Signcryption, which University of North Carolina at Charlotte professor Yuliang Zheng created, is a technology that protects confidentiality and authenticity, seamlessly and simultaneouslyis and is particularly useful in cloud computing for ensuring confidential, authenticated transmissions. The International Organization for Standardization (ISO) has published a standard for a public-key technology that combines signing and encrypting a message in a single step.
The first signcryption scheme was introduced by Professor Yuliang Zheng in 1997 and he continued his research in this revolutionary new technology at the College of Computing and Informatics. After nearly a three-year process, the International Organization of Standardization (ISO) has formally recognized his research efforts as an international standard.
News of the ISO adoption comes amidst daily reports of cyber attack and cyber crime around the world. Zheng says the application will also enhance the security and privacy of cloud computing. "The adoption of signryption as an international standard is significant in several ways," he said. "It will now be the standard worldwide for protecting confidentiality and authenticity during transmissions of digital information."
"This will also allow smaller devices, such as smartphones and PDAs, 3G and 4G mobile communications, as well as emerging technologies, such as radio frequency identifiers (RFID) and wireless sensor networks, to perform high-level security functions," Zheng said. "And, by performing these two functions simultaneously, we can save resources, be it an individual's time or be it energy, as it will take less time to perform the task."
There are also many other signcryption schemes that are proposed throughout the years, each of them having its own problems and limitations, while they are offering different level of security services and computational costs.
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
35 Facebook false websites
Security Web-Center found 35 Facebook phishing websites. These spammers create fake pages that look like the Facebook login page. If you enter your email and password on one of these pages, the spammer records your information and keeps it. The fake sites, like the one below, use a similar URL to Facebook.com in an attempt to steal people's login information.
The people behind these websites, then use the information to access victims' accounts and send messages to their friends, further propagating the illegitimate sites. In some instances, the phishers make money by exploiting the personal information they've obtained. Check out the list:
New botnets arrive
The recent breakup of the ChangeDNS botnet which infected more than 4 million computers and was under the control of a single ring of criminals raised a new set of concerns. The biggest effect of the commoditization of botnet tools and other computer security exploits might be a new wave of major botnet attacks, driven by people who simply buy their malware from the equivalent of an app store—or who rent it as a service.
The botnet market is nothing new—it's been evolving for years. But what is new is the business model of botnet developers, which has matured to the point where it begins to resemble other, legitimate software markets. One example of this change is a Facebook and Twitter CAPTCHA bypass bot called JET, which is openly for sale online.
 |
| The JET Facebook posting bot from jetbots.com |
Tor Project turns to Amazon
The Tor Project offers a channel for people wanting to route their online communications anonymously and this channel has been used by activists to avoid censorship as well as those seeking anonymity for more nefarious reasons. Now the people involved in this project to maintain a secret layer of the internet have turned to Amazon to add bandwidth to the service. According to some experts, the use of Amazon's cloud service will make it harder for governments to track.
Amazon's cloud service - dubbed EC2 (Elastic Compute Cloud) offers virtual computer capacity. The Tor developers are calling on people to sign up to the service in order to run a bridge - a vital point of the secret network through which communications are routed. According to Tor developers, by setting up a bridge, you donate bandwidth to the Tor network and help improve the safety and speed at which users can access the internet.
US military ready for cyber warfare
The US military is now legally in the clear to launch offensive operations in cyberspace, the commander of the US Strategic Command said Wednesday, less than a month after terming this a work in progress.
Air Force General Robert Kehler said in the latest sign of quickening U.S. military preparations for possible cyber warfare that "I do not believe that we need new explicit authorities to conduct offensive operations of any kind". "I do not think there is any issue about authority to conduct operations," he added, referring to the legal framework.
But he said the military was still working its way through cyber warfare rules of engagement that lie beyond "area of hostilities," or battle zones, for which they have been approved.
The US Strategic Command is in charge of a number of areas for the US military, including space operations (like military satellites), cyberspace concerns, 'strategic deterrence' and combating WMDs. The U.S. Cyber Command, a sub-command, began operating in May 2010 as military doctrine, legal authorities and rules of engagement were still being worked out for what the military calls the newest potential battle "domain."
