Anonymous unsheathes new, potent attack weapon

Better DDoS attacks ahead

Members of Anonymous are developing a new attack tool as an alternative to the LOIC (Low Orbit Ion Cannon) DDoS utility.
The move follows a spate of arrests thought to be connected to use of the LOIC, which by default does nothing to hide a user's identity.

The new tool, dubbed RefRef, due to be released in September, uses a different approach to knocking out websites. LOIC floods a targeted site with TCP or UDP packets, a relatively unsophisticated yet effective approach, especially when thousands of users use the tool to join voluntary botnets.

RefRef, by contrast, is based on a more sophisticated application-level approach designed to tie up or crash the servers behind targeted websites instead of simply flooding them with junk traffic, according to a blog post on the development by an Anonymous-affiliated blog.
"Anonymous is developing a new DDoS tool," the post explains. "So far, what they have is something that is platform neutral, leveraging JavaScript and vulnerabilities within SQL to create a devastating impact on the targeted website."
RefRef, which uses a "target site's own processing power against itself" is undergoing field trials, with tests against Pastebin, the blog post by AnonOps Communications reports.
Arrests in UK, Spain and Turkey connected to LOIC-powered attacks have already prompted some core members of Anonymous to move towards using a new server and dropping LOIC in favour of other attack tools, such as Slow Loris and Keep-Dead DoS. This now seems to be purely a stop-gap measure while RefRef undergoes development.
LOIC was originally developed for network stress-testing, but later released into the public domain where, years later, it became a weapon of choice for hacktivists, most notably in the Operation Payback attacks against financial service organisations that blocked accounts controlled by Wikileaks last December following the controversial release of US diplomatic cables.
The problem with LOIC is that unless attacks are anonymised by routing them through networks, such as Tor, then users will be flinging junk packets that are stamped with their IP address at the targeted systems. These IP addresses can then be traced back to suspects by police.
Whether or not RefRef does a better job at anonymisation, by default, remains unclear but early experiments suggest that Anonymous is brewing a more potent attack tool. "Supposedly, the tool will DoS a targeted website with ease," Dancho Danchev, an independent cyber-threats analyst told El Reg. ®

DIY Spy Drone Sniffs Wi-Fi, Intercepts Phone Calls

LAS VEGAS — What do you do when the target you’re spying on slips behind his home-security gates and beyond your reach?

Launch your personal, specially equipped WASP drone — short for Wireless Aerial Surveillance Platform — to fly overhead and sniff his Wi-Fi network, intercept his cellphone calls, or launch denial-of-service attacks with jamming signals.

These are just a few of the uses of the unmanned aerial vehicle that security researchers Mike Tassey and Richard Perkins demonstrated at the Black Hat security conference here Wednesday.

At a cost of about $6,000, the two converted a surplus FMQ-117B U.S. Army target drone into their personal remote-controlled spy plane, complete with Wi-Fi and hacking tools, such as an IMSI catcher and antenna to spoof a GSM cell tower and intercept calls. It also had a network-sniffing tool and a dictionary of 340 million words for brute-forcing network passwords.

The GSM hack was inspired by a talk given at last year’s DefCon hacker conference by Chris Paget, who showed how to create a cellphone base station that tricks nearby handsets into routing their outbound calls through it instead of through commercial cell towers.

That routing allows someone to intercept even encrypted calls in the clear. The device tricks phones into disabling encryption, and records call details and content before they’re routed to their intended receiver through voice-over-internet protocol or redirected to anywhere else the hacker wants to send them.

The drone takes that concept and gives it flight. The plane weighs 14 pounds and is 6 feet long. Per FAA regulations, it can legally fly only under 400 feet and within line of sight. But the height is sufficient to quiet any noise the drone might produce, which the researchers said is minimal, and still allow the plane to circle overhead unobtrusively.

It can be programmed with GPS coordinates and Google maps to fly a predetermined course, but requires remote control help to take off and land.

The two security researchers created the spy plane as a proof of concept to show what criminals, terrorists and others might also soon be using for their nefarious activities.

