About these ads

Archive

Posts Tagged ‘Denial-of-service attack’

1 – 15 August Cyber Attacks Statistics

August 22, 2012 Leave a comment

First of all, let me begin with great news: The Cyber Attacks Statistics page is complete with all the data collected so far: I created and inserted even the charts for January, so I am currently covering (and will cover) the whole 2012.

Now, after this small “self-gratification” it is time to look at the statistics derived from the Cyber Attacks Timeline for the first half of August. You will soon discover that this month has seen an (un)expected revamping of Hacktivism and consequently of his preferred weapon (DDoS), and preferred targets (governments). This is a consequence of the so-called OpDemonoid carried on by the Anonymous collective against the takedown of the famous Torrent Tracker (which in many ways reminded the most famous OpMegaUpload). But this is also a consequence of OpAustralia, the operation (successful since the law proposal is in standby) against the new Australian Internet Surveillance Law.

As far as the Motivations Behind Attacks are concerned, Hacktivism ranked at number on with nearly the 50% of the events. Cyber Crime ranked at number two (43%) while as usual Cyber Espionage and Cyber Warfare are well behind (but I wonder how many targeted attacks are acting in this moment, silent and undetected). It is interesting to notice the rise of events motivated by Cyber Espionage (three inside the interval taken into consideration): the Gauss Cyber Attack, the campaign against Saudi Aramco and the attacks against the Nepalese Government.

The winds of hacktivism have a clear influence even in the Distribution Of Attack Techniques which shows a new entry (as it were) at number one. Yes, in the first half of August the DDoS has overtaken the SQLi with nearly one third of the occurrences (31.9%) against the 21.3 of the latter. Only for the 17% of the attacks it has not been possible to identify with certainty the attack technique leveraged.

Clearly the hacktivism also influenced the Distribution Of Targets: nearly one cyber attack on five (among the sample considered), corresponding to the 21%, hit government targets. Targets belonging to the industry sector and to the news sector ranked at number two, both of them with the 13% of the occurrences. Apparently the first half of August has been particularly awful for the News Sector, thanks most of all to Thomson Reuters, that has been hacked three times in two weeks.

Again, I will never get tired of repeating that data must be taken very carefully since they do refer only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the considered period.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

About these ads

July 2012 Cyber Attacks Statistics

Here we are with the statistics from the Cyber Attack Timelines  for the first and the second half of July 2012. The sample included 76 attacks which have been analyzed according the three familiar parameters: Motivations behind attacks, Distribution of attacks techniques and Distribution of targets.

Again, I will never get tired of repeating that data must be taken very carefully since they do refer only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the considered period. Moreover, remember that the most dangerous threats are the invisible ones.

As far as  the Motivations Behind Attacks are concerned, July has confirmed the predominance of Cyber Crime, although it dropped down to 55% from 72% of the previous month. It is interesting to notice the corresponding growth of Hacktivism, from 18% in June to 32% in July. Although the number of (discovered) attacks motivated by Cyber Espionage is always low, this month their occurrences nearly doubled as a consequence of the events in the Middle East, that confirms to be a “hot area” for the Cyber Arena. Cyber Warfare is positioned at the bottom of the chart with a “poor” 4% of the occurrences.

The Distribution Of Attacks Techniques chart confirms that is getting harder and harder to recognize what the cyber crooks have leveraged to reach their goal. The percentage of the unknown attacks has grown from the 36% of June to the 45% of July. In any case, among the recognized attacks, SQL Injection ranks at number one with the 28% of possible occurrences. DDoS has confirmed his decreasing trend from 16% in June to 9% in July. Maybe the possible victims are learning to effectively defend themselves?

The Distribution of Targets chart confirms that targets belonging to industry are always on top of the preferences of Cyber Crooks with the 32% of occurrences, well above the 21% of the last month. Government targets confirmed their second place with the 15% of occurrences (were the 18% on July) followed by Online Services with the 10%. It is interesting to notice the low occurrences of incidents targeting Law Enforcement Agencies and Military Institutions. Maybe after the high number of cyber attacks suffered, they are learning to enforce adequate countermeasures.

 If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

July 2012 Cyber Attacks Statistics (Part I)

Here we are with the statistics from the Cyber Attack Timeline for the first half of July 2012. The sample included 39 attacks which have been analyzed according the three familiar parameters: Motivations behind attacks, Distribution of attacks techniques and Distribution of targets.

