workaround processes for security clearance have been implemented”.

The reseller also, obviously, blocked further unauthorised access to the mailbox, stopped using it and “advised users not to send information to it”.

“The mailbox will be permanently deleted once the investigation and root cause analysis is completed,” the memo to staff added. “We would also like to re-emphasise that the attack was not on Computacenter’s own email system.”

That will come as small consolation to any employee or contractors whose details were exposed in the leak.

The company added: “Whilst we believe that the motive for the attack was disruptive rather than exploitative, you should consider the possibility of identification theft or fraud.” Depending on the type of information provided, staff were urged to monitor account statements for “evidence of unauthorised activity”.

Computacenter is offering a 12-month free ID monitoring service, but to access it staff and contractors need to email the UK Vetting Team.

One source who sent data to the affected mailbox told us it was used for vetting Computacenter workers for all sorts of sites and customers. He told us the company requested various forms of documentation including a passport, driving licence and bank statements.

“I was told if I did not provide them I could not be on-site. Now it’s a custom identity fraud kit,” one of our sources said.

Computacenter has told the Information Commissioner’s Office of the breach.

The Register has asked the ICO and Computacenter to comment.

Updated 11.14BST to add:

An ICO spokesperson contacted us to say: “Computacenter has made us aware of an incident and we will assess the information provided”.®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/23/computacenter_staff_security_clearance_application_mailbox_breached/

We’ll hack back at Russians, declare UK ministers in cyber-Blitz blitz

library
crime | hacking | security

British ministers are stepping up their rhetoric on cyber warfare, with £22m to be splurged on embiggening an “offensive hacking” unit as Foreign Secretary Jeremy Hunt vowed to retaliate against Russian cyber-attacks.

In a speech delivered this morning at Lancaster House, the preferred venue for big foreign policy set-pieces, Hunt declared that Britain’s “primary goal” must be to deter foreign state-backed hackers from targeting the country at all.

“In particular,” he said, “we should be more emphatic about what we consider to be unacceptable behaviour and the consequences for any breach of international law.”

His speech was the keynote of a NATO press conference, arranged for the NATO Cyber Defence Pledge conference. That conference was themed around getting alliance members to agree tougher responses to largely Russian hacking attacks.

Hunt continued: “Recent events demonstrate that our adversaries regard democratic elections as a key vulnerability of an open society. If cyber interference were to become commonplace, the danger is that authoritarian states would damage public confidence in the very fabric of democracy.”

He said all this without acknowledging the electoral chaos rampaging through the UK thanks to the indecision of his own political party over the Britain leaving the European Union.

We must be very clear, any cyber operations designed to alter an election would breach international law and justify a proportionate response. Together we possess options for responding to any attacks that fall below the threshold for Article 5 and we should be prepared to use them.

Article 5 is the part of the NATO founding treaty which says an attack on one alliance member is counted as an attack on all of them.

NATO Secretary-General Jens Stoltenberg also chipped in, boasting: “None of the [hacking] attempts against NATO have compromised our secure networks and none have affected our operations.”

The secretary-general, a one-time prime minister of Norway, ominously added that the 29-strong alliance must be “ready to use our cyber capabilities to fight an enemy” – though he later qualified this to mean in the same way that British hackers disrupted Islamic State extremists’ propaganda channels during the ongoing war in Iraq and Syria.

Separately, yesterday evening, UK Defence Secretary Penny Mordaunt announced that a fresh £22m from the MoD budget would be be splurged on enlarging existing “offensive cyber” units. She said in a prepared speech: “Cyber enemies think they can act with impunity. We must show them they can’t. That we are ready to respond at a time and place of our choosing in any domain, not just the virtual world.”

All in all, British rhetoric is growing about the nation being increasingly willing to actively hack and damage other countries’ cyber-infrastructure in retaliation for attacks on our own, or allied, infrastructure. With the general thrust of recent defence and foreign policy being to push Britain as a countering “force for good” against the traditional bogeyman of Russia, cyber warfare threats will be playing an increasingly larger role.

