Law Enforcement Targets Users of DDoS-For-Hire Services

Law enforcement authorities from more than a dozen countries last week carried out a series of operations designed to crack down on DDoS-for-hire services. Thirty four individuals who are alleged to have purchased stressers and booter services were arrested as part of the operation. Stressers and...

Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Vulnerabilities

Exploit for macOS platform in category dos / poc Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Credit: Maksymilian Arciemowicz https://cxsecurity.com/ --- 0. Description ---- The latest macOS and iOS have weak OCSP validation process which allow attacker to send OCSP...

Europol arrests 34 Teenagers for using DDoS Attack Tools

Europol has announced that the law enforcement agencies from 13 countries around the globe have arrested 34 users of Netspoof DDoS attack tool and interviewed and warned 101 suspects in a global crackdown. According to the report published on the official website of Europol, law enforcement...

On Backdoors in Sony's IP Cameras, a Linux Bug, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest Linux bug, Sony closing backdoors in cameras, and Google’s new open source fuzzer. Show notes: Sony Closes Backdoors in IP-Enabled Cameras Old Linux Kernel Code Execution Bug Patched Google Debuts Continuous Fuzzer for...

New Call to Regulate IoT Security By Design

A Washington, D.C. think tank whose mission is critical infrastructure security has joined the call for lawmakers to consider regulating the security of connected devices. In a report published this week, the Institute for Critical Infrastructure Technology pinned the blame for a rash of Mirai...

Updated ntp packages fix security vulnerabilities

When ntpd is configured with rate limiting for all associations restrict default limited in ntp.conf, the limits are applied also to responses received from its configured sources. An attacker who knows the sources e.g., from an IPv4 refid in server response and knows the system is misconfigured ...

Turkish Hackers Are Giving Away Prizes For Participating In DDoS Attacks

DDoS has become a game now that could knock any service offline. A Turkish hacking group is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service DDoS attacks against a list of predetermined targets. The points...

Hackers Gamifies DDoS Attacks With Collaborative Platform

A Turkish hacking crew is luring participants to join its DDoS platform to compete with peers to earn redeemable points that are exchangeable for hacking tools and click-fraud software. The goal, security researchers say, is to “gamify” DDoS attacks in order to attract a critical mass of hackers...

New Large-Scale DDoS Attacks Follow Schedule

A powerful new botnet is being blamed for massive and sustained DDoS attacks that security researchers at CloudFlare compare to Mirai when it comes to intensity and scope. The attacks began Nov. 23 and ran for eight hours daily, similar to an average workday. The consistent attacks occurred for...

New Mirai Variant Targets Routers, Knocks 900,000 Offline

Attackers are targeting DSL routers this week with what’s being called a potent new variant of the Mirai malware that knocked offline major Internet companies like Twitter and Spotify last month. According to Germany’s Deutsche Telekom 900,000 of its DSL router customers have already been targete...

Antivirus Firm Kaspersky launches Its Own Secure Operating System

The popular cyber security and antivirus company Kaspersky has unveiled its new hack-proof operating system: Kaspersky OS. The new operating system has been in development for last 14 years and has chosen to design from scratch rather than relying on Linux. Kaspersky OS makes its debut on a...

NTP DoS Exploit Released — Update Your Servers to Patch 10 Flaws

A proof-of-concept PoC exploit for a critical vulnerability in the Network Time Protocol daemon ntpd has been publically released that could allow anyone to crash a server with just a single maliciously crafted packet. The vulnerability has been patched by the Network Time Foundation with the...

CVE-2016-9310

A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. Mitigation Use "restrict default noquery ..." in your ntp.conf file...

Oracle acquires DNS provider Dyn for more than $600 Million

Yes, Oracle just bought the DNS provider company that brought down the Internet last month. Business software vendor Oracle announced on Monday that it is buying cloud-based Internet performance and Domain Name System DNS provider Dyn. Dyn is the same company that was hit by a massive distributed...

Credentials Accessible in Siemens-Branded CCTV Cameras

Vanderbilt Industries has provided a firmware update for more than a dozen Siemens-branded IP-based closed circuit TV cameras that patches a serious, remotely exploitable vulnerability. The flaw, CVE-2016-9155, could allow an attacker to gain admin credentials by sending certain crafted requests,...

Network Time Protocol Control Mode Unauthenticated Trap Information Disclosure and DDoS Amplification Vulnerability

Summary An exploitable configuration modification vulnerability exists in the control mode mode 6 functionality of ntpd. A specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, preventing legitimate monitoring. A...

OWOX, Inc.: Direct IP Access

I can access the website through its IP following its default port which is port 80 .. it means that the hacker can Execute a DDOS on your website.. Actual IP and Port accessible:: 104.155.10.15:80 just copy and paste it in URL address bar...

IBM Opens Attack Simulation Test Center

CAMBRIDGE, Ma. – IBM cut the ribbon on its new global security headquarters Wednesday that will also serve as command center for its just announced X-Force Incident Response and Intelligence Services. The centerpiece of the new 153,000-sqft facility is the company’s Cyber Range which IBM bills as...

Regulation May Be Best Answer to IoT Insecurity

One thing technologists overtly shun is the prospect of government regulation. But recent DDoS attacks carried out by botnets of connected things have spooked some people of influence in security to the point where intervention by lawmakers may be inevitable. Testifying before subcommittees of th...

Dutch Hacker Who Almost Broke The Internet Escapes Jail

The Dutch hacker, who in 2013 was accused of launching the biggest cyberattack to date against the anti-spam group Spamhaus, escaped prison Monday even after he was sentenced to nearly 8 months in jail because most of his term was suspended. Sven Olaf Kamphuis, 39, was arrested in April 2013 by...