As far as Motivations Behind Attacks are concerned, the first two weeks of July confirmed the trend of the last months: Cybercrime ranked at number one with nearly the 70% of the occurrences, well ahead hacktivism, at number two with the 23%. Cyber Warfare and Cyber Espionage are well behind with respectively the 5% and 3% of the attacks.

The Distribution Of Attack Techniques has shown, for the first half of July, a considerable number of attacks of unknown origin. As a matter of fact, in more than one half of the occurrences (53%) it has not been possible to track the attack technique used by cyber croockers, at least according to the available information. In all those cases in which it has been possible to track the attacks, the first half of July has seen an overtake of DDoS (18%) against SQL Injection (13%), although if one sums the total occurrences of SQL Injections (certain and claimed, the latter are characterized by a question mark in the chart), the total of SQLi is a remarkable 21%, slightly greater than DDoS). I had to modify this chart after I came across an article indicating an SQL Injection attack as the vector of the breach suffered by Nvidia.

The Distribution of Targets chart confirms the Industry at rank number one with the 38% of occurrences. In any case, if we do not consider the fragmentation of this category (I have dedicated an apposite chart to drill it down), Governments have confirmed to be the most vulnerable targets with the 10% of the occurrences, corresponding to the most vulnerable single category.

Amongst the single categories, Law Enforcement Agencies rank at number two with the 8% of occurrences, followed by Education targets, online forums and political organizations, each one of them with the 5% of occurrences.

Again, please notice that data must be taken very carefully since they do refer only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the considered period. Moreover, remember that the most dangerous threats are the invisible ones.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

July 2012 Cyber Attacks Timeline (Part I)

July 20, 2012 1 comment

Update 08/02/2012: July 2012 Cyber Attacks Timeline (Part II)

Although the number of attacks has considerably diminuished, the first half of July has left several high-profile attacks which deserverd huge attention, exposing in theory more than 2,000,000 individuals. Yahoo! Voice, Android Forums, Nvidia, Formspring, Billabong and ASUS are several of the well-known names that were victims of the high-profile breaches in the first two weeks of July.

World Health Organization and PBS (once again) were also illustrious victims of Cyber Attacks.

Besides these remarkable events, it looks like the actions carried on by the Law Enforcement agencies in the last period led to some results since the number of incidents looks undoubtably smaller than the previous months.

For what concerns the cyber attacks driven by hacktivism, it is particularly important to notice #OpPedoChat, still ongoing, which caused many pedophiles to be exposed, in several cases with unpredictable consequences, as in Belgium where a far-right official resigned after Anonymous’ Paedophilia Claims.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

Read more…

June 2012 Cyber Attacks Statistics

July 13, 2012 1 comment

As usual I aggregated the data from the Cyber Attack Timelines of June to provide some aggregated statistics. Data must be taken very carefully since they do refers only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the month. Moreover, remember that the most dangerous threats are the invisible ones, how I can easily verify thanks to the advanced malware detection campaigns I am performing in these hard days.

Let us start with the Motivations Behind Attacks chart. Cybercrime is undoubtedly on the rise and has reached the unprecedented percentage of 72%. On the other hand Summer seems to be a period of vacation for hacktivists, whose influence on the landscape fell down to 18%. As usual Cyber Warfare and Cyber Espionage are well behind respectively to 6% and 4%. But of course, this is only the tip of the iceberg. On the other hand, I would not expect a complex cyber espionage action to be easily uncovered, or worst, advertised on social media as it happens for (too) many actions allegedly motivated by cyber crime or hacktivism.

Moving to Distribution of Targets, shows a preference of cybercrookers for  Industry targets (21%), immediately followed by Government targets (18%). Targets belonging to education sadly confirm their top position, and rank, even in June, at number three with the 8% of occurrences. Of course industry targets are hugely fragmented hence, if we consider each category singularly, it turns out that Governments are still the most vulnerable victims of cyber attacks.

