Feeds

Nine-ball attack splits security researchers

Ruck over whether figures stack up

Providing a secure and efficient Helpdesk

Security researchers are split over the seriousness of a web attack dubbed "Nine-ball" which broke onto the internet last week.

Websense last week reported a web attack dubbed "Nine-ball", a moniker derived from the name of ninetorag.in, one of the malware hosts associated with the assault, had claimed 40,000 website victims.

Web security services firm ScanSafe, by contrast, describes the attack as "almost non-existent".

Mary Landesman, senior security researcher at ScanSafe, reckons that from 15 June the total number of requests to sites involved in the attacks came to just 333. The total number of compromised websites observed over the last week was just 62 of which only one domain - skyscrapercity.com - features above the top 10,000 traffic spot in Alexa's traffic ratings.

"We were a bit surprised that such an allegedly massive attack could bypass our sentries," Landesman said. "After we did take a look, it became apparent why this one didn't trip our alert sensors - this attack is almost non-existent and might be more aptly named 'scratch ball'.

"It is such a low number attack that it’s not the type of thing we’d normally spend our time investigating."

ScanSafe claims its real-time web scanning gives it a grandstand view of malfeasance on the web while Websense is equally adamant that it has the clearest possible view of malware on the net, and a mite indignant over ScanSafe's suggestion that it's exaggerating the impact of the Nine-ball attack.

Websense updated its original analysis on Monday, after we passed on ScanSafe's observations, reiterating that Nine-ball (although slightly decreased in intensity) remains a potent force. This more detailed analysis includes videos and diagrams illustrating the attack, which has evolved since it was first detected on 2 June.

Carl Leonard, security research manager for Websense EMEA, suggested that if ScanSafe reckoned that the attack was insignificant then it must be missing the bigger picture.

"The Nine-Ball attack was more complicated than most which made it difficult for less experienced researchers to understand its complexities," Leonard told El Reg.

"A confusing factor is that there is not one clear infection path. With no fixed start point, no set route and no fixed end point, linking a series together and appreciating that it’s all part of the same campaign is not an easy thing to do, especially when the attack has more than one malicious host involved.

"Most security companies lack the technology to analyze such attacks. Because Websense has such an extensive Threatseeker network we can see the bigger picture when some other companies may only see a part." ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.