So far the UK has not admitted to actually using its hacking capabilities against another country. Only Islamic extremists in the Middle East have been publicly acknowledged as targets. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/23/uk_will_hack_other_countries_say_ministers/

Data Asset Management: What Do You Really Need?

library
crime | hacking | security

At Interop, a cybersecurity and privacy leader explains her approach to data management and governance at a massive, decentralized company.

INTEROP 2019 – LAS VEGAS – Nobody wants to admit they don’t know what kind of data they’re collecting, where it goes, or where their backups are located. In a room packed with IT professionals, one could guess at least a few are grappling with those exact questions.

“It’s really critical to us to know what we have,” said Stacey Halota, vice president of information security and privacy at Graham Holdings Co., during a keynote chat with Dark Reading senior editor Sara Peters at Interop 2019, held this week in Las Vegas. Each year, Graham Holdings conducts a “sensitive data project” to inventory data from every organization in the company. When the iterative process is complete, she explained, all of the metrics are sent to the board.

Much of the chat focused on data asset management and governance, a hot topic among the IT pro audience. Each data privacy regulation forces IT and security teams to consider data in a different way, Halota said. Consider GDPR, which she said was “a little bit easier” for the global company because it was already regulated by the European Union’s Data Protection Directive.

“GDPR is a supercharged version of the directive,” Halota noted. But the California Consumer Privacy Act (CCPA), which has a different definition for personally identifiable information (PII), required a broader approach. Graham Holdings had to consider a wider range of device information to ensure its definition of PII was varied enough to include all of the data it stores. Its data protection impact assessment (DIPA) and existing risk assessments had to be repackaged.

New regulations have prompted technological change. The company relies on Archer for much of its data governance and risk compliance. A major step for GDPR, CCPA, and the many bills coming in the future is to repurpose Archer in some ways to define risk assessment and expand its document repository so it collects data needed for different laws.

Halota isn’t only concerned with ensuring compliance for Graham Holdings’ data. She’s also focused on reducing the collection of sensitive data and deleting anything it doesn’t need.

“To us, the keystone of our business is information,” she said. “It’s understanding what you have and what you collect … what you collect is precious, it’s important, and it’s important to only collect what we need.” If a company doesn’t need information, it should delete it. As part of the sensitive data project, Graham Holdings’ organizations are not only asked about the information they collected, but that which they deleted. If they didn’t delete anything, why?

“We seek to minimize the really sensitive data that we hold,” Halota said. For instance, Graham Holdings keeps data in production environments but scrambles it in non-production. It doesn’t keep credit card numbers if it can help it, she added; if it has numbers, they’re tokenized.

Keeping sensitive data to a minimum is a businesswide effort. Halota has to speak with everyone – CEO, CFO, marketing, human resources, legal – to understand their needs and when it may be time to eliminate data. “It’s always a hard conversation,” she said, and it can be complicated. “I’ve had missteps myself … I think things should be deleted and they don’t.”

The most important part is building a relationship with different departments. “It’s absolutely critical” to talk with every part of the business so she can argue when data isn’t valuable to the company. “It’s not just saying, ‘We’re going to delete all this stuff,'” she said.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/data-asset-management-what-do-you-really-need/d/d-id/1334786?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New Software Skims Credit Card Info From Online Credit Card Transactions

library
crime | hacking | security

The new exploit builds a fake frame around legitimate portions of an online commerce website.

A new strain of software designed to steal financial information from retail websites has surfaced, demonstrating criminals’ ability to adapt and improve their tools in the face of improved security measures.

The software, discovered by researcher Jérôme Segura at Malwarebytes, takes advantage of the popular retail practice of using a third-party credit card payment organization to facilitate credit card use. In this case, the software targets companies using Magento as their financial processing service provider. The malicious software inserts an iframe around the display code that would send the customer to Magento to finalize a purchase — an iframe that requests and captures the customer payment card info far earlier than it would be requested in a legitimate transaction.