Tassey, a security consultant to Wall Street and the U.S. intelligence community, told the conference crowd that if the two of them could think up and build a personal spy drone, others were likely already thinking about it, too.

The spy drones have multiple uses, both good and bad. Hackers could use them to fly above corporations to steal intellectual property and other data from a network, as well as launch denial-of-service or man-in-the-middle attacks. They could also transmit a cellphone jamming signal to frustrate an enemy’s communications.

“It’s hard to keep something that’s flying from getting over your facility,” Tassey said.

A drone could also be used to single out a target, using the target’s cellphone to identify him in a crowd, and then follow his movements. And it would be handy for drug smuggling, or for terrorists to trigger a dirty bomb.

But the drones don’t just have malicious uses. The researchers point out that they would be great for providing emergency cellular access to regions hit by a disaster.

The drones could also be outfitted with infrared cameras and shape-recognition technology to run search-and-rescue missions for lost hikers. The military could use them for electronic countermeasures to jam enemy signals or as communication relays flown over remote areas to allow soldiers on two sides of a mountain, for example, to communicate.

“You don’t need a PhD from MIT to do this,” Perkins said.

http://www.wired.com/threatlevel/2011/08/blackhat-drone/

Hackers attack Zim stock exchange site

     

Harare - Computer hackers have attacked the Zimbabwe Stock Exchange website, prompting the authorities at the bourse to shut down the site, chief executive Emmanuel Munyukwi said on Friday.

"Our website has been targeted by hackers and the last incident was on Wednesday," Munyukwi told AFP.

"We have taken it offline. Our hosts have recommended to us that the site is no longer safe and they notified us about this yesterday."

"They have also recommended that we need a new website," he added.

Munyukwi said the attack affected traders monitoring performance on the bourse with 79 listed companies.

ZSE does not conduct trading on the internet.

Early this year hackers attacked the website of Zimbabwe's finance ministry.

Hacker group Anonymous takes over Syrian Ministry of Defense website

The loose band of global hackers known as Anonymous has claimed another scalp in its ongoing fight against tyrants, corporate crooks and naysayers, taking over the Syrian government Ministry of Defense website and replacing it with message of support for the Syrian people.

News of the hack, just the latest in a string of high profile takedowns that include Rupert Murdoch's News of the Word newspaper, Paypal and others, spread like wildfire over Twitter Sunday night as social media users echoed support.

The hacking excursion comes jus tours after Syrian forces were accused of firing on civilians, killing an estimated 50 people in the rebel-controlled city of Deir al-Zour.

Replacing the traditional website at http://mod.gov.sy/ was an adapted Syrian flag, now featuring the Anonymous logo, with a message below in Arabic and English, saying the following:

"To the Syrian people: The world stands with you against the brutal regime of Bashar Al-Assad. Know that time and history are on your side - tyrants use violence because they have nothing else, and the more violent they are, the more fragile they become. We salute your determination to be non-violent in the face of the regime's brutality, and admire your willingness to pursue justice, not mere revenge. All tyrants will fall, and thanks to your bravery Bashar Al-Assad is next."

It continued, "To the Syrian military: You are responsible for protecting the Syrian people, and anyone who orders you to kill women, children, and the elderly deserves to be tried for treason. No outside enemy could do as much damage to Syria as Bashar Al-Assad has done. Defend your country - rise up against the regime! - Anonymous"

This is just the latest incident in a weekend of hacker activity; On Friday, Anonymous hackers broke into the websites and emails of 70 U.S. police networks, and Saturday saw hackers at the DefCon convention run a contest to see which company had the most lax computer security. Oracle had the misfortune of winning the competition.

http://www.vancouversun.com/technology/Hacker+group+Anonymous+takes+over+Syrian+Ministry+Defense+website/5220327/story.html#ixzz1UQFZM0D9

77 Law Enforcement websites hit in mass attack by #Antisec Anonymous

Because of FBI’s actions against Anonymous and Lulzsec including several arrests, Now AntiSec supporters have targeted 77 law enforcement domains and walked away with everything on them. 77 domains were hosted on the same server. Few weeks before AntiSec targeted Arizona police departments, leaking personal information and other sensitive data, in response to immigration laws passed by the state. This time however, the latest law enforcement raid by AntiSec is in response to actions taken by the FBI.