"When warranted, we will respond to hostile acts in cyberspace as we would to any other threat to our country," the DoD said in the report. "All states possess an inherent right to self-defense, and we reserve the right to use all necessary means – diplomatic, informational, military, and economic – to defend our nation, our allies, our partners, and our interests."
The Office of the National Counterintelligence Executive, a U.S. intelligence arm, said in a report to Congress last month that China and Russia are using cyber espionage to steal U.S. trade and technology secrets and that they will remain "aggressive" in these efforts.
It defined cyberspace as including the Internet, telecommunications networks, computer systems and embedded processors and controllers in "critical industries."
The Pentagon, in the report to Congress made public Tuesday, said it was seeking to deter aggression in cyberspace by building stronger defenses and by finding ways to make attackers pay a price.
Windows 8 first malware bootkit
An independent programmer and security analyst, Peter Kleissner, is planning to release the world's first Windows 8 bootkit in India, at the International Malware Conference (MalCon).
A bootkit is a rootkit that is able to load from a master boot record and persist in memory all the way through the transition to protected mode and the startup of the OS. It’s a boot virus that is able to hook and patch Windows to get load into the Windows kernel, and thus getting unrestricted access to the entire computer. It is even able to bypass full volume encryption, because the master boot record (where Stoned is stored) is not encrypted. The master boot record contains the decryption software which asks for a password and decrypts the drive. This is the weak point, the master boot record, which will be used to take over the whole system.
A bootkit is built upon the following broad parts:
- Infector
- Bootkit
- Drivers
- Plugins (the payload)
A bootkit is a rootkit that is able to load from a master boot record and persist in memory all the way through the transition to protected mode and the startup of the OS. It’s a boot virus that is able to hook and patch Windows to get load into the Windows kernel, and thus getting unrestricted access to the entire computer. It is even able to bypass full volume encryption, because the master boot record (where Stoned is stored) is not encrypted. The master boot record contains the decryption software which asks for a password and decrypts the drive. This is the weak point, the master boot record, which will be used to take over the whole system.
Stuxnet 3.0 released at MalCon?
Security researchers were shocked to see in a twitter update from MalCon that one of the research paper submissions shortlisted is on possible features of Stuxnet 3.0. While this may just be a discussion and not a release, it is interesting to note that the speaker Nima Bagheri presenting the paper is from IRAN.
The research paper abstract discusses rootkit features and the malware authors may likely show demonstration at MalCon with new research related to hiding rootkits and advanced Stuxnet like malwares.
Stuxnet is a computer worm discovered in June 2010. It targets Siemens industrial software and equipment running Microsoft Windows. While it is not the first time that hackers have targeted industrial systems, it is the first discovered malware that spies on and subverts industrial systems, and the first to include a programmable logic controller (PLC) rootkit.
What is alarming is the recent discovery (On 1 September 2011) by The Laboratory of Cryptography and System Security (CrySyS) of the Budapest University of Technology and Economics, of a new worm theoretically related to Stuxnet. After analyzing the malware, they named it Duqu and Symantec, based on this report, continued the analysis of the threat, calling it "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper. The main component used in Duqu is designed to capture information such as keystrokes and system information and this data may be used to enable a future Stuxnet-like attack.
FBI's Operation Ghost Click
Resulting from a two-year investigation by the FBI, dubbed "Operation Ghost Click", a gang of internet bandits who stole $14 million after hacking into at least 4 million computers in an online advertising scam have been arrested.
Six Estonian nationals have been arrested and charged with running a sophisticated Internet fraud ring that infected millions of computers worldwide with a virus and enabled the thieves to manipulate the multi-billion-dollar Internet advertising industry. Users of infected machines were unaware that their computers had been compromised—or that the malicious software rendered their machines vulnerable to a host of other viruses.
Computers in more than 100 countries were infected by the “DNSChanger” malware, which redirected searches for Apple’s iTunes store to fake pages pretending to offer Apple software for sale, as well as sending those searching for information on the U.S. Internal Revenue Service to accounting company H&R Block, which allegedly paid those behind the scam a fee for each visitor via a fake internet ad agency. Beginning in 2007, the cyber ring used DNSChanger to infect approximately 4 million computers in more than 100 countries.