This new attack is similar to an earlier overlay code tactic used by Magecart. It allows the purchase to proceed, minimizing the speed with which it might be found, but will exfiltrate customer payment information in the process. The only real clue for those who don’t have the checkout page layout memorized is the process by which payment information is requested twice — which should alert all consumers that something is amiss.

Alphabet’s Chronicle Explores Code-Signing Abuse in the Wild

library
crime | hacking | security

A new analysis highlights the prevalence of malware signed by certificate authorities and the problems with trust-based security.

Researchers with Chronicle, the cybersecurity company and Alphabet subsidiary, today published an analysis of its investigation into the trend of signed malware being exploited in the wild.

The process of cryptographically signing code was created to give the Windows operating system a means to distinguish good code from bad. Certificates are signed/issued by trusted certificate authorities (CAs), backed by a trusted parent CA. The purpose behind signing a Windows executable file was to mark the authenticity of code published on the Internet.

The problem is, this system is based on trust, and cybercriminals are taking advantage of it.

Malware authors buy these certificates, directly or through resellers. While a CA can revoke a certificate deemed untrustworthy — and more of them are — this remains the only way to cut down on abuse. The process creates a window during which malware has a trusted certificate.

To highlight the prevalence of this trend and problems with trust-based security, Chronicle researchers used VirusTotal, an online virus/malware scanner that analyzes suspicious files that a machine’s antivirus tools may have missed. They limited this project to Windows PE Executable files, filtered out samples with fewer than 15 aggregate detections, and “aggressively” filtered out grayware files to determine the number of malware samples each CA was responsible for signing. When all was said and filtered, the researchers ended up with a total of 3,815 malware samples.

CAs that signed certificates of 100+ malware samples accounted for nearly 78% of signed malware uploaded to VirusTotal, Chronicle reports. Interestingly, there is a significant drop between CAs when considering malware samples signed. For example, COMODO RSA Code Signing CA, which has the most samples at 1,775, has almost 3.5 times the amount of Thawte SHA256 Code Signing CA, which has the next-highest number, at 509 signed malware samples. The numbers continue to fall from there: Thawte SHA256 has double the next-highest CA.

Researchers report CAs are combating the trend. More than 20% of malware samples had their certificates revoked at the time Chronicle’s blog post published, a sign CAs are cracking down.

As Chronicle points out, attackers taking advantage of user trust is nothing new; however, it was believed to mostly be popular among nation-state attackers. Now, it appears the trend has grown to become a common practice among most cybercriminals armed with malware.

“The impact is amplified by the scope and scale of typical crimeware campaigns,” the company reports. “Expect to see signed malware reported more frequently.”

US Air Force probes targeted malware attack, blames… er, the US Navy? What?

library
crime | hacking | security

The US Air Force has opened an investigation into a “malware” infection – which it is blaming on lawyers employed by the US Navy who are working on a war crimes case.

The bizarre case hinges around an alleged attempt by a US Navy prosecutor to plant malware on the devices of US Air Force lawyers defending a US Navy SEAL over war crimes charges from his time commanding a small unit in Afghanistan.

Like the UK, US military lawyers can work on cases involving people from outside their own branch of the armed forces.

The US Air Force Times, an independent publication, quoted from a memo written by Captain David Wilson, a senior Navy defence lawyer, referring to “malware” found on the machine of a USAF lawyer he was working alongside. This was later described as having been written to gain “full access to his computer and all files on his computer”.

“In fact, I’ve learned that the Air Force is treating this malware as a cyber-intrusion on their network and have seized the Air Force Individual Military Counsel’s computer and phone for review,” he wrote.

The malware was further described as “tracking software”.

Similar malware was sent to the editor of sister publication the US Navy Times, USAF Times reported. The editor had written a number of detailed articles about the ongoing trial, leading USN prosecutors to believe someone was leaking documents – in breach of a court order. USAF Times speculated that the malware was sent in the hope of identifying potential sources for those leaks.

