One of the Internet’s oldest and crudest attacks experiences a resurgence.
A number of sites have been hit by distributed denial-of-service attacks over the past week. Strong enough to knock some of them offline for days at a time, these DDoS attacks have been launched by extortionists demanding thousands of dollars in ransom money.
One of the latest sites to be targeted is FastMail. In a blog post published Wednesday, the Australian e-mail provider said it was hit by a wave of data assaults on Sunday that were soon followed by e-mails demanding a payment of 20 Bitcoins, worth about $6,600 at current exchange rates. Other services reporting similar shakedowns includeHushmail, Runbox, and VFEMail. As Ars reported last week, ProtonMail paid a $6,000 ransom only to be taken out by a new round of attacks. Zoho also reported a week-long struggle to beat back DDoS attackers but made no mention of receiving a ransom demand.
“The attackers have demanded a ransom, which we will not pay, and have promised an increase in the intensity of the attacks,” Hushmail wrote in their advisory, which was published last Friday. “As such we expect that there will be continued attacks, which may result in further interruptions in service. We are continuing to improve our protection against these attacks, and have filed a criminal complaint with the relevant authorities.”
On Wednesday, Hushmail posted an update that read: “We’re experiencing a service outage as a result of the ongoing DDoS incidents. We’re working to bring services back online as quickly as possible.” The service appeared to be operating normally on Thursday as this story was being prepared.
One attack group behind at least some of the recent campaigns calls itself the Armada Collective. Similar groups have operated for years.
Crude but effective
DDoS attacks have always been the hack-attack equivalent of a caveman wielding a blunt club. They generally require little skill, just a large amount of brute force in the form of a botnet of infected computers—or in more recent incarnations, commandeered home and small office Internet routers. The digital assaults work by sending targets certain types of data in bulk that require time and computing power to process.
For instance, when tens of thousands of infected computers simultaneously send syn packets—that is, the first of three data packets sent when a web browser is establishing a connection with a website—the target is forced to store each request in memory and allocate resources while it waits for the three-way handshake to complete. The target is left in limbo, because the attackers never send the final packet. Such syn floods can cause websites to become completely unresponsive in the same way a pizza delivery store is no longer available when dozens of mischievous teenagers repeatedly phone it at the same time.
Over the years, DDoS attack techniques have evolved. Amplification attacks that abuse insecurely configured domain name system servers and network time protocol services, for example, can turn a trickle of bandwidth into a tidal wave of junk traffic. And attackers sometimes overwhelm the applications websites use to HTTPS-encrypt traffic or provide other services in assaults that are hard to block using traditional mitigation methods.
Still, most DDoS attacks require minimal technical skills. As KrebsOnSecurity noted in a post published Thursday, sloppy security practices among ISPs and modem manufacturers frequently aid the attackers.
But for all their crudeness, DDoS attacks remain an effective way to take out a website. And the wave of recent reports suggests these attacks generate enough revenue to make them worth an attacker’s effort. Services that are subjected to DDoS-for-ransom attacks shouldn’t give in to the demands, since that only strengthens an industry that represents an existential threat to the entire Internet as we know it. Instead, they should funnel their money to a reputable DDoS mitigation service.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