Trend Micro, which helped supply information to the FBI on DNS Changer, hailed the law enforcement operation as the "biggest cyber criminal takedown in history." Whilst the rogue DNS servers have been replaced, many may still be infected. Head here to learn about how to check if your system is part of the DNS Changer botnet.
Six Estonian nationals have been arrested and charged with running a sophisticated Internet fraud ring that infected millions of computers worldwide with a virus and enabled the thieves to manipulate the multi-billion-dollar Internet advertising industry. Users of infected machines were unaware that their computers had been compromised—or that the malicious software rendered their machines vulnerable to a host of other viruses.
Computers in more than 100 countries were infected by the “DNSChanger” malware, which redirected searches for Apple’s iTunes store to fake pages pretending to offer Apple software for sale, as well as sending those searching for information on the U.S. Internal Revenue Service to accounting company H&R Block, which allegedly paid those behind the scam a fee for each visitor via a fake internet ad agency. Beginning in 2007, the cyber ring used DNSChanger to infect approximately 4 million computers in more than 100 countries.
Trend Micro, which helped supply information to the FBI on DNS Changer, hailed the law enforcement operation as the "biggest cyber criminal takedown in history." Whilst the rogue DNS servers have been replaced, many may still be infected. Head here to learn about how to check if your system is part of the DNS Changer botnet.
Who Are Anonymous?
Anonymous' organization
Anonymous isn’t truly an organization; not in any traditional sense. They are a large, decentralized group of individuals who share common interests and web haunts. There are no official members, guidelines, leaders, representatives or unifying principles. Rather, Anonymous is a word that identifies the millions of people, groups, and individuals on and off of the internet who, without disclosing their identities, express diverse opinions on many topics.
Being "Anonymous" is much more a quality or a self-definition than a membership. Each project under the Anonymous banner may have a whole different set of instigators. Leadership, when it exists, is informal and carried out in chat channels, forums, IM and public calls to action online. No one's meeting in a board room.
The name Anonymous itself is inspired by the perceived anonymity under which users post images and comments on the Internet. Usage of the term Anonymous in the sense of a shared identity began on imageboards.
Origin of Anonymous
They are loosely affiliated with 4chan and other smaller "chan" boards (like 7chan, 2chan and 711chan) due to these sites' anonymous posting feature, which allows them to plan attacks without revealing any identifying information.
A tag of Anonymous is assigned to visitors who leave comments without identifying the originator of the posted content. Users of imageboards sometimes jokingly acted as if Anonymous were a real person. As the popularity of imageboards increased, the idea of Anonymous as a collective of unnamed individuals became an internet meme.
They coordinate raids on forums like 4chan.org and ICQ chat rooms, among other venues. 4chan.org is a major hub, but I wouldn’t call it Anonymous’ home. Anonops.net was as close to an HQ as they had, but it has been shut down.
Some claim Anonymous to be the first internet-based superconsciousness. Anonymous is a group, in the sense that a flock of birds is a group. How do you know they're a group? Because they're travelling in the same direction. At any given moment, more birds could join, leave, peel off in another direction entirely.
Anonymous doesn't like to be called a 'group'. And much less do its members like to be called 'hackers'. They are, to use the manifesto's excitable, sci-fi-tinged terminology, an "Online Living Consciousness"
Anonymous hierarchy
They have been described as a leaderless, anarchic group of "hacktivists" but inside Anonymous, some have found that the organization is more hierarchical – with a hidden cabal of around a dozen highly skilled hackers coordinating attacks across the web.
One member said the group's "command and control" centers are invite-only, adding: "It's to protect people, but if you have proven trustworthy you get invited – it's not hard to do. It's not some elitist structure but a way to keep the press and the odd bit of law enforcement seeing who issues commands."
"Our project has no leader structure, only different roles. The degree of leadership and organization in the various projects various a lot," one long-term insider explained. "It's all very chaotic, but we communicate and co-operate with each other. I see us as different cells of the same organism."
