Feeds

New-age cyber-attack inflicts major damage with modest means

Ladyboydolls.com and the new DDoS

The essential guide to IT transformation

A Matter of Time

The attacks being tracked by Jackson have been accompanied by more traditional distributed denial of service (DDoS) attacks generated by botnets. They bear the hallmarks of a commercial DDoS application known as BlackEnergy (PDF), leading Jackson to believe it's only a matter of time before the technique gets folded into the package.

What's more, an increasing number of sites over the past couple weeks have been subjected to the attack. For now, they tend to be underground operations such as those cranking out pharmaceutical spam, but Jackson expects that to change.

"When the bot writers integrate this and use it as a value add, then we'll see it in the mainstream," he said.

The only way to prevent the attack is for DNS administrators to ensure their servers are configured to answer upward referrals only to authorized zones within their domain. While some DNS software, such as DJBDNS, does this by default, plenty of other other programs don't. Various versions of BIND, by far the most widely used DNS program, by default return queries for the root servers. (Instructions for changing this behavior in BIND are available here).

DNS software from Microsoft and others can also be used by attackers as DNS amplifiers out of the box, Jackson says. (Readers who know how to change this default behavior for other packages are invited to leave a comment or contact me using this link).

Another possible fix, ISPrime's Rosenthal said, is using firewalls built into FreeBSD, Linux, and Windows. But Jackson says this solution is far from ideal. That's because it would require the blacklisting of hundreds of thousands of legitimate DNS servers. Instead, Jackson is leaning toward the use of special signatures based on the open-source intrusion prevention system known as Snort.

But even some of the more feasible remedies may create problems, warns Baylor University's Vaughn, who says the sudden squelching of DNS responses to the queries could create collateral damage as the requests are repeated over and over.

"Everything we do has a cost, and unfortunately, this is one of those things where there might be some debate about what to do," he said. "There's going to have to be by protocol some sort of response." ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?