77 US law enforcement institutions were attacked including : 20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,alabamasheriffs.com, arkansassheriffsassociation.com,bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org,georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com,jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov,jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,mostwantedgovernmentwebsites.com, mostwantedwebsites.net,newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,tunicamssheriff.com, vbcso.com, woodsonsheriff.com

In 77 law enforcement domains were attacked, resulting in the theft of 5-10GB worth of sensitive documents. Some of the data lifted in the AntiSec raids includes training files, and the personal information like names, addresses, phone numbers, Social Security Numbers, usernames, and passwords of more than 7,000 officers from dozens of police departments.
“[The compromised data] also contained jail inmate databases and active warrant information, but we are redacting the name/address info to demonstrate how those facing the gun of the criminal injustice system are our comrades and not our adversaries. On the other hand, we will be making public name and contact information about informants who had the false impression that they would be able to ‘anonymously’ snitch in secrecy.”

“We demand prosecutors immediately drop all charges and investigations against all ‘Anonymous’ defendants,” Attacker said.

“To law enforcement: your bogus trumped-up charges against the Anonymous PayPal
LOIC attacks will not stick, nor will your intimidation tactics stop us from exposing your corruption. While many of the recent ‘Anonymous’ arrestees are completely innocent, there is no such thing as an innocent cop, and we will act accordingly.”

“To our hacker comrades: now is the time to unite and fight back against our common oppressors. Escalate attacks against government, corporate, law enforcement and military targets: destroy their systems and leak their private data.”

Sheriff Montgomery’s , of Baxter County, Arkansas, website is among the 77 recently targeted by AntiSec.
As of Saturday evening, baxtercountysheriff.com remains offline. A mirror of the site’s defacement by AntiSec is here. Additionally, cityofgassville.org, was offline as well. It too is listed as one of the 77 sites targeted by AntiSec.

http://www.thehackernews.com/2011/07/77-law-enforcement-websites-hit-in-mass.html

Topiary 'known' to police says network giant

Frontline Lulzsec hacking member Topiary's identity and whereabouts were known to British police, chief technology officer of Prolexic Paul Sop has said.
While debate raged over whether British Police had arrested Topiary.
Scotland Yard released the name of a teenager, Jake Davis, it arrested in the Shetland Islands last week on suspicion of involvement with the LulzSec hacking group.
It has yet to emerge if the arrest man was the LulzSec identity Topiary, a concept contested by some online groups dedicated to uncovering the groups' participants.
Paul Sop, chief technology officer at Prolexic could not say if Topiary was in police hands, or talk specifically about the international police operation to locate and identify suspected online criminals within Anonymous and LulzSec because of non-disclosure agreements.
But he confirmed that police knew who and where Topiary was.
“Yes, I’ve read about the speculation. But you know I can’t say anything, right?” Sop said.
His company used its global IP network and technical specialists to defend businesses against Distributed Denial of Service (DDoS) attacks.
In doing so, it had harvested countless IP addresses and other data from DDoS attacks launched against customers and supplied them to law enforcement.
“With that many eyes watching the long and protracted attacks [by LulzSec and Anonymous] it’s not really possible to stay anonymous," Sop said.
"Police efforts are slow and protracted – they have to be because evidence must be transferred and it cannot be compromised".
Sop predicted the hacking groups' continued attacks against government intelligence and police agencies and scores of businesses would be “just more damning for them”.
Prolexic was not the only private sector company to assist the police investigations into Lulzsec and Anonymous.
A sworn affidavit by an FBI agent had revealed PayPal supplied the IP addresses of 1000 participants in DDoS attacks launched against its network in December.
Many of the DDoS participants had used the LOIC (Low Orbit Ion Cannon) software which made it easy for non-technical users to participate in coordinated attacks against nominated targets.
But in doing so, their IP addresses were recorded on the logs of victims, or with specialists like Prolexic.
A report  last year by researchers from the University of Twente in the Netherlands compared the use of LOIC for DDoS attacks to "overwhelming someone with letters, but putting your address at the back of the envelope".
The IP addresses were all there, in logs,” Sop said. “It’s rather daft – like throwing a brick through a window with your address taped to it," he said.
The philosophical ideology that united much of the Anonymous and Anti Security movement had helped investigators build profiles, Sop said.
Yet for all the attacks against Prolexic customers, Sop was warm to the movements’ broad ambitions to fight censorship and corruption.
“I don’t disagree with the messages, but the methods affect hundreds of thousands of innocent people. Look at the attacks on Sony – that affected thousands of people who just wanted to play PlayStation. When it was down, I couldn’t enjoy gaming with my son.”

