Archive
16-31 January 2013 Cyber Attacks Timeline
Two Weeks Living Dangerously! I have no other words to describe this second half of January (first two weeks here) that has shown an unprecedented level of attacks! And if a good day starts with the morning, this will be a very troubled year from an information security perspective.
Not only the peaks of DDoS attacks against the US Banks have reached an unstoppable peak, but, most of all, at the end of the month details have been unveiled about a massive cyber-espionage campaign allegedly orchestrated by Chinese hackers against some major US media including The New York Times, The Wall Street Journal, The Washington Post and Bloomberg News.
A very very long list of targets this month, with some high profile victims such as the U.S. Sentencing Commission, whose web site has been hacked twice and turned into an Asteroid game, but also Renault Argentina that suffered 37,000 accounts leaked.
To summarize this month is really impossible, you just have to scroll down the timeline to realize the hacking spree in this January 2013.
If this trend continues, I will have to decrease the frequency of publication…
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
The Quassam Group Stops the Cyber Attacks Against US Banks
Finally it looks like the DDoS attacks against US Banks, carried on by the Izz ad-Din al-Qassam Cyber Fighters in name of the infamous Operation Ababil, have been temporarily suspended. The decision is a consequence of the removal of the controversial video “The innocence of Muslim” from Youtube.
Actually only one copy has been removed (the one which collected more views) and a dozen of copies are still available to visitors. Nevertheless the hacktivists have appreciated this action and have consequently suspended the cyber attacks.
The sudden stop came in the moment of maximum peak: in the last two weeks the wave of DDoS has reached an unprecedented level, with 35 attacks against 25 banks. An apparently unstoppable storm that has dramatically shown the fragility of the system. Here the details of the banks impacted (of course you will find them in the forthcoming Cyber Attack Timeline.
|
Date |
Target |
Details |
|
Jan 22 |
 |
The seventh week of Operation Ababil 2 begins with the following banks taken down: |
|
Jan 23 |
 |
Other US banks are targeted: |
|
Jan 24 |
 |
Again, other DDoS attacks against US Banks. The wave is unprecedented and the list of the targets is very long, including:
|
1-15 January 2013 Cyber Attacks Statistics
Here are the statistics for the Cyber Attacks occurred in the first half of January 2013 and included inside the corresponding Cyber Attack Timeline.
The Daily Trend of January shows a couple of peaks in correspondence of the 3rd and the 10th of January, during the DDoS attacks of the Izz ad-Din al-Qassam Cyber Fighters (another minor peak occurred during the 8th of January. On average the sample included 4.67 attacks per day.
Even the attack by the Islamist collective contributed to the overtake of the hacktivism against cyber crime shown in the Motivations Behind Attacks chart. One attack on two of the sample was done for this purpose, even if the authors with different connotations: from the protests against the infamous video “The Innocence of Muslims”, to the retaliation for the suicide of Aaron Swartz, going through the different operations carried on by the Anonymous.
In any case, the Distribution of Attack Techniques chart shows frequency of DDoS Attacks did not prevent the SQL Injection of being the preferred weapon for cybercrooks with the 35% of occurrences. DDoS is immediately behind with the 27% of occurrences.
However, the Distribution Of Targets chart shows that targets belonging to finance were the most preferred in this period with the 25% of preferences, certainly a consequence of the wave of DDoS attacks against US Banks. Governmental targets are very close with the 24% of occurrences. Industry targets complete the podium with the 13%, just before targets belonging to Organizations and Education, respectively with the 8% and 7%.
As usual, no need to remind that the sample must be taken very carefully since it refers only to discovered attacks included in the 1-15 January 2013 Cyber Attacks Timeline (the so-called tip of the iceberg), and hence it does not pretend to be exhaustive but only aims to provide an high level overview of the “cyber landscape”.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
Related articles
- 1-15 January 2013 Cyber Attacks Timeline (hackmageddon.com)
- December 2012 Cyber Attacks Statistics (hackmageddon.com)
1-15 January 2013 Cyber Attacks Timeline
So here we are with the first Cyber Attacks Timeline for 2013 covering the first half of January.
Apparently the new year has begun with an intense activity by Cyber Crooks. Hacktivists and Cyber Criminals had many time to spend in front of their keyboards during the holiday break, and as a consequence the number of breaches with more than 10.000 accounts compromised is incredibly high. WWF China, the City of Steubenville, Ohio and The German Chamber of Commerce are only three examples of institutions that suffered massive breaches during the beginning of this year.
