Al-Qaida's Shamukh Chat Forum Under Attack

Al-Qaida's top-tier Al-Shamukh chat forum is facing an ongoing electronic attack, that has rendered the forum totally unreachable, according to a terrorism expert.The attack on Shamukh is similar to one reported in June this year, and first the domain and then subsequently the underlying data server were both taken down separately, Evan Kohlmann of Flashpoint Partners said in an email late Monday.

The difference this time however is that al-Qaida now has an alternate secondary forum to distribute its propaganda and media, known as "Al-Fidaa". "In other words, shutting down Shamukh is still quite an annoyance, and it certainly causes jihadi webmasters headaches, but it hasn't had the same effect of gagging al-Qaida's media machine," said Kohlmann who has spent over a decade tracking al-Qaida and other terrorist organizations.

Al-Fidaa is not yet under attack, but it would be interesting to see if a similar electronic attack is launched against this forum as well.

The identity of the attackers is still not known, but it looks like someone launched a coordinated assault on the forum that was designed to cripple the whole system, Kohlmann said.

Typically, that's not the kind of thing that happens because of a lightning strike or a handful of people relying on a tool like LOIC (Low Orbit Ion Cannon), he added.

LOIC is a network stress-testing tool that floods sites with data, making them unable to serve legitimate visitors. This type of attack is called a distributed denial of service (DDoS) attack.

Kohlmann said in a Twitter message earlier on Monday that web domain names servicing Shamukh chat forum have come under apparent attack by unknown hostile parties. He later reported that the forum was "totally unreachable".

A threat to "cut the tongue" of U.S. TV host and comedian David Letterman was posted on the forum in August.

http://www.pcworld.com/businesscenter/article/240637/alqaidas_shamukh_chat_forum_under_attack_says_expert.html

Web Host Netregistry Hit by DDoS Attack

WEB HOST INDUSTRY REVIEW) --Australian web host NetRegistry (www.netregistry.au) was hit by a DDoS attack on Monday, according to a report by ZDNet Australia.

This attack comes a few months after it acquired the customers and assets of Australian web host Distribute.IT, the web host attacked by hacker group Evil in June.

According to the report, the attack started at 10:30 am and affected its customers using shared and virtual private server hosting. Approximately 100,000 customers were likely to have been affected by the disruption, according to Netregistry CEO Brett Fenton.

Fenton says Netregistry itself was not the intended target, but it isn't sure which hosting customer the attack was directed at. According to the report, Netregistry had to fend off a similar DDoS attack last year when its customer the Australian Federation Against Copyright Theft was targeted by Anonymous.

Around 10:45 am, Netregistry announced its phone system was overloaded and had to place a limit on the number of calls it could accept. Around this time, the company confirmed it was experiencing a DDoS attack, and began to re-divert its network bandwidth and work with its upstream provider Telstra to stem the flow of traffic.

A report by iTechReport says that by lunchtime, the company believed it had resolved the issue, but the attack restarted around 2pm bringing the hosted sites offline again.

Netregistry says by 5pm access had been restored for most customers except for those using a Telstra-provided internet connection. Access to sites on the Zeus Dynamic shared hosting infrastructure remains offline, according to the report.

The report says the outage impacted its resellers and subsidiaries like ZipHosting as well.

http://www.thewhir.com/web-hosting-news/092611_Web_Host_Netregistry_Hit_by_DDoS_Attack

Tesco says sorry after website crash leaves thousands unable to order groceries

Thousands of Tesco customers were unable to order food yesterday after the chain’s website crashed.
Britain’s biggest grocer was forced to say sorry when a glitch locked families out of their shopping lists.
One fed-up customer told the Mirror: “I tried for more than two hours and then gave up and switched to another supermarket because I needed a certain time slot for my shopping.”

With customers unable to order groceries and others booted off its Tesco Direct ­catalogue, experts said lost sales could add up to £1million over 24 hours.

Tesco is estimated to make £255million a year from online sales alone.

GLITCH

The Tesco.com site went down at around 1pm and while Tesco Direct was back up again two hours later, IT engineers were still working flat out to fix the grocery shopping site.

