Feeds

New-age cyber-attack inflicts major damage with modest means

Ladyboydolls.com and the new DDoS

Security for virtualized datacentres

A Matter of Time

The attacks being tracked by Jackson have been accompanied by more traditional distributed denial of service (DDoS) attacks generated by botnets. They bear the hallmarks of a commercial DDoS application known as BlackEnergy (PDF), leading Jackson to believe it's only a matter of time before the technique gets folded into the package.

What's more, an increasing number of sites over the past couple weeks have been subjected to the attack. For now, they tend to be underground operations such as those cranking out pharmaceutical spam, but Jackson expects that to change.

"When the bot writers integrate this and use it as a value add, then we'll see it in the mainstream," he said.

The only way to prevent the attack is for DNS administrators to ensure their servers are configured to answer upward referrals only to authorized zones within their domain. While some DNS software, such as DJBDNS, does this by default, plenty of other other programs don't. Various versions of BIND, by far the most widely used DNS program, by default return queries for the root servers. (Instructions for changing this behavior in BIND are available here).

DNS software from Microsoft and others can also be used by attackers as DNS amplifiers out of the box, Jackson says. (Readers who know how to change this default behavior for other packages are invited to leave a comment or contact me using this link).

Another possible fix, ISPrime's Rosenthal said, is using firewalls built into FreeBSD, Linux, and Windows. But Jackson says this solution is far from ideal. That's because it would require the blacklisting of hundreds of thousands of legitimate DNS servers. Instead, Jackson is leaning toward the use of special signatures based on the open-source intrusion prevention system known as Snort.

But even some of the more feasible remedies may create problems, warns Baylor University's Vaughn, who says the sudden squelching of DNS responses to the queries could create collateral damage as the requests are repeated over and over.

"Everything we do has a cost, and unfortunately, this is one of those things where there might be some debate about what to do," he said. "There's going to have to be by protocol some sort of response." ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.