Last but not least, the next chart: Distribution Of Attacks Techniques. Apparently is getting harder and harder to recognize the attack techniques leveraged to execute the reported cyber attacks. Anyway, in those cases where it has been possible to do it, SQL Injection steadily keeps on being the King of Hill. The smaller occurrence of DDoS attacks reflects the minor influence of hacktivism during this month, with account hijacking confirming to be one of the most dangerous vectors. When looking at defacements, consider that typically I do not take them into consideration in my timelines (they are really too many) unless they are executed against very remarkable targets, hence consider that 3% belonging to what I defined high profile defacements.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

June 2012 Cyber Attacks Timeline (Part II)

July 5, 2012 1 comment

Part I (1-15 June) at this link

From an information security perspective, the second half of June has been characterized by the hacking collective UGNAZI (and its members) and also by an individual hacker: .c0mrade AKA @OfficialComrade.

Both entities have left behind them a long trail of Cyber Attacks against different targets (in several cases the real extent of the attack is uncertain) and with different techniques, although it is likely that the UGNAZI collective will be forced to change the plans after the arrest of the group’s leader, JoshTheGod, nearly at the end of the month (27thof June), effectively they have considerably reduced the rate of their cyber attacks in the second part of the analyzed period.

On the other hand, hospitals, banks, several major airlines are only few examples of the preys fallen under the attacks carried on by .c0mrade. Plese notce that from  Cyber Crime perspective,  is also interesting to notice the High Roller Operation, a giant fraud against the banking industry, unmasked by McAfee.

Needless to say, the Cyber War front is always hot, most of all in Middle East, were several DDoS attacks targeted some Israeli institutions and, most of all, an alleged unspecified massive Cyber Attack targeted tje Islamic Republic of Iran.

The hacktitic landscape is completely different: maybe hacktivists have chosen to go on vacation since June 2012 has apparently shown a decreasing trend, in sharp contrast with an year ago, when the information security community lived one of its most troubled periods.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timeline.

Read more…

Categories: Cyber Attacks Timeline, Security Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

June 2012 Cyber Attacks Statistics (Part I)

As usual, here we are with some fresh charts obtained from the first part of the June 2012 Cyber Attacks Timeline.

Let us start with the Motivations Behind Attacks chart. Once again Cyber Crime Ranks at number 1, showing a growing trend respect May, from the 61% to 82% (at least in this first half). On the other hand, hacktivism-led cyber events have dropped from 30% to 14%. Apparently no explicit Cyber Warfare event has been detected, at least according to the data I collected.

Starting, from this month, to make the Distribution Of Targets chart less fragmented and more readable, I decided to aggregate all the attacks against Industries (and Organizations). With this new classification, Government targets go down at rank number 2 with the 15% of occurrences (against the 22% of the previous month), followed by targets belonging to education with the 10% (the same value collected on May). Interesting to notice is the apparent lack of attention by cybercrookers against Law Enforcement targets. In any case, if we consider the fact that Industry data have been aggregated, the chart is not so much different from the one of May: Governements keep on showing a worrying lack of Security.

Last but not least, during the first half of June, it has apparently been difficult to identify the 40% of the attack techniques, although, SQLi (and more in general DB vulnerabilities) keeps on to hold the crown among the identified events. Interesting to notice the drop of DDoS attacks (from 20% of the sample to 10%). Probably it is not a coincidence that it has followed the same trend than the hacktivism-driven Cyber Attacks, having halved its rate with respect to the previous month.

Again, no need to repeat that data must be taken very carefully since they do refers only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the month.

Furthermore, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

May 2012 Cyber Attacks Statistics

June 10, 2012 1 comment

As I did last month for the Cyber Attacks occurred in April, I have aggregated the data collected on the timelines of May (on the right) in order to provide a consolidated view of the month according to the three parameters of Motivations Behind Attacks, Distribution of Targets and Distribution of Attack Techniques. Again, no need to repeat that data must be taken very carefully since they do refers only to discovered attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but only aim to provide an high level overview of the “cyber landscape” of the month.

As far as Motivations Behind Attacks are concerned, month after month, the charts are becoming monotonous. Cyber Crime ranked undoubtedly at number one with the 61% of occurrences. Twice the occurrences of Hacktivism which ranked at number two. In this chart, Cyber Warfare and Cyber Espionage motivated-attacks are well behind although they were few but good (One Flame was enough for this month, wasn’t it?).

The Distribution of Targets chart is highly fragmented even if with a familar pattern:  Government targets ranked firmly on top of the preferences for the attackers, with Education and Law Enforcement targets completing the top three (although, compared to April, they swapped their positions in this unenviable chart). It worths to mention that targets belonging to organizations that offers on-line services are fragmented as well, but if the single entries are summed up, they would rank at number two with approximately the 15% of occurrences.