Shoppers trying to log on were told: “We’re very sorry. The Tesco.com grocery website is currently undergoing improvement works.

“It will be up and running shortly so please try again.”

A statement from the ­supermarket giant blamed a technical fault.

It said: “This is a rare glitch which has affected some of our online operations. We are working hard to fix it.”

Tesco websites have been plagued by computer ­problems in recent months.

In June, angry savers threatened to dump Tesco Bank after a similar crash left them without access to their cash for three days.

And before Christmas, customers trying to cash in Clubcard vouchers ahead of a deadline were shut out after the site went down.

http://www.mirror.co.uk/news/top-stories/2011/09/21/tesco-says-sorry-after-website-crash-leaves-thousands-unable-to-order-groceries-115875-23434841/

Talking Points Memo Site Brought Down After Hacker Story

The popular politics and news website Talking Points Memo crashed on Friday after experiencing an apparent distributed denial-of-service (DDOS) attack. The shutdown came after the site published the mugshots of 14 alleged members of Anonymous, a loose-knit group of online hacker activists, who became well-known after launching online attacks on parties who opposed WikiLeaks, including MasterCard and PayPal. While there was no direct evidence that tied Anonymous to the attack, the group has launched similar attacks against media websites and law enforcement agencies in the past.

http://www.huffingtonpost.com/2011/09/09/talking-points-memo-websi_n_956424.html

DDoS takes down UK's Russian embassy website before PM visit to Moscow

It has been 5 years since a British leader has visited Moscow. On the eve of the first visit since a Kremlin critic was killed in London, the website for the Russian Embassy in London was attacked by a distributed denial of service attack.
British Prime Minister David Cameron has been very vocal in the past about the killing of Alexander Litvinenko who was poisoned in 2006 by radioactive polonium-210, but has worked in the last year since taking over as Prime Minister to mend the relationship with Russia and President Dmitry Medvedev.
“Prior to the visit of Prime Minister David Cameron to Russia, the website of the Russian Embassy in London was brought down by a suspected DDoS attack,” the embassy said in a statement.
The site went down on Friday, came back up on Saturday, then fell again on Sunday. It is currently live.

http://www.techi.com/2011/09/ddos-takes-down-uks-russian-embassy-website-before-pm-visit-to-moscow/

Leading Industry Analyst Firm Cites Prolexic in Recent Hype Cycle Report

 

Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) mitigation services, today announced that it has been mentioned as a sample vendor in a report entitled, “Hype Cycle for Infrastructure Protection, 2011” by respected industry analyst firm Gartner. In the August 10 report, Gartner predicts DDoS defense will achieve mainstream adoption in less than two years and lists it as “highly beneficial” on its Priority Matrix.

Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) mitigation services, today announced that it has been mentioned as a sample vendor in a report entitled, “Hype Cycle for Infrastructure Protection, 2011” by respected industry analyst firmGartner.

In the August 10 report, Gartner predicts DDoS defense will achieve mainstream adoption in less than two years and lists it as “highly beneficial” on its Priority Matrix.

A DDoS attack is an attempt to make a computer resource (i.e. web site, e-mail, voice, or a whole network) unavailable to its intended users. By overwhelming a web site and/or server with data and/or requests, the target system either responds so slowly as to be unusable or crashes completely. The data volumes required to do this are typically achieved by a network of remotely controlled Zombie or botnet [robot network] computers.

"Gartner client calls on DDoS have increased and DDoS services are nearing "must-have" status. Any Internet-enabled application that requires guaranteed levels of availability should employ DDoS protection to meet those requirements."

According to Gartner Vice President and Research Fellow, John Pescatore, Gartner client calls on DDoS have increased and DDoS services are nearing "must-have" status. In the report, he states, “DDoS mitigation services should be a standard part of business continuity/disaster recovery planning and be included in all Internet service procurements when the business depends on the availability of Internet connectivity. Any Internet-enabled application that requires guaranteed levels of availability should employ DDoS protection to meet those requirements.” The report also lists 10 sample DDoS mitigation providers, including Prolexic.

