Feeds

Nine-ball attack splits security researchers

Ruck over whether figures stack up

Using blade systems to cut costs and sharpen efficiencies

Security researchers are split over the seriousness of a web attack dubbed "Nine-ball" which broke onto the internet last week.

Websense last week reported a web attack dubbed "Nine-ball", a moniker derived from the name of ninetorag.in, one of the malware hosts associated with the assault, had claimed 40,000 website victims.

Web security services firm ScanSafe, by contrast, describes the attack as "almost non-existent".

Mary Landesman, senior security researcher at ScanSafe, reckons that from 15 June the total number of requests to sites involved in the attacks came to just 333. The total number of compromised websites observed over the last week was just 62 of which only one domain - skyscrapercity.com - features above the top 10,000 traffic spot in Alexa's traffic ratings.

"We were a bit surprised that such an allegedly massive attack could bypass our sentries," Landesman said. "After we did take a look, it became apparent why this one didn't trip our alert sensors - this attack is almost non-existent and might be more aptly named 'scratch ball'.

"It is such a low number attack that it’s not the type of thing we’d normally spend our time investigating."

ScanSafe claims its real-time web scanning gives it a grandstand view of malfeasance on the web while Websense is equally adamant that it has the clearest possible view of malware on the net, and a mite indignant over ScanSafe's suggestion that it's exaggerating the impact of the Nine-ball attack.

Websense updated its original analysis on Monday, after we passed on ScanSafe's observations, reiterating that Nine-ball (although slightly decreased in intensity) remains a potent force. This more detailed analysis includes videos and diagrams illustrating the attack, which has evolved since it was first detected on 2 June.

Carl Leonard, security research manager for Websense EMEA, suggested that if ScanSafe reckoned that the attack was insignificant then it must be missing the bigger picture.

"The Nine-Ball attack was more complicated than most which made it difficult for less experienced researchers to understand its complexities," Leonard told El Reg.

"A confusing factor is that there is not one clear infection path. With no fixed start point, no set route and no fixed end point, linking a series together and appreciating that it’s all part of the same campaign is not an easy thing to do, especially when the attack has more than one malicious host involved.

"Most security companies lack the technology to analyze such attacks. Because Websense has such an extensive Threatseeker network we can see the bigger picture when some other companies may only see a part." ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.