The paper claimed the email had “contained hidden computer coding designed to extract the IP address of the Navy Times computer network and to send that information back to a server located in San Diego”.

If unauthorised, such behaviour would be a clear criminal offence under American law.

The intentional, weaponised use of malware by state agencies is something that is, by law and custom, restricted to being used against actual criminals and not journalists. While aggressive and unsupervised law enforcement bodies across the world do abuse their powers, break the law and spy on journalists, doing so with email malware appears to be a new one. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/22/us_navy_us_air_force_friendly_fire_malware_allegations/

The 3 Cybersecurity Rules of Trust

library
crime | hacking | security

Every day, keeping anything secure requires being smart about trust. The rules of trust will keep you and your data safer.

Do you trust me?

Why wouldn’t you? I’m honest, have strong credentials in cybersecurity, and helped design security solutions for top technology companies and government entities.

But hold on — you don’t know me from a hole in the ground. Am I fictitious? The advanced degrees in my office — are they real? My six patents — real or exaggerated? You have to trust your instincts on whether I’m trustworthy.

That’s the central problem everyone faces in information security today. Casual hackers, organized crime, government-sponsored hackers, secret backdoors, malicious insiders, corrupt supply chains, and porous technological defenses all contribute to our predicament. You can listen to experts, hire security professionals, buy technologies from the right companies, and still lose the security battle. Bulletproof solutions would be prohibitively expensive, and standard off-the-shelf solutions may not keep you safe.

The Rules of Trust
You already make trust decisions based on a framework every day. You let hotel staff clean your suite but don’t leave cash out on the dresser. You give your credit card to Amazon.com, but not to that dubious character selling designer-brand watches on the sidewalk. You invest in established mutual funds but not the get-rich-quick scheme that your friend’s cousin swears is a sure 1,000% return on investment.

How do you make those decisions? Simple: You follow three Rules of Trust:

All things being equal, trust as little as possible.
Use evidence and experience to measure trustworthiness.
Trust proportionally to risk.

That’s it. You’re set. Easy, right?

You know better; trust is no precise science. Even if you follow the rules carefully, you’ll get burned sometimes for being too trusting, or miss out on something for not trusting enough. Yet on the whole, following these three Rules of Trust will help you make better cybersecurity decisions.

Be Untrusting
Rule 1: “All things being equal, trust as little as possible.”

In other words, allow attackers fewer ways to compromise you. Make life harder for them. Reduce your “attack surface.”

Making data inaccessible is the best kind of security. If your secrets are not on — or passing through — your computer, bad guys probably can’t get them. When feasible, keep super-sensitive stuff on paper or an external drive that is usually disconnected from your computers. Anything transmitted could be stolen before it arrives. When you send a private e-mail or post in a closed community assume it will be read by unintended parties. Our collective defenses are too weak to assume anything else. Despite your carefulness, many people and organizations (sadly) could get malware onto your computer, if they targeted you.

Measure Trustworthiness
No doubt you load all your favorite software on your computer, and 20+ apps on your smartphone, and access email on both devices, probably using public Wi-Fi. Fine. Being untrusting doesn’t mean being a digital hermit. To be productive, we all sometimes need sensitive material on our devices — so we all must learn to gauge trustworthiness.

Rule 2: “Use evidence and experience to measure trustworthiness.”

A few tips to measure risk levels:

More code = more risk: Programs with 10,000 lines of code could actually be reviewed by careful developers. Software with 10 million lines of code (sorry, Microsoft) is going to have a lot of bugs and create more risk.
More programs = more risk: Picking which permissions to grant your smartphone apps is complicated. Once you install more than a couple apps, risk balloons. It takes just one malicious app to compromise your system. One survey found companies average over 480 cloud and on-premises applications in use, and they’re attacked 500 times per day.
Hardware tends to be safer than software: It’s very expensive to change hardware, so hardware vendors work hard to make sure it’s exactly right before it reaches you. Security hardware often provides isolation capabilities that block malware on your machine from accessing data.
Old technology and too-new technology may be vulnerable: Criminals eventually find ways around almost any security. You’ll need to adopt new kinds of security over time, but don’t always trust the salesperson, who may not know about vulnerabilities that haven’t been fixed.
Doing homework helps: Are your hardware and software from reputable vendors? Do people trust their security? Your intuition is often an accurate guide, too.

