DDOS | Bach Seat

Tag Archive for DDOS

RB | October 14, 2024

Comments Off

Data Breach Hits Internet Archive Users

Updated—10/21/2024—The Verge reports that the Internet Archive is under the influence of attackers. Despite being back online in Read Only mode, it seems the attackers control the IA help desk. According to reports, the attackers have a Zendesk token and can intercept tickets.

—

Updated – 10/16/2024 – TechRadar reports that the attack used two attack vectors: TCP reset floods and HTTPS application layer attacks. The TCP flood will flood a victim with vast numbers of Transmission Control Protocol (TCP) reset packets, which trick a computer into terminating its connection with others in its network. An HTTPS application layer attack will typically aim to overwhelm servers by targeting the application layer to disrupt the normal traffic flow, rendering regular services unavailable.

—

The non-profit Internet Archive has been offline since Tuesday (10/09/2024). Founded in 1996, the Internet Archive digital library provides “universal access to all knowledge.” Through the Wayback Machine, it preserves billions of webpages, texts, audio recordings, videos, and software applications.

Internet Archive founder Brewster Kahle posted on X (formerly Twitter) that the site was under a DDoS attack.

Later on Tuesday, the attack evolved. The site started displaying a hacker pop-up notification. After closing the message, the site loaded typically but very slowly. The pop-up said:

“Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”

HIBP refers to Have I Been Pwned?, a website where people can check to see if their information has leaked from cyber attacks.

Finally, the pop-up was gone, along with the rest of the site, leaving only a placeholder message saying:

“Internet Archive services are temporarily offline.”

Stolen Internet Archive data

On September 28, 2024, attackers stole the site’s user authentication database with 31 million unique records. Bleeping Computer confirmed that Have I Been Pwned had received an “ia_users.sql” database file containing authentication information for registered members, including their email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other internal data.

Who is responsible

The hacktivist group SN_BlackMeta, which emerged in November 2023, claimed responsibility for the DDoS attack. Cybersecurity firm Radware connected SN_BlackMeta to a pro-Palestinian hacktivist movement that utilizes DDoS-for-hire services like InfraShutdown. SN_BlackMeta has launched other cyberattacks, including a record-breaking DDoS attack against a Middle Eastern financial institution.

It’s unclear if they are involved in the Internet Archive data breach. The group said that it carried out the DDoS attack because the United States supports Israel and that the Internet Archive “belongs to the USA.”

Many social media users quickly pointed out that the Internet Archive is an independent non-profit organization not affiliated with the U.S. government.

Internet Archive Back online – sorta

10/14/2024, it is back in a limited read-only way

rb-

Finally, what do you need to do if you have an account at the Internet Archive?

A compromised password is always a concern in any breach. But in this case, the passwords were salted and hashed, making them difficult to crack through reverse engineering or brute force. Still, once the Internet Archive returns, you should change your password to be safe.

Related article

Famous DDoS attacks | The largest DDoS attacks of all time (Cloudflare)

Ralph Bach has been in I.T. for a while and has blogged from the Bach Seat about I.T., careers, and anything else that has caught my attention since 2005. You can follow me on Facebook or Mastodon. Email the Bach Seat here.

Category: Uncategorized | Tags: 2024, Business, data theft, DDOS

RB | October 11, 2019

Comments Off

How Secure are Your Printers?

Printers are under the security microscope again. Printers are IoT devices that sit on the network and never get updated. I have covered some of the problems that printers cause a number of times on the Bach Seat. And now more vulnerabilities have been identified by UK-based security consultancy NCC Group in six popular enterprise printers.

Vulnerabilities in printers

The research team was made up of Daniel Romero, managing security consultant and research lead, and Mario Rivas, security consultant at NCC Group. They identified several classes of vulnerabilities in printers including:

Denial of service attacks that could crash printers;
The ability to add back-doors into printers to maintain attacker persistence on a network.
The ability to spy on every print job sent to vulnerable printers.
The ability to forward print jobs to an external internet-based attacker.

Matt Lewis, research director at NCC Group told ComputerWeekly,

Because printers have been around for decades, they’re not typically regarded as enterprise IoT [internet of things devices], yet they are embedded devices that connect to sensitive corporate networks and therefore demonstrate the potential risks and security vulnerability posed by enterprise IoT.

