Feeds

New-age cyber-attack inflicts major damage with modest means

Ladyboydolls.com and the new DDoS

The Power of One eBook: Top reasons to choose HP BladeSystem

A Matter of Time

The attacks being tracked by Jackson have been accompanied by more traditional distributed denial of service (DDoS) attacks generated by botnets. They bear the hallmarks of a commercial DDoS application known as BlackEnergy (PDF), leading Jackson to believe it's only a matter of time before the technique gets folded into the package.

What's more, an increasing number of sites over the past couple weeks have been subjected to the attack. For now, they tend to be underground operations such as those cranking out pharmaceutical spam, but Jackson expects that to change.

"When the bot writers integrate this and use it as a value add, then we'll see it in the mainstream," he said.

The only way to prevent the attack is for DNS administrators to ensure their servers are configured to answer upward referrals only to authorized zones within their domain. While some DNS software, such as DJBDNS, does this by default, plenty of other other programs don't. Various versions of BIND, by far the most widely used DNS program, by default return queries for the root servers. (Instructions for changing this behavior in BIND are available here).

DNS software from Microsoft and others can also be used by attackers as DNS amplifiers out of the box, Jackson says. (Readers who know how to change this default behavior for other packages are invited to leave a comment or contact me using this link).

Another possible fix, ISPrime's Rosenthal said, is using firewalls built into FreeBSD, Linux, and Windows. But Jackson says this solution is far from ideal. That's because it would require the blacklisting of hundreds of thousands of legitimate DNS servers. Instead, Jackson is leaning toward the use of special signatures based on the open-source intrusion prevention system known as Snort.

But even some of the more feasible remedies may create problems, warns Baylor University's Vaughn, who says the sudden squelching of DNS responses to the queries could create collateral damage as the requests are repeated over and over.

"Everything we do has a cost, and unfortunately, this is one of those things where there might be some debate about what to do," he said. "There's going to have to be by protocol some sort of response." ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.