DoS/DDoS news resources

Considering the hype about DoS and DDoS in the last days as consequence of attacks to Twitter, Facebook and LiveJournal I decided to include some of my information sources in this blog. I did some redesign of the right bar. I included some DoS and DDoS news, they are a set of news manually selected by me. I take the news from different sources and I apply some basic filtering and data-mining I come with them. They can be also accessed here if you want to include them in your RSS reader.

"Security news from Twitter" are posts about DoS/DDoS attacks collected from twitter. This is a little bit noisy with around 30-50 posts per day. Some of the posts are repeated or uninterested (from my perspective) but it works as a source for my tools that extract some information for them. The raw feeds are here and here.

Finally I included some general IT security news from twittsecurity. Twittsecurity is a bot that shares security news in Twitter. It searches and selects IT security news using a hybrid method (automatic and human assisted). Feel free to follow it.

Some NS-2 code to simulate DoS and DDoS attacks

This is some basic TCL code that used for some simulations. This code works on the NS-2 network simulator.

Simple simulation with flow monitors. It creates 4 nodes: 1 UDP source and 1 TCP source (FTP), 1 destination node and 1 transit node. It monitors the flows coming in and out from the queue in the link between the transit and destination node. It dumps the trace data to a flow file.

Ping Flood . It creates two nodes. Node 1 floods ping packets to Node 2. It could be useful to simulate Denial of Service attacks.

Simple DoS Attack. It creates a topology of 7 nodes. Two nodes generate valid traffic (one UDP and another TCP in the form of FTP). Another node generates and UDP DoS.

The big news today about Conficker ... is that there is no news

For the moment everything looks calm. Although it is almost April 1 throughout the whole world there is not yet any news about of the end of the world. Today, the media expected big problems as result from the spreading of the worm conficker and the new "payload" that would be activated.

More than a result of a large patch campaign, I think that the famous worm exploited a large media campaign that exaggerated and overestimated its effects. I expect this to be just another day in the life of a security research. Anyway, if something happens, I will be updating my twitter and my tumbr (this is Spanish only). In case of infection or pro-action against the worm, here are some resources.

The BBC, the botnet and other DDoS attacks

No doubt that the most commented DDoS news of the week were related to the botnet that the BBC hired. In fact it was the staff of one of its programs called Click. The program's goal was to demonstrate how easy it is to hire a botnet to perform criminal activities. The botnet was used to send SPAM to a especially set account and to launch a DDoS attack to security company website's specifically set for this purpose. Although the ethics of the action has been critiqued, the fact is that they have demonstrated how easy and cheap it is to hire such services.

In other news, Jose Nazario of Arbor Networks in hiss presentation at SOURCE Boston commented about the new "trends" in cyber crime. Nazario said that cyber criminals are not just selling kits for running malicious software on unprotected computers. Now they sell services for script-kiddies and criminals who are just not good enough to use the malware by themselves. The audio of the presentation here.

The DDoS attack to the torrent site Mininova continued during this week. Here you can see some trends in traffic that the attacks have generated.

The Spanish version of this post here.

DDoS attacks in the Olympics?

According to Jean-Michel Louboutin, Executive Director of Interpol Police the main security risk in the Olympic Games is the physical security of the visitors (and Chinese people as well). I agree with that, however I think that in the interview with PCWorld he subestimate the effect of a DDoS attack. The Chinese Internet infrastructure might be stronger against a DDoS than Estonian, but in a synchronized attack some services such as news reports or the Internet communication of visitors may be compromised. It is true that according to MessageLabs the infamous botnet "Storm" seems to shrunk; although these are good news (and less DoS could be launch) we are not sure if the small size of Storm is due to better security practices or just that another group of hackers has taken control of the botnet.

I read a comment in the Bruce Schneier's Blog about security: Never say "never", "this is impossible", "this will not happen". I honestly wish to be wrong, but I am sure that it will be more than one attack against the olimpyc infrastructure and at least one will success.

This post in spanish

A worm that strikes back

The last August 9th the REN-ISAC from the University of Indiana warned the academic community about the Storm Worm infected machines. After scanned, machines that are infected strike back with a flood DoS attack to the source of the scanning. The process seems to be automated according to the note.

Although the warning was issued to universities in U.S. I am sure that it will also affect to other universities and enterprises that have the scanning of hosts as one of their security policies.

More notes:
Information Week
The Register

Spammers using DDoS attacks

I read in a post in the SANS website that ansti-spam groups websites are under a DDoS attack. It is interesting the point of view of the post's author about seeing this as a desperate action from the spammers groups.

P2P networks used to launch DDoS attacks

I read a pair of notes about P2P networks (using DC++) hijacked to create botnets. The problem is caused by a vulnerability in the code of the P2P software that allows the injection of malicious code. The compromised host can be used to launch DDoS attacks.

Netcraft
Net-security

Distributed Denial of Service (DDoS) Attacks are Back

Yes, the Distributed Denial of Service (DDoS) Attacks are not in the past as pointed by Symantec's Yazan Gable in the enterprise blog. Some examples after his comments:

Finnish Website prey of DoS
DDoS/DoS to myBulgaria.info
Computer Terrorism For Sale

And that is not at all. Yesterday the British's Daily Telegraph website was knocked out by a DDoS (the note). In my opinion the more critical event was the apparent Russian's Cyber Attack against Estonia's network infrastructure some days ago. There are not yet enough information to clarify the incident but it would not be the first time that hackers from different countries attack each other after some political events (China v.s Taiwan). This remind me the comments of Professor Dorothy Denning in her book Information Warfare and Security. (Professor Denning was one of the first research works on Intrusion Detection Systems (IDS), her paper).

My opinion is that DDoS will be there no matter what security companies say. While the motivation exists, the problem will remain.

-as