DDoS attacks, DNS cache poisoning keeping ISPs up at night

By Joel Hruska | Published: November 17, 2008 - 02:24PM CT

New survey data indicates shows an increase in the size and frequency of DDoS attacks, as well as a rise in more sophisticated attack methods. Virtually all of the ISPs that participated in the Arbor Networks survey indicated they were increasingly concerned about the possibility of DNS cache poisoning or other infrastructure weaknesses, but these fears aren't being communicated to law enforcement, even after an attack has taken place.

...

Defenses against DDoS strengthening: survey

Results warn of increasing dangers of highly sophisticated attacks at speeds of up to 24 Gbps

By Brad Reed , Network World , 09/17/2007

...

Two Europeans charged in U.S. over DDoS attacks

By Jeremy Kirk , IDG News Service , 10/03/2008

Two European men have been indicted for allegedly orchestrating cyberattacks against two Web sites, a continuation of the first successful U.S. investigation ever into distributed denial-of-service attacks, according to the U.S. Department of Justice.

...

Storm Worm DDoS Attack

Author: Joe Stewart

A number of anti-spam websites came under a distributed denial-of-service attack on January 12, 2007. The trojan responsible for the attack was one of several dropped onto systems infected by a seeding of the email virus which later came to be called "Storm Worm", also W32/Small.DAM and Trojan.Peacomm.

...

MS08-067 Used to Drop DDoS Bots

Posted on Monday, November 3rd, 2008

MS08-067 Used to Drop DDoS Bots

by Jose Nazario

Earlier today we were informed about a bot that we’ve seen before, KernelBot, being dropped by an exploit tool for MS08-067. The exploit code is “67.exe”, and the bot itself is “6767.exe”. KernelBot is a Chinese origin DDoS bot run by someone we think uses the handle IceKernel; he even names his project KernelBot: d:\Works\KernelBots_Up28\Server\Release\Server.pdb. We first became aware of this bot during the CNN.Com attacks earlier this year; some researchers we were working with brought it to our attention. Since then we’ve been watching this guy’s activities and seen a handful of DDoS targets, but most of them are Baidu. It’s nice to see most of the AV vendors have finally caught up and added detection.

US teen admits to 'Anonymous' DDoS attack on Scientology

Up to 10 years in the clink

By Dan Goodin Posted in Crime, 17th October 2008 21:52 GMT

A New Jersey man has admitted he participated in January's high-profile cyber attack on the Church of Scientology that took its website offline and caused as much as $70,000 worth of damage.

Dmitriy Guzner, 18, of Verona, New Jersey, helped carry out the crippling distributed denial of service (DDoS) assault because he believed it furthered the goals of the anti-Scientology group "Anonymous," to which he claimed to belong, according to court documents filed in federal court. He has agreed to plead guilty to a single felony charge of unauthorized impairment of a protected computer.

...

Anti fraud site hit by a DDoS attack

November 17th, 2008

Anti fraud site hit by a DDoS attack

Posted by Dancho Danchev @ 4:01 pm

The popular British anti-fraud site Bobbear.co.uk is currently under a DDoS attack (distributed denial of service attack) , originally launched last Wednesday, and is continuing to hit the site with 3/4 million hits daily from hundreds of thousands of malware infected hosts mostly based in Asia and Eastern Europe, according to the site’s owner. Targeted DDoS attacks against anti-fraud and volunteer cybercrime fighting communities clearly indicate the impact these communities have on the revenue stream of scammers, and with Bobbear attracting such a high profile underground attention, the site is indeed doing a very good job.

...