“Because DDoS is all we do, we have more expertise, more experience and more network resources dedicated to fighting these attacks than any other provider,” said Scott Hammack, chief executive officer at Prolexic. “That’s why large, complex attacks that can overwhelm other providers always end at Prolexic.”

Since 2003, Prolexic has been protecting Internet facing infrastructures against all known types of DDoS attacks at the network, transport and application layers with a distributed global network of scrubbing centers. By dedicating more bandwidth to attack traffic than any other provider – supplemented by proprietary tools, techniques, and experienced security experts – Prolexic has been able to handle the largest and most sophisticated DDoS attacks ever launched.

Prolexic’s singular focus on DDoS mitigation also avoids potential conflicts of interest between business groups for companies that offer multiple service lines. This can occur when a DNS provider also offers “add on” DDoS mitigation services, for example. If the same infrastructure that supports DNS services is overwhelmed by a DDoS attack, it is possible that DDoS customers will be sacrificed to protect DNS customers and the company’s core business. Pure play DDoS mitigation providers like Prolexic do not have this concern.

“Five of the ten largest global banks, e-Commerce providers, payment processors and others with mission critical Internet-facing infrastructures trust Prolexic to protect them from DDoS attacks and restore availability in minutes,” said Hammack. “That’s why Prolexic is the gold standard for DDoS monitoring and mitigation.”

http://www.prweb.com/releases/2011/8/prweb8742612.htm

Prolexic Becomes First DDoS Mitigation Provider to Gain PCI DSS Certification - Speeds Service Provisioning to Mitigate Encrypted Layer 7 Attacks -

Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) mitigation services, today announced that it is the first DDoS mitigation provider to secure PCI DSS (Payment Card Industry Data Security Standard) level 2 certification.
PCI DSS is a worldwide program designed to help protect consumers from fraud by regulating payment card data security. The PCI DSS standard is the result of a collaborative effort by the major credit card brands (Visa, MasterCard, American Express, Discover and JCB) to build a set of requirements designed to ensure that all merchants that process, store or transmit credit card information maintain a secure online environment.
In the last few years, Prolexic has observed an increase in the number of encrypted attacks against web properties. Typically, these attacks use Secure Socket Layer (SSL) to start an application layer (Layer 7) attack. To monitor and mitigate these encrypted attacks effectively, Prolexic requires that a customer provide their data decrypting private keys.
“Achieving PCI DSS compliance makes it much easier for customers to deploy with us and leverage our unique capabilities to overcome encrypted attacks,” said Paul Sop, chief technology officer at Prolexic. “With this certification, customers know instantly that our key management and security procedures are in compliance with their PCI DSS policy without the time and expense of auditing Prolexic.”

With this certification, customers know instantly that our key management and security procedures are in compliance with their PCI DSS policy without the time and expense of auditing Prolexic.

While PCI DSS certification is not required because Prolexic does not store or process any credit card data, certification makes it much easier for a compliant organization to onboard with Prolexic. Critically, certification speeds deployment of remediation for compliant organizations during encrypted Layer 7 DDoS attacks.
Brightline, http://www.brightline.com, an external auditing company specializing in assurance and compliance services, found that Prolexic has taken sound measures to establish a solid set of security controls and procedures.
“Achieving compliance with this globally recognized data security standard is a significant milestone for Prolexic,” added Sop. “With more and more payment processing and e-Commerce companies coming under DDoS attack, this certification will further differentiate our capabilities and make Prolexic the logical choice for these types of organizations.”
About Prolexic
Prolexic is the world’s largest, most trusted Distributed Denial of Service (DDoS) mitigation provider. Able to absorb the largest and most complex attacks ever launched, Prolexic restores mission critical Internet facing infrastructures for global enterprises and government agencies within minutes. Five of the world’s ten largest banks and the leading companies in e-Commerce, payment processing, travel/hospitality, gaming and other at risk industries rely on Prolexic to protect their businesses. Founded in 2003 as the world’s first “in the cloud” DDoS mitigation platform, Prolexic is headquartered in Hollywood, Florida and has scrubbing centers located in the Americas, Europe and Asia. For more information, visit http://www.prolexic.com.

http://www.prweb.com/releases/2011/8/prweb8711385.htm