DDoS defenses emerging from Homeland Security

By Evan Koblentz | October 31, 2016, 9:53 AM PST

Public, private, and academic researchers are working on new ways to combat distributed denial-of-service attacks. The recent large-scale attacks are making them even more determined.


Government, academic, and private-sector officials are collaborating on new ways to prevent and mitigate distributed denial-of-service (DDoS) attacks, based on research years in the making but kicked into high gear by the massive takedown this month of domain name system provider Dyn.


The largest attacks in summer 2015 were about 400 gigabits per second, but September 2016 saw an attack on security blogger Brian Krebs of more than 600Gbps, while Dyn said its own attack may have exceeded 1.2 terabits per second. Government-led research is focusing on the 1-terabit range but with systems that can scale higher, which is already needed due to the proliferation of vulnerable Internet of Things devices too easily commandeered by malicious hackers.



But it means there's a ton of job security for Dan Massey, a computer science Ph.D. serving as program manager for the U.S. Department of Homeland Security Advanced Research Projects Agency Cyber Security Division. Massey in August 2015 began evaluating and funding new anti-DDoS efforts at the National Institute of Standards and Technology (NIST), private companies, and universities, which share the goal of getting innovative techniques into commercially feasible pilot projects no later than summer 2018. Some are already underway, Massey and others said.


Funded projects include attack information sharing methods from the University of Southern California, University of California-Los Angeles, and University of Oregon; the latter implements a unique peer-to-peer method of letting networks share information about traffic patterns. Colorado State University is making a way to distribute the task of packet filtering and intelligence gathering; the University of Delaware and others including IBM are focusing on identifying new kinds of attacks; and the University of Houston is looking at on-demand network capacity for handling attacks when they hit. In addition, Waterford, Va.-based Waverley Labs and the Cloud Security Allianceare working on whitelisting methods to make a network only accept approved traffic. NIST is collaborating with the University of California-San Diego to determine whether the software for stopping DDoS attacks would hurt network performance.

Other anti-DDoS measures are already common for large companies, such as load balancing so that different parts of a network can pick up the slack if others go down, having multiple DNS providers for the same reason, and educating end users on safe internet usage, security experts at Akamai, Radware, and certification specialist (ISC)2 said. It's unclear why the

Cyber attacks hit Singapore telecom service provider StarHub

Image Credit: StarHub Facebook

  26 Oct 2016 , 14:34

Singaporean telecoms service provider StarHub Ltd said intentional cyber attacks had caused internet connection disruption for some of its home broadband customers on Oct. 22 and Oct. 24. The company said it analysed network logs of the disruptions and found that it had experienced intentional and likely malicious distributed denial-of-service (DDoS) attacks on its domain name servers (DNS).

DDoS attackers typically target sites by flooding servers with messages from multiple systems so they are unable to respond to legitimate traffic. StarHub said there was no evidence of any impact on the rest of its services, and the security of its customers’ information was not compromised. “On both occasions, we mitigated the attacks by filtering unwanted traffic and increasing our DNS capacity, and restored service within two hours,” it said in a statement late on Tuesday.

The incidents come close on the heels of attacks on Twitter Inc, PayPal Holdings Inc, Spotify AB and other customers of Dyn, a U.S. company which acts as a switchboard for internet traffic. StarHub said it was investigating the intent and source of the two attacks, which it called “unprecedented in scale, nature and complexity” for the company.

It told Reuters in an email on Wednesday that it does not use Dyn services. As of June 30, StarHub’s residential broadband subscribers totalled 473,000. Singapore authorities on Tuesday advised other telecom firms to strengthen defences to protect against similar disruptions.

Singapore Telecommunications Ltd, the city-state’s biggest telecom operator, said it did not observe any abnormal traffic trends over the weekend but will continue to monitor networks closely. Third-ranked M1 Ltd said it was aware of the cyber-attacks and was on alert.\

Reuters

Security experts urge companies to use multiple vendors to avoid major like cyber attack

Representational Image : Reuters

  24 Oct 2016 , 10:55

Companies can reduce the risk from the type of cyber attack that took out major websites on Friday by using multiple vendors for the critical internet service known as a domain name service, or DNS, companies and security experts said on Sunday. “We have advocated for years for redundancy in your infrastructure,” said Kyle York, chief strategy officer for Dyn, the New Hampshire DNS provider that was attacked on Friday. “I don’t think you can ever be safe enough or redundant enough.”

Hackers unleashed a complex attack on the internet through common devices like webcams and digital recorders and cut access to some of the world’s best known websites on Friday, a stunning breach of global internet stability. York said clients who used multiple servers “saw less of an impact.”

Using multiple DNS providers can, however, make managing traffic more complicated and costly, experts said. Friday’s cyber attack alarmed security experts because it represented a new type of threat rooted in the proliferation of simple digital devices such as webcams. Such devices often lack proper security, and hackers found a way to harness millions of them to flood a target with so much traffic that it can’t cope.

The attack on Dyn and the resulting outage started in the Eastern United States on Friday and then spread to other parts of the country and Europe, affecting companies including Twitter and Paypal. DNS providers such as Dyn act as a switchboard for internet traffic. “It’s important to implement diversity geographically, as well as architecturally,” for a defense against domain name service attacks, said Andy Ellis, chief security officer at Akamai Technologies, which helped Dyn recover on Friday.

Businesses can choose up to eight authoritative domain service providers, and some of the hardest-hit sites were customers who only picked Dyn. Eliminating the threat from the unsecured devices that make up what’s often called the Internet of Things will be a much tougher task, however. Many inexpensive webcams, connected thermostats, baby monitors and other products lack even basic security and sometimes use hard-coded passwords that are simple to break, security experts said.