Who to blame

There is plenty of blame to share for most of these latest vulnerabilities. Mr. Lewis says the manufacturers are causing these problems by neglecting to build security into their products.

Building security into the development life-cycle would mitigate most, if not all, of these vulnerabilities and so it’s therefore important that manufacturers continue to invest in and improve cybersecurity, including secure development training and carrying out thorough security assessments of all devices.

End-users have to take some of the blame as well according to NCC Group

Corporate IT teams can also make small changes to safeguard their organization from IoT-related vulnerabilities, such as changing default settings, developing and enforcing secure printer configuration guides, and regularly updating firmware.

Impacted printer models

The printers tested by the researchers were from HP, Ricoh, Xerox, Brother, Lexmark, and Kyocera.

The NCC Group found vulnerabilities in HP (HPQ) printers. The Color LaserJet Pro MFP M281fdw printers have buffer overflows, cross-site scripting (XSS) vulnerabilities, and cross-site forgery countermeasures bypass.

HP has posted firmware updates to address potential vulnerabilities to some of its Color LaserJet series. “HP encourages customers to keep their systems updated to protect against vulnerabilities,” the company said in a statement.

The vulnerabilities in Lexmark CX310DN printers NCC Group found include denial of service vulnerability, information disclosure vulnerabilities, lack of cross-site request forgery countermeasures, and lack of account lockout.

The NCC Group found Vulnerabilities in Kyocera (KYO) Ecosys M5526cdw printers. The security holes include buffer overflows, broken access controls, cross-site scripting vulnerabilities, and lack of cross-site request forgery countermeasures.

NCC Group identified stack buffer overflows, heap overflows and information disclosure vulnerabilities in Brother (6448) HL-L8360CDW printers.

The vulnerabilities reported in Ricoh (RICOY) SP C250DN printers include buffer overflows, lack of account lockout, information disclosure vulnerabilities, denial of service vulnerabilities, lack of cross-site request forgery countermeasures, and hard-coded credentials.

NCC Group claims the Xerox (XRX) Phaser 3320 printer vulnerabilities include buffer overflows, cross-site scripting vulnerabilities, lack of cross-site request forgery countermeasures, and lack of account lockout.

All of the vulnerabilities discovered during this research have either been patched or are in the process of being patched by the relevant manufacturers. NCC Group recommends that system administrators update any affected printers to the latest firmware available, and monitor for any further updates.

HP Has No Easy Way Out of Printer Jam (Wall Street Journal)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: 2019, APT, Backdoor, Brother, data theft, DDOS, HP, IOT, NCC Group, Printer, Security, Xerox

RB | May 12, 2017

Comments Off

Whose Time Is It?

What time is it? If you looked at the lower right corner of your Windows PC screen, you know what time it is. That is good enough for most people, but followers of the Bach Seat want to know more. How does Microsoft know that time it is? Microsoft and everybody else uses Internet Engineering Task Force (IETF) RFC 7822 standard protocol called Network Time Protocol (NTP).

Network Time Protocol (NTP)

NTP is one of the oldest Internet protocols still in use. NTP was designed by UMich alum David Mills at the University of Delaware. NTP can maintain time to within tens of milliseconds over the public Internet, and better than one-millisecond accuracy on a LAN. Like many other things in the network world, NTP is set up as a hierarchy. At the top of the tree are “Atomic Clocks” (Stratum 0). Corporations, governments, and the military run atomic clocks.

Atomic clocks are high-precision timekeeping devices that use the element cesium, which has a frequency of 9,192,631,770 Hertz. That means it “oscillates” a little over nine billion times a second. Knowing the oscillation frequency and then measuring it in a device creates an incredibly accurate timekeeping mechanism. Atomic clocks generate a very accurate interrupt and timestamp on a connected Stratum 1 computer. Stratum 0 devices are also known as reference clocks. The other stratum levels are:

1 – These are computers attached to stratum 0 devices. Stratum 1 servers are also called “primary time-servers”.

2 – These are computers that synchronize over a network with stratum 1 servers. Stratum 2 computers may also peer with other stratum 2 computers to offer more stable and robust time for all devices in the peer group.

3 computers synchronize with stratum 2 servers. They use the same rules as stratum 2, and can themselves act as servers for stratum 4 computers, and so on.