The leaders of the group use internet relay chat (IRC) technology, which can allow groups of people to communicate clandestinely. Some in the upper echelons are understood to have control over "botnets" comprising more than 1,000 Windows PCs that have been infected with a virus and can be controlled without the user's knowledge to direct "distributed denial of service" (DDoS) attacks against target organizations.
History of Anonymous Hacktivism
We are Anonymous. We are legion. We do not forgive. We do not forget. Expect us.
-Anonymous
Long before they became vigilantes in the Wikileaks cyberwars, Anonymous was conducting large-scale “raids” against their enemies.
The Habbo Hotel raids
Probably the first time 4chan users banded together under the moniker Anonymous was in order to harass the users of Habbo Hotel, a cartoonish social network designed as a virtual hotel.
As early as 2006, Anonymous would "raid" Habbo, blocking its usual users from moving around. The first major raid is known as the "Great Habbo Raid of '06," and a subsequent raid the following year is known as the "Great Habbo Raid of '07."There appears to be some connection to the news of an Alabama amusement park banning a two-year-old toddler affected by AIDS from entering the park's swimming pool.
Users signed up to the Habbo site dressed in avatars of a black man wearing a grey suit and an Afro hairstyle and blocked entry to the pool, declaring that it was "closed due to AIDS," flooding the site with internet sayings, and forming swastika-like formations. Then when all their black cartoon avatars got banned, they'd call Habbo racist. This was all done "for the lulz," or just for fun.
At this point, Anonymous’ actions had not taken on a political bent. Some members of Anon would argue it was better that way.
Hal Turner
Anonymous targeted this white supremacist with a talk radio show in December 2006. According to Hal Turner, in December 2006 and January 2007 individuals who identified themselves as Anonymous overloaded his website, costing him thousands of dollars in bandwidth bills.
Some Anons seem to have distaste for actual racism, though they express it frequently in jest. But of course you can never tell if it's the same people. "Anon is legion," they like to say.
As a result, Turner sued 4chan, eBaum's World, 7chan, and other websites for copyright infringement. He lost his plea for an injunction, however, and failed to receive letters from the court, which caused the lawsuit to lapse.
Chris Forcand
Anonymous helped catch an internet child predator, Chris Forcand, by reporting information to the police in 2007. By this time, Anonymous began to see themselves as a group of internet vigilantes fighting for assorted noble causes, rather than a band of merry pranksters.
On December 7, 2007, the Canada-based Toronto Sun newspaper published a report stating that Forcand was already being tracked by "cyber-vigilantes who seek to out anyone who presents with a sexual interest in children" before police investigations commenced. Forcand, 53, was charged with two counts of luring a child under the age of 14, attempt to invite sexual touching, attempted exposure, possessing a dangerous weapon, and carrying a concealed weapon
Anonymous contacted the police after some members were "propositioned" by Forcand with "disgusting photos of himself." The report also stated that this is the first time a suspected Internet predator was arrested by the police as a result of Internet vigilantism
The Church of Scientology
With these raids, Anonymous exploded into popular culture. The group gained worldwide press for Project Chanology, the protest against the Church of Scientology.
Calling the action by the Church of Scientology a form of Internet censorship, members of Project Chanology organized a series of denial-of-service attacks against Scientology websites, prank calls, and black faxes to Scientology centers.
There were also several organized protests in many cities worldwide against Scientology. They took to the streets, protesting outside of Scientologist churches wearing "V-masks," the disguise used by Alan Moore's vigilante comic book hero, V, originally inspired by would-be British terrorist and folk hero Guy Fawkes.
Epilepsy Foundation
Anonymous has also trolled the Epilepsy Foundation of America, uploading seizure-inducing content to its forums.
On March 28, 2008, the epilepsy support forum run by the Epilepsy Foundation of America was assaulted and JavaScript code and flashing computer animations were posted with the intention of triggering migraine headaches and seizures in photosensitive and pattern-sensitive epileptics.