Distrust and Verify
When you must trust, Rule 3 is important:

Rule 3: “Distrust proportionally to the level of risk.”

Your risk level is based on an attacker’s cost and motivation to take what’s yours — and on the value of your assets to you. If you treasure that data, and criminals want it, distrust much — and verify more. High risk? Then attacks are coming. Consider two-factor authentication, and remember your measure of trustworthiness; verify that you really trust the software and hardware you use.

The security you have today is probably sufficient, if your assets have low value to attackers — or if the attack costs more than the assets are worth. Most attackers seek profit, after all.

Every day, keeping anything secure requires being smart about trust. Stay alert, evaluate continually, and adjust security as things change. Your decisions about trust will factor into almost every choice you have. The rules of trust will keep you and your data safer. Trust me; I’m a security CTO. Maybe.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ari Singer, CTO at TrustiPhi and long-time security architect with over 20 years in the trusted computing space, is former chair of the IEEE P1363 working group and acted as security editor/author of IEEE 802.15.3, IEEE 802.15.4, and EESS #1. He chaired the Trusted Computing … View Full Bio

Article source: https://www.darkreading.com/perimeter/the-3-cybersecurity-rules-of-trust-/a/d-id/1334732?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google Alerts Admins to Unhashed Password Storage

library
crime | hacking | security

The company reports it has seen improper access to, or misuse of, affected enterprise G Suite credentials.

Google this week informed a subset of enterprise G Suite users that passwords were stored unhashed in its encrypted internal systems. So far, it says, none of them have been accessed or misused.

The issue specifically affects business G Suite users. Google had previously given domain admins a tool, located in the admin console, to upload or manually set user passwords for employees. This was a commonly requested feature and helped with account recovery and bringing aboard new users. For example, they could use it to give credentials to a new employee on his or her first day. This capability has since been eliminated for password recovery, Google reports in a blog post.

“We made an error when implementing this functionality back in 2005,” writes Suzanne Frey, vice president of engineering for Cloud Trust, explaining how the admin console stored copies of the unhashed password. While the passwords were stored in Google’s encrypted infrastructure, she says, “this practice did not live up to our standards.”

In January 2019, Google was troubleshooting G Suite customer sign-up flows when it found a subset of unhashed passwords mistakenly stored in its encrypted infrastructure. It says it has fixed the issue, alerted those affected, and is working with admins to ensure passwords are reset.

DDoS Attacks Up in Q1 After Months of Steady Decline

library
crime | hacking | security

Sudden surge suggests that new actors have stepped up to the plate to replace the old operators.

Distributed denial-of-service attacks (DDoS) — particularly those lasting more than an hour — increased sharply in number during the first quarter of this year over the prior quarter after declining steadily for most of 2018.

The unexpected resurgence suggests that new suppliers of DDoS services have quietly emerged to replace operators that were disrupted in a series of law enforcement actions last year, Kaspersky Lab said in a report summarizing DDoS activity in Q1 2019.

The security vendor’s analysis shows the number of DDoS attacks in Q1 to be some 84% higher than the number recorded in the last three months of 2018.

One significant trend that Kaspersky Lab notes is an overall increase in the number of attacks lasting one hour or longer. Over one in 10 (10.13%) of the DDoS attacks in Kaspersky Lab’s dataset lasted between five hours and nine hours, and another 9.37% lasted between 10 hours and 49 hours — or more than two days. Some 2% of the attacks were longer than 50 hours, with the longest one lasting 289 hours, or just over 12 days.