Once synchronized, with a stratum 1, 2, or 3 server, the client updates the clock about once every 10 minutes, usually requiring only a single message exchange. The NTP process uses User Datagram Protocol port 123. The NTP timestamp message is 64-bits and consists of a 32-bit part for seconds and a 32-bit part for the fractional second. 64-bits gives NTP a time scale of 232 seconds (136 years) and a theoretical resolution of 232 seconds (233 picoseconds). NTP uses an epoch of January 1, 1900, so the first rollover will be on February 7, 2036.

Microsoft Windows Time Service

Microsoft (MSFT) has a mixed history of complying with NTP. All Microsoft Windows versions since Windows 2000 include the Windows Time service (“W32Time”) which was originally implemented to support the Kerberos version 5 authentication protocol. It required time to be within 5 minutes of the correct value to prevent replay attacks. The NTP version in Windows 2000 and XP violates several aspects of the NTP standard. Beginning with Windows Server 2003 and Vista, MSFT’s NTP was reliable to 2 seconds. Windows Server 2016 can now support 1ms time accuracy.

In 2014 a new NTP client, ntimed, was started. As of May 2017, no official release was done yet, but ntimed can synchronize clocks reliably under Debian and FreeBSD, but has not been ported to Windows or Apple (AAPL) macOS.

Accurate time across a network is important for many reasons; discrepancies of even fractions of a second can cause problems. For example:

Distributed procedures depend on coordinated times to make sure proper sequences are followed.
Authentication protocols and other security mechanisms depend on consistent timekeeping across the network.
File-system updates carried out by a number of computers depend on synchronized clock times.
Network acceleration and network management systems also rely on the accuracy of timestamps to measure performance and troubleshoot problems.
Each individual blockchain includes a timestamp representing the approximate time the block was created.

NTP vulnerabilities

NTP has known vulnerabilities. The protocol can be exploited and used in distributed denial of service (DDoS) attacks for two reasons: First, it will reply to a packet with a spoofed source IP address; second, at least one of its built-in commands will send a long reply to a short request.

More vulnerabilities were recently discovered in NTP. SearchSecurity.com reports that security researcher Magnus Stubman discovered the vulnerability and, instead of going public, took the mature route and privately informed the community of his findings. Mr. Stubman wrote that the vulnerability he discovered could allow unauthenticated users to crash NTPF with a single malformed UDP packet, which will cause a null point dereference. The article explains this means that an attacker could be able to craft a special UDP packet that targets NTP, resulting in an exception bypass that can crash the process. A patch to remediate specific vulnerability — named NTP 4.2.8p9 — was released by the Network Time Foundation Project.

This is a Windows-only vulnerability at this time. The author urges anyone running the NTP daemon on a Windows system to patch it as soon as possible. This particular DoS attack against NTP could incapacitate a time-server and cause havoc in the network. The easiest fix is to apply the NTP patch the article states.

rb-
NTP is important to your network and patching and protecting it should be a priority. The threat to your environment is real. If NTP is not patched, an attacker could take advantage of the chaos created by this vulnerability to hide their tracks since timestamps on files and in logs won’t match.

Way back in the day, when I was a network administrator, I inherited a network where a directory services container was frozen. Seems that time had never been properly set up on the server holding the replica and as time passed, the server time drifted away from network time and at some point, we could not make changes or force a replica update. That meant a late-night call to professional services to kill the locked objects and then apply DSRepair –xkz (I think) and then re-install a R/O replica.

A ‘leap second’ will make 2016 a little longer (businessinsider.com)

Category: Uncategorized | Tags: 2017, AAPL, Apple, Atomic Clock, Blockchain, DDOS, Debian, FreeBSD, GOOG, Google, Microsoft, MSFT, NTP, Security, UDP 123, Vulnerability

RB | November 10, 2016

Comments Off

Bad Passwords Crippled the Web

Followers of the Bach Seat know that passwords suck and now default passwords really suck. In fact, default passwords seem to be a key part of the massive DDOS attack that disabled large parts of the Internet on October 21, 2016. The cyberattack targeted Internet traffic company DYN. DYN provides DNS services for many high-profile sites. Some of the sites affected by the attack on Dyn included; Amazon (AMZN), Business Insider, New York Times, Reddit, and Twitter (TWTR).