But the massive breaches are not the only remarkable events of this period: the waves of DDoS Attacks against US banks continued (and promise to extend also in the next weeks), Kaspersky Lab discovered a new massive Cyber Espionage Campaign dubbed “Red October”, and also the Japan Farm Ministry was hit by yet another Cyber Attack, allegedly originating from China…
If this is only the beginning… 2013 promises to be pretty much troubled for system administrators…
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
16-31 December 2012 Cyber Attacks Timeline
The year is gone, and here it is the last Cyber Attack Timeline for 2012 (first part here).
The most important cyber-events of this second part of December can be considered: the third phase of the operation Ababil carried on by the Izz ad-Din al-Qassam Cyber Fighters against U.S. Banks, the attacks of the Anonymous collective against the Westboro Baptist Church, and, last but not least the Cyberwar echoes coming from Iran.
The wave of DDoS attacks carried on by the Izz ad-Din al-Qassam Cyber Fighters has taken down Six U.S. Banks under the fists of DDoS attacks apparently unstoppable. Instead the Anonymous seem to have changed tactic in their personal fight against the Westboro Baptist Church, they did not limit to DDoS the church’s website, but also performed a couple of Twitter account takeover against some key persons (with the collaboration of UGNazi members).
Instead, on the Cyberwar front, Iran confirms to be a danger zone, with some reports of a new Wiper and a simil-Stuxnet malware (even if this second news has been downplayed in a second moment.
Other noticeable news include an alleged breach to Yahoo!, a massive breach against a Chinese HP domain and a strange, controversial breach against Verizon FiOS (with data apparently leaked six months ago).
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts). To do so, you can use this form.
OpIsrael Confirms the Cyber-space is the Fifth Domain of War
The Israeli Cyber Space is under attack by Anonymous hackers in retaliation for the Israeli operation “Pillar of Defence“. The military operation began on Wednesday with the killing of Ahmed Al-Jaabari, the commander of the military wing of Hamas, whose car has been hit by an Israeli Missile
If Hamas’s armed wing, immediately after the attack, replied that “The occupation has opened the gates of hell”, the ongoing wave of cyber-attacks against Israeli sites initiated by the Anonymous collective (under the so-called OpIsrael), has analogously opened the gates of hell in the cyber-space.
So far the Anonymous claim that more than 660 websites have been defaced and nearly 90 completely deleted (including the Bank Of Jerusalem), and the list keeps on growing as the cyber-offensive continues (just follow the #OpIsrael hashtag on Twitter). Israel is suffering a growing number of DDoS and SQLi attacks against governmental, retail, and business targets resulting in sites down, data dump and, in the worst cases, databases completely erased. Interestingly, this wave of cyber-attacks has also deserved the attention of the “semi-official” Iranian news agency Fars News, which has dedicated an article to the Anonymous Hacks.
In the past four days, Israel claims to have deflected 44 million cyber-attacks.
Definitely the cyber-space is the fifth domain of war and this sad circumstance is confirming this assertion, not so much for the cyber-attacks (Anonymous cannot be considered an army), but mostly for other aspects typical of real wars that has been applied to the cyber-space.
In response to the Israeli threat to cut Internet off from Gaza, the Anonymous have put together the Anonymous Gaza Care Package a kind of first-aid kit containing instructions in Arabic and English to survive an Internet teardown and to evade IDF surveillance.
On the opposite side, the Israeli Defence Force has released a tool on its blog, called IDF Ranks, that rewards with badges frequent visitors who interact with the site. The scope, according to IDF, is “to help fight the misinformation about Israel and the IDF online”. A clear attempt to use the cyber-space for propaganda.
October 2012 Cyber Attacks Timeline
Click here for the first part covering the Cyber Attacks from 1 to 15 October 2012.
Here is the timeline for the main Cyber Attacks in October 2012. A month that has been characterized by hacktivism and also by several remarkable cyber crime operations.
For sure the next days will be hard for taxpayers of South Carolina, whose Department of Revenue has been targeted by foreign hackers able to access records of 3.6 million of individuals. But hard days are going to come also for banks: not only the trail of DDoS attack against U.S. Banks has continued even in the second half of the month (although different groups took credit for them), but also, on the cyber crime front, Citigroup has lost 1 million of bucks because of a loophole exploited by a ring of 13 individuals. Different motivations, same lesson: bank security needs a dramatic improvement.
Moving to hactkivism, nothing new under the sun. The pale sun of October has enlightened several operations targeting governments (Greece and Italy above all, to reflect the delicate situation of these two countries) and organization all over the world…
As usual after the jump you will find all the references.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).
Read more…
DDoS and SQLi are the Most… Discussed Attack Techniques
Imperva has just published the results of its annual analysis on one of the largest-known hacker forums counting approximately 250,000 members.
The research (also made on other smaller forums) used the forum’s search engine capabilities to analyze conversations by topic using specific keywords. Unfortunately no details have been provided about the methodology used to collect the data, however the results show that SQL Injection and DDoS are the most discussed topic, both of them with the 19% of discussion volume (I am glad to see that the results are coherent with the findings of my Cyber Attack Statistics).
