Feeds

Nine-ball attack splits security researchers

Ruck over whether figures stack up

Secure remote control for conventional and virtual desktops

Security researchers are split over the seriousness of a web attack dubbed "Nine-ball" which broke onto the internet last week.

Websense last week reported a web attack dubbed "Nine-ball", a moniker derived from the name of ninetorag.in, one of the malware hosts associated with the assault, had claimed 40,000 website victims.

Web security services firm ScanSafe, by contrast, describes the attack as "almost non-existent".

Mary Landesman, senior security researcher at ScanSafe, reckons that from 15 June the total number of requests to sites involved in the attacks came to just 333. The total number of compromised websites observed over the last week was just 62 of which only one domain - skyscrapercity.com - features above the top 10,000 traffic spot in Alexa's traffic ratings.

"We were a bit surprised that such an allegedly massive attack could bypass our sentries," Landesman said. "After we did take a look, it became apparent why this one didn't trip our alert sensors - this attack is almost non-existent and might be more aptly named 'scratch ball'.

"It is such a low number attack that it’s not the type of thing we’d normally spend our time investigating."

ScanSafe claims its real-time web scanning gives it a grandstand view of malfeasance on the web while Websense is equally adamant that it has the clearest possible view of malware on the net, and a mite indignant over ScanSafe's suggestion that it's exaggerating the impact of the Nine-ball attack.

Websense updated its original analysis on Monday, after we passed on ScanSafe's observations, reiterating that Nine-ball (although slightly decreased in intensity) remains a potent force. This more detailed analysis includes videos and diagrams illustrating the attack, which has evolved since it was first detected on 2 June.

Carl Leonard, security research manager for Websense EMEA, suggested that if ScanSafe reckoned that the attack was insignificant then it must be missing the bigger picture.

"The Nine-Ball attack was more complicated than most which made it difficult for less experienced researchers to understand its complexities," Leonard told El Reg.

"A confusing factor is that there is not one clear infection path. With no fixed start point, no set route and no fixed end point, linking a series together and appreciating that it’s all part of the same campaign is not an easy thing to do, especially when the attack has more than one malicious host involved.

"Most security companies lack the technology to analyze such attacks. Because Websense has such an extensive Threatseeker network we can see the bigger picture when some other companies may only see a part." ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.