Feeds

Techwatch weathers DDoS extortion attack

Botnet blackmail

Security for virtualized datacentres

Techwatch is back online following a sustained denial of service attack that left the digital TV news site unavailable for two days earlier this week.

The botnet-powered assault was accompanied by blackmail demands posted on the site's forum through compromised zombie machines. These threatening messages claimed the site was being carpetbombed with spurious traffic generated through a 9,000 strong botnet of compromised machines.

Techwatch was able to restore the site to normal after applying advanced traffic filters.

Brian Turner, Executive editor of Techwatch, told El Reg that the assault is evidence that denial of service extortion attacks are a problem not just for traditional targets such as bookmakers but for mainstream web businesses.

Techwatch was hit by a 446Mbps distributed denial of service attack on Tuesday, 27 January which rose to 2Gbps on Wednesday. The deluge of spurious (SYNflood) requests left the site unable to cope with genuine visitors.

"Techwatch normally handles between 15,000-25,000 uniques per day without problem, but there's little chance of us staying online with 2Gbps traffic," Turner explained.

The site was restored to normal service on Thursday afternoon. Turner said his experiences with Techwatch should act as a warning for other web businesses who face dangers more severe than defacement by script kiddies, the more traditional form of threat.

"Anyone with a popular website is at risk of it being hacked - this time for commercial purposes - not least to insert hidden links to porn, pills and pharmaceuticals sites," Turner explained. "The danger is, the recent Techwatch DDoS could be a part of an increasing trend where everyday webmasters could find themselves victims of a new form of protection racket - blackmailed into paying to stop their sites being taken down by a SYNflood."

Webadmins can add procedures on how to deal with such an attack as part of their disaster recovery planning, he added. "Ensure you know which are your most important IPs for delivering customers. Web crawlers, newsbots, and anything similar which act as main traffic channels to your website. This way, if you do have to aggressively block IP ranges, you can whitelist these.

"Website admins should also keep an eye on their server logs to spot early signs of trouble."

The assault on Techwatch follows a denial of service attack on hardware enthusiast site Overclockers UK. OcUK is offering a £10,000 ($13,380) reward for information that results in the arrest and convictions of the perpetrators of the attack, the motives for which remain unclear. ®

Security for virtualized datacentres

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Huawei ditches new Windows Phone mobe plans, blames poor sales
Giganto mobe firm slams door shut on Microsoft. OH DEAR
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Forget silly privacy worries - help biometrics firms make MILLIONS
Beancounter reckons dabs-scanning tech is the next big moneypit
Microsoft's Office Delve wants work to be more like being on Facebook
Office Graph, social features for Office 365 going public
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.