In total, the proportion of sustained attacks, or those lasting more than an hour, nearly doubled from 11% of the overall number of DDoS attacks in the last quarter of 2018 to 21% of the total in the first three months this year. Correspondingly, the number of short-duration DDoS attacks lasting less than four hours declined — from 83.34% in Q4 2018 to 78.66% this year.

Alexander Gutnikov, an analyst with Kaspersky Lab DDoS prevention service, says attackers are increasingly moving away from volumetric, high-bandwidth attacks at the network (L3) and transport (L4) layers because of the mitigations available for such attacks. Instead, they are turning to smarter DDoS attacks such as those that target the application layer.

“The main driver of the growth of smart DDoS attacks is a decrease in the effectiveness of volumetric attacks,” Gutnikov says. “Volumetric attacks have to be very powerful to significantly affect the stability of resources,” For vendors that provide dedicated DDoS mitigation services, the trend is not particularly new. he adds.

As has been the case for several years, a majority of DDoS attacks last quarter were SYN flood attacks. However, the number of SYN attacks as a percentage of the overall total of DDoS attacks jumped sharply from 58.1% in the last quarter of 2018 to over 84% in this year’s first quarter. Meanwhile, other types of DDoS attacks, such as UDP flooding and TCP flooding, showed a corresponding decrease.

HTTP flooding attacks targeting the Web application layer are still relatively rare. However, the number of such attacks appears to be growing. Kaspersky Lab analysis shows HTTP flood attacks increasing in number from 2.2% of the overall total in Q4 to 3.3% last quarter. “In terms of the ratio of effectiveness and cost of organization, application-level attacks, L7, are an optimal option for malefactors,” Gutnikov notes.

A Persistent Threat
Kaspersky Lab’s new report is the latest to highlight the continuing threat that DDoS attacks present to organizations despite some major wins for law enforcement against those behind such attacks.

Last April, for instance, European law enforcement agencies, in cooperation with their counterparts in other regions of the world, dismantled Webstresser, one of the largest sites for buying and selling DDoS services at the time, and announced the arrests of the operators and several clients of the illegal outfit.

More recently the US Justice Department announced it had seized 15 websites offering similar DDoS-for-hire services and charged three individuals for their roles in the operation. In January, a Boston federal judge sentenced an individual convicted on charges of launching a DDoS attack on Boston Children’s Hospital to 10 years in prison.

The fact that the number of attacks increased last quarter are all the same suggests that new actors have stepped up to the plate to replace the old operators, according to Kaspersky Lab.

“We believe that the motives for DDoS services remain the same: politics, unfair competition, concealment of other cybercrime, or personal motives,” Gutnikov says. “And for people who conduct DDoS attacks, the main motive is money.”

Data from Verizon’s “2019 Data Breach Investigations Report” (DBIR) shows that public-sector organizations and those in the IT, finance, and professional services sectors are far more frequent targets of DDoS attacks than organizations in other industries. Verizon counted more than 990 DDoS incidents against public-sector organizations in 2018, 684 attacks against IT organizations, 575 targeting financial firms, and nearly 410 against professional services firms.

Financial services organizations and IT companies are also targets of some of the biggest DDoS attacks — from a bandwidth and packets-per-second standpoint. Verizon’s data shows that in 2018, the median size of DDoS attacks against financial services companies and IT organizations were 1.47 Gbps and 1.27 Gbps, respectively.

“Over time, DDoS attacks have been getting much more tightly clumped with regard to size,” with little difference in size between the largest and smallest attacks, Verizon said.

Ominously for enterprise organizations, while DDoS attacks, on average, have shrunk in size overall, there has been an increase in the number of really massive attacks.

According to security vendor Imperva, there has been a recent increase in DDoS attacks involving 500 million or more attack packets per second. During a one-week period earlier this year, Imperva’s researchers detected nine such DDoS attacks, with the largest one hitting an astounding 652 million packets per second.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ddos-attacks-up-in-q1-after-months-of-steady-decline/d/d-id/1334778?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple