Net Attacks Down, Bot Networks Up
13566
The average daily volume of Internet attacks declined in the last six months, according to Symantec Corp.&#39;s Internet Security Threat Report.
592676
Sophisticated computer worm is setting up a botnet that may be hard to beat.
574879
InfoWorld - A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.
22243
Net safe thanks to technology called Anycast Last month's attack on at least six of the net's root servers was formidable, but thanks to the implementation of a technology designed to protect the infrastructure, only two were affected, according to a factsheet issued today by ICANN.â¦
152473
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was initially turned on in Jan. 2007, will relight its set of attack monitoring sensors on or about the first of the year after significantly scaling back its operations during the month of December.After its initial 11 months of data collection, the project undertook the month-long hiatus to give project researchers more time to examine results and plan for the year ahead.In addition to tweaking their tactics for tracking and luring malware distributors in 2008, WASC project leaders said they are also planning to add new honeypots to their existing network, which already spans locations in Europe, Russia, South America, and the United States.Unlike more traditional OS-level or SMTP-based honeypot applications -- systems designed to collect individual malware samples for subsequent examination by anti-virus researchers -- the WASC project utilizes a network of 14 specially-configured open proxy servers (or proxypots) to monitor traffic for nefarious activities carried out by everyone from botnet herders to adware purveyors.Traditional honeypots have proven useful for tracking widespread computer viruses and allowing AV companies to produce the signature files needed to protect machines against infection, but those targets are ill-suited to provide the level of real-time intelligence needed to protect against today's fast-moving customized threats, said Ryan Barnett, the WASC project's leader.By serving up an unprotected open proxy server to the larger Internet, and thereby advertising itself as exactly the type of anonymous conduit that attackers seek out to distribute their work -- rather than merely an undefended computer, the effort is already garnering new insight into cyber-criminals' methods, he said.Barnett, who is also director of application security training at Breach Security and an instructor for the SANS Institute, said that despite being pleased with the project's initial ability to identify attacks and test ways to thwart malware campaigns further upstream, he is hoping that 2008 will provide even greater rewards.Among the improvements the group is aiming to make to its system -- built around the ModSecurity open-source Web application firewall, for which Barnett also serves as development community manager -- are more effective ways for categorizing attacks, correlating anomalies, and applying forensics to trends that it charts over time.The security expert is hoping that the same open-source movement that has allowed ModSecurity to mature, with the firewall recently adding a range of new features in its late-December version 2.5 release, will also take hold with the honeypot effort and encourage more people to launch sensors or help research its data findings."Getting different versions of data analysis will be key, but we will need to get a lot more people onboard," Barnett said. "We feel that there's a whole symbiotic approach with the project and the open-source community already. We need to export more of the raw data into that community to help analyze the results -- there's simply too much data for us to churn through alone."The future of the proxypots What the use of the proxypot model allows the project to observe are the source IP addresses being used by attackers running over its sensors, along with the nature of their threats and their targets.For instance, out of the 8.9 million questionable transactions carried out over the group's servers in October, when the sensor network was last running at full bore, 2.6 million of the requests were related to advertising click fraud, the leading type of threat observed in the firewalls' logs.Further investigation of the results would allow WASC to figure exactly which sites were being pumped-up by those automated traffic hoarders and inform any companies involved of the illegal activity, Barnett said.For the record, more than three quarters of the traffic moving over the proxypots fails to trigger any of the firewall rules, meaning that it is either benign or unidentifiable as malware.While the WASC honeypot project could eventually be used to snuff out some malware sources or block the threats themselves, for now, the idea is to create an early warning system to help the security industry respond to emerging attacks.Along with finding more bodies to throw at analysis of its findings, the project is also considering how it will continue to move forward in relation to the matter of allowing its proxypots to be used to carry out actual attacks.Thus far, participants in the program have been sending spoofed information back to the attackers channeling traffic over their proxies to fool them into thinking that their campaigns are working and prevent detection of the honeypots.However, some researchers involved with the program have been asking to allow traffic to pass over their systems unrestricted under the belief that it would be the best way to screen for the newest and smartest threats.In most cases, project participants will need to defer to local laws governing their level of liability for allowing nefarious traffic flow over their servers if they decide to run wide open, said Barnett. Figuring out exactly how to tackle the issue is one of the WASC honeypot's other major goals in advancing its status during 2008."We're trying to regroup and figure out how to best address everything in the next twelve months, enough people are asking about the alternative of not blocking malicious traffic that it has become a question we seriously need to consider," said Barnett. "There are legal issues to study if we want to let real attack run through us, it could still happen anyways -- people can always get around rules, so, there is definitely still some risk involved."
685834
Three of the 13 computers used to manage global internet traffic are hacked overnight. It's one of the biggest attacks since 2002. By the Associated Press.
408560
Vulnerabilities in technology widely used for network authentication leave computers open to attack.
717832
WASHINGTON  --  Hackers briefly overwhelmed at least three of the 13 computers that help manage global computer traffic Tuesday in one of the most significant attacks against the Internet since 2002.
431171
A distributed denial-of-service attack that disrupted Web-based systems at credit card payment processing firm Authorize.NetÂ earlier this week is indicative of a sharp increase in the number of cyberattacks being targeted at specific companies and driven by profit motives on the part of the hackers who launch them.
443477
A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.While larger security software makers, including Symantec, McAfee, and Trend Micro, have built botnet-fighting functions into their existing products, and carrier security specialists such as Arbor Networks have added tools for detecting the threats in their network monitoring systems, a handful of smaller companies are attempting to market themselves as purists in the anti-botnet field.As carriers, ISPs, and large enterprises investigate techniques to keep computers on their networks, and those of their customers, from being recruited into the zombie armies of botnet-controlled devices, some experts say that there may be a market for stand-alone technologies that address the problem -- at least for the next several years."If you look at the change in the characteristics of malware attacks over the last year, and the public outrage over data breaches, private and government organizations have reached a point where the botnet issue is directly accessible," said Nick Selby, analyst at The 451 Group."Botnets are very relevant to data loss, and without question, customers are looking for in-the-cloud protection and clean pipes; the problem is too complex for any individual user to deal with alone, even large enterprise users," he said. "Anti-botnet vendors could see compliance and media-fueled growth because everyone understands the issue of data loss."Just as Webroot was able to build and maintain a business dedicated to fighting spyware -- even in the face of competition from larger rivals who built tools for warding off those attacks into their integrated security suites -- vendors staking a claim to the anti-botnet space contend that there will be plenty of demand for their specialized skills.Perhaps the two best-known providers making noise in the segment are FireEye, a Silicon Valley startup backed by funding from Sequoia Capital and Norwest Venture Partners, and Damballa, an Atlanta-based company with roots at Georgia Tech backed by Sigma Partners and Noro-Moseley Partners.Leaders with both companies maintain that their businesses are already taking off as botnets take over."These networks of infected PCs have become, in essence, the world's largest computing grids. They dwarf the world's supercomputers in terms of their power, so that tells you something about the severity of the overall threat," said Ashar Aziz, chief executive of FireEye, who maintains there are currently as many as 150 million botnet-infected computers worldwide."This is the actual infrastructure that connects all the malware, spam, and denial-of-service attacks," he said. "A feature built into an end-point client is not going to solve the problem on its own; large enterprises and carriers are looking for something today that is going to help them keep their assets from being victimized."In addition to the carrier crowd, Aziz said that a growing number of large enterprises are seeking to take things into their own hands to ensure that their networks aren't being exploited by botnet commanders.Not only are large companies fearful of having their assets used as proxies by all sorts of attackers, and any potential fines that such activity or related data loss could lead to, he said, they are also hoping to avoid the embarrassment of having machines inside their walls publicly revealed as spam and malware delivery stations.Throughout 2007, researchers at network security technology vendor Support Intelligence repeatedly detailed spam runs emanating from well-known businesses, including Bank of America, Intel, and Nationwide Insurance, that were thought to be driven by botnet-infected computers.At the core of the company's anti-botnet technology, delivered via its appliances, is its FireEye Analysis and Control Technology (FACT) engine, which looks for suspicious traffic, confirms attacks, and blocks access from infected devices to other machines on a network.Using the information being drawn from its customers, which already include a number of large North American carriers and Fortune 1,000 companies, according to the CEO, FireEye claims that it also has the ability to backtrack its way through the networks of infected machines to scope out the size of botnet operations and work with carriers to snuff out the infrastructure.Aziz contends that even if anti-botnet technologies become digested in broader suites by most companies or through carrier-provided services, FireEye -- whose virtualization-based technology was originally positioned for use in network access control (NAC) systems when it was founded in 2004 -- will be able to turn a profit by providing the intelligence needed by those systems to identify and track the attacks."The capability to build this intelligence about the botnets themselves is a sizable business opportunity. These companies offering services will need to constantly feed new data into their gateways," he said. "We feel this is a viable business model, finding the infrastructure that is out there and helping people understand where it lives and how it works."Damballa, which takes it name from the realm of voodoo spirits, is already marketing its capabilities to both enterprises and carriers in a number of different models.For instance, the company already offers three deployment options to enterprise customers: its Global Surveillance Network, a subscription service that alerts users if any of their machines are infected by known botnets; its Enterprise Protection package, which uses sensors placed on clients' networks to look for attacks; and its Extended Enterprise Protection offering, which utilizes sensors outside companies' firewalls to look for attempts by botnets to connect to users' computers.It markets comparable services for carriers and other security OEMs.Damballa leaders said that the key to earning a spot inside more companies' operations will be the continued evolution and maturation of the threats themselves, and the company's unique ability to chart botnet behavior."We definitely see a best-of-breed opportunity for fighting botnets. It depends on the customer, but most of the success we're finding is with organizations who already have a lot of security technologies in place but still find themselves dealing with this problem," said Tripp Cox, vice president of engineering at Damballa, which was founded in late 2006."These companies are getting green lights from other products telling them that everything is OK, but they are still finding out about compromises inside their networks," he said. "A lot of the larger security players will have to have something in their suite to address the problem, and there's definitely potential for consolidation at some point in this space, but if you look at a problem like spam, there's a history there of companies building a stand-alone business to solve problems like this."The 451 Group's Selby said that there will likely be growth of the anti-botnet segment before any industry consolidation takes place, despite a wide number of companies --ranging from anti-virus vendors to massive carriers with managed security services -- who want to take on a broader piece of the market."It would seem to make sense for these [anti-botnet] companies to cut deals with ISPs to have better visibility into their networks and botnet activity in general, as they already have," the analyst said. "This is a market that should see expansion as botnets continue to become a bigger problem for everyone."
741713
Attack largely unsuccessful, but security experts warn of more to come.
230551
(InfoWorld) - Online attackers have briefly disrupted service on at least two of the 13 "root" servers that are used to direct traffic on the Internet. The attack, which began Tuesday at about 5:30 a.m. Eastern time, was the most significant attack against the root servers since an October 2002 DDoS attack, said Ben Petro, senior vice president of services with Internet service provider Neustar. Root servers manage the Internet's DNS, used to translate Web addresses such as Amazon.com into the numerical IP addresses used by machines. The attack appeared to have been launched by a group of compromised PCs, called a botnet, Petro said. "Two of the root servers suffered badly, although they did not completely crash; some of the others also saw heavy traffic," said John Crain, chief technical officer with the Internet Corporation for Assigned Names and Numbers (ICANN). The two hardest-hit servers are maintained by the U.S. Department of Defense and ICANN, he added. The botnet briefly overwhelmed these servers with useless requests, causing them to occasionally hang, but did not disrupt Internet service, Petro said. By 10:30 a.m., Internet service providers were able to filter enough of the traffic from the botnet machines that traffic to and from the root servers was essentially back to normal. Compared to other DDoS attacks, this one did not have a lot of firepower. Petro said the bandwidth of the attack could be measured in megabytes, as opposed to the gigabyte-level attacks that are now frequently seen. "It was a small attack, but it was focused and targeted at the roots," he said. It is unclear where the attack originated, Crain said. "The effect of this traffic on the end users was negligible," he added. Petro said engineers are still "scratching their heads" about the reason for the attack. Although some DDoS attacks are launched for political reasons or to extort money from Web site owners, this one appeared to have no such purpose, he said. Crain ventured a guess as to the attack's effect, however. "I suspect that the largest effect of the DNS traffic was to deprive some engineers of sleep and generate press," he wrote.