SOHH and AllHipHop
In late June 2008, users who identified themselves as Anonymous claimed responsibility for a series of attacks against the SOHH (Support Online Hip Hop) website. The attack was reported to have begun in retaliation for insults made by members of SOHH's "Just Bugging Out" forum against 4chan's users.
The attack against the website took place in stages, as Anonymous users flooded the SOHH forums, which were then shut down. On June 23, 2008, the group which identified themselves as Anonymous organized DDoS attacks against the website, successfully eliminating over 60% of the website's service capacity. On June 27, 2008, the hackers utilized cross-site scripting to alter the website's main page with satirical images and headlines referencing numerous racial stereotypes and slurs, and also successfully stole information from SOHH employees.
No Cussing Club
Anonymous also targeted the kid who started The No-Cussing Club, for obvious reasons. In January 2009 members of Anonymous targeted California teen McKay Hatch who runs the No Cussing Club, a website against profanity.
As Hatch's home address, phone number, and other personal information were leaked on-line, his family has received a lot of hate mail, lots of obscene phone calls, and even bogus pizza and pornography deliveries.
As Hatch's home address, phone number, and other personal information were leaked on-line, his family has received a lot of hate mail, lots of obscene phone calls, and even bogus pizza and pornography deliveries.
YouTube porn day
On May 20, 2009, members of Anonymous uploaded numerous pornographic videos onto YouTube. Many of these videos were disguised as children's videos or family friendly videos with tags such as "jonas brothers." YouTube has since removed all videos uploaded.
The BBC contacted one of the uploaders who stated that it was a "4chan raid" organized due to the removal of music videos from YouTube. BBC News reported that one victim posted a comment saying: "I'm 12 years old and what is this?" which went on to become an internet meme.
The BBC contacted one of the uploaders who stated that it was a "4chan raid" organized due to the removal of music videos from YouTube. BBC News reported that one victim posted a comment saying: "I'm 12 years old and what is this?" which went on to become an internet meme.
Iranian Election protests
Following allegations of vote rigging after the results of the June 2009 Iranian presidential election were announced, declaring Iran's incumbent President Mahmoud Ahmadinejad as the winner, thousands of Iranians participated in demonstrations.
Anonymous teamed up with Pirate Bay and various Iranian hackers to offer Iranian dissidents a way to plan demonstrations and connect with the outside world. The result was Anonymous Iran, an Iranian Green Party Support site and a successful information-freedom project.
Operation Didgeridie
In September 2009 the group reawakened "in order to protect civil rights" after several governments began to block access to its imageboards. The tipping point was the Australian government's plans for ISP-level censorship of the internet.
Early in the evening of September 9, Anonymous took down the prime minister's website with a distributed denial-of-service attack. The site was taken offline for approximately one hour.
Operation Titstorm
On the morning of February 10, 2010, Anonymous launched a more prepared attack hilariously-titled "Operation Titstorm."
It defaced the prime minister's website, took down the Australian Parliament House website for three days and nearly managed to take down the Department of Communications' website as a protest against the Australian Government over the forthcoming internet filtering legislation and the perceived censorship in pornography of small-breasted women (who are perceived to be under age) and female ejaculation.
Other entities they’ve tangled with include AT&T, Gene Simmons, KnowYourMeme, Hot Topic, Jessi Slaughter, and Tumblr. but I would consider these to be only skirmishes.
All of these without mentioning the recent Operation Payback, and the strikes againt Tunisia, Zimbabwe and Egypt.
Who knows where the next target might be...
It defaced the prime minister's website, took down the Australian Parliament House website for three days and nearly managed to take down the Department of Communications' website as a protest against the Australian Government over the forthcoming internet filtering legislation and the perceived censorship in pornography of small-breasted women (who are perceived to be under age) and female ejaculation.
Other entities they’ve tangled with include AT&T, Gene Simmons, KnowYourMeme, Hot Topic, Jessi Slaughter, and Tumblr. but I would consider these to be only skirmishes.
All of these without mentioning the recent Operation Payback, and the strikes againt Tunisia, Zimbabwe and Egypt.
Who knows where the next target might be...
BotTorrent: A new paradigm in hacktivism?