Law enforcement authorities said on Friday they are investigating the attack. The tools making the new type of attack possible were released on the internet by unknown hackers last month, thus creating a long list of possible suspects. “This is the new norm, the internet wasn’t designed with these kinds of attacks in mind,” said cyber security expert and entrepreneur Barrett Lyon.

Long term solutions would likely require governments to take far more responsibility for mandating internet security, experts agreed. Chinese electronics component manufacturer Hangzhou Xiongmai Technology said on Sunday that weak default passwords on its products inadvertently played a role in the cyber attack, according to a report from IDG News Service. The company said it has patched the flaws and now is asking customers to change the default password the first time they use it.

Reuters

Massive DDoS Attack Against Dyn DNS Service Knocks Popular Sites Offline

Friday, October 21, 2016  Swati Khandelwal

UPDATE — How an army of million of hacked Internet-connected smart devices almost broke the Internettoday.

Cyber attacks are getting evil and worst nightmare for companies day-by-day, and the Distributed Denial of Service (DDoS) attack is one such attacks that cause a massive damage to any service.

Recently, the Internet witnessed a record-breaking largest DDoS attack of over 1 Tbps against France-based hosting provider OVH, and now the latest victim of the attack is none other than Dyn DNS provider.

A sudden outage of popular sites and services, including Twitter, SoundCloud, Spotify, and Shopify, for many users, is causing uproar online. It's because of a DDoS attack against the popular Domain Name System (DNS) service provider Dyn, according to a post on Ycombinator.

DNS act as the authoritative reference for mapping domain names to IP addresses. In other words, DNS is simply an Internet's phone book that resolves human-readable web addresses, like thehackernews.com, against IP addresses.

Dyn DNS is used by many websites and services as their upstream DNS provider, including Twitter, Spotify, SaneBox, Reddit, Box, Github, Zoho CRM, PayPal, Airbnb, Freshbooks, Wired.com, Pinterest, Heroku and Vox Media properties.

All of these sites and services are reportedly experiencing outages and downtime, either completely or partially.

Here's an internet outage map from Level3:

According to Dyn DNS, the DDOS started at 11:10 UTC and is mostly affecting its customers in the East Coast of the United States, specifically Managed DNS customers.

"We are aware of the ongoing service interruption of our Managed DNS network. For more information visit our status page," Dyn tweeted.

At the time, it's not clear who is behind this DDoS attack, but the company said its engineers are working on "mitigating" the issue.

Here's the statement posted by Dyn on its website:

"This attack is mainly impacting US East and is impacting Managed DNS customers in this region. Our Engineers are continuing to work on mitigating this issue.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available.

Customers with questions or concerns are encouraged to reach out to our Technical Support Team."

What websites are down for you? Let us know in the comments below.

We'll update the story as soon as we get to hear more about the attack. Stay Tuned!

ICANN transition moves forward, despite last-minute attempt to block it

Fears about a transition away from U.S. government of ICANN are unfounded, says Lawrence Strickling, administrator of the National Telecommunications and Information Administration. Credit: NTIA

Grant Gross
IDG News Service
Oct 3, 2016 7:47 AM
The legal fight over the transition away from US oversight may not be over, however.

The Internet Corporation for Assigned Names and Numbers, the long-time coordinator of the internet’s Domain Name System, is independent of U.S. government oversight, at least for now.

The U.S. National Telecommunications and Information Administration’s planned turnover of ICANN oversight to the wider internet community happened early Saturday morning, despite a last-ditch lawsuit filed by four state attorneys general attempting to block the move.


Late Friday, a judge in Texas refused to issue an injunction that would have forced the NTIA to retain its oversight of ICANN’s coordination of the Domain Name System root and IP addressing functions.

The legal fight may not be over, though. The judge’s ruling does not “resolve the underlying legal questions raised by the states,” wrote Berin Szóka, president of TechFreedom, a free-market think tank opposing the move. “Nor does it mean the transition is a done deal.”

A court could still rule that the NTIA did not have the authority to “relinquish its responsibilities” and could order ICANN and NTIA to negotiate a new contract, he added.

The four states aren’t likely to give up their case, and other parties could join the fight, he said. “And even if this lawsuit fizzles, some other plaintiff could raise the issue in the future,” he wrote. “This issue could cast a long shadow over ICANN for years until a court finally rules on the merits.”

Several tech trade groups have pushed for the transition to move forward. The Internet Association praised the transition, saying the move gives oversight to a wider community “with strong accountability measures and controls.”

The transition is “good for U.S. national security, the economy, and for the future of the internet,” the trade group said in a press release. Supporters of the transition have argued that continued oversight of ICANN has prompted other countries to complain about outsized U.S. control over internet functions and to push for international control.

The long-time policy of the U.S. government has been to eventually end its oversight of ICANN. But some Republicans, led by Senator Ted Cruz of Texas, have protested the decision to end ICANN oversight by President Barack Obama’s administration. Cruz has suggested that the transition amounts to the U.S. giving away the internet, although ICANN’s authority is limited to administering the DNS.

Cruz and other critics have suggested that a lack of U.S. oversight would allow repressive regimes to more easily censor the internet, although neither ICANN nor the U.S. government can control how other countries block content within their borders.

Some conservatives fear the lack of U.S. government oversight will embolden other countries or international bodies to attempt to take control of ICANN. The ICANN community has put together a transition plan designed to prevent that from happening, but those questions remain.