310941
The volume of worms and viruses is increasing, but the rate of successful attacks has dropped, according to a new report from Symantec.
496625
Authorities in Singapore shut down a large network of around 10,000 robot, or "zombie," computers this week, after technicians at Norwegian Internet service provider (ISP) Telenor ASA stumbled on the illicit network by tracing Internet Relay Chat (IRC) communications from compromised customer PCs on its system.
356771
While corporations are monitoring ports and using advanced security tools to fend off infection and attack, home users -- who have less technical sophistication -- are left more susceptible, sometimes
105425
Marks host malware Booby-trapped web pages are growing at an alarming rate with unsuspecting firms acting for nurseries for botnet farmers, according to a new study.â¦
532297
(InfoWorld) - Financially motivatedÂ malwareÂ attacks areÂ on the rise,Â with automated software packages making it easy for unskilled hackers to earn a living by sending out spam, researchers at messaging security vendor Secure Computing say. A malware kit calledÂ MPack,Â released by Russian hackers last December, allows pretty much anyone with $200 to become a master spammer because it is easy to use and exploits vulnerabilities in FireFox, Internet Explorer and Apple's QuickTime, says Dmitri Alperovitch, principal research scientist for Secure Computing. The trend that "kind of defines 2007" is the convergence of traditional e-mail with Web-based attacks, in which message recipients are prompted to click on links to malicious Web sites, rather than to download attachments, Alperovitch says. "Certainly, exploiting Web browser vulnerabilities has been common. We've seen that for a long time," he says. "Now we're seeing that capability being merged with traditional e-mail worms that sort of blanket the Internet." Information-stealing malware now accounts for 10 percent of all threats, up from 8 percent in January, new research from Secure Computing has found. Trojans comprise 63 percent of all newly discoveredÂ malware, up from 58 percent in January. SpywareÂ and phishing are also becoming more problematic as attackers use more targeted attacks to steal personal and financial information. "The barriers to entry into cyber crime have been lowered so much," Alperovitch says. "People are realizing that they can make very serious money with almost no accountability, almost complete anonymity." Quoting the analyst firm Gartner, Secure Computing's researchers say that 75 percent of enterprises will be infected by "undetectable professional-grade malware" by year-end. About 90 percent of all e-mail is malicious, but that figure will rise as the holiday season gets closer, according to Alperovitch. "There's a good chance we'll reach 95 percent, maybe higher, of all e-mails being malicious by the end of the year," he says. As the storm worm showed, the automation of online attacks is allowing the creation of more botnets, he says. E-mail delivery mechanisms are also being optimized to bypass spam filters. Unfortunately, many Web surfers are far too trusting. "If you're walking down the street and someone asks you for your Social Security number or your bank account pin, you're not going to give it to them," Alperovitch says. "Yet on the Internet, people freely give them out to anyone who sends them an e-mail message." Here are some key security trends and events identified by Secure Computing in the first eight months of 2007: -- TheÂ Storm worm,Â named after subject lines like "230 dead as storm batters Europe," and similar worms became widespread in January and the following months, with new variants being created every 15 minutes. -- A password-stealingÂ Trojan hit visitors to the Miami Dolphins' stadium Web siteÂ during the Super Bowl, when attackers took advantage of a vulnerability in Internet Explorer's rendering of vector markup language documents. -- A mass-email with pictures of Britney Spears and Paris Hilton in April lured people to a Web site that hosted a zero-day exploit related to Windows' handling of animated cursor files. Microsoft released a patch to fix the vulnerability. -- More than 10,000 European Web sites hosted malware attacks in June after being compromised. "Hidden IFRAME's" were injected into the Web sites, referring visitors to malicious sites using MPack to deliver banking Trojans. -- So-called backdoor Trojans affect home users around the world, including nearly 100,000 PCs now infected by a new wave of storm malware. "The mailings that came with subject lines such as 'You've received a postcard from a family member!' directed users to Web-hosted exploits for several different vulnerabilities; they infect users' computers and attach them to the Storm family's P2P botnet," Secure Computing writes. Network World is an InfoWorld affiliate.