The Low Orbit Ion Cannon, or LOIC, is a popular tool for taking down websites these days. It was used on Visa, Master Card, Paypal and other institutions by "Anonymous" hacktivists.
A new weapon of mass awareness is in the horizon, however, that may very well step up the severity and efficiency of these attacks. If effective, it will set into motion attacks originating from thousands of computers worldwide. The difference? End-users will not necessarily know they are participating in the attacks.
Thought BitTorrent was just about downloading movies and TV shows? Think again: The BitTorrent protocol can be abused to initiate massive denial of service attacks, which could be used to take down large-scale websites. This exploit is based on BitTorrent’s ability to download data without the help of any centralized server, also known as trackerless BitTorrent. Here's how it would work.
A home user navigates to a torrent search engine to download a popular file (a film or TV show, for instance).The file may have several thousands of leechers or seeders; these numbers may increase to the hundreds of thousands in some cases, depending on the popularity of the file. For simplicity, think of each leecher as one computer attempting to download the file.
BitTorrent was originally designed with a central server dubbed tracker in mind which would help users interested in the same file find each other to facilitate downloads. However, these tracker servers have become a kind of Achilles heel of the P2P protocol. Once a tracker server goes down, the whole network goes down. BitTorrent programmers came up with a way to discover users without such a server that’s based on the Kademlia DHT technology.
This technology is based on individual BitTorrent clients randomly introducing themselves to each other to establish a kind of distributed directory. However, it was recently showed that one can manipulate some of the data exchanged by BitTorrent clients for trackerless torrenting to introduce oneself to many more clients in the network than necessary and then tell those clients that a popular file is available under a certain IP address.
By manipulating the data being communicated through BitTorrent clients, one can create the appearance of availability for a given file and cause leechers to attempt a download. The leecher would not actually be downloading the intended file, but attacking a target IP without their knowledge. This would result in the flooding of the target host and, in many cases, eventual take-down of the target site.
Nefarious users could utilize publicly available data from torrent sites like The Pirate Bay to find DHT hashes for some of the most popular files and essentially trick some of these downloaders into attacking a certain target. For example, one could tell tens of thousands of users that a fresh version of Tron Legacy (not yet released!) is available at an address that really is the web server of a corporation. All of these users would immediately try to download the file under that address, bombarding the server with requests and possibly taking it down in the process.
Distributed denial of service (DDoS) attacks were most recently used to take down the sites of major credit card companies as part of the Anonymous revenge for actions taken against WikiLeaks. However, users tend to actively take part in a DDoS attack. In the case of this type of exploit, users may not even be aware that they’re bombarding a bank server with bogus requests while they’re trying to download a movie file.
This new technology, termed BotTorrent, would have revolutionary significance not merely in virtue of its creative underpinnings, but in terms of legal responsibility. Clearly, it is unlikely that end-users would prosecuted for carrying out an attack of which they had no knowledge. Furthermore, given the number of unknowing users carrying out the attacks, the magnitude of the attacks would expand massively.
A new weapon of mass awareness is in the horizon, however, that may very well step up the severity and efficiency of these attacks. If effective, it will set into motion attacks originating from thousands of computers worldwide. The difference? End-users will not necessarily know they are participating in the attacks.
Thought BitTorrent was just about downloading movies and TV shows? Think again: The BitTorrent protocol can be abused to initiate massive denial of service attacks, which could be used to take down large-scale websites. This exploit is based on BitTorrent’s ability to download data without the help of any centralized server, also known as trackerless BitTorrent. Here's how it would work.
A home user navigates to a torrent search engine to download a popular file (a film or TV show, for instance).The file may have several thousands of leechers or seeders; these numbers may increase to the hundreds of thousands in some cases, depending on the popularity of the file. For simplicity, think of each leecher as one computer attempting to download the file.
BitTorrent was originally designed with a central server dubbed tracker in mind which would help users interested in the same file find each other to facilitate downloads. However, these tracker servers have become a kind of Achilles heel of the P2P protocol. Once a tracker server goes down, the whole network goes down. BitTorrent programmers came up with a way to discover users without such a server that’s based on the Kademlia DHT technology.