Security researcher Brian Krebs, whose site, krebsonsecurity.com, was one of the first sites hit by a massive 620 GB/s DDoS attack, has reported the Mirai botnet was at the center of the attack on his site. CIO.com reports ‘Mirai’ can break into a wide range of Internet of Things (IoT) devices from CCTV cameras to DVRs to home networking equipment turning them into ‘bots. CIO reports a single Chinese vendor, Hangzhou Xiongmai Technology made many of the devices used in the Mirai attacks.

Level 3 Communications says there are nearly half a million Mirai-powered bots worldwide. To amass an IoT botnet, a Mirai bot herder scans a broad range of IP addresses, trying to login to devices using a list of default usernames and passwords that are baked into Mirai code, according to US-CERT. The Mirai zombie devices are largely security cameras, DVRs, and home routers. Mr. Krebs identified some of the specific devices.

Mirai Passwords

Username	Password	Function
admin	123456
root	123456	ACTi IP camera
admin	password
admin1	password
root	password
admin	12345
root	12345
guest	12345
admin	1234
root	1234
administrator	1234
888888	888888
666666	666666	Dahua IP camera
admin	(none)
admin	1111	Xerox printers, etc.
admin	1111111	Samsung IP camera
admin	54321
admin	7ujMko0admin	Dahua IP camera
admin	admin
admin	admin1234
admin	meinsm	Mobotix network camera
admin	pass
admin	smcadmin	SMC router
Administrator	admin
guest	guest
mother	fucker
root	(none)	Viviotek IP camera
root	00000000	Panasonic printers
root	1111
root	54321	Packet8 VoIP phone
root	666666	Dahua DVR
root	7ujMko0admin	Dahua IP camera
root	7ujMko0vizxv	Dahua IP camera
root	888888	Dahua DVR
root	admin	IPX-DDK network camera
root	anko	Anko Products DVR
root	default
root	dreambox	Dreambox TV receiver
root	hi3518	HiSilicon IP Camera
root	ikwb	Toshiba network camera
root	juantech	Guangzhou Juan Optical
root	jvbzd	HiSilicon IP Camera
root	klv123	HiSilicon IP Camera
root	klv1234	HiSilicon IP Camera
root	pass
root	realtek	Realtek router
root	root
root	system	IQinVision camera, etc.
root	user
root	vizxv	Dahua camera
root	xc3511	H.264 - Chinese DVR
root	xmhdipc	Senzhen Anran security camera
root	zlxx.	EV ZLX two way speaker
root	Zte521	ZTE router
service	service
supervisor	supervisor	VideoIQ
support	support
tech	tech
ubnt	ubnt	Ubiquiti AirOS Router
user	user

US-CERT says the purported author of Mirai claims to have 380,000 IoT devices are under its control. Some estimate the botnet has generated greater than 1Tbps DDoS attacks.

When Mirai botnets are called upon to carry out DDoS attacks, they can draw on a range of tools including ACK, DNS, GRE, SYN, UDP and Simple Text Oriented Message Protocol (STOMP) floods, says Josh Shaul, vice president of web security for Akamai.

rb-

Followers of Bach Seat already know that many of the default passwords used by Mirai are among the worst and should have been changed already. They include:

Password
123456
12345
1234

While reports say, Chinese vendor, XiongMai Technologies equipment was widely exploited, other notable tech firms are included. The Mirai zombie army includes equipment from Xerox (XRX), Toshiba (TOSBF), Samsung (005930), Panasonic (6752), and ZTE (763).

I wrote about security cameras being compromised as part of botnets back in July here.

Terabit-scale DDoS events are on the horizon (helpnetsecurity.com)

Category: Uncategorized | Tags: 2016, Botnet, Brian Krebs, Business Insider, China, cyber attack, DDOS, Denial-of-service attack, DNS, Dyn, Mirai, New York Times, Passwords, Reddit, Samsung, Security, Toshiba, Twitter, TWTR, Xerox, XiongMai Technologies, ZTE

RB | July 9, 2016

Comments Off

Security Cam Concerns in Ann Arbor

Security Cam Concerns in Ann Arbor Next time you are in Ann Arbor to get a bite to eat at Zingerman’s or attend a U of M football game at Michigan stadium someone may be watching you. NetworkWorld, says Ann Arbor is one of the top U.S. cities with the most unsecured security cameras. In fact, Ann Arbor ranks seventh nationally.