The Distribution of Attack Techniques chart whows that SQL Injection has been the preferred weapon used by Cyber Criminals in May, overtaking Distributed Denial of Service, the Cyber Paintball Pistol. Clearly the occurrences of DDoS attacks are influenced by the winds of hacktivism which did not blow so high in May. Interesting to notice a further important number of events (17% of the sample) related to unknown attacks targeting DBs, which clearly shows that data repositories are proving to be the weakes element of the chain. May the patch enFORCEment be with you!

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

Sixteen Months of Cyber Attacks in Italy

Tomorrow, during the 2012 Security Summit, Edition of Rome, the June Update of the 2012 Italian Report on ICT Security will be unleashed.

I gave a contribution for the section concerning the Cyber Attacks in Italy. The following lines depict a summary of what you will be able to find in the full report (so far only in Italian).

During the period ranging from February 2011 to April 2012, I collected 127 cyber attacks, among which 112, corresponding to the 88% (that is almost the entire sample), driven by hacktivism. In only 15 cases different motivations were found, related to Cyber Crime (14 occurrences) and Cyber Espionage.

The collected sample shows that more than 43% of targets were government sites and political associations. Organizations related to education rank at number three even though most of the attacks were concentrated in a single event in July when as many as 18 universities were affected simultaneously.

Entertainment industry and Law Enforcement Agencies are far behind, but ahead all other categories, probably a consequence of the cyber attacks perpetrated in January and March 2012 during the waves of protests against SOPA and PIPA, (and the subsequent shutdown of MegaUpload). Please notice that not event the Holy See has been safe from hackers with a wave of DDoS attacks targeting several Vatican sites after some controversial declarations of a security vendor.

The trend analysis clearly reflects the influence of external factors on hacktivism in Italy: the first intervention in Libya, then the emotional impact of the collective LulzSec, and finally the protests against the proposed laws considered repressive to freedom of expression on the Internet.

As far as the attack distribution is concerned, Italy has just demonstrated to be a “Spaghetti DDOS” country. On the wake of hacktivism, our country has assisted, in the analyzed period, to a massive wave of Distributed Denial Of Service Attacks. SQL Injection and Defacement attacks are well behind (again remember that most of the SQLi attacks were concentrated on a single event occurring on July). In any case the distribution shows a tendency to perform those kinds of attacks (DDoS and Defacement) capable to gain the most attention from media.

Although the sample may provide an interesting snapshot, please keep in mind that it only includes those attacks that have been detected since the authors claimed them, or simply because the attacks themselves earned plenty of space on media. Given the times we are living in, I’m afraid these are just the tip of the iceberg.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

P.S. I did not include in the sample the controversial attack to CNAIPIC (Italian Cyber Police) since the origin of that event is far from being certain.

Botnets, ISPs, and The Role of The Cloud

Data CenterOne interesting comment on my previous post on Botnets, gave me a cue for another consideration concerning the role of the cloud inside the fight against botnets.

The fact that ISPs are evaluating an Anti Botnet Conduct Code means  their are feeling responsible for what resides inside (and leaves) their networks, and hence are supposed to take technical, organizational and educational countermeasures.

Anyway, in order to be effective, anti-bot controls should be enforced inside the customers’ networks, or at least before any source NAT is performed, otherwise IP addresses of the infected machines would be hidden, making impossible to detect and block them directly. A huge task for an ISP unless one were able to centralize the security enforcement point where the traffic is monitored and compromised endpoints members of a bot detected.

Said in few words I believe that ISPs will soon offer advanced anti-malware (read anti-bot) services in the cloud by routing (or better switching) the customer’s traffic on their data centers where it is checked and the customers notifyed in real time about the presence of bots inside their networks. You may think to the same approach used for URL filtering services on the cloud with the difference that in this scenario the clients should arrive to the ISP’s Data Center with their original IP Address or a statically NATed address so that it could always be possible to recognize the original source. Another difference is also that in this scenario the purpose in not only to protect the customers’ networks from the external world but also (and maybe most of all) to protect the external world from the customers’ (dirty) networks.

Another contribution of the cloud against Botnets that I forgot to mention in the original post.

Follow

Get every new post delivered to your Inbox.

Join 2,705 other followers