This technology is based on individual BitTorrent clients randomly introducing themselves to each other to establish a kind of distributed directory. However, it was recently showed that one can manipulate some of the data exchanged by BitTorrent clients for trackerless torrenting to introduce oneself to many more clients in the network than necessary and then tell those clients that a popular file is available under a certain IP address.
By manipulating the data being communicated through BitTorrent clients, one can create the appearance of availability for a given file and cause leechers to attempt a download. The leecher would not actually be downloading the intended file, but attacking a target IP without their knowledge. This would result in the flooding of the target host and, in many cases, eventual take-down of the target site.
Nefarious users could utilize publicly available data from torrent sites like The Pirate Bay to find DHT hashes for some of the most popular files and essentially trick some of these downloaders into attacking a certain target. For example, one could tell tens of thousands of users that a fresh version of Tron Legacy (not yet released!) is available at an address that really is the web server of a corporation. All of these users would immediately try to download the file under that address, bombarding the server with requests and possibly taking it down in the process.
Distributed denial of service (DDoS) attacks were most recently used to take down the sites of major credit card companies as part of the Anonymous revenge for actions taken against WikiLeaks. However, users tend to actively take part in a DDoS attack. In the case of this type of exploit, users may not even be aware that they’re bombarding a bank server with bogus requests while they’re trying to download a movie file.
This new technology, termed BotTorrent, would have revolutionary significance not merely in virtue of its creative underpinnings, but in terms of legal responsibility. Clearly, it is unlikely that end-users would prosecuted for carrying out an attack of which they had no knowledge. Furthermore, given the number of unknowing users carrying out the attacks, the magnitude of the attacks would expand massively.
Cyber War IV - Operation Payback explained
These kind of hacking campaigns are not a new phenomenon triggered by the Wikileaks situation. Just to mention a well-known example, back in 2003, the Recording Industry Association of America (RIAA) had their site collapsed due to a series of online attacks after they’d launched a joint anti-file piracy campaign together the Motion Picture Association of America (MPAA). Now we have this so called “Operation Payback”, a new initiative allegedly from the same group of hackers that performed the attacks in 2003.
It’s believed that other hacker groups have joined in on the efforts to ally themselves with WikiLeaks and attack those who’ve attacked out against WikiLeaks. Nobody on the outside knows just how big this network spans and especially if they’ve been banded together with communities like 4chan, it could very well be one of the largest unified hacking campaigns to date.
This type of attack typically involves flooding a target website with data. The attackers hope to overwhelm it in one way or another so it cannot serve its legitimate users. As its name implies it aims to deny service to those visitors.
How are the attacks made?
Using Twitter and probably hidden IRC channels, the group has managed coordinate their attacks in a very effective way. The majority of the attacks so far have all been mass DDoS (Distributed Denial-of-Service) attacks which on a big scale and have been effective in collapsing the websites of these organizations. In case you're unaware of the type of attack this is, it's a method that calls on multiple computers (usually networked as slave units) to connect all at once and continuously to the victim of the attack, causing their servers to collapse due to the weight of traffic demands.
There are many types of DDoS attacks; some exploit the basic protocols of the internet that define how your web browser talks to the webpage you want to visit while other attacks send fragments of data packets to a target so it spends all its time putting them back together rather than sending data to visitors. Against sites with a low bandwidth link to the wider web simply sending lots of data traffic can choke the connection and cut it off.
In essence, what is happening is that lots and lots of individuals are hammering specific websites with TCP or UDP packets or HTTP requests. There are only so many resources to go around, which means that with enough individuals involved, even large websites can be taken down very quickly.
In essence, what is happening is that lots and lots of individuals are hammering specific websites with TCP or UDP packets or HTTP requests. There are only so many resources to go around, which means that with enough individuals involved, even large websites can be taken down very quickly.
The first denial of service attacks typically came from a single source. Now the data bombardment is typically carried out by lots of computers, usually running Windows, all over the world, hence distributed. Most attacks are carried out through a botnet.