The report’s author, security firm Protection 1, analyzed the data from Insecam. Inseacam identifies open security cameras and Protection 1 estimates there are over 11,000 open security cameras on the Internet in the U.S. Protection 1 identified the cities with the most cameras that can be viewed by anyone online. The top 10 cities with unsecured security cameras are:

Walnut Creek, CA – 89.69 / 100,000 residents
Richardson, TX – 72.74 / 100,000 residents
Torrance, CA – 72.55 / 100,000 residents
Newark, NJ – 38.07 / 100,000 residents
Rancho Cucamonga, CA – 36.76 / 100,000 residents
Corvallis, OR – 37.98 / 100,000 residents
Ann Arbor, MI – 34.18 / 100,000 residents
Orlando, FL – 34.05 / 100,000 residents
Eau Claire, WI – 22.21 / 100,000 residents
Albany, NY – 20.32 / 100,000 residents

Open security cameras connect to the Internet via Wi-Fi or a cable. They have no password protection or are using the manufacturer’s default password. Malicious people and governments can record or broadcast our lives from unprotected open security cameras. Open cameras are also vulnerable attacks that can turn them into bots.

From a privacy perspective, the most worrisome finding is that 15% of the open cameras are in Americans’ homes. Anyone can watch these cameras if the default password is not changed to a unique password to lock down the camera.

Besides being spied on from the web, open cameras can be exploited by criminals. Cyber-criminals can force online cameras to attack other things on the Internet as part of a DDoS attack.

A DDoS attack against a jewelry shop website led to the discovery of a CCTV-based botnet. A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing a denial of service for users of the targeted system. TargetTech says the flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.

Help Net Security reports that Sucuri researchers discovered the jewelry site was being attacked by a CCTV botnet made up of 25,000+ cameras from around the globe. The website was first attacked by a layer 7 attack (HTTP Flood) at 35,000 HTTP requests per second and then, when those efforts were thwarted, with 50,000 HTTP requests per second.

Sucuri researchers discovered that all the attacking IP addresses had a similar default page with the ‘DVR Components’ title. After digging some more, they found that all these devices are BusyBox based. Busybox is a GNU-based software that aims to be the smallest and simplest correct implementation of the standard Linux command-line tools.

CCTV botnet made up of 25,000+ cameras from around the globe The compromised CCTV cameras were located around the globe:

24% originated from Taiwan,
12% United States,
9% Indonesia,
8% Mexico,
and elsewhere.

rb-

Unless something is done, security flaws, misconfiguration, and ignorance about the dangers of connecting unsecured devices to the IoT will keep these botnets functioning well into the future.

To protect your website from botnets and DDoS, you need to be able to block or absorb malicious traffic. Firms should talk to their hosting provider about DDoS attack protection. Can they route incoming malicious traffic through distributed caching to help filter out malicious traffic — reducing the strain on existing web servers. If not find a reputable third-party service that can help filter out malicious traffic.

DDoS defense services require a paid subscription, but often cost less than scaling up your own server capacity to deal with a DDoS attack.

Arbor Networks is one firm that provides services and devices to defend against DDoS.

Google has launched Project Shield, to use Google’s infrastructure to support free expression online by helping independent sites mitigate DDoS attack traffic.

GetResponse CEO Statement Regarding the DDoS Attack (getresponse.com)

Category: Uncategorized | Tags: 2016, Ann Arbor, Arbor Networks, BusyBox, CCTV, Daniel Cid, DDOS, Denial-of-service attack, DVR, GOOG, Google, HTTPS, Inseacam, Internet of Things, IP address, Jim Harbaugh, Linux, Michigan, Protection 1, Security, Sucuri

« Older Entries

Bach Seat

Tag Archive for DDOS

Data Breach Hits Internet Archive Users

Stolen Internet Archive data

Who is responsible

Internet Archive Back online – sorta

rb-

How Secure are Your Printers?

Vulnerabilities in printers

Who to blame

Impacted printer models

Related articles

Whose Time Is It?

Network Time Protocol (NTP)

Microsoft Windows Time Service

NTP vulnerabilities

Related articles

Bad Passwords Crippled the Web

Mirai Passwords

Related articles

Security Cam Concerns in Ann Arbor

Related articles

Meta