http://www.scmagazine.com.au/News/265445,topiary-known-to-police-says-network-giant.aspx

Massive DDoS attack mitigated

Prolexic Technologies, a company specializing in Distributed Denial of Service (DDoS) mitigation services, has announced that it successfully mitigated another major DDoS attack of unprecedented size in terms of packet-per-second volume. Prolexic cautions that global organizations should consider the attack an early warning of the escalating magnitude of similar DDoS threats that are likely to become more prevalent in the next six to eight months.
The attack was directed against an Asian company in a high-risk e-commerce industry. It generated larger than usual TCP SYN Floods and ICMP Floods, both of which are common DDoS attack methods. There was nothing common, however, about the magnitude of the attack.
According to Prolexic chief technology officer Paul Sop, the volume of the attack reached levels of approximately 25 million packets per second (pps), a rate that can overwhelm the routers and DDoS mitigation appliances of an internet service provider (ISP) or a major carrier. In contrast, most high-end border routers can forward 70,000 pps in typical deployments. In addition, Prolexic’s security experts found 176,000 remotely controlled PCs, or bots, in the attacker’s botnet (robot network). This represents a significant threat as typically only 5,000 to 10,000 bots have been employed in the five previous attacks mitigated by Prolexic.
“The customer attempted to mitigate these repeated DDoS attacks for many months with solutions from its ISP and its carrier before approaching Prolexic,” said Sop. “Defeating this attack is a testament to our unrivaled capacity and our unique position as the only global DDoS mitigation provider with the experience and bandwidth to successfully fight these gigantic attacks.”
To mitigate this high-magnitude attack without putting the burden on a single carrier, Prolexic distributed traffic among several of its global Tier 1 carrier partners and scrubbing network centers. Prolexic was able to help the client maintain service availability throughout the duration of the attack. While Prolexic was fighting this particular threat, it simultaneously helped another client who was experiencing a 7 Gbps DDoS attack.

Early warning and escalating threats
“Prolexic sees this massive attack in Asia with millions of packets per second as an early warning beacon of the increasing magnitude of DDoS attacks that may be on the horizon for Europe and North America in the next 6 to 8 months,” Sop said. “High risk clients, such as those extremely large companies in the gaming and gambling industries in Asia, are usually the first targets of these huge botnets just to see how successful they can be.”
Prolexic cautions that the next quantum leap in DDoS attacks will not necessarily center on bandwidth, but rather on increasing the volume of packets per second to such a high level that carriers cannot handle the overload. According to Sop, these extremely high packet-per-second DDoS attacks are especially insidious because they can cause collateral damage to carriers long before the “bad traffic” ever reaches its intended target.
Overwhelmed by the deluge of Internet traffic, carriers try to cope by passing around the excessive traffic like a “hot potato” from one to another. Ultimately, the carriers must “black hole” the IP address of the attack target and in doing so they unwittingly help the hacker to achieve the goal of creating a “zero route” which crashes the victim’s site. In addition, the continuous shifting of traffic from carrier to carrier can seriously affect the performance of multiple web sites, not just the intended target.
“Prolexic has invested millions to be ready for this type of DDoS attack and while we have only seen this botnet once in the Western Hemisphere to date, it is likely to follow a common pattern and become much more prevalent,” Sop said. “The good news is that Prolexic is already well ahead of the game and has proven that we can stop attacks of this magnitude.”

http://dateline.ph/2011/08/01/massive-ddos-attack-mitigated/