Botnets are groups of computers, unwittingly linked together via the internet, that can be remotely controlled to perform tasks. Typically they send out spam email, perform DDoS attacks, and gather personal information. Botnets are typically created through virus infection, or by installing malicious software (known as malware) on your machine. Malware can take many forms but are typically referred to as a 'trojan'. Named after the legendary Trojan horse, it is a piece of malicious code that hides inside another piece of software (in this instance illegally downloaded copies of software).
Most of the participants in Operation Payback are not hackers — at least not in the true sense of the word. Instead, these users are using computer programs — or more recently, simply visiting websites — in order to stage their attack.
Anonymous is using a botnet but one that is slightly different to the usual. The botnet is made up of machines that have been actively enrolled in it by their owners downloading and installing Anonymous' attack tool - known as the Low Orbit Ion Cannon (LOIC).
What is a botnet?
Botnets are groups of computers, unwittingly linked together via the internet, that can be remotely controlled to perform tasks. Typically they send out spam email, perform DDoS attacks, and gather personal information. Botnets are typically created through virus infection, or by installing malicious software (known as malware) on your machine. Malware can take many forms but are typically referred to as a 'trojan'. Named after the legendary Trojan horse, it is a piece of malicious code that hides inside another piece of software (in this instance illegally downloaded copies of software).
As the user installs the software, it is also installing the trojan program unware of the fact that might be creating a new zombie computer to be part of a botnet controled by who knows who....
Most of the participants in Operation Payback are not hackers — at least not in the true sense of the word. Instead, these users are using computer programs — or more recently, simply visiting websites — in order to stage their attack.
Anonymous is using a botnet but one that is slightly different to the usual. The botnet is made up of machines that have been actively enrolled in it by their owners downloading and installing Anonymous' attack tool - known as the Low Orbit Ion Cannon (LOIC).
This tool, which was purportedly originally created to stress test networks, is written in C# and can be downloaded off open source code repositories like Github and Sourceforge.
LOIC can be used to target a website the user inputs, or using an option called Hive Mind, to connect to IRC or even Twitter, and grab information for a targeted web attack. Because C# will only work on Windows computers out of the box (Mac and Linux users have to install additional libraries and do extra configuration), a Java port of LOIC also exists. The most recent variant of LOIC is a new proof of concept that is floating around called JS LOIC. The “JS” in the title stands for JavaScript. This proof of concept, which doesn’t appear to have as many features as LOIC or Java LOIC — and may also be easier to stop — is actually pretty clever.
Rather than requiring a user download program to run, someone can just visit a web page with a single HTML file and press a button to carry out their part of an attack. On the one hand, the trick of using JavaScript to carry out this kind of flooding attack is pretty clever. On the other hand, it’s also pretty scary.
From what we can gather, the majority of the attacks on Operation Payback targets are not coming from web clients. However, that could change. We would caution users against clicking on any links claiming to aid in this series of attacks. Not only is willfully participating in a DDoS illegal in many countries, you never know what is behind the file you download or what action clicking on that web button could trigger.
As with many other aspects of the WikiLeaks saga, the distributed and de-centralized nature of the Internet means that shutting down all mirrors for documents — or even for attack tools — is an exercise in futility.
This is easily the most public and mainstream hacking campaign to date and so far it must be said, has been largely successful. A spokesperson for the group behind Operation Payback posted that they’d attack all of those who were “bowing down to government pressure”.
So what does this say about the power of the internet? Nothing really that experts didn’t know about. But for the general public and for the media as a whole, I think it’s come to quite a shock to them knowing that hackers could be so influential and on the frontline of the news for a sustained period of time. Most people’s impressions of your average hacker is that of one who sits around and steals your credit card number and whilst this is still a major problem, it does put things into perspective when groups such as Anon manage to bring down Goliath companies like Mastercard and Swiss FinancePost to their knees.
Small defacement attacks by political reasons, or just for the fun of it, are very common and happen every day but this is a completely new phenomenon, we are now dealing with a potentially global cyber power and cyber war can trigger some heavy legislative responses from governments worldwide.
Subscribe to:
Posts (Atom)