Of course the data must be taken with the needed caution since the analyzed sample could not be entirely consistent. As Imperva admits: “The site we examined is not a hardcore crime site, but it’s not entirely softcore. New hackers come to this site to learn and,on the other hand, more experienced hackers teach to gain “street cred” and recognition […]. Typically, once hackers have gained enough of a reputation, they go to a more hardcore, invitation-only forum.” This probably means that the incidence of the two attack techniques is overrated since one should expect a beginner hacker to approach the easiest and most common attack methods for which there are many tools available.
Anyway the events of the last months show that an attack does not deserve less attention only because it is carried on by a beginner, nor a beginner worries too much if he uses automated tools without full knowledge and awareness. A look to the infosec chronicles of the last period is sufficient to verify that DDoS and SQLi attacks are always in the first pages.
Sadly, Imperva estimates that only the 5% of the security budget is spent on thwarting SQL Injection attacks.
Other interesting findings of the research are: the fact that social networks pose a major interest for hackers since they are becoming a prominent source of information and potential monetary gain (Facebook was the most discussed social media platform, with 39%, immediately followed by Twitter at 37%), and also the fact that E-whoring is becoming one of the most common methods for beginner cyber criminals to gain easy money (more than 13,000 threads observed).
16-30 September 2012 Cyber Attacks Timeline
Part One with 1-15 September 201 Timeline Here.
September is over and it’s time to analyze this month from an Information Security perspective with the second part of the Cyber Attack Timeline.
Probably this month will be remembered for the massive outage of six U.S. Banks (Bank of America, JPMorgan Chase, Citigroup, U.S. Bank, Wells Fargo and PNC ) caused by a wave of DDoS attack carried on by alleged Muslim hackers in retaliation for the infamous movie (maybe this term is exaggerated) “The Innocence of Muslims”.
China has confirmed its intense activity inside the Cyber space. Alleged (state-sponsored?) Chinese hackers were allegedly behind the attack to Telvent, whose project files of its core product OASyS SCADA were stolen after a breach, and also behind a thwarted spear-phishing cyber attack against the White House.
Adobe suffered a high-profile breach which caused a build server to be compromised with the consequent theft of a certificate key used to sign two malware strains found on the wild (with the consequent necessary revoke of the compromised key affecting approximately 1,100 files).
Last but not least, the Hacktivism fever has apparently dropped. September has offered some attacks on the wake of the #OpFreeAssange campaign, and a new wave of attacks at the end of the month after the global protests set for September, the 29th, under the hashtag of #29s.
If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 and the related statistics (regularly updated), and follow @paulsparrows on Twitter for the latest updates.
Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).
Even Botnets Go on Holidays!
The attack model based on botnet-generated Distributed Denials of Service is opportunistic. The botmaster selects a target, gathers as many resources as possible among his army of zombie machines, and when he realizes to have achieved enough firepower, simply selects a target and pushes the attack button. After this the target is inevitably flooded by packets generated by the bots, while the unaware owners of the zombie machines perform their normal work or fun activities with their infected computers.
In theory there is only a weak point in this opportunistic model and it consists on the fact that the botmaster controls the compromised machines but cannot control their availability. Simply said, if a user has not switched on his computer while the botmaster needs that machine to execute a DDoS attack, the machine is not available, and there is not so much to do.
Of course this is essentially a theoretical weak point since, quoting a famous phrase, we could say that on botnet empire the sun never sets: indeed botnets are so huge and widespread to be in practice always available (they span different continents and different time zones) and constantly grant enough firepower.
But what happens if some global events or some global festivities make a larger number of computers to be turned off? Quite simple apparently! The firepower of the botnet is hugely affected and the number of DDoS attack drops. This is one of the paradoxical conclusions that can be derived from a paper presented few days ago at the Virus Bulletin 2012 International Conference by Cloudflare (probably the main CDN company in the world), about which an interesting post by Naked Security has provided additional details.
Apparently the number of IP addresses used to execute Layer 7 DDoS attacks in 2012 showed the minimum values just in those days of events or vacations which kept the users away from their Personal Computers. The minimum values occurred in days such as Mardi Gras, Earth Day (the 22nd of April when one billion people around the world chose to keep their computers turned off to reduce energy consumption), the Memorial Day weekend on the 29th May and 28th June, just before US Independence Day celebrations.
Quoting the Naked Security article, the conclusion is quite amusing: if everyone turned off their computers each night, it might not just be good for the environment because of the lower levels of energy being consumed… it could also mean a reduction in botnet attacks.
About The Author
Support My Work!
Share